[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via aa658ca962c VERSION: Disable GIT_SNAPSHOT for the 4.10.18 release. via 1d3bbd71736 WHATSNEW: Add release notes for Samba 4.10.18. via a414d149503 CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge via 4809d018dea CVE-2020-1472(ZeroLogon): s4 torture rpc: Test empty machine acct pwd via 4c0ad865d40 CVE-2020-1472(ZeroLogon): docs-xml: document 'server require schannel:COMPUTERACCOUNT' via 54fb5e12d68 CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: log warnings about unsecure configurations via 912cc29a995 CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: support "server require schannel:WORKSTATION$ = no" via 6a6f64fc8c3 CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: refactor dcesrv_netr_creds_server_step_check() via bfb70388c1c CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: log warnings about unsecure configurations via 1a1ecc5fc31 CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: support "server require schannel:WORKSTATION$ = no" via b33d4dff5f5 CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: refactor dcesrv_netr_creds_server_step_check() via 59f88cb36eb CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: protect netr_ServerPasswordSet2 against unencrypted passwords via e799c47b6e0 CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: protect netr_ServerPasswordSet2 against unencrypted passwords via bffdfb129ce CVE-2020-1472(ZeroLogon): libcli/auth: reject weak client challenges in netlogon_creds_server_init() via 1665085bb3a CVE-2020-1472(ZeroLogon): libcli/auth: add netlogon_creds_is_random_challenge() to avoid weak values via 36824951f3a CVE-2020-1472(ZeroLogon): s4:rpc_server:netlogon: make use of netlogon_creds_random_challenge() via 8aa00858571 CVE-2020-1472(ZeroLogon): s3:rpc_server:netlogon: make use of netlogon_creds_random_challenge() via 520216a051a CVE-2020-1472(ZeroLogon): libcli/auth: make use of netlogon_creds_random_challenge() in netlogon_creds_cli.c via 0b45e084a45 CVE-2020-1472(ZeroLogon): s4:torture/rpc: make use of netlogon_creds_random_challenge() via e3e81644347 CVE-2020-1472(ZeroLogon): libcli/auth: add netlogon_creds_random_challenge() via 40d23ea50ce util: fix build on AIX by fixing the order of replace.h include via 016e08ca07f util: Reallocate larger buffer if getpwuid_r() returns ERANGE via 57bd719af1f util: Fix build on FreeBSD by avoiding NSS_BUFLEN_PASSWD via f9d9ba6cd06 util: Simplify input validation via 05596094a9b VERSION: Bump version up to 4.10.18. via 2bdfa66ab1d Merge tag 'samba-4.10.17' into v4-10-test via 69324a82444 VERSION: Bump version up to 4.10.17... from e88b0e44899 VERSION: Diable GIT_SNAPSHOT for the 4.10.17 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - commit aa658ca962cfe9057741495ce9eda5d6b6965882 Author: Karolin Seeger Date: Fri Sep 18 12:59:51 2020 +0200 VERSION: Disable GIT_SNAPSHOT for the 4.10.18 release. Signed-off-by: Karolin Seeger commit 1d3bbd71736365b745a29f4e6bfafc2537d7aa71 Author: Karolin Seeger Date: Fri Sep 18 13:18:55 2020 +0200 WHATSNEW: Add release notes for Samba 4.10.18. CVE-2020-1472: Samba impact of "ZeroLogon". Signed-off-by: Karolin Seeger commit a414d149503718650bf2bdd049a92b04472ef267 Author: Gary Lockyer Date: Fri Sep 18 15:57:34 2020 +1200 CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge Ensure that client challenges with the first 5 bytes identical are rejected. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Gary Lockyer [abart...@samba.org: backported from master as test order was flipped] commit 4809d018dea336dd50e84f713778c53ed85fef20 Author: Gary Lockyer Date: Fri Sep 18 12:39:54 2020 +1200 CVE-2020-1472(ZeroLogon): s4 torture rpc: Test empty machine acct pwd Ensure that an empty machine account password can't be set by netr_ServerPasswordSet2 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Gary Lockyer commit 4c0ad865d400739106c624beb1494128f885fce6 Author: Stefan Metzmacher Date: Thu Sep 17 17:27:54 2020 +0200 CVE-2020-1472(ZeroLogon): docs-xml: document 'server require schannel:COMPUTERACCOUNT' BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher commit 54fb5e12d6805e687e8840209a2d4af26294ee18 Author: Günther Deschner Date: Thu Sep 17 14:42:52 2020 +0200 CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: log warnings about unsecure configurations BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via e88b0e44899 VERSION: Diable GIT_SNAPSHOT for the 4.10.17 release. via 9127ebabb8e WHATSNEW: Add release notes for Samba 4.10.17. via ca38b0eecdd CVE-2020-10760 dsdb: Add tests for paged_results and VLV over the Global Catalog port via 4bc0ada8d99 CVE-2020-10760 dsdb: Ensure a proper talloc tree for saved controls via 2e190d5c766 CVE-2020-14303: s4 nbt: fix busy loop on empty UDP packet via 9773231e3a5 CVE-2020-14303 Ensure an empty packet will not DoS the NBT server via 21a449f491b CVE-2020-10745: ndr/dns-utils: prepare for NBT compatibility via d266802a3fd CVE-2020-10745: dns_util/push: forbid names longer than 255 bytes via dbde3431f70 CVE-2020-10745: ndr_dns: do not allow consecutive dots via 0c6bbd70192 CVE-2020-10745: ndr/dns_utils: correct a comment via b8788a04ebd CVE-2020-10745: ndr_dns: move ndr_push_dns_string core into sharable function via b9ba23d41e0 CVE-2020-10745: librpc/tests: cmocka tests of dns and ndr strings via 6253d590d23 CVE-2020-10745: pytests: hand-rolled invalid dns/nbt packet tests via ec11a9adbf9 ldb: Bump version to 1.5.8 via d6848d2f3f2 CVE-2020-10730: lib ldb: Check if ldb_lock_backend_callback called twice via d400d7d8ac6 CVE-2020-10730: s4 dsdb vlv_pagination: Prevent repeat call of ldb_module_done via 9c5c2c845ca CVE-2020-10730: s4 dsdb paged_results: Prevent repeat call of ldb_module_done via fff5a35ba4e CVE-2020-10730: dsdb: Ban the combination of paged_results and VLV via 04f059fa7ec CVE-2020-10730: dsdb: Fix crash when vlv and paged_results are combined via ca2be7c95bb CVE-2020-10730: selftest: Add test to show that VLV and paged_results are incompatible via 80144c53d55 CVE-2020-10730: vlv: Another workaround for mixing ASQ and VLV via 9d4b98d75ea CVE-2020-10730: selftest: Add test to confirm VLV interaction with ASQ via c745a495415 CVE-2020-10730: vlv: Do not re-ASQ search the results of an ASQ search with VLV via 3ca77e3edc0 CVE-2020-10730: vlv: Use strcmp(), not strncmp() checking the NULL terminated control OIDs via 55f01236e44 VERSION: Bump version up to 4.10.17... from ee766dffdd8 VERSION: Disable GIT_SNAPSHOT for the 4.10.16 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - commit e88b0e44899ad462abef61d0082b10d9a4e2c9cb Author: Karolin Seeger Date: Thu Jun 25 13:12:45 2020 +0200 VERSION: Diable GIT_SNAPSHOT for the 4.10.17 release. This is a security release in order to address the following CVEs: o CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results. o CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU. o CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV. o CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd. Signed-off-by: Karolin Seeger commit 9127ebabb8eddfdca9cd0418b8276089809ff056 Author: Karolin Seeger Date: Thu Jun 25 13:12:17 2020 +0200 WHATSNEW: Add release notes for Samba 4.10.17. Signed-off-by: Karolin Seeger commit ca38b0eecddbfab0ff1b80d7e588b19beb299084 Author: Andrew Bartlett Date: Mon Jun 8 16:32:14 2020 +1200 CVE-2020-10760 dsdb: Add tests for paged_results and VLV over the Global Catalog port This should avoid a regression. (backported from master patch) [abart...@samba.org: sort=True parameter on test_paged_delete_during_search is not in 4.10] Signed-off-by: Andrew Bartlett commit 4bc0ada8d99425ad8d8933e0c3b1abecaa185edf Author: Andrew Bartlett Date: Fri Jun 5 22:14:48 2020 +1200 CVE-2020-10760 dsdb: Ensure a proper talloc tree for saved controls Otherwise a paged search on the GC port will fail as the ->data was not kept around for the second page of searches. An example command to produce this is bin/ldbsearch --paged -H ldap://$SERVER:3268 -U$USERNAME%$PASSWORD This shows up later in the partition module as: ERROR: AddressSanitizer: heap-use-after-free on address 0x60b00151ef20 at pc 0x7fec3f801aac bp 0x7ffe8472c270 sp 0x7ffe8472c260 READ of size 4 at 0x60b00151ef20 thread T0 (ldap(0)) #0 0x7fec3f801aab in talloc_chunk_from_ptr ../../lib/talloc/talloc.c:526 #1 0x7fec3f801aab in __talloc_get_name ../../lib/talloc/talloc.c:1559 #2 0x7fec3f801aab in talloc_check_name ../../lib/talloc/talloc.c:1582 #3 0x7fec1b86b2e1 in partition_search ../../source4/dsdb/samdb/ldb_modules/partition.c:780 or smb_panic_default: PANIC (pid 13287): Bad talloc magic
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via ee766dffdd8 VERSION: Disable GIT_SNAPSHOT for the 4.10.16 release. via 896ca7047c5 WHATSNEW: Add release notes for Samba 4.10.16. via 55a3861260c s3: lib: Paranoia around use of snprintf copying into a fixed-size buffer from a getenv() pointer. via 54151c2d84e s3:gencache: Allow to open gencache as read-only via 55f91b59309 lib:util: Add test for path_expand_tilde() via 452e543ca5f lib:util: Add path_expand_tilde() via 134c109094b docs-xml: Fix usernames in pam_winbind manpages via f441f026b66 lib:util: Fix smbclient -l basename dir via 3566d8826f1 Add a test for smbclient -l basename via 198e810bc28 testprogs: Add 'net ads join createupn' test also verifying the keytab via f798edaea3c s3:libads: Fix ads_get_upn() via 3bff6f6ad28 libsmb: Protect cli_oem_change_password() from rprcnt<2 via c25c2fc665f libsmb: Protect cli_RNetServerEnum against rprcnt<6 via bfe436e4c80 libsmb: Protect cli_RNetShareEnum() against rprcnt<6 via 70d390656b6 libsmb: Fix indentation in cli_RNetShareEnum() via ad2c619133d libsmb: Don't try to find posix stat info in SMBC_getatr() via 5998d32ab73 VERSION: Bump version up to 4.10.16. via e1addc5cdd8 Merge tag 'samba-4.10.15' into v4-10-test via 53ea67687d3 VERSION: Bump verison up to 4.10.15... from b98108ff760 VERSION: Disable GIT_SNAPSHOT for the 4.10.15 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - --- Summary of changes: VERSION| 2 +- WHATSNEW.txt | 55 +++- docs-xml/manpages/pam_winbind.8.xml| 4 +- docs-xml/manpages/pam_winbind.conf.5.xml | 4 +- lib/util/debug.c | 8 +- lib/util/tests/test_util_paths.c | 127 + lib/util/util_paths.c | 76 +++ lib/util/util_paths.h | 9 ++ lib/util/wscript_build | 6 + selftest/tests.py | 2 + source3/include/libsmb_internal.h | 1 - source3/lib/gencache.c | 63 - source3/libads/ldap.c | 1 + source3/libsmb/clirap.c| 151 - source3/libsmb/libsmb_file.c | 20 --- source3/libsmb/libsmb_server.c | 9 -- .../script/tests/test_smbclient_log_basename.sh| 36 + source3/selftest/tests.py | 3 + testprogs/blackbox/test_net_ads.sh | 17 +++ 19 files changed, 489 insertions(+), 105 deletions(-) create mode 100644 lib/util/tests/test_util_paths.c create mode 100755 source3/script/tests/test_smbclient_log_basename.sh Changeset truncated at 500 lines: diff --git a/VERSION b/VERSION index c183a16b2fa..5e391d3a25c 100644 --- a/VERSION +++ b/VERSION @@ -25,7 +25,7 @@ SAMBA_VERSION_MAJOR=4 SAMBA_VERSION_MINOR=10 -SAMBA_VERSION_RELEASE=15 +SAMBA_VERSION_RELEASE=16 # If a official release has a serious bug # diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 2d2c7ff2043..f644038694c 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,3 +1,54 @@ + === + Release Notes for Samba 4.10.16 +May 25, 2020 + === + + +This is the last stable release of the Samba 4.10 release series. + + +Changes since 4.10.15 +- + +o Jeremy Allison + * s3: lib: Paranoia around use of snprintf copying into a fixed-size buffer + from a getenv() pointer. + +o Amit Kumar + * BUG 14345: lib:util: Fix smbclient -l basename dir. + +o Volker Lendecke + * BUG 14366: Malicous SMB1 server can crash libsmbclient. + +o Andreas Schneider + * BUG 14336: s3:libads: Fix ads_get_upn(). + * BUG 14358: docs-xml: Fix usernames in pam_winbind manpages. + * BUG 14370: Client tools are not able to read gencache anymore since 4.10. + + +### +Reporting bugs & Development Discussion +### + +Please discuss this release on the samba-technical mailing list or by +joining the #samba-technical IRC channel on irc.freenode.net. + +If you do report problems then please try to send high quality +feedback. If you don't provide vital information to help us track down +the problem then you will probably be ignored. All bug reports
