summaryrefslogtreecommitdiff
path: root/source4/rpc_server
AgeCommit message (Collapse)AuthorFilesLines
2021-06-29s4:rpc_server: Check return code of cli_credentials_set_conf()Andreas Schneider1-1/+9
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29rpc/dnsserver: check talloc_strndup returnDouglas Bagnall1-17/+15
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29rpc dnsserver: improve handling of serial numbersDouglas Bagnall1-5/+32
This is not correct, but it gets closer. We need to save the updated serial number in the SOA. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29rpc dnsserver: set the record rankDouglas Bagnall1-0/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29rpc dnsserver: updates reset more than timestampDouglas Bagnall1-2/+8
This is based on observed Windows behaviour. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29rpc:dnsserver: allow update replacing with similar recordDouglas Bagnall1-6/+15
We have been refusing to handle the case where the replaced record matches the replacement according to dns_record_match() (meaning the wType and data are semantically identical). In Windows this is explicitly used for changing TTL. There are further changes we need to properly handle this case. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29rpc:dnsserver: split off record rank setting logicDouglas Bagnall1-9/+16
We want to do this also in update (in following commits), and we later will want to fix the logic. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-11dns: merge dns_records_match and dns_record_matchDouglas Bagnall1-66/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28s4:rpc_server: Set Kerberos to desiredAndreas Schneider1-0/+9
This is required for ncalrpc_as_system to work. In FIPS enabled mode, 'client use kerberos' is forced to required. We need to allow non-kerberos use for ncalrpc_as_system here. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-09s4:rpc_server: Use cli_credentials_init_server()Andreas Schneider1-9/+3
This also removes dcerpc_remote:domain option for the machine account case. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-03-30rpc/idl dnsserver s/DNS_RPC_DATA/DNS_RPC_RECORD_DATA/Douglas Bagnall1-1/+1
Following MS-DNSP. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Mar 30 00:20:53 UTC 2021 on sn-devel-184
2021-03-29librpc/idl: dnsp tombstone timestamp name matches MS-DNSPDouglas Bagnall1-2/+2
MS-DNSP uses the term "EntombedTime" in e.g. "2.2.2.2.4.23 DNS_RPC_RECORD_TS" which is more descriptive than the generic "timestamp", and less likely to be confused with dwTimestamp, which has been our curse. Let's make it grep-able, google-able, and evocative. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-03-26smb.conf: Remove "share backend" optionAndrew Bartlett2-9/+9
This is a confusing hold-over from the NTVFS fileserver that never became part of the merged architecture. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-03-16rpc_server4: Make "srv_callbacks" staticVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-03-16librpc: Add "private_data" to struct dcesrv_context_callbacksVolker Lendecke1-5/+11
Not used right now, but we should never have callbacks without a "private_data" pointer. Some of the callbacks could even today benefit from this. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-02-01s4:rpc_server: Add missing break in switch statementAndreas Schneider1-0/+1
error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough] Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-01-28epmapper: Simplify _epm_Map()Volker Lendecke1-2/+1
We have a routine to compare ndr_syntax_id, don't do it manually. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org>
2021-01-22rpc_server: Fix a "bool==true" conditionVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-01-22rpc_server: Fix a typoVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2020-11-27s4: rename source4/smbd/ to source4/samba/Ralph Boehme2-3/+3
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Fri Nov 27 10:07:18 UTC 2020 on sn-devel-184
2020-11-09s4:rpc_server: Allow to use RC4 for creating trustsAndreas Schneider1-0/+18
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-11-09s4:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob()Andreas Schneider1-1/+1
It doesn't matter for RC4, but just to be correct. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29s4:rpc_server: Allow to use RC4 for setting passwordsAndreas Schneider2-1/+31
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-16CVE-2020-1472(ZeroLogon): rpc_server/netlogon: Fix confounder checkGary Lockyer1-1/+1
Add check for zero length confounder, to allow setting of passwords 512 bytes long. This does not need to be backported, as it is extremely unlikely that anyone is using 512 byte passwords. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-10-01Fix build after removal of an extra safe_string.hAlexander Bokovoy1-0/+1
Move of strcasecmp redefine to lib/util/safe_string.h in https://gitlab.com/samba-team/samba/-/merge_requests/1507 broke build on Fedora 33 with GCC 10.2.1 for those compilation units that use ldb_att_cmp(). The reason for that is that ldb_attr_cmp() defined as #define ldb_attr_cmp(a, b) strcasecmp(a, b) because attribute names restricted to be ASCII by RFC2251 (LDAPv3 spec). A solution is to add #undef strcasecmp to all source code files which use ldb_attr_cmp(). Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Oct 1 22:45:29 UTC 2020 on sn-devel-184
