summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* VERSION: Disable GIT_SNAPSHOT for the 4.11.17 release.samba-4.11.17v4-11-stableKarolin Seeger2020-12-031-1/+1
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* WHATSNEW: Add release notes for Samba 4.11.17.Karolin Seeger2020-12-031-2/+50
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* vfs_glusterfs: print exact cmdline for disabling write-behind translatorGünther Deschner2020-12-022-3/+10
| | | | | | | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Fri Nov 27 17:15:07 UTC 2020 on sn-devel-184 (cherry picked from commit 369c1d539837b70e94fe9d533d44860c8a9380a1) Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-11-test): Wed Dec 2 16:04:24 UTC 2020 on sn-devel-184
* manpages/vfs_glusterfs: Mention silent skipping of write-behind translatorAnoop C S2020-12-021-0/+5
| | | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 Signed-off-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Mon Nov 9 13:30:06 UTC 2020 on sn-devel-184 (cherry picked from commit be03ce7d8bb213633eedcfc3299b8d9865a3c67f)
* s3-vfs_glusterfs: always disable write-behind translatorGünther Deschner2020-12-022-3/+20
| | | | | | | | | | | | | | | | | | | | | | The "pass-through" option has now been merged upstream as of: https://github.com/gluster/glusterfs/pull/1640 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Pair-Programmed-With: Anoop C S <anoopcs@samba.org> Pair-Programmed-With: Sachin Prabhu <sprabhu@redhat.com> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Nov 4 22:53:49 UTC 2020 on sn-devel-184 (cherry picked from commit a51cda69ec6a017ad04b5690a3ae67a5478deee9) Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-13-test): Thu Nov 5 13:54:25 UTC 2020 on sn-devel-184
* s3: modules: gluster. Fix the error I made in preventing talloc leaks from a ↵Jeremy Allison2020-11-191-8/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | function. file_lines_parse() plays horrible tricks with the passed-in talloc pointers and the hierarcy which makes freeing hard to get right. As we know mem_ctx is freed by the caller, after calling file_lines_parse don't free on exit and let the caller handle it. This violates good Samba coding practice but we know we're not leaking here. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Wed Nov 11 15:02:27 UTC 2020 on sn-devel-184 (cherry picked from commit 457b49c67803dd95abc8502c2a410fac273f6fba) Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-11-test): Thu