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via b98108ff760 VERSION: Disable GIT_SNAPSHOT for the 4.10.15 release. via b78b4ef0874 WHATSNEW: Add release notes for Samba 4.10.15. via ea944665e6f CVE-2020-10704 libcli ldap: Check search request lengths. via 139f49ac0c8 CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decode via 2714fb173f9 CVE-2020-10704: S4 ldap server: Limit request sizes via 4ec90ccda8d CVE-2020-10704: smb.conf: Add max ldap request sizes via fdc00bf95f5 CVE-2020-10704: ldapserver tests: Python 2 comaptibility via d8ec11ea9f3 CVE-2020-10704: ldapserver tests: Limit search request sizes via 8e7b910f687 CVE-2020-10704: lib util asn1: Check parse tree depth via ab4ff93b05b CVE-2020-10704: libcli ldap: test recursion depth in ldap_decode_filter_tree via 2aa1d7a8e42 CVE-2020-10704: lib util asn1: Add ASN.1 max tree depth via 100821b43c4 CVE-2020-10700: ldb: Bump version up to 1.5.7. via 865ca0dbe5e CVE-2020-10700: dsdb: Do not permit the ASQ control for the GUID search in paged_results via 350361c779b CVE-2020-10700: ldb: Always use ldb_next_request() in ASQ module via afbbd3faebb CVE-2020-10700: dsdb: Add test for ASQ and ASQ in combination with paged_results via 0f64711aae9 VERSION: Bump verison up to 4.10.15... from 9aa60fc0e53 VERSION: Disable GIT_SNAPSHOT for the 4.10.14 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - commit b98108ff760f6a56075026926e0e8efadbec4d41 Author: Karolin Seeger Date: Tue Apr 21 10:43:35 2020 +0200 VERSION: Disable GIT_SNAPSHOT for the 4.10.15 release. o CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ o CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC Signed-off-by: Karolin Seeger commit b78b4ef087489f9e95963f8f6b0007f98fa64b00 Author: Karolin Seeger Date: Tue Apr 21 10:42:38 2020 +0200 WHATSNEW: Add release notes for Samba 4.10.15. Signed-off-by: Karolin Seeger commit ea944665e6fe75a4c96cca1313036918de8e49e3 Author: Gary Lockyer Date: Wed Apr 8 10:46:44 2020 +1200 CVE-2020-10704 libcli ldap: Check search request lengths. Check the search request lengths against the limits passed to ldap_decode. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer Reviewed-by: Andrew Bartlett commit 139f49ac0c866b4c4d3b99e98fd1940bd7dedcab Author: Gary Lockyer Date: Wed Apr 8 08:49:23 2020 +1200 CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decode Add search request size limits to ldap_decode calls. The ldap server uses the smb.conf variable "ldap max search request size" which defaults to 250Kb. For cldap the limit is hard coded as 4096. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer Reviewed-by: Andrew Bartlett commit 2714fb173f95bd15f0653574eb8c1ec3a7446f16 Author: Gary Lockyer Date: Wed Apr 8 15:32:22 2020 +1200 CVE-2020-10704: S4 ldap server: Limit request sizes Check the size of authenticated and anonymous ldap requests and reject them if they exceed the limits in smb.conf Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer Reviewed-by: Andrew Bartlett commit 4ec90ccda8d4a751bfc1cb03b01d729833be2ad6 Author: Gary Lockyer Date: Tue Apr 7 09:09:01 2020 +1200 CVE-2020-10704: smb.conf: Add max ldap request sizes Add two new smb.conf parameters to control the maximum permitted ldap request size. Adds: ldap max anonymous request size default 250Kb ldap max authenticated request size default 16Mb Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer Reviewed-by: Andrew Bartlett commit fdc00bf95f5ad45ddffc8f1ab31ecd577e25518d Author: Gary Lockyer Date: Thu Apr 16 10:49:29 2020 +1200 CVE-2020-10704: ldapserver tests: Python 2 comaptibility The test python/samba/tests/ldap_raw.py does not run under python 3 which means the CI task build_ad_dc_py2 fails. The test is run and passes in the CI task build_ad_dc. This patch adds a check for the Python version and skips the tests if running under python 2, allowing CI to run for V4.10. This patch is only applied
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via 9aa60fc0e53 VERSION: Disable GIT_SNAPSHOT for the 4.10.14 release. via b645568e385 WHATSNEW: Add release notes for Samba 4.10.14. via d7936eab41d ctdb-tcp: Do not stop outbound connection in ctdb_tcp_node_connect() via 3d7da451367 ctdb-tcp: Factor out function ctdb_tcp_start_outgoing() via ec0d2193c32 ctdb-tcp: add ctdb_tcp_stop_incoming() via 7f135cb6ceb ctdb-tcp: rename ctdb_tcp_stop_connection() to ctdb_tcp_stop_outgoing() via 37c03834d99 ctdb-tcp: Remove redundant restart in ctdb_tcp_tnode_cb() via d156db3b084 ctdb-tcp: always call node_dead() upcall in ctdb_tcp_tnode_cb() via d80e1985da7 ctdb-tcp: move free of inbound queue to TCP restart via 5d4e66b3df8 ctdb-daemon: more logical whitespace, debug modernisation via 8a3a942b520 ctdb-daemon: ensure restart() callback is called in half-connected state via 6528833ee7e ctdb-daemon: Rename ctdb_context private_data to transport_data via f6d45183709 ctdb-daemon: Rename ctdb_node private_data to transport_data via 1bca6456030 nmblib: avoid undefined behaviour in handle_name_ptrs() via 43b343786e3 selftest: Export DC conf path for special cases via 1905ed84f8a selftest: Test behaviour of DNS scavenge with an existing dNSTombstoned value via 4bc3641a083 dsdb: Correctly handle memory in objectclass_attrs via 9b805c08442 wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9 via ee7e298bd70 s3: VFS: full_audit. Use system session_info if called from a temporary share definition. via 3230cf3e23e auth: Fix CID 1458418 Null pointer dereferences (REVERSE_INULL) via 11f214df1e3 auth: Fix CID 1458420 Null pointer dereferences (REVERSE_INULL) via 7f836b10103 ctdb-tcp: Make error handling for outbound connection consistent via f3eebacb127 winbindd: handling missing idmap in getgrgid() via 8d069f20ec1 s3:auth_sam: map an empty domain or '.' to the local SAM name via f1b3a95852a s3:selftest: test authentication with an empty userdomain and upn names via f4706d85b95 s3:auth_sam: introduce effective_domain helper variables via 731ae2864d8 s3:auth_sam: make sure we never handle empty usernames via 33b37926b25 s3:auth_sam: unify the debug messages of all auth_sam*_auth() functions via d5fa47e02ff s3:auth_sam: replace confusing FALL_THROUGH; with break; via 105e48e2712 script/release.sh: Don't use quotations any longer. via 677362ca796 lib:util: Log mkdir error on correct debug levels via 9fd10a2cacd s4:torture: Skip the deltest20 as user root via 55177a44258 s3: lib: nmblib. Clean up and harden nmb packet processing. via 9dca42f43b3 VERSION: Bump version up to 4.10.14... from 9678370227a VERSION: Disable GIT_SNAPSHOT for the 4.10.13 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - --- Summary of changes: VERSION| 2 +- WHATSNEW.txt | 72 - buildtools/wafsamba/samba_utils.py | 2 +- ctdb/ib/ibw_ctdb.c | 11 +- ctdb/ib/ibw_ctdb_init.c| 13 ++- ctdb/include/ctdb_private.h| 4 +- ctdb/server/ctdb_server.c | 13 ++- ctdb/tcp/ctdb_tcp.h| 3 +- ctdb/tcp/tcp_connect.c | 114 + ctdb/tcp/tcp_init.c| 20 ++-- ctdb/tcp/tcp_io.c | 5 +- lib/util/util.c| 7 +- python/samba/tests/dns.py | 39 +++ script/release.sh | 26 - selftest/knownfail.d/empty-domain-name | 7 ++ selftest/selftest.pl | 7 ++ selftest/target/Samba4.pm | 6 ++ source3/auth/auth_sam.c| 85 +-- source3/libsmb/nmblib.c| 15 ++- source3/modules/vfs_full_audit.c | 20 +++- source3/selftest/tests.py | 8 ++ source3/winbindd/winbindd_getgrgid.c | 4 + source4/dsdb/samdb/ldb_modules/objectclass_attrs.c | 17 ++- source4/torture/basic/delete.c | 4 + 24 files changed, 378 insertions(+), 126 deletions(-) create mode 100644 selftest/knownfail.d/empty-domain-name Changeset truncated at 500 lines: diff --git a/VERSION b/VERSION index e7e72c2dc8c..5428aa21c57 100644 --- a/VERSION +++ b/VERSION @@ -25,7 +25,7 @@
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via 9678370227a VERSION: Disable GIT_SNAPSHOT for the 4.10.13 release. via 5630c60aea4 WHATSNEW: Add release notes for Samba 4.10.13. via 969123b4ab8 script/release.sh: make it possible to run from a git worktree via 1c330a18d45 VERSION: Bump version up to 4.10.13. via a69b3905140 Merge tag 'samba-4.10.12' into v4-10-test via b2800628a6b ctdb-tests: Skip some tests that don't work with IPv6 via 57390cc5a36 ctdb-scripts: Strip square brackets when gathering connection info via 6a109e3ddb3 librpc: Fix string length checking in ndr_pull_charset_to_null() via fe015ece4ee upgradedns: ensure lmdb lock files linked via 78fb3cb0051 test upgradedns: ensure lmdb lock files linked via decce5e6e19 docs-xml/winbindnssinfo: clarify interaction with idmap_ad etc. via a2f8fdb4109 libsmbclient: If over SMB1 first try to do a posix stat on the file. via 6ae62c26ef9 s3:libsmb: Add a setup_stat_from_stat_ex() function via 0d32af6001d s3:libsmb: Return a 'struct stat' buffer for SMBC_getatr() via 9c7ec52a017 s3:libsmb: Add try_posixinfo to SMBSRV struct. Only enable for SMB1 with UNIX for now. via 9cb73280894 s3:libsmb: Generate the inode only based on the path component via 745f563d4c7 s3: libsmb: Move setting all struct stat fields into setup_stat(). via ee236c2f307 s3: libsmb: Move setting st->st_ino into setup_stat. via 06b0e8d3ae1 s3: libsmb: Change generate_inode()/setup_stat() to modern coding standards. via b5e8ba021bf s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir via 30352214311 Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero. via edeed08a04c pygpo: use correct method flags via bbeb73b40b8 VERSION: Bump version up to 4.10.12. via 2757c0711d0 s3: smbd: Only set xconn->smb1.negprot.done = true after supported_protocols[protocol].proto_reply_fn() succeeds. via d8d661aabfd python: tests. Add test for fuzzing smbd crash bug. via a622ad439bd s3: smbd: Ensure we exit if supported_protocols[protocol].proto_reply_fn() fails. via fb1beba0091 s3: smbd: Change (*proto_reply_fn()) to return an NTSTATUS. via 2feddd181dd s3: smbd: Change reply_smb20xx() to return NTSTATUS. via 100caebe0b7 s3: smbd: Ensure we exit on smbd_smb2_process_negprot() fail. via 546a2e935a5 s3: smbd: Allow smbd_smb2_process_negprot() to return NTSTATUS as it can fail. via 41c9250320d s3: smbd: SMB2 - Ensure we use the correct session_id if encrypting an interim response. via 8f9a2afd469 Merge tag 'samba-4.10.11' into v4-10-test via cc58e4b1899 heimdal-build: avoid hard-coded /usr/include/heimdal in asn1_compile-generated code. via 939a0c8bb24 ctdb-tcp: Close inflight connecting TCP sockets after fork via 47b1e70b6aa ctdb-tcp: Drop tracking of file descriptor for incoming connections via 39f93ff7121 ctdb-tcp: Avoid orphaning the TCP incoming queue via 5eb95d0d088 ctdb-tcp: Check incoming queue to see if incoming connection is up via 471835acb08 s3: libsmb: Ensure return from net_share_enum_rpc() sets cli->raw_status on error. via 0b6c23def7b s3: utils: smbtree. Ensure we don't call cli_RNetShareEnum() on an SMB1 connection. via dd946f54f6f s3: libsmb: Ensure we don't call cli_RNetShareEnum() on an SMB1 connection. via 7fe9b58d665 s3:printing: Fix %J substition via c7013a9f905 s3:printing: add a DEBUG statement via 136a1553f6c s3:lib: factor out talloc_sub_advanced() from talloc_sub_full() via 3a9fa54ca0e s3: rename talloc_sub_advanced() to talloc_sub_full() via eb304625299 s3: remove unused function standard_sub_advanced() via 046fe483012 s3: replace standard_sub_advanced with talloc_sub_advanced in one place via 2f6ec2e6aa5 s3:printing: fix a long line via 33142a8fe9b lib/adouble: pass filesize to ad_unpack() via 2a61a6b7c37 lib/adouble: drop ad_data reallocate logic via f3482d9efc8 vfs_fruit: README.Coding fix: multi-line if expression via 5f4e4ff16a8 vfs_fruit: fix a long line via d3a81333a8f torture: expand test "vfs.fruit.resource fork IO" to check size via e6129b8930b s3:smbd: Fix sync dosmode fallback in async dosmode codepath via 5ba5a1dc780 s3:smbd: Incomplete conversion of former parametric options via 47466691ccb s3: remove now unneeded call to cmdline_messaging_context() via 459ead6d8f0 s3:dbwrap: initialize messaging before getting the ctdb connection via 466b19feef4 libnet_join: add SPNs for additional-dns-hostnames entries via d57753e3476 docs-xml: add "additional dns hostnames" smb.conf option via 3d9240bf3cf libnet_join_set_machine_spn: simplify adding uniq