2020-09-18CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: log warnings about ↵Stefan Metzmacher1-3/+63
unsecure configurations This should give admins wawrnings until they have a secure configuration. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Günther Deschner <gd@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-09-18CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: support "server require ↵Stefan Metzmacher1-1/+8
schannel:WORKSTATION$ = no" This allows to add expections for individual workstations, when using "server schannel = yes". "server schannel = auto" is very insecure and will be removed soon. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-09-18CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: refactor ↵Stefan Metzmacher1-12/+33
dcesrv_netr_creds_server_step_check() We should debug more details about the failing request. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-09-18CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: protect ↵Stefan Metzmacher1-1/+59
netr_ServerPasswordSet2 against unencrypted passwords BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-09-18CVE-2020-1472(ZeroLogon): s4:rpc_server:netlogon: make use of ↵Stefan Metzmacher1-2/+1
netlogon_creds_random_challenge() This is not strictly needed, but makes things more clear. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-09-07s4:rpc_server: Use cli_credentials_init_server()Andreas Schneider1-14/+3
Signed-off-by: Andreas Schneider <asn@samba.org>
2020-08-28lib/util: remove extra safe_string.h fileMatthew DeVore11-0/+22
lib/util/safe_string.h is similar to source3/include/safe_string.h, but the former has fewer checks. It is missing bcopy, strcasecmp, and strncasecmp. Add the missing elements to lib/util/safe_string.h remove the other safe_string.h which is in the source3-specific path. To accomodate existing uses of str(n?)casecmp, add #undef lines to source files where they are used. Signed-off-by: Matthew DeVore <matvore@google.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Aug 28 02:18:40 UTC 2020 on sn-devel-184
2020-08-24s4/dns: do not crash when additional data not foundDouglas Bagnall1-3/+4
Found by Francis Brosnan Blázquez <francis@aspl.es>. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12795 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Mon Aug 24 00:21:41 UTC 2020 on sn-devel-184
2020-08-23s4: dns: Ensure variable initialization with NULL.Douglas Bagnall1-11/+13
Ensure no use after free. Based on patches from Francis Brosnan Blázquez <francis@aspl.es> and Jeremy Allison <jra@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12795 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-03lib: relicense smb_strtoul(l) under LGPLv3Ralph Boehme1-0/+1
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Swen Schillig <swen@linux.ibm.com> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Aug 3 22:21:04 UTC 2020 on sn-devel-184
2020-07-07s4:rpc_server: Implement epmapper LookupHandleFreeSamuel Cabrero1-1/+10
Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: David Mulder <dmulder@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Samuel Cabrero <scabrero@samba.org> Autobuild-Date(master): Tue Jul 7 13:43:14 UTC 2020 on sn-devel-184
2020-05-24librpc: core: Move the s4 handles implementation to the RPC server coreSamuel Cabrero2-364/+1
Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-05-15s4/rpc_server/dnsserver: Allow parsing of dnsProperty to fail gracefullyAndrew Bartlett1-7/+65
On (eg) the DC=_msdcs.X.Y,CN=MicrosoftDNS,DC=ForestDnsZones,DC=X,DC=Y record, in domains that have had a Microsoft Windows DC an attribute: dNSProperty:: AAAAAAAAAAAAAAAAAQAAAJIAAAAAAAAA 000000 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 >................< 000010 92 00 00 00 00 00 00 00 >........< 000018 We, until samba 4.12, would parse this as: pull returned Success dnsp_DnsProperty: struct dnsp_DnsProperty wDataLength : 0x00000000 (0) namelength : 0x00000000 (0) flag : 0x00000000 (0) version : 0x00000001 (1) id : DSPROPERTY_ZONE_NS_SERVERS_DA (146) data : union dnsPropertyData(case 0) name : 0x00000000 (0) dump OK However, the wDataLength is 0. There is not anything in [MS-DNSP] 2.3.2.1 dnsProperty to describe any special behaviour for when the id suggests that there is a value, but wDataLength is 0. https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dnsp/445c7843-e4a1-4222-8c0f-630c230a4c80 We now fail to parse it, because we expect an entry with id DSPROPERTY_ZONE_NS_SERVERS_DA to therefore have a valid DNS_ADDR_ARRAY (section 2.2.3.2.3). As context we changed it in our commit fee5c6a4247aeac71318186bbff7708d25de5912 because of bug https://bugzilla.samba.org/show_bug.cgi?id=14206 which was due to the artificial environment of the fuzzer. Microsoft advises that Windows also fails to parse this, but instead of failing the operation, the value is ignored. Reported by Alex MacCuish. Many thanks for your assistance in tracking down the issue. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14310 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri May 15 07:29:17 UTC 2020 on sn-devel-184