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via 06f7473fe56 VERSION: Disable GIT_SNAPSHOT for the 4.10.12 release. via 8e1313322ce WHATSNEW: Add release notes for Samba 4.11.5. via ed516929162 CVE-2019-19344 kcc dns scavenging: Fix use after free in dns_tombstone_records_zone via 7deeb0c93bb CVE-2019-14907 lib/util: Do not print the failed to convert string into the logs via 28e6066e5db CVE-2019-14907 lib/util/charset: clang: Fix Value stored to 'reason' is never read warning via 90c1563cb83 CVE-2019-14902 dsdb: Change basis of descriptor module deferred processing to be GUIDs via d257c764a7b CVE-2019-14902 repl_meta_data: Set renamed = true (and so do SD inheritance) after any rename via cf95287171e CVE-2019-14902 repl_meta_data: Fix issue where inherited Security Descriptors were not replicated. via efb7ac7efe0 CVE-2019-14902 repl_meta_data: schedule SD propagation to a renamed DN via f3e3e8deb46 CVE-2019-14902 dsdb: Ensure we honour both change->force_self and change->force_children via 8092b27908c CVE-2019-14902 dsdb: Add comments explaining why SD propagation needs to be done here via 17e6091b99a CVE-2019-14902 dsdb: Explain that descriptor_sd_propagation_recursive() is proctected by a transaction via 62e098fec23 selftest: Add test to confirm ACL inheritence really happens via 9480a26697e CVE-2019-14902 selftest: Add test for a special case around replicated renames via e7eeb725858 CVE-2019-14902 selftest: Add test for replication of inherited security descriptors via a4c62918730 VERSION: Re-enable GIT_SNAPSHOT. via 32d2cd1f5b5 VERSION: Bump version up to 4.10.12. from d644dfea6f2 VERSION: Disable GIT_SNAPSHOT for the 4.10.11 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - commit 06f7473fe565b3e2fd9413cbdcc77439d9907735 Author: Karolin Seeger Date: Thu Jan 9 12:51:27 2020 +0100 VERSION: Disable GIT_SNAPSHOT for the 4.10.12 release. o CVE-2019-14902: Replication of ACLs set to inherit down a subtree on AD Directory not automatic. o CVE-2019-14907: Crash after failed character conversion at log level 3 or above. o CVE-2019-19344: Use after free during DNS zone scavenging in Samba AD DC. Signed-off-by: Karolin Seeger commit 8e1313322ce62b1dbd56957faa849e83d7c9ddfe Author: Karolin Seeger Date: Thu Jan 9 12:48:31 2020 +0100 WHATSNEW: Add release notes for Samba 4.11.5. o CVE-2019-14902: Replication of ACLs set to inherit down a subtree on AD Directory not automatic. o CVE-2019-14907: Crash after failed character conversion at log level 3 or above. o CVE-2019-19344: Use after free during DNS zone scavenging in Samba AD DC. Signed-off-by: Karolin Seeger commit ed5169291628b663c6d641f3c9e8d89bb84f91ac Author: Gary Lockyer Date: Mon Dec 16 13:57:47 2019 +1300 CVE-2019-19344 kcc dns scavenging: Fix use after free in dns_tombstone_records_zone ldb_msg_add_empty reallocates the underlying element array, leaving old_el pointing to freed memory. This patch takes two defensive copies of the ldb message, and performs the updates on them rather than the ldb messages in the result. Bug: https://bugzilla.samba.org/show_bug.cgi?id=14050 Signed-off-by: Gary Lockyer commit 7deeb0c93bb5da014ea3d259ab9dbd63e8be72cb Author: Andrew Bartlett Date: Fri Nov 29 20:58:47 2019 +1300 CVE-2019-14907 lib/util: Do not print the failed to convert string into the logs The string may be in another charset, or may be sensitive and certainly may not be terminated. It is not safe to just print. Found by Robert Święcki using a fuzzer he wrote for smbd. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14208 Signed-off-by: Andrew Bartlett (adapted from master commit) commit 28e6066e5db61ca0a375fd8712385c0d1761b257 Author: Noel Power Date: Fri May 24 13:37:00 2019 + CVE-2019-14907 lib/util/charset: clang: Fix Value stored to 'reason' is never read warning Fixes: lib/util/charset/convert_string.c:301:5: warning: Value stored to 'reason' is never read <--[clang] Signed-off-by: Noel Power Reviewed-by: Gary Lockyer g...@catalyst.net.nz (cherry picked from commit add47e288bc80c1bf45765d1588a9fa5998ea677) commit 90c1563cb83a59fb4d9b997fbde76bcec1092c29 Author: Andrew Bartlett Date: Thu Dec 12 14:44:57 2019 +1300 CVE-2019-14902 dsdb: Change basis of descriptor module deferred processing to be GUIDs We can not process on the basis of a DN, as the DN may have changed in a rename, not only that this module can see, but also from repl_meta_data below. Therefore
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via d644dfea6f2 VERSION: Disable GIT_SNAPSHOT for the 4.10.11 release. via aa4577474f1 WHATSNEW: Add release notes for Samba 4.10.11. via 8330f54718e CVE-2019-14870: mit-kdc: enforce delegation_not_allowed flag via 3ec39df607f CVE-2019-14870: heimdal: enforce delegation_not_allowed in S4U2Self via 534fd4b6ec3 CVE-2019-14870: heimdal: add S4U test for delegation_not_allowed via c706fb4430d samba-tool: add user-sensitive command to set not-delegated flag via d38677abd92 s4-torture: Reduce flapping in SambaToolDrsTests.test_samba_tool_replicate_local via 329b78ed92c CVE-2019-14861: Test to demonstrate the bug via 181feb7a6be CVE-2019-14861: s4-rpc/dnsserver: Avoid crash in ldb_qsort() via dcesrv_DnssrvEnumRecords) via 1cc564ada17 CVE-2019-14861: s4-rpc_server: Remove special case for @ in dns_build_tree() via a67944da822 CVE-2019-14861: s4-rpc/dnsserver: Confirm sort behaviour in dcesrv_DnssrvEnumRecords via 97f0deb4e38 VERSION: Re-enable GIT_SNAPSHOT. via 9378520acaa VERSION: Bump version up to 4.10.11. from e6f6df7658d VERSION: Disable GIT_SNAPSHOT for the 4.10.10 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - commit d644dfea6f2a55b2c205a4f268372b72a06757d1 Author: Karolin Seeger Date: Tue Dec 3 12:54:00 2019 +0100 VERSION: Disable GIT_SNAPSHOT for the 4.10.11 release. o CVE-2019-14861: Samba AD DC zone-named record Denial of Service in DNS management server (dnsserver). o CVE-2019-14870: DelegationNotAllowed not being enforced in protocol transition on Samba AD DC. Signed-off-by: Karolin Seeger commit aa4577474f16614edf6436bc54d487bece478309 Author: Karolin Seeger Date: Tue Dec 3 12:52:58 2019 +0100 WHATSNEW: Add release notes for Samba 4.10.11. o CVE-2019-14861: Samba AD DC zone-named record Denial of Service in DNS management server (dnsserver). o CVE-2019-14870: DelegationNotAllowed not being enforced in protocol transition on Samba AD DC. Signed-off-by: Karolin Seeger commit 8330f54718ef2ba464d01c4eaf029d10fde0f977 Author: Isaac Boukris Date: Thu Nov 21 11:12:48 2019 +0100 CVE-2019-14870: mit-kdc: enforce delegation_not_allowed flag Signed-off-by: Isaac Boukris commit 3ec39df607f66c2fdfec507d86da1bb41dd5fbab Author: Isaac Boukris Date: Mon Oct 28 02:54:09 2019 +0200 CVE-2019-14870: heimdal: enforce delegation_not_allowed in S4U2Self Signed-off-by: Isaac Boukris commit 534fd4b6ec31bfd0b12254cdd754a9a772876b6c Author: Isaac Boukris Date: Wed Oct 30 15:59:16 2019 +0100 CVE-2019-14870: heimdal: add S4U test for delegation_not_allowed Signed-off-by: Isaac Boukris commit c706fb4430d2ffa9e5e15885f7466f306be601b3 Author: Isaac Boukris Date: Sun Oct 27 14:02:00 2019 +0200 samba-tool: add user-sensitive command to set not-delegated flag Signed-off-by: Isaac Boukris commit d38677abd9285d571ecacce9f53dfc543836524c Author: Andrew Bartlett Date: Fri Nov 1 06:53:56 2019 +1300 s4-torture: Reduce flapping in SambaToolDrsTests.test_samba_tool_replicate_local This test often flaps in Samba 4.9 (where more tests and DCs run in the environment) with obj_1 being 3. This is quite OK, we just need to see some changes get replicated, not 0 changes. Signed-off-by: Andrew Bartlett Reviewed-by: Douglas Bagnall (cherry picked from commit 4ae0f9ce0f5ada99cf1d236377e5a1234c879ae3) commit 329b78ed92cc8d08ca2ca88653890a8a60aa1a7b Author: Andrew Bartlett Date: Wed Oct 30 11:50:57 2019 +1300 CVE-2019-14861: Test to demonstrate the bug This test does not fail every time, but when it does it casues a segfault which takes out the rpc_server master process, as this hosts the dnsserver pipe. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14138 Signed-off-by: Andrew Bartlett commit 181feb7a6beb061affe93e494eda33be951842d4 Author: Andrew Bartlett Date: Tue Oct 29 14:15:36 2019 +1300 CVE-2019-14861: s4-rpc/dnsserver: Avoid crash in ldb_qsort() via dcesrv_DnssrvEnumRecords) dns_name_compare() had logic to put @ and the top record in the tree being enumerated first, but if a domain had both then this would break the older qsort() implementation in ldb_qsort() and cause a read of memory before the base pointer. By removing this special case (not required as the base pointer is already seperatly located, no matter were it is in the returned records) the crash is avoided. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14138 Signed-off-by: Andrew Bartlett commit 1cc564ada17215f32d1b6163984b2c6cb8d5646b Author:
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via e6f6df7658d VERSION: Disable GIT_SNAPSHOT for the 4.10.10 release. via bd0462b3062 WHATSNEW: Add release notes for Samba 4.10.10. via 489ef124459 CVE-2019-14847 dsdb: Correct behaviour of ranged_results when combined with dirsync via 6957ec76a5a CVE-2019-14847 dsdb: Demonstrate the correct interaction of ranged_results style attributes and dirsync via da8f00d1be8 CVE-2019-14847 dsdb/modules/dirsync: ensure attrs exist (CID 1107212) via d58567ee733 CVE-2019-14833 dsdb: send full password to check password script via 9c8e722fea1 CVE-2019-14833: Use utf8 characters in the unacceptable password via 284c98515b9 CVE-2019-10218 - s3: libsmb: Protect SMB2 client code from evil server returned names. via 13bc9d73657 CVE-2019-10218 - s3: libsmb: Protect SMB1 client code from evil server returned names. via 844c353ca5d VERSION: Bump version up to 4.10.10... from a1cdfe58b70 VERSION: Disable GIT_SNAPSHOT for the 4.9.10 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - commit e6f6df7658d0f147a32af157cffaf11b69e59a2b Author: Karolin Seeger Date: Thu Oct 24 12:13:36 2019 +0200 VERSION: Disable GIT_SNAPSHOT for the 4.10.10 release. * Bug 14071: CVE-2019-10218: Client code can return filenames containing path separators. * Bug 12438: CVE-2019-14833: Samba AD DC check password script does not receive the full password. * Bug 14040: CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync. Signed-off-by: Karolin Seeger commit bd0462b306209580206b3ef74bf4cdc62ab2062f Author: Karolin Seeger Date: Thu Oct 24 12:11:30 2019 +0200 WHATSNEW: Add release notes for Samba 4.10.10. * Bug 14071: CVE-2019-10218: Client code can return filenames containing path separators. * Bug 12438: CVE-2019-14833: Samba AD DC check password script does not receive the full password. * Bug 14040: CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync. Signed-off-by: Karolin Seeger commit 489ef1244596625c8e6ae748c5e515f9806c4feb Author: Andrew Bartlett Date: Tue Oct 15 15:44:34 2019 +1300 CVE-2019-14847 dsdb: Correct behaviour of ranged_results when combined with dirsync BUG: https://bugzilla.samba.org/show_bug.cgi?id=14040 Signed-off-by: Andrew Bartlett commit 6957ec76a5a9bd31f487192752468f99146b3a61 Author: Andrew Bartlett Date: Tue Oct 15 16:28:46 2019 +1300 CVE-2019-14847 dsdb: Demonstrate the correct interaction of ranged_results style attributes and dirsync Incremental results are provided by a flag on the dirsync control, not by changing the attribute name. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14040 Signed-off-by: Andrew Bartlett commit da8f00d1be85002d0c8e05573035f65398b4a894 Author: Douglas Bagnall Date: Fri May 3 17:27:51 2019 +1200 CVE-2019-14847 dsdb/modules/dirsync: ensure attrs exist (CID 1107212) BUG: https://bugzilla.samba.org/show_bug.cgi?id=14040 Signed-off-by: Douglas Bagnall Reviewed-by: Gary Lockyer (cherry picked from commit 23f72c4d712f8d1fec3d67a66d477709d5b0abe2) commit d58567ee7338dcd9688e9a059ec6a32519625548 Author: Björn Baumbach Date: Tue Aug 6 16:32:32 2019 +0200 CVE-2019-14833 dsdb: send full password to check password script utf8_len represents the number of characters (not bytes) of the password. If the password includes multi-byte characters it is required to write the total number of bytes to the check password script. Otherwise the last bytes of the password string would be ignored. Therefore we rename utf8_len to be clear what it does and does not represent. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12438 Signed-off-by: Björn Baumbach Signed-off-by: Andrew Bartlett commit 9c8e722fea1611d31bce2d88cfef2e9588a653de Author: Andrew Bartlett Date: Thu Sep 19 11:50:01 2019 +1200 CVE-2019-14833: Use utf8 characters in the unacceptable password This shows that the "check password script" handling has a bug. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12438 Signed-off-by: Andrew Bartlett commit 284c98515b9963838792e8452d16294e86c899af Author: Jeremy Allison Date: Tue Aug 6 12:08:09 2019 -0700 CVE-2019-10218 - s3: libsmb: Protect SMB2 client code from evil server returned names. Disconnect with NT_STATUS_INVALID_NETWORK_RESPONSE if so. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14071 Signed-off-by: Jeremy Allison commit 13bc9d7365751f12eb2f752eefe95fb610c65f30 Author: Jeremy Allison Date: Mon Aug 5 13:39:53 2019 -0700 CVE-2019-10218 - s3:
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via a1cdfe58b70 VERSION: Disable GIT_SNAPSHOT for the 4.9.10 release. via d2908f256cc WHATSNEW: Add release notes for Samba 4.10.9. via 3ad42536f87 s3:libads: Do not turn on canonicalization flag for MIT Kerberos via d533a588b62 lib:krb5_wrap: Do not create a temporary file for MEMORY keytabs via 8939186345f spnego: fix server handling of no optimistic exchange via 68d91436d85 python/tests/gensec: add spnego downgrade python tests via 3a06edfe4fa python/tests/gensec: make it possible to add knownfail tests for gensec.update() via 5c411a2f9f5 selftest: add tests for no optimistic spnego exchange via a403e4d63e0 spnego: add client option to omit sending an optimistic token via 9d2d4cf9c93 selftest: s3: add a test for spnego downgrade from krb5 to ntlm via 24a43d7c742 s3:libsmb: Do not check the SPNEGO neg token for KRB5 via f340056428a spnego: ignore server mech_types list via de0841138e6 testprogs: Add test for 'net ads join createcomputer=' via f65a755bdd1 s3:libads: Just change the machine password if account already exists via 9d984cebde3 s3:libnet: Improve debug messages via 1e384434960 s3:libads: Fix creating machine account using LDAP via ac8c51fbb56 s3:libads: Don't set supported encryption types during account creation via f5216b70c37 s3:libads: Fix detection if acount already exists in ads_find_machine_count() via 60c5d1d3de6 s3:libads: Use a talloc_asprintf in ads_find_machine_acct() via ddd4a6af621 s3:libads: Cleanup error code paths in ads_create_machine_acct() via 39959813881 s3:libnet: Require sealed LDAP SASL connections for joining via 377483859c0 s3:libads: Use ldap_add_ext_s() in ads_gen_add() via c68763bff35 testprogs: Fix failure count in test_net_ads.sh via eafb3a20b9d s3: smbclient: Stop an SMB2-connection from blundering into SMB1-specific calls. via 59c3bd1b15d ctdb-vacuum: Process all records not deleted on a remote node via fc89f8f54ba s3:libsmb: Link libsmb against pthread via 0fe766a4f62 nsswitch: Link stress-nss-libwbclient against pthread via 308c2c9cd48 waf:replace: Do not link against libpthread if not necessary via cade53a1558 third_party: Link uid_wrapper against pthread via e405ed01b02 third_party: Link nss_wrapper against pthread via 171ff620cd0 third_party: Only link cmocka against librt if really needed via 93ab3efe769 pthreadpool: Only link pthreadpool against librt if we have to via a1309d360b9 replace: Only link against librt if really needed via b0362fd07f8 s3:waf: Do not check for nanosleep() as we don't use it anywhere via 1ad8c6f4b08 winbind: provide passwd struct for group sid with ID_TYPE_BOTH mapping (again) via 8a2ca386dfb selftest: Test ID_TYPE_BOTH with idmap_rid module via d689042dffe s3-winbindd: fix forest trusts with additional trust attributes. via f19881f6198 fault.c: improve fault_report message text pointing to our wiki via 56379945161 selftest/Samba3.pm: use "winbind use krb5 enterprise principals = yes" for ad_member via abd2d22cdda selftest/Samba3.pm: use "winbind scan trusted domains = no" for ad_member via fd097f0b3bb selftest/tests.py: test pam_winbind with a lot of username variations via fe13bfcdfdc selftest/tests.py: test pam_winbind with krb5_auth via 9bb73edc69c selftest/tests.py: prepare looping over pam_winbindd tests via 8118fc89262 test_pam_winbind.sh: allow different pam_winbindd config options to be specified via 6bc0549bfde tests/pam_winbind.py: allow upn names to be used in USERNAME with an empty DOMAIN value via f2283616011 tests/pam_winbind.py: turn pypamtest.PamTestError into a failure via 956618ac6da s3:winbindd: implement the "winbind use krb5 enterprise principals" logic via 4760bbaae22 docs-xml: add "winbind use krb5 enterprise principals" option via aa1e8e53551 krb5_wrap: let smb_krb5_parse_name() accept enterprise principals via d7f0baf2f54 s3:libads: ads_krb5_chg_password() should always use the canonicalized principal via 73608fced20 s4:auth: kinit_to_ccache() should always use the canonicalized principal via be9ea381530 krb5_wrap: smb_krb5_kinit_password_ccache() should always use the canonicalized principal via 03477632b62 s3:libads/kerberos: always use the canonicalized principal after kinit via aeaffacb9c8 s3:libsmb: let cli_session_creds_prepare_krb5() update the canonicalized principal to cli_credentials via 45a078db792 s3:libsmb: avoid wrong debug message in cli_session_creds_prepare_krb5() via e620cad350e s3:libads: let kerberos_kinit_password_ext() return the canonicalized principal/realm
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated
via 2d587a11d5f VERSION: Disable GIT_SNAPSHOT for the 4.10.8 release.
via 3761e4787f0 WHATSNEW: Add release notes for Samba 4.10.8.
via 661a7cdb0ab CVE-2019-10197: smbd: split
change_to_user_impersonate() out of change_to_user_internal()
via 962d4a98b50 CVE-2019-10197: test_smbclient_s3.sh: add regression
test for the no permission on share root problem
via d1d48f20a25 CVE-2019-10197: selftest: make fsrvp_share its own
independent subdirectory
via 0af5d11c762 CVE-2019-10197: smbd: make sure we reset
current_user.{need,done}_chdir in become_root()
via fd0d3986bba CVE-2019-10197: smbd: make sure that
change_to_user_internal() always resets current_user.done_chdir
via cf67b48f779 CVE-2019-10197: smbd: separate out impersonation debug
info into a new function.
via 523f9f15b02 VERSION: Bump version up to 4.10.8...
from c0f6317dade VERSION: Disable GIT_SNAPSHOT for the 4.10.7 release.
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable
- Log -
commit 2d587a11d5f48a012d06df3c614283013ccf728c
Author: Karolin Seeger
Date: Tue Aug 27 13:16:44 2019 +0200
VERSION: Disable GIT_SNAPSHOT for the 4.10.8 release.
Signed-off-by: Karolin Seeger
commit 3761e4787f0f174252d7316adc23e7e17723bd1c
Author: Karolin Seeger
Date: Tue Aug 27 13:13:48 2019 +0200
WHATSNEW: Add release notes for Samba 4.10.8.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035
CVE-2019-10197 [SECURITY][EMBARGOED] permissions check deny can allow user
to
escape from the share.
Signed-off-by: Karolin Seeger
commit 661a7cdb0aba2c94332ff7b997023ad040aa4f7c
Author: Stefan Metzmacher
Date: Thu Jul 11 17:02:15 2019 +0200
CVE-2019-10197: smbd: split change_to_user_impersonate() out of
change_to_user_internal()
This makes sure we always call chdir_current_service() even
when we still impersonated the user. Which is important
in order to run the SMB* request within the correct working directory
and only if the user has permissions to enter that directory.
It makes sure we always update conn->lastused_count
in chdir_current_service() for each request.
Note that vfs_ChDir() (called from chdir_current_service())
maintains its own cache and avoids calling SMB_VFS_CHDIR()
if possible.
It means we still avoid syscalls if we get a multiple requests
for the same session/tcon tuple.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035
Signed-off-by: Stefan Metzmacher
Reviewed-by: Ralph Boehme
commit 962d4a98b50a3ce1d58ebc516e8de9335a14dfdb
Author: Stefan Metzmacher
Date: Tue Jul 16 15:40:38 2019 +0200
CVE-2019-10197: test_smbclient_s3.sh: add regression test for the no
permission on share root problem
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035
Signed-off-by: Stefan Metzmacher
commit d1d48f20a25867e65f064f2c157222cdcb74658b
Author: Stefan Metzmacher
Date: Tue Jul 30 17:16:59 2019 +0200
CVE-2019-10197: selftest: make fsrvp_share its own independent subdirectory
The next patch will otherwise break the fsrvp related tests.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035
Signed-off-by: Stefan Metzmacher
commit 0af5d11c762ee623f4c656897ed196722ed8d626
Author: Stefan Metzmacher
Date: Tue Jun 18 14:04:08 2019 +0200
CVE-2019-10197: smbd: make sure we reset current_user.{need,done}_chdir in
become_root()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035
Signed-off-by: Stefan Metzmacher
commit fd0d3986bba5ce9fee3df5dbba26a593e1274680
Author: Stefan Metzmacher
Date: Thu Jul 11 17:01:29 2019 +0200
CVE-2019-10197: smbd: make sure that change_to_user_internal() always
resets current_user.done_chdir
We should not leave current_user.done_chdir as true if we didn't call
chdir_current_service() with success.
This caused problems in when calling vfs_ChDir() in pop_conn_ctx() when
chdir_current_service() worked once on one share but later failed on another
share.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035
Signed-off-by: Stefan Metzmacher
Reviewed-by: Ralph Boehme
commit cf67b48f779807ccebde6f7c86f4330063f705eb
Author: Jeremy Allison
Date: Fri Jul 12 12:10:35 2019 -0700
CVE-2019-10197: smbd: separate out impersonation debug info into a new
function.
Will be called on elsewhere on successful impersonation.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035
Signed-off-by: Jeremy Allison
Reviewed-by: Ralph Boehme
Reviewed-by: Stefan Metzmacher
commit 523f9f15b020e944cd7929b8afc4d02158668137
Author: Karolin Seeger
Date: Tue Aug 20 11:09:43 2019 +0200
VERSION: Bump version up to 4.10.8...
and
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated
via c0f6317dade VERSION: Disable GIT_SNAPSHOT for the 4.10.7 release.
via db1d9ca55b6 WHATSNEW: Add release notes for Samba 4.10.7.
via aabd5558bcf smbtorture: extend rpc.lsa to lookup machine over
forest-wide LookupNames
via 692e9e1f411 lookup_name: allow own domain lookup when flags == 0
via a89157e5535 torture/rpc/lsa: allow testing different lookup levels
via bf28f9d7bef tests/drs_no_dns: Check dbcheck and ldapcmp pass
via bf70fc09852 tests: Add samba_upgradedns to the list of possible cmds
via 1d2c7ee7061 netcmd: Allow drs replicate --local to create partitions
via 9dac4d85ad0 join: Use a specific attribute order for the DsAddEntry
nTDSDSA object
via f839423bdab ctdb-config: depend on /etc/ctdb/nodes file
via b0ebe62fe51 vfs_catia: pass stat info to synthetic_smb_fname()
via 376bed3a0e6 samba-tool: add 'import samba.drs_utils' to fsmo.py
via 7788b9f3039 samba-tool: use only one LDAP modify for dns partition
fsmo role transfer
via 4d7ce477eb0 s4:torture:fsmo.py: remove unused 'net_cmd' variable
via cfce211fff1 samba-tool: fix replication after dns partition fsmo
role transfer
via 65c4f412509 s4:torture:fsmo.py: test role transfers of dns
partitions
via b2849a889f3 dnsp.idl: fix payload for
DSPROPERTY_ZONE_DELETED_FROM_HOSTNAME
via d2087e4b480 dnsp.idl: fix the dnsp_dns_addr_array definition
via e7dfe3f7f77 dnsp.idl: fix dnsp_ip4_array definition
via 7dbde4521fe s4:torture: add local.ndr.dnsp tests
via bbe41dc7806 dbcheck: fallback to the default tombstoneLifetime of
180 days
via c51d810ee99 third_party: Update waf to version 2.0.17
via 1dcb5dc3844 lib/util: set current_msg_{level,class} also during a
DEBUGADD[C]() call
via 823d57094b9 lib/util: remove unused prototypes in debug.h
via fdec94ba7c4 lib/util: fix call to dbghdrclass() for DEBUGC()
via b56e010af12 s4/libnet: Fix joining a Windows pre-2008R2 DC
via 4743188456f vfs:glusterfs_fuse: treat ENOATTR as ENOENT
via 01a7df07fc9 vfs:glusterfs: treat ENOATTR as ENOENT
via 27bd08f36bd dsdb: Handle DB corner-case where PSO container doesn't
exist
via 1f0870a7b28 s3:rpc_server:netlogon: simplify AUTH_TYPE_SCHANNEL
check in netr_creds_server_step_check()
via b7f586ca6c9 s3:rpc_server:netlogon: don't require
NEG_AUTHENTICATED_RPC in netr_ServerAuthenticate*()
via e9c23a02470 s4:rpc_server:netlogon: don't require
NEG_AUTHENTICATED_RPC in netr_ServerAuthenticate*()
via 58760fe8b72 s4 librpc rpc pyrpc: Fix flapping dcerpc.bare tests
via 4f70d4d76a0 s4 librpc rpc pyrpc: Ensure tevent_context deleted last
via 4179bdb6f2a s4/pyrpc_util: appropriately decrement refcounts on
failure
via 8128ceceb87 build: Allow build when --disable-gnutls is set
via 372ee382939 VERSION: Bump version up to 4.10.7...
from 9c67187029b VERSION: Disable GIT_SNAPSHOT for the 4.10.6 release.