2020-02-05s4:rpc_server/lsa: remove some useless talloc_reference() callsStefan Metzmacher1-10/+10
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2019-12-12pidl:NDR/Server: Allow to define endpoint server shutdown functionsSamuel Cabrero1-0/+7
The next commits will register legacy api_struct when the endpoint server is initialized. This commit adds a shutdown function which will be used to unregister the legacy api_struct. The shutdown function will be also used to replace the rpc_srv_callbacks struct shutdown member used, for example, by the spoolss service to cleanup before exiting. Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-12librpc:core: Add public functions to initialize endpoint serversSamuel Cabrero1-0/+2
The dcesrv_init_registered_ep_servers() will be used by the S3 server to initialize all registered endpoint servers (for embedded services), and the dcesrv_init_ep_server() function will be used by the external daemons to initialize the required ones. As serveral S3 services may require to initialize another one before itself (svcctl and eventlog for example require winreg) a boolean flag is added to track the initialization status. Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-12librpc:core: Split dcesrv context init and endpoint servers initSamuel Cabrero1-1/+7
The S4 server will initialize the endpoint servers specified in smb.conf, but the S3 server need to initialize all registered endpoint servers (the embedded ones). Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-10CVE-2019-14861: s4-rpc/dnsserver: Avoid crash in ldb_qsort() via ↵Andrew Bartlett3-27/+17
dcesrv_DnssrvEnumRecords) dns_name_compare() had logic to put @ and the top record in the tree being enumerated first, but if a domain had both then this would break the older qsort() implementation in ldb_qsort() and cause a read of memory before the base pointer. By removing this special case (not required as the base pointer is already seperatly located, no matter were it is in the returned records) the crash is avoided. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14138 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-12-10CVE-2019-14861: s4-rpc_server: Remove special case for @ in dns_build_tree()Andrew Bartlett1-4/+5
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14138 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-12-10session: convert sess_crypt_blob to use gnutlsIsaac Boukris1-2/+11
Signed-off-by: Isaac Boukris <iboukris@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-10smbdes: convert des_crypt112_16 to use gnutlsIsaac Boukris1-3/+10
Signed-off-by: Isaac Boukris <iboukris@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-10smbdes: convert E_old_pw_hash to use gnutlsIsaac Boukris1-2/+14
Signed-off-by: Isaac Boukris <iboukris@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-27smbdotconf: mark "server string" with substitution="1"Ralph Boehme1-2/+4
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-22build: Do not build selftest binaries for builds without --enable-selftestAndrew Bartlett1-9/+8
Add new for_selftest option to SAMBA_BINARY() and SAMBA3_BINARY() This allows us to be much more consistent (at least in the core Samba) and documents clearly why the binary should not be installed. Not modified are - test_lp_load - notifyd-tests - gendrandperf - test* from examples/libsmbclient - dbwrap_torture - split_tokens - locktest2 - msgtest - msg_sink - msg_source - versiontest - rpc_open_tcp - test_headers As these are not tested in selftest so any change would also be untested. Of course they probably should be added in a different MR. Also not modified (because they are not tests, nor part of the build system) are: - smb2mount - notifydd - log2pacp - debug2html - smbfilter - destroy_netlogon_creds_cli - spotlight2* - tevent_glib_tracker These do however appear to be untested. For now, the source4 forked client tools are left unchanged: - smbclient4 - nmblookup4 Finally, the heimdal binaries are left as install=False as they are either part of the build system or end-user tools that we just don't want to install. These are however tested. The motivation is commit like c34ec003b7d45aa4196ff93a0ac29694b25e5309 and da87fa998ab71328f30bcdf5b41aee8675aee48a, which are both totally correct but are not needed if the selftest is not run on MacOS. There are likely other platforms or build environments where building our test binaries is more pain than valuable, see for example also https://lists.samba.org/archive/samba/2019-November/227137.html Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Isaac Boukris <iboukris@samba.org> Autobuild-User(master): Isaac Boukris <iboukris@samba.org> Autobuild-Date(master): Fri Nov 22 11:48:59 UTC 2019 on sn-devel-184
2019-11-20s4:rpc_server: Return the status code from dcesrv_transport_session_key()Andreas Schneider1-4/+3
Normally this returns the right status code, which normally is: NT_STATUS_NO_USER_SESSION_KEY This is consitent with the source3 samr server implmentation. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Isaac Boukris <iboukris@samba.org> Autobuild-User(master): Isaac Boukris <iboukris@samba.org> Autobuild-Date(master): Wed Nov 20 22:29:35 UTC 2019 on sn-devel-184
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-26 06:02:11 +0000