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable
- Log -
---
Summary of changes:
VERSION| 2 +-
WHATSNEW.txt | 85 -
buildtools/bin/waf | 2 +-
buildtools/wafsamba/wafsamba.py| 2 +-
ctdb/config/ctdb.service | 1 +
lib/mscat/wscript | 6 +-
lib/util/debug.c | 17 +-
lib/util/debug.h | 11 +-
librpc/idl/dnsp.idl| 9 +-
python/samba/dbchecker.py | 5 +-
python/samba/join.py | 23 +-
python/samba/netcmd/drs.py | 4 +-
python/samba/netcmd/fsmo.py| 27 +-
python/samba/tests/__init__.py | 1 +
source3/modules/vfs_catia.c| 42 +--
source3/modules/vfs_glusterfs.c| 2 +-
source3/modules/vfs_glusterfs_fuse.c | 2 +-
source3/passdb/lookup_sid.c| 2 +-
source3/rpc_server/netlogon/srv_netlog_nt.c| 52 +--
source4/dns_server/dnsserver_common.c | 2 +-
source4/dsdb/samdb/ldb_modules/operational.c | 12 +
source4/libnet/libnet_vampire.c| 9 +
source4/librpc/rpc/pyrpc.c | 15 +
source4/librpc/rpc/pyrpc.h | 1 +
source4/librpc/rpc/pyrpc_util.c| 70 ++--
source4/rpc_server/netlogon/dcerpc_netlogon.c | 15 -
.../tests/rpc_dns_server_dnsutils_test.c | 44 +--
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via 9c67187029b VERSION: Disable GIT_SNAPSHOT for the 4.10.6 release. via 9f1a6fe7f27 WHATSNEW: Add release notes for Samba 4.10.6. via 8052d52b26f ldb: Release ldb 1.5.5 via f8d504acb4c python/ntacls: use correct "state directory" smb.conf option instead of "state dir" via 662d66dcd3c selftest: add test for samba-tool ntacl get/set --use-ntvfs --xattr-backend=tdb via 1970eadd123 docs: Document DCEPRC binding string for rpcclient via 9218655399f s3:client: Link smbspool_krb5_wrapper against krb5samba via 48c47f5dbbb wafsamba: Use native waf timer via d106f5eb971 s3:mdssvc: fix flex compilation error via 7c80167e2af ctdb-scripts: Fix tcp_tw_recycle existence check via 4f32284840d docs: Improve documentation of "lanman auth" and "ntlm auth" connection via 47a96935df0 vfs_fruit: remove a now unnecessary include via bdc257a1cba vfs_fruit: use VFS functions in ad_read_rsrc_adouble() via 2d6a2080afb vfs_fruit: use fsp and remove syscalls from ad_convert_blank_rfork() via 91ed0f8beb9 vfs_fruit: use VFS function in ad_convert_truncate() via 28cdc4421c2 vfs_fruit: add VFS handle to ad_convert_truncate() via fef47b90e54 vfs_fruit: use fsp and remove mmap in ad_convert_xattr() via 7fc300d4655 vfs_fruit: remove use of mmap() from ad_convert_move_reso() via d49df05e619 vfs_fruit: convert ad_open_rsrc() to open a proper fsp with SMB_VFS_CREATE_FILE() via f5d1561c5b1 vfs_fruit: only do cross protocol locking on non-internal opens via 9ebfd4f2e51 vfs_fruit: remove a layer of indirection via f890c4fb86c vfs_fruit: pass VFS handle to ad_convert_move_reso() via 8f49fbfdebb vfs_fruit: remove xattr code from the AppleDouble subsystem via 7bd5ceea7d2 vfs_fruit: remove now unused AppleDouble code for resource fork in xattr via cc1ff660b80 vfs_fruit: use stream code for resource fork size calculation in readdir_attr_rfork_size() via d1164d9f374 vfs_fruit: use correct case FRUIT_RSRC_STREAM in readdir_attr_rfork_size() via 8ceb0486446 vfs_fruit: ignore AppleDouble files in fruit_unlink() via 30f25ed6214 vfs_fruit: add a missing else via 8787ac7938c vfs_fruit: add and use is_adouble_file() via 2b8eeb231e0 vfs_fruit: finally, remove ad_handle from struct adouble via ef0522b3434 vfs_fruit: pass handle to ad_convert_delete_adfile() via f2b796844b1 vfs_fruit: pass handle to ad_convert_finderinfo() via 3ff1b960c5e vfs_fruit: pass handle to ad_convert_blank_rfork() via 4e22296dc6c vfs_fruit: pass handle to ad_convert_xattr() via 47e08c03ed8 vfs_fruit: indentation fix via 03d1328e33b vfs_fruit: pass handle to ad_read_rsrc() and all the way down via 9b4ad2a32a6 vfs_fruit: use proper VFS function in ad_read_meta() via fd63fda7769 vfs_fruit: indentation fix via 7a99bba9294 vfs_fruit: pass handle to ad_read_meta() via 25ee7f97c6c vfs_fruit: pass handle to ad_read() via ab9a428f335 vfs_fruit: pass handle to ad_set() via 92bc9e3e11c vfs_fruit: pass handle to ad_fset() via 730c24902d5 s3:auth: explicitly add BUILTIN\Guests to the guest token via b312ceb5730 tests: add a test for guest authentication via d8e33defa5a selftest: allow guest login in the ad_member_idmap_rid env via 90a538f4689 s3:smbd: call reinit_guest_session_info() in the conf updated handler via 7f6b171c3e9 s3:auth: add reinit_guest_session_info() via 813856c1c4e dsdb:audit_log: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..." via 49acbea1378 ldb_kv: Skip @ records early in a search full scan via d9fed540c36 samba-tool domain provision: Fix --interactive module in python3 via 8867c178a9b ldap server: generate correct referral schemes via 207295b9523 ldap tests: test scheme for referrals via fa1de54cd92 s3/vfs_glusterfs_fuse: Avoid using NAME_MAX directly via 778448469bb s3/vfs_glusterfs: Avoid using NAME_MAX directly via bb688404227 Revert "s3/vfs_glusterfs_fuse: Dynamically determine NAME_MAX" via f830628c3aa Revert "s3/vfs_glusterfs: Dynamically determine NAME_MAX" via 70e8344a043 VERSION: Bump version up to 4.10.6... via 734d72bdc96 Merge tag 'samba-4.10.5' into v4-10-test via 881793d52d9 vfs_fruit: change trigger points of AppleDouble conversion via 436356f8d00 vfs_fruit: add a forward declaration for ad_get() via 886ab13095e selftest: run vfs.fruit test against a share that deletes empty resource forks via 0dfaa70427e s4:torture/vfs/fruit: ensure test_adouble_conversion_wo_xattr() uses a non-emtpy resourcefork via 6dcec5e2536 s4:torture/vfs/fruit: ensure test_adouble_conversion() uses a non-emtpy
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via 0953917629b VERSION: Disable GIT_SNAPSHOT for the 4.10.5 release. via bfa9f92e611 WHATSNEW: Add release notes for Samba 4.10.5. via c48920093da CVE-2019-12436 dsdb/paged_results: ignore successful results without messages via d32b96aeff0 CVE-2019-12435 rpc/dns: avoid NULL deference if zone not found in DnssrvOperation2 via 0b9da247534 CVE-2019-12435 rpc/dns: avoid NULL deference if zone not found in DnssrvOperation via 090e8700af3 VERSION: Bump version up to 4.10.5... from 8e479542e28 VERSION: Disable GIT_SNAPSHOT for the 4.10.4 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - commit 0953917629bb2e21a41013f50def0c9402d5399a Author: Karolin Seeger Date: Thu Jun 13 11:48:53 2019 +0200 VERSION: Disable GIT_SNAPSHOT for the 4.10.5 release. CVE-2019-12436 dsdb/paged_results: ignore successful results without messages BUG: https://bugzilla.samba.org/show_bug.cgi?id=13951 CVE-2019-12435 rpc/dns: avoid NULL deference if zone not found in DnssrvOperation2 BUG: https://bugzilla.samba.org/show_bug.cgi?id=13922 Signed-off-by: Karolin Seeger commit bfa9f92e611e3b634c505b9c4a2c7aef128afb64 Author: Karolin Seeger Date: Thu Jun 13 11:47:07 2019 +0200 WHATSNEW: Add release notes for Samba 4.10.5. CVE-2019-12436 dsdb/paged_results: ignore successful results without messages BUG: https://bugzilla.samba.org/show_bug.cgi?id=13951 CVE-2019-12435 rpc/dns: avoid NULL deference if zone not found in DnssrvOperation2 BUG: https://bugzilla.samba.org/show_bug.cgi?id=13922 Signed-off-by: Karolin Seeger commit c48920093da7f5f6cbbca42d516b86b9cf51eea6 Author: Douglas Bagnall Date: Fri May 17 14:42:24 2019 +1200 CVE-2019-12436 dsdb/paged_results: ignore successful results without messages So that we don't dereference result->msgs[0] when it doesn't exist. This can happen when the object has changed in such a way that it no longer matches the original search query. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13951 Signed-off-by: Douglas Bagnall Reviewed-by: Andrew Bartlett commit d32b96aeff0022c7a9052f15adbc7cd36643ca22 Author: Douglas Bagnall Date: Wed May 22 13:23:25 2019 +1200 CVE-2019-12435 rpc/dns: avoid NULL deference if zone not found in DnssrvOperation2 We still want to return DOES_NOT_EXIST when request_filter is not 0. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13922 Signed-off-by: Douglas Bagnall Reviewed-by: Andrew Bartlett commit 0b9da247534f735fa96141e9285fd22e0f2bb442 Author: Douglas Bagnall Date: Wed May 22 12:58:01 2019 +1200 CVE-2019-12435 rpc/dns: avoid NULL deference if zone not found in DnssrvOperation We still want to return DOES_NOT_EXIST when request_filter is not 0. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13922 Signed-off-by: Douglas Bagnall Reviewed-by: Andrew Bartlett commit 090e8700af31c0b9fd273e91a0deb8d1efd3ef24 Author: Karolin Seeger Date: Wed May 22 11:50:17 2019 +0200 VERSION: Bump version up to 4.10.5... and re-enable GIT_SNAPSHOT. Signed-off-by: Karolin Seeger (cherry picked from commit 827b5423c0fe6ad472226b6d172e0460d074135a) --- Summary of changes: VERSION | 2 +- WHATSNEW.txt| 64 - python/samba/tests/dcerpc/dnsserver.py | 51 source4/dsdb/samdb/ldb_modules/paged_results.c | 3 +- source4/dsdb/tests/python/vlv.py| 50 ++- source4/rpc_server/dnsserver/dcerpc_dnsserver.c | 14 +- 6 files changed, 177 insertions(+), 7 deletions(-) Changeset truncated at 500 lines: diff --git a/VERSION b/VERSION index cddf98545d9..73c35f8f66c 100644 --- a/VERSION +++ b/VERSION @@ -25,7 +25,7 @@ SAMBA_VERSION_MAJOR=4 SAMBA_VERSION_MINOR=10 -SAMBA_VERSION_RELEASE=4 +SAMBA_VERSION_RELEASE=5 # If a official release has a serious bug # diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 21aef0c4960..8339bbf958a 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,3 +1,63 @@ + == + Release Notes for Samba 4.10.5 + June 19, 2019 + == + + +This is a security release in order to address the following defects: + +o CVE-2019-12435 (Samba AD DC Denial of Service in DNS management server + (dnsserver)) +o CVE-2019-12436 (Samba AD DC LDAP server
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via 8e479542e28 VERSION: Disable GIT_SNAPSHOT for the 4.10.4 release. via def2c7dabc9 Merge 'origin/v4-10-stable' into the real 4.10.4 release via fa9de54681b WHATSNEW: Add release notes for Samba 4.10.4. via d6243acb3ac ctdb-common: Fix memory leak in run_proc via 0d4280abf98 ctdb-common: Fix memory leak via 32065a0772e ctdb-recoverd: Fix memory leak via 417a4d2c3cc vfs_ceph: fix cephwrap_flistxattr() debug message via 4c02823ab51 s3:smbspool: Fix regression printing with Kerberos credentials via 5c9489ba557 s3: SMB1: Don't allow recvfile on stream fsp's. via 198cb5b0550 s3:smbd: don't use recvfile on streams via f7ffa7a007f s3:utils: If share is NULL in smbcacls, don't print it via b0e862a64a7 s3:utils: If share is NULL in smbcquotas, don't print it via 601cb1d5726 s3:winbindd: Do not free db_path in idmap_tdb2 before we printed it via 5b6adbb0f05 ctdb:common: Do not print NULL if we don't get a sockpath via b578a2df99f s4:torture: Do not free full_name before we printed it via 4113054a7ce lib:torture: Fix string comparison macros where we directly pass NULL via a81f78ce4e4 s4:torture: Do not print NULL strings we just checked before via b522ed38de1 s4:ntvfs: Do not free eadb before we printed an error via 405872948fa s3:rpc_server: Do not free the tdbname before we printed it via 4f0a4fac3de s4:auth: Fix debug statement in gensec_gssapi via 8542379bde8 s3 rpc_client: Fix Asan stack use after scope via 8a320aad332 ctdb-daemon: Never use 0 as a client ID via 6aa0fd8b7cd s4 lib socket: Ensure address string owned by parent struct via 385a36b7e7c nsswitch pam_winbind: Fix Asan use after free via 52ba5136f2f ctdb-tests: Fix logic error in simple ctdb reloadips test via 63a59de4f0f ctdb-tests: Make ctdb reloadips tests more reliable via efb35a1a695 ctdb-tests: Capture output in $out on failure as well via 65bf14afd83 ctdb-tests: Remove old socket wrapper state directory during setup via 33739d55569 ctdb-tests: Actually restart if cluster doesn't become healthy via 0cdf5c6b5ce ctdb-tests: Don't clean up test var directory in autotest target via 3582e306606 ctdb-tests: Fix usage message via b8cf1594a73 ctdb-tests: Wait to allow database attach/detach to take effect via 221da170256 ctdb-tests: Avoid bulk output in $out, prefer $outfile via 2044466dd3e ctdb-tests: Make try_command_on_node less error-prone via 8bb1726f6a7 ctdb-tests: Change sanity_check_output() to internally use $out via c054f19fb37 ctdb-tests: Extend test to cover ctdb rddumpmemory via 8c9abb2749f ctdb-tools: Fix ctdb dumpmemory to avoid printing trailing NUL via 42b32da4160 smbd: implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling via 5308f042e67 s4:torture/smb2: add smb2.getinfo.normalized test via 3205d032781 s4:libcli/raw: add RAW_FILEINFO_NORMALIZED_NAME_INFORMATION support via 07382f0765a smbd: allow case insensitive opens of named streams via 649dd7bce86 s4:torture/smb2: add smb2.stream.names3 test via f4a603a9f32 s3: modules: ceph: use current working directory instead of share path via de505618e60 s3:debug: enable logging for early startup failures via c584a4b4dfb s3:debug: adjust indention via c7f25b25d3a s3:debug: use struct initializer via 1fa6a46fa53 winbind: Fix overlapping id ranges via 24d39db5c37 selftest: Add trusted domain tests for idmap_ad via 3a46730f12e selftest: Pass trusted domain information to idmap_ad test via c3c2f3707a0 selftest: Add idmap configuration for trusted domain for idmap_ad via 79c04524c38 selftest: Make trusted domain information available for idmap_ad environment via 28b5ff2ccf7 selftest: Use fl2008r2dc for ad_member_idmap_ad via 38746ec0a3e selftest: Add gid-to-sid lookup to idmap_ad test via 9c167fa8628 lib util debug: Increase format buffer to 4KiB via 2cc3b4c42c5 lib: Initialize getline() arguments via d1962a5f527 pytests/dns: use 2.6 compatible syntax via 893ac2a6b20 netcmd: Fix passwordsettings --max-pwd-age command via afc2243b478 netcmd: Add some timestamp conversion helper functions via 36da4c095de netcmd: Use python constant for -0x8000 via 1efa1e01194 tests: Add test for setting min/maxPwdAge via ea74b0eb2ef dbcheck: fix the err_empty_attribute() check via b01e1e3376b winbind: Use domain name from lsa query for sid_to_name cache entry via 9034980420d winbind: Return queried domain name from name_to_sid via b519cd2156d winbind: Query domain from winbind sam_name_to_sid via af48878005a winbind: Query
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via 8eb462bf914 Merge tag 'samba-4.10.3' into v4-10-stable via 70a164b3214 VERSION: Disable GIT_SNAPSHOT for the 4.10.3 release. from 6c23ad16f02 VERSION: Disable GIT_SNAPSHOT for the 4.10.3 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - commit 8eb462bf914f9b8f9427ececbfc15ae8ae4e5b72 Merge: 6c23ad16f02 70a164b3214 Author: Karolin Seeger Date: Wed May 22 12:05:26 2019 +0200 Merge tag 'samba-4.10.3' into v4-10-stable samba: tag release samba-4.10.3 Signed-off-by: Karolin Seeger Signed-off-by: Stefan Metzmacher --- Summary of changes: Changeset truncated at 500 lines: -- Samba Shared Repository
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via 6c23ad16f02 VERSION: Disable GIT_SNAPSHOT for the 4.10.3 release. via 20ce967a45a WHATSNEW: Add release notes for Samba 4.10.3. via 12086db2101 CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum via 6ad19ca4687 CVE-2018-16860 selftest: Add test for S4U2Self with unkeyed checksum via 6a7e06239fb VERSION: Re-enable GIT_SNAPSHOT. via 770352cd077 VERSION: Bump version up to 4.10.3. from 17cd92e1c36 VERSION: Disable GIT_SNAPSHOT for 4.10.2 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - commit 6c23ad16f02497d086f42dccd75c6fcc5dad Author: Karolin Seeger Date: Tue May 7 11:06:14 2019 +0200 VERSION: Disable GIT_SNAPSHOT for the 4.10.3 release. CVE-2018-16860 (Samba AD DC S4U2Self/S4U2Proxy unkeyed checksum) Signed-off-by: Karolin Seeger commit 20ce967a45a140475b36c90b8c24ba51374e57d2 Author: Karolin Seeger Date: Tue May 7 10:46:21 2019 +0200 WHATSNEW: Add release notes for Samba 4.10.3. CVE-2018-16860 (Samba AD DC S4U2Self/S4U2Proxy unkeyed checksum) Signed-off-by: Karolin Seeger commit 12086db2101beb44db41da0a811a6be8544b546e Author: Isaac Boukris Date: Wed Jan 30 23:49:07 2019 +0200 CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum BUG: https://bugzilla.samba.org/show_bug.cgi?id=13685 Signed-off-by: Isaac Boukris Reviewed-by: Andrew Bartlett Signed-off-by: Andrew Bartlett commit 6ad19ca46879f166e896562b88244e2ffd17e1ed Author: Isaac Boukris Date: Thu Apr 25 22:12:10 2019 +1200 CVE-2018-16860 selftest: Add test for S4U2Self with unkeyed checksum BUG: https://bugzilla.samba.org/show_bug.cgi?id=13685 Signed-off-by: Isaac Boukris Signed-off-by: Andrew Bartlett commit 6a7e06239fb725f77877ed6e3435ef101a162148 Author: Karolin Seeger Date: Tue May 7 11:02:17 2019 +0200 VERSION: Re-enable GIT_SNAPSHOT. Signed-off-by: Karolin Seeger commit 770352cd07776fcfc49511b0b393c2e6371724e9 Author: Karolin Seeger Date: Mon Apr 8 12:30:35 2019 +0200 VERSION: Bump version up to 4.10.3. Signed-off-by: Karolin Seeger (cherry picked from commit cf323d769f0f75a8201b21e5563fc5481beb614e) --- Summary of changes: VERSION | 2 +- WHATSNEW.txt | 58 - source4/heimdal/kdc/krb5tgs.c| 7 +++ source4/torture/krb5/kdc-canon-heimdal.c | 105 +-- 4 files changed, 165 insertions(+), 7 deletions(-) Changeset truncated at 500 lines: diff --git a/VERSION b/VERSION index db76ce216a7..2b49166b9c6 100644 --- a/VERSION +++ b/VERSION @@ -25,7 +25,7 @@ SAMBA_VERSION_MAJOR=4 SAMBA_VERSION_MINOR=10 -SAMBA_VERSION_RELEASE=2 +SAMBA_VERSION_RELEASE=3 # If a official release has a serious bug # diff --git a/WHATSNEW.txt b/WHATSNEW.txt index f88d3e99b3c..8472caa032c 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,3 +1,57 @@ + == + Release Notes for Samba 4.10.3 +May 14, 2019 + == + + +This is a security release in order to address the following defect: + +o CVE-2018-16860 (Samba AD DC S4U2Self/S4U2Proxy unkeyed checksum) + + +=== +Details +=== + +o CVE-2018-16860: + The checksum validation in the S4U2Self handler in the embedded Heimdal KDC + did not first confirm that the checksum was keyed, allowing replacement of + the requested target (client) principal. + +For more details and workarounds, please refer to the security advisory. + + +Changes since 4.10.2: +- + +o Isaac Boukris + * BUG 13685: CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed + checksum. + + +### +Reporting bugs & Development Discussion +### + +Please discuss this release on the samba-technical mailing list or by +joining the #samba-technical IRC channel on irc.freenode.net. + +If you do report problems then please try to send high quality +feedback. If you don't provide vital information to help us track down +the problem then you will probably be ignored. All bug reports should +be filed under the "Samba 4.1 and newer" product in the project's Bugzilla +database (https://bugzilla.samba.org/). + + +== +== Our Code, Our Bugs, Our Responsibility. +== The Samba Team +== + +
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via 17cd92e1c36 VERSION: Disable GIT_SNAPSHOT for 4.10.2 release. via 619d39538fa WHATSNEW: Add release notes for Samba 4.10.2. via 67c837789f3 CVE-2019-3880 s3: rpc: winreg: Remove implementations of SaveKey/RestoreKey. via 8e0a6867c4e CVE-2019-3870 pysmbd: Ensure a zero umask is set for smbd.mkdir() via 9a4029b5d3b CVE-2019-3870 pysmbd: Move umask manipuations as close as possible to users via ebb9b7fa9ea CVE-2019-3870 pysmbd: Include tests to show the outside umask has no impact via 0b712415db6 CVE-2019-3870 tests: Add test to check file-permissions are correct after provision via c25ee5bd463 CVE-2019-3870 tests: Extend smbd tests to check for umask being overwritten via 16fa173a144 VERSION: Bump version up to 4.10.2... from e0cc225f8a4 VERSION: Disable GIT_SNAPSHOT for the 4.10.1 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - commit 17cd92e1c3672c4ffde7ca94546f57907d22262b Author: Karolin Seeger Date: Fri Apr 5 10:35:41 2019 +0200 VERSION: Disable GIT_SNAPSHOT for 4.10.2 release. CVE-2019-3870 (World writable files in Samba AD DC private/ dir) CVE-2019-3880 (Save registry file outside share as unprivileged user) Signed-off-by: Karolin Seeger commit 619d39538fa9453574a408f858d9168d152839de Author: Karolin Seeger Date: Fri Apr 5 10:18:41 2019 +0200 WHATSNEW: Add release notes for Samba 4.10.2. CVE-2019-3870 (World writable files in Samba AD DC private/ dir) CVE-2019-3880 (Save registry file outside share as unprivileged user) Signed-off-by: Karolin Seeger commit 67c837789f321c42230bfc3592652ce858f68da1 Author: Jeremy Allison Date: Thu Mar 21 14:51:30 2019 -0700 CVE-2019-3880 s3: rpc: winreg: Remove implementations of SaveKey/RestoreKey. The were not using VFS backend calls and could only work locally, and were unsafe against symlink races and other security issues. If the incoming handle is valid, return WERR_BAD_PATHNAME. [MS-RRP] states "The format of the file name is implementation-specific" so ensure we don't allow this. As reported by Michael Hanselmann. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13851 Signed-off-by: Jeremy Allison Reviewed-by: Andrew Bartlett commit 8e0a6867c4e3480c0269c87821b54f1451656ae7 Author: Andrew Bartlett Date: Thu Mar 21 17:24:14 2019 +1300 CVE-2019-3870 pysmbd: Ensure a zero umask is set for smbd.mkdir() mkdir() is the other call that requires a umask of 0 in Samba. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13834 Signed-off-by: Andrew Bartlett Reviewed-by: Jeremy Allison commit 9a4029b5d3be1f42da49d4e635f4637f76f01a22 Author: Andrew Bartlett Date: Thu Mar 14 18:20:06 2019 +1300 CVE-2019-3870 pysmbd: Move umask manipuations as close as possible to users Umask manipulation was added to pysmbd with e146fe5ef96c1522175a8e81db15d1e8879e5652 in 2012 and init_files_struct was split out in 747c3f1fb379bb68cc7479501b85741493c05812 in 2018 for Samba 4.9. (It was added to assist the smbd.create_file() routine used in the backup and restore tools, which needed to write files with full metadata). This in turn avoids leaving init_files_struct() without resetting the umask to the original, saved, value. Per umask(2) this is required before open() and mkdir() system calls (along side other file-like things such as those for Unix domain socks and FIFOs etc). Therefore for safety and clarify the additional 'belt and braces' umask manipuations elsewhere are removed. mkdir() will be protected by a umask() bracket, for correctness, in the next patch. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13834 Signed-off-by: Andrew Bartlett Reviewed-by: Jeremy Allison commit ebb9b7fa9ead90906ff71fed68c30d093ab9c15a Author: Andrew Bartlett Date: Thu Mar 21 17:21:58 2019 +1300 CVE-2019-3870 pysmbd: Include tests to show the outside umask has no impact BUG: https://bugzilla.samba.org/show_bug.cgi?id=13834 Signed-off-by: Andrew Bartlett Reviewed-by: Jeremy Allison commit 0b712415db68dd5f0a082c036ba051f2b857aa2a Author: Tim Beale Date: Fri Mar 15 13:52:50 2019 +1300 CVE-2019-3870 tests: Add test to check file-permissions are correct after provision This provisions a new DC and checks there are no world-writable files in the new DC's private directory. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13834 Signed-off-by: Tim Beale Reviewed-by: Andrew Bartlett Reviewed-by: Jeremy Allison commit c25ee5bd463d2d433a1b0a868e5d63e3490bc7fd Author: Tim Beale Date: Fri Mar 15 15:20:21 2019 +1300
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via e0cc225f8a4 VERSION: Disable GIT_SNAPSHOT for the 4.10.1 release. via 17f3d535c71 WHATSNEW: Add release notes for Samba 4.10.1. via af05bf7911e libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response via 815be52b600 lib: Make fd_load work for non-regular files via e769bd66089 s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so via 0e94b0a3144 s4:dlz make b9_has_soa check dc=@ node via 7921aa6365b dlz: Add test to ensure there are writable zones via 78b72ff339d regfio tests: Update comment style to match README.Coding via 722c5b32548 regfio: Update code near recent changes to match README.Coding via d4ef858ec11 regfio: Improve handling of malformed registry hive files via bf6a8517820 regfio: Add trivial unit test via cfffac0fc9f regfio: Use correct function names in debug information via 3f278c3f911 Fix typos in "valid" via 76b38e19d3c py/logger: use python 2.6 compatible arguments via f52ebe258ba py/uptodateness: use 2.6 compatible dictionary construction via 9b8398ecbbd py/kcc_utils: py2.6 compatibility via 75b6e02a8e6 py/graph: use 2.6 compatible check for set membership via 868356cf365 acl_read: Fix regression caused by db15fcfa899e1fe4d6994f68ceb299921b8aa6f1 for empty lists via 286b80cb7a3 ldb: cmocka test for empty attributes bug via 10a390e8975 dbcheck: use the str() value of the "name" attribute via 6602a77b649 dbcheck: don't check expired tombstone objects by default anymore via 4b658a5a396 blackbox/dbcheck-links.sh: prepare regression test for skipping expired tombstones via 40b6af9c000 blackbox/dbcheck*.sh: pass --selftest-check-expired-tombstones to dbcheck via b292ef1d9f6 dbcheck: add --selftest-check-expired-tombstones cmdline option via 178fad24f2c python/samba/netcmd: provide SUPPRESS_HELP via Option class via 89fb9d0a81b dbcheck: detect the change after deletion bug via 4f0b554b955 blackbox/dbcheck-links.sh: add regression test for lost deleted object repair via caf0caba4e4 dbcheck: add find_repl_attid() helper function via a47b27b2c96 dbcheck: don't remove dangling one-way links on already deleted objects via 0c2f7224e07 dbcheck: don't move already deleted objects to LostAndFound via 95f5b9f246a dbcheck: do isDeleted, systemFlags and replPropertyMetaData detection first via 8736fb5eb4e dbcheck: use DSDB_CONTROL_DBCHECK_FIX_LINK_DN_NAME when renaming deleted objects via 3e539f756ac dsdb:repl_meta_data: allow CONTROL_DBCHECK_FIX_LINK_DN_NAME to by pass rename via 4fc17804088 blackbox/dbcheck-links.sh: reproduce lost deleted object problem via 8d1241dac6b blackbox/*.sh: pass -u to 'diff' via 18f4167198a selftest: force running with TZ=UTC via 2d4820f0a8e s3:waf: Fix the detection of makdev() macro on Linux via a21e9754c74 s3:tests: Add test for smbstatus and smbstatus --resolve_uids via 79d3de4de41 selftest: Add smbstatus to testhelper via b866bdbe4fa s3:utils: Add 'smbstatus -L --resolve-uids' to show usernames via 084d2f1bc4f s3:utils: Use C99 initializer for poptOption in smbstatus via c8e8d97959d s3:lib: Fix the debug message for adding cache entries. via f6df8d97686 s4:librpc: Fix installation of Samba via eb632754830 ctdb-tests: Add some testing for IPv4-mapped IPv6 address parsing via 909cecd3606 ctdb: Initialize addr struct to zero before reparsing as IPV4 via fc4e3273316 ctdb-packaging: Test package requires tcpdump via 755f624e2bb ctdb-packaging: ctdb package should not own system library directory via 84aad2ea7d5 s3:client: Fix smbspool device uri handling via c6f1719b5e2 s3:client: Make sure we work on a copy of the title via 0db9487434a s3:client: Evaluate the AUTH_INFO_REQUIRED variable set by cups via 18515064c9b s3:client: Pass DEVICE_URI and AUTH_INFO_REQUIRED env to smbspool via d3ed17e74e7 s3:script: Fix jobid check in test_smbspool.sh via 4cafdc7f2eb ctdb-tests: Build cluster mutex path manually via 5f1d98c233e ndr_spoolss_buf: fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT() via f515f1a5486 ctdb-version: Simplify version string usage via 6401d809566 ctdb-build: Drop creation of .distversion in tarball via 2b30986174d ctdb-build: use a fixed ctdb_version.h using SAMBA_VERSION_STRING via 3170d75b5f1 VERSION: Bump version up to 4.10.1... from 25f2fe02a61 VERSION: Disable GIT_SNAPSHOT for the 4.10.0 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log -
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated
via 25f2fe02a61 VERSION: Disable GIT_SNAPSHOT for the 4.10.0 release.
via 983bcc352cb VERSION: Bump version up to 4.10.0.
via 5da71ca11d4 WHATSNEW: Add release notes for Samba 4.10.0.
via 00ea6a7d24e lib:util: Move debug message for mkdir failing to log
level 1
via 6d901af0f1c lib/winbind_util: Add winbind_xid_to_sid for
--without-winbind
via 3c32774b925 lib/winbind_util: Move include out of ifdef
via 545914afefa passdb: Update ABI to 0.27.2
via 2021080a41d passdb: Make [ug]id_to_sid use xid_to_sid
via 8c0268a5fec passdb: Introduce xid_to_sid
via 10a0d77f17c lib: Introduce winbind_xid_to_sid
via ba6dd781d4a winbind: Use idmap_cache_find_xid2sid
via a20e68bcc63 torture: Add tests for idmap cache
via f6f0994a597 idmap_cache: Introduce idmap_cache_find_xid2sid
via 6434de2b76d winbind: Now we explicitly track if we got ids from
cache
via 465bd07ff70 winbind: Initialize "expired" parameter to
idmap_cache_xid2sid
via 1df6720d74b idmap_cache: Only touch "sid" on success in
find_xid_to_sid
via 41c1870a8c2 lib: Make idmap_cache return negative mappings
via 5c2a243d3e7 CI: don't use swap
via 7bd135d25d6 s4/scripting/bin: open unicode files with utf8 encoding
and write unicode string
via 5d0e2bf8190 libcli/security: fix handling of deny type ACEs in
access_check_max_allowed()
via cc7629a20e9 s4:torture: Add test_deny1().
via c9b6b7ed4be s4:torture: Add test_owner_rights_deny1().
via 1dc2e296f17 libcli/security: correct access check and maximum
access calculation for Owner Rights ACEs
via 3026c1a36c3 s4:torture: Add test_owner_rights_deny().
via 63f0db77204 s4:torture: Fix the test_owner_rights() test to show
permissions are additive.
via 7e95499d39a libcli/security: add "Owner Rights" calculation to
access_check_max_allowed()
via ac08949dcdf s4:torture: add a Maximum Access check with an Owner
Rights ACE
via 3b52cba505a s4:libcli: remember return code from maximum access
via 49bac77e789 autobuild: Add -py2 tests for new split backup/restore
testenvs
via 9f85efa76d3 autobuild: Split backup/restore testenvs out into
separate job
via ea33a7b0911 sambaundoguididx: use the right escaped oder unescaped
sam ldb files
via 2f4d8214601 s4-server: Open and close a transaction on sam.ldb at
startup
via 0e80b245bf4 WHATSNEW: mention new vfs_glusterfs_fuse module
via 9169e9722d6 VERSION: Bump version up to 4.10.0rc5...
from e399a0209f4 VERSION: Disable GIT_SNAPSHOT for the 4.10.0rc4 release.
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable
- Log -
---
Summary of changes:
.gitlab-ci.yml | 17 +-
VERSION| 2 +-
WHATSNEW.txt | 58 ++-
lib/util/util.c| 6 +-
libcli/security/access_check.c | 127 +++--
script/autobuild.py| 13 +
source3/lib/idmap_cache.c | 48 +-
source3/lib/idmap_cache.h | 2 +
source3/lib/winbind_util.c | 41 +-
source3/lib/winbind_util.h | 2 +
...passdb-0.27.1.sigs => samba-passdb-0.27.2.sigs} | 2 +
source3/passdb/lookup_sid.c| 235 +++--
source3/passdb/lookup_sid.h| 1 +
source3/selftest/tests.py | 1 +
source3/torture/proto.h| 1 +
source3/torture/test_idmap_cache.c | 122 +
source3/torture/torture.c | 1 +
source3/winbindd/wb_xids2sids.c| 33 +-
source3/wscript_build | 3 +-
source4/libcli/raw/interfaces.h| 1 +
source4/libcli/smb2/create.c | 4 +-
source4/scripting/bin/gen_ntstatus.py | 11 +-
source4/scripting/bin/gen_werror.py| 11 +-
source4/scripting/bin/sambaundoguididx | 3 +-
source4/smbd/server.c | 42 ++
source4/torture/smb2/acls.c| 558 +
26 files changed, 1066 insertions(+), 279 deletions(-)
copy source3/passdb/ABI/{samba-passdb-0.27.1.sigs => samba-passdb-0.27.2.sigs}
(99%)
create mode 100644 source3/torture/test_idmap_cache.c
Changeset truncated at 500 lines:
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 04d57cb0491..4249f5296b3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -7,12 +7,7 @@ variables:
GIT_DEPTH: "3"
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via e399a0209f4 VERSION: Disable GIT_SNAPSHOT for the 4.10.0rc4 release. via 74aa2abf861 WHATSNEW: Add release notes for Samba 4.10.0rc4. via a65f7b71a25 WHATSNEW: Add some detail on the changes to paged results via 3fe0c3031e6 fix samba-tool gpo backup syntax in WHATSNEW.txt via 19b2885de7c vfs_ceph: remove ceph_fallocate/ceph_ftruncate fallback via 3332a895ed1 vfs_ceph: fix strict_allocate_ftruncate() via 0a784f28b46 vfs_ceph: add missing fallocate hook via 0c034112280 s3: smbd: filenames - ensure we replace the missing '/' if we error in an intermediate POSIX path. via b58c6f1f8b0 s3: torture: Add additional POSIX mkdir tests. via 179db55a3bb smbd: unix_convert: Ensure we don't call get_real_filename on POSIX paths. via 230c557e2f7 smbd: SMB1-POSIX: Add missing info-level SMB_POSIX_PATH_OPEN for UCF_UNIX_NAME_LOOKUP flag. via f765b515814 s3: smbtorture3: Add POSIX-MKDIR test for posix_mkdir case sensitive bug. via ce4c9c40fab winbindd: set idmap cache entries as the last step in async wb_xids2sids via 3b9ef9090a9 winbindd: track whether a result from xid2sid was coming from the cache via 3577293313c winbindd: switch send-next/done order via e9ffadb2b21 winbindd: update xid in wb_xids2sids_state->xids with what we got via 406a1cdff42 winbindd: convert id to a pointer in wb_xids2sids_dom_done() via f877231507e winbindd: make xids a const argument to wb_xids2sids_send() via 07820a3144f winbindd: make a copy of xid's in wb_xids2sids_send() via e0720c16c43 ctdb-cluster-mutex: Separate out command and file handling via c39430b0ae6 ctdb-tests: Add a test for configuring the recovery lock as a command via 75fcaea7251 ctdb-tests: Add -R option for local daemons to use recovery lock command via 6ac45076549 ctdb-tests: Force test failure if local daemon setup fails via d7fe81405aa ctdb-recoverd: Time out attempt to take recovery lock after 120s via bf774b81051 ctdb-recoverd: Ban node on unknown error when taking recovery lock via 5a060f07469 ctdb-recoverd: Make recoverd context available in recovery lock handle via 04baa822c40 ctdb-recoverd: Clean up logging on failure to take recovery lock via 6ee34859e86 ctdb-recoverd: Free cluster mutex handler on failure to take lock via a4a8351c1f3 ctdb-tests: Add test for ctdb_io.c via 8d28f78bfd7 ctdb: buffer write beyond limits via b69bb1f7619 ctdb-config: Change example recovery lock setting to one that fails via caf15a440a2 messages_dgm: Properly handle receiver re-initialization via d3a84988073 torture3: Extend read3 for the "messaging target re-inits" failure via 5b7e33f0556 messages_dgm: Use saved errno value via da238723afe man pages: document prefork process model via a2f740691a7 notifyd: Fix SIGBUS on sparc via 97fcdfb58a7 CVE-2019-3824 ldb: version 1.5.4 via 21a44989274 CVE-2019-3824 ldb: Add tests for ldb_wildcard_match via aecd14f8bdc CVE-2019-3824 ldb: wildcard_match end of data check via 41fd2cde0c7 CVE-2019-3824 ldb: wildcard_match check tree operation via 9a0ace32390 CVE-2019-3824 ldb: ldb_parse_tree use talloc_zero via 4cd0abe3c70 CVE-2019-3824 ldb: Improve code style and layout in wildcard processing via e9afae48efa CVE-2019-3824 ldb: Extra comments to clarify no pointer wrap in wildcard processing via aa13a46221a CVE-2019-3824 ldb: Out of bound read in ldb_wildcard_compare via bfa9353ce1d ldb: The test api.py should not rely on order of entries in dict via 942822e7165 lib:ldb: Use correct C99 initializer for 'struct tm' via d16b81cf586 lib:ldb: Use C99 initializer for tdb_logging_context via 7d0902c2a2b lib:ldb: Use C99 initializer for PyGetSetDef in pyldb via 0da2d830806 tevent: version 0.9.39 via f868654638a py_tevent: add_timer takes float argument via 6b125f6ce2d lib:tevent: Use correct C99 initializer for tevent_req via 7bc0d67e2f5 talloc: version 2.1.16 via dd2ec6de72d tdb: version 1.3.18 via 0130b999d2a lib:tdb: Use C99 initializer for tdb_logging_context via a5284f9ce32 lib:tdb: Use C99 initializer for tdb_header via b6bb285d9a9 lib:tdb: Use C99 initializer for PyGetSetDef in pytdb via 50be2c58274 tdb: Fix compatibility of wscript with older python via ba5a93c860a Search for location of waf script via fb1d5988e30 buildtools/wafsamba: Avoid decode when using python2 via 9dde00c3e0a VERSION: Bump version up to 4.10.0rc4... from 3d91947b53e VERSION: Disable GIT_SNAPSHOT for the 4.10.0rc3 release. https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated
via 3d91947b53e VERSION: Disable GIT_SNAPSHOT for the 4.10.0rc3 release.
via 1f749eb6f6a WHATSNEW: Add release notes for Samba 4.10.0rc3.
via a3a9630a464 waf: Check for libnscd
via d8911eaa54d WHATSNEW: Add note that python2 support will be dropped
on v4.11
via be6f8d41ca7 waf: Do not install internal header
via 9bf434a941b lib:util: Move discard_const(_p) to own header for
libndr.h
via 66bf14d8322 pidl: Use NDR_ZERO_STRUCT(P) macros
via f6a44c807a9 librpc:ndr: Add NDR_ZERO_STRUCT(P) macros
via 2ba1d9dd8d2 librpc:ndr: Implement ndr_zero_memory()
via 6d2af886f40 tldap: avoid more use after free errors
via 9a530ee4f91 tldap: avoid a use after free crash
via 1ed75df5711 s3:vfs: Correctly check if OFD locks should be enabled
or not
via fcd5865f3ff s3:vfs: Initialize pid to 0 in test_netatalk_lock()
via fbc8ea71c5c s4: torture: vfs_fruit. Change
test_fruit_locking_conflict() to match the vfs_fruit working server code.
via 72bcae77752 s3: VFS: vfs_fruit. Fix the NetAtalk deny mode
compatibility code.
via eba5d055376 smbd: uid: Don't crash if 'force group' is added to an
existing share connection.
via f68aab42318 s3: tests: Add regression test for smbd crash on share
force group change with existing connection.
via d6dbd33fdcd printing: check lp_load_printers() prior to pcap cache
update
via 3d0450ef3c5 printing: drop pcap_cache_loaded() guard around
load_printers()
via 7621c622f83 s3-smbd: use fruit:model string for mDNS registration
via e21e24d8345 ldb: Release ldb 1.5.3
via bb850a07502 ldb: Add even more comments on what strict does to the
list intersections
via 2a915942295 ldb: Rename variable
via 62fea7e9c3f ldb: Elaborate on ldb_kv_search_indexed() comments
via f7774530936 ldb: Remove comment that no longer makes sense
via 7fc34817657 ldb: Avoid inefficient one-level searches
via 0c75bfe674b VERSION: Bump version up to 4.10.0rc2...
from 61e654828c1 VERSION: Diable GIT_SNAPSHOT for the 4.10.0rc2 release.
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable
- Log -
---
Summary of changes:
VERSION| 2 +-
WHATSNEW.txt | 89 +++--
lib/ldb/ABI/{ldb-1.5.1.sigs => ldb-1.5.3.sigs} | 0
...yldb-util-1.1.10.sigs => pyldb-util-1.5.3.sigs} | 0
...-util-1.1.10.sigs => pyldb-util.py3-1.5.3.sigs} | 0
lib/ldb/ldb_key_value/ldb_kv_index.c | 76 ++--
lib/ldb/wscript| 2 +-
lib/util/discard.h | 51 ++
lib/util/memory.h | 27 ---
lib/util/samba_util.h | 1 +
lib/util/wscript_build | 18 +-
librpc/ABI/{ndr-0.1.2.sigs => ndr-0.2.0.sigs} | 1 +
librpc/ndr/libndr.h| 10 +-
librpc/ndr/util.c | 5 +
librpc/wscript_build | 2 +-
pidl/lib/Parse/Pidl/Samba3/ServerNDR.pm| 2 +-
pidl/lib/Parse/Pidl/Samba4/COM/Proxy.pm| 2 +-
pidl/lib/Parse/Pidl/Samba4/NDR/Client.pm | 6 +-
pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm | 6 +-
selftest/selftesthelpers.py| 1 +
selftest/target/Samba3.pm | 5 +
source3/include/proto.h| 2 +-
source3/lib/tldap.c| 1 -
source3/lib/tldap_util.c | 2 -
source3/lib/util.c | 7 +-
source3/libsmb/samlogon_cache.c| 1 +
source3/modules/vfs_default.c | 14 +-
source3/modules/vfs_fruit.c| 204 ++---
source3/printing/load.c| 4 +-
source3/printing/pcap.c| 5 +
source3/printing/queue_process.c | 6 +-
source3/printing/spoolssd.c| 8 +-
source3/script/tests/test_force_group_change.sh| 73
source3/selftest/tests.py | 4 +
source3/smbd/avahi_register.c | 27 +++
source3/smbd/files.c | 9 +
source3/smbd/uid.c | 35 +++-
source3/wscript| 3 +
source3/wscript_build | 1 +
source4/torture/vfs/fruit.c| 26 ++-
40 files changed, 516 insertions(+), 222 deletions(-)
copy lib/ldb/ABI/{ldb-1.5.1.sigs =>
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated via 61e654828c1 VERSION: Diable GIT_SNAPSHOT for the 4.10.0rc2 release. via d902eec5bae WHATSNEW: Add release notes for Samba 4.10.0rc2. via 676b549321a s3-vfs: Use ENOATTR in errno comparison for getxattr via f8773e8a78e s3-vfs: add glusterfs_fuse vfs module. via a2e889740b3 selftest:Samba4: use 'smbcontrol samba shutdown' via 902de86daa6 s4:server: add support for 'smbcontrol samba shutdown' via 45c19f4c253 s4:server: avoid using pid=0 for the parent 'samba' process via f105c379545 s4:messaging: add support 'smbcontrol debug/debuglevel' via 9d2e05b1a6d manpages/samba.7.xml: smbcontrol can also work with 'samba' via 520c062db5f libcli: dns: Change internal DNS_REQUEST_TIMEOUT from 2 to 10 seconds. via 6990f5018d9 python: dns_hub: Fix indentation of 'raise' on error. via 56549fd07d6 join: Throw CommandError instead of Exception for simple errors via 334f1e6f56a join: Fix TypeError when handling exception via 9ae7ffa5f05 vfs_glusterfs: Adapt to changes in libgfapi signatures via 94aff506747 WHATSNEW: fix typo. via 9859cc5c1b0 WHATSNEW: Add missing parenthesis via a4466ec4282 ctdb: Print locks latency in machinereadable stats via 16b1971ea0a WHATSNEW: Update for Bug 13676 changes in Samba 4.10 via 26cd687f14d netcmd: Try to improve domain backup error message via f088f070b4c tests: Run ntacls_backup tests against testenv with SMBv1 disabled via 7399fe07fea selftest: Give the backup testenvs a 'test1' share via 349cfec01df tests: Run GPO commands against testenv with SMBv1 disabled via e682347bc18 ntacls: Pass correct use_ntvfs through to setntacl() via 6158ca6e299 tests: Run samba_tool.gpo tests against backup testenvs via 9d9b00566c1 s4:pysmb: Add error log that the s4 bindings are deprecated via c4323c00ec5 netcmd: Change GPO commands to use s3 SMB Py bindings via c9fdea2e361 s3:pylibsmb: Add FILE_READ_ATTRIBUTES access to .loadfile() API via b47e42e0400 netcmd: Change SMB flags from s4 Py bindings to s3 via 3ed03bd24eb s3:pylibsmb: Add .set_acl API to SMB py bindings via f43abe39d56 python/gpclass: Convert gpclass to use s3 SMB Python bindings via 529b29203d4 s3:libsmb: Honor disable_netbios option in smbsock_connect_send via 248c234e06b VERSION: Bump version up to 4.10.0rc2... from 1c9e1bcda1c VERSION: Bump version up to 4.10.0rc1... https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable - Log - --- Summary of changes: VERSION| 2 +- WHATSNEW.txt | 50 +- ctdb/tools/ctdb.c | 5 + docs-xml/manpages/samba.7.xml | 2 +- docs-xml/manpages/vfs_glusterfs_fuse.8.xml | 103 + docs-xml/wscript_build | 1 + libcli/dns/dns.c | 2 +- python/samba/gpclass.py| 10 +- python/samba/join.py | 7 +- python/samba/netcmd/domain.py | 2 +- python/samba/netcmd/domain_backup.py | 5 +- python/samba/netcmd/gpo.py | 20 ++-- python/samba/ntacls.py | 3 +- .../samba/tests/dns_forwarder_helpers/dns_hub.py | 4 +- selftest/target/Samba4.pm | 17 source3/libsmb/pylibsmb.c | 54 ++- source3/libsmb/smbsock_connect.c | 7 ++ source3/modules/posixacl_xattr.c | 4 +- source3/modules/vfs_glusterfs.c| 21 - source3/modules/vfs_glusterfs_fuse.c | 71 ++ source3/modules/wscript_build | 8 ++ source3/wscript| 4 + source4/lib/messaging/messaging.c | 72 ++ source4/libcli/pysmb.c | 12 +++ source4/selftest/tests.py | 15 +-- source4/smbd/server.c | 39 +++- 26 files changed, 500 insertions(+), 40 deletions(-) create mode 100644 docs-xml/manpages/vfs_glusterfs_fuse.8.xml create mode 100644 source3/modules/vfs_glusterfs_fuse.c Changeset truncated at 500 lines: diff --git a/VERSION b/VERSION index fde61a99da4..a251f875c42 100644 --- a/VERSION +++ b/VERSION @@ -87,7 +87,7 @@ SAMBA_VERSION_PRE_RELEASE= # e.g. SAMBA_VERSION_RC_RELEASE=1 # # -> "3.0.0rc1" #
[SCM] Samba Shared Repository - branch v4-10-stable updated
The branch, v4-10-stable has been updated
via 1c9e1bcda1c VERSION: Bump version up to 4.10.0rc1...
via 86253ce3845 WHATSNEW: Add release note for Samba 4.10.0rc1.
via 340cb9ca97b ldb: version 1.5.2
via 1c73f38633c tevent: version 0.9.38
via b915626087c talloc: version 2.1.15
via 33de2f0727e Merge remote-tracking branch 'origin/v4-10-test' into
HEAD
via 08f27a00832 Revert "WHATSNEW: Add release note for Samba 4.10.0rc1."
via a4e37680d35 Revert "VERSION: Bump version up to 4.10.0rc1..."
via 118b492d3ec Revert "VERSION: Bump version up to 4.10.0rc2..."
via f2d8308c22c addns: Async ads_dns_lookup_ns
via 75106e05b42 VERSION: Bump version up to 4.10.0rc2...
via 9537e5d2a14 VERSION: Bump version up to 4.10.0rc1...
via 3f4bd61b840 WHATSNEW: Add release note for Samba 4.10.0rc1.
via 4b4ae005b20 addns: Async ads_dns_lookup_srv
via 9563fcf6ffa samba_dnsupdate: With dns_hub, we don't need resolv_wrap
via 99b775336b7 selftest: Use dns_hub's resolv.conf
via 5f02a6af948 selftest: Add dns_hub deps
via 62584f3d081 selftest: setup_dns_hub
via 61e64791294 selftest: add central dns forwarder
via a8191f88ca8 libcli/dns: Add dns_res_rec_get_sockaddr
via dbbce1a4545 libcli/dns: clidns must depend on ndr_standard, not on
NDR_DNS
via 237c06aad81 libcli/dns: Make "clidns" a library
via b7418203eeb dns_lookup: Let make test override the resolv.conf
location
via 5f393deb309 libcli/dns: Add dns_lookup
via e9e4aeafc0c libcli/dns: Add resolv.conf parsing
via ff2dbe24b80 dns_update: samba_dnsupdate's exit code is not an errno
via a7e28a7eb56 addns: Centralize siteless lookup fallback
from 12398a2d1dd vfs_fileid: fix get_connectpath_ino
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-stable
- Log -
---
Summary of changes:
VERSION| 6 +-
WHATSNEW.txt | 2 +-
lib/addns/dnsquery.c | 906 +++--
lib/addns/dnsquery.h | 16 +
lib/addns/wscript_build| 2 +-
lib/ldb/ABI/{ldb-1.5.1.sigs => ldb-1.5.2.sigs} | 0
...yldb-util-1.1.10.sigs => pyldb-util-1.5.2.sigs} | 0
...-util-1.1.10.sigs => pyldb-util.py3-1.5.2.sigs} | 0
lib/ldb/wscript| 2 +-
...-util-2.1.10.sigs => pytalloc-util-2.1.15.sigs} | 0
...3-2.1.10.sigs => pytalloc-util.py3-2.1.15.sigs} | 0
.../ABI/{talloc-2.1.10.sigs => talloc-2.1.15.sigs} | 0
lib/talloc/wscript | 2 +-
.../ABI/{tevent-0.9.37.sigs => tevent-0.9.38.sigs} | 0
lib/tevent/wscript | 2 +-
libcli/dns/dns_lookup.c| 374 +
libcli/dns/dns_lookup.h| 48 ++
libcli/dns/{dns.h => dns_lookuptest.c} | 75 +-
libcli/dns/resolvconf.c| 123 +++
.../libads/krb5_errs.h => libcli/dns/resolvconf.h | 25 +-
libcli/dns/resolvconftest.c| 82 ++
libcli/dns/wscript_build | 21 +-
.../samba/tests/dns_forwarder_helpers/dns_hub.py | 156
selftest/target/Samba.pm | 2 +
selftest/target/Samba3.pm | 4 +
selftest/target/Samba4.pm | 159 +++-
.../{test_pthreadpool.sh => test_resolvconf.sh}| 8 +-
source3/selftest/tests.py | 4 +
source4/dsdb/dns/dns_update.c | 4 +-
source4/scripting/bin/samba_dnsupdate | 37 +-
30 files changed, 1331 insertions(+), 729 deletions(-)
copy lib/ldb/ABI/{ldb-1.5.1.sigs => ldb-1.5.2.sigs} (100%)
copy lib/ldb/ABI/{pyldb-util-1.1.10.sigs => pyldb-util-1.5.2.sigs} (100%)
copy lib/ldb/ABI/{pyldb-util-1.1.10.sigs => pyldb-util.py3-1.5.2.sigs} (100%)
copy lib/talloc/ABI/{pytalloc-util-2.1.10.sigs => pytalloc-util-2.1.15.sigs}
(100%)
copy lib/talloc/ABI/{pytalloc-util.py3-2.1.10.sigs =>
pytalloc-util.py3-2.1.15.sigs} (100%)
copy lib/talloc/ABI/{talloc-2.1.10.sigs => talloc-2.1.15.sigs} (100%)
copy lib/tevent/ABI/{tevent-0.9.37.sigs => tevent-0.9.38.sigs} (100%)
create mode 100644 libcli/dns/dns_lookup.c
create mode 100644 libcli/dns/dns_lookup.h
copy libcli/dns/{dns.h => dns_lookuptest.c} (52%)
create mode 100644 libcli/dns/resolvconf.c
copy source3/libads/krb5_errs.h => libcli/dns/resolvconf.h (63%)
create mode 100644 libcli/dns/resolvconftest.c
create mode 100755 python/samba/tests/dns_forwarder_helpers/dns_hub.py
copy source3/script/tests/{test_pthreadpool.sh => test_resolvconf.sh} (54%)
Changeset truncated at 500 lines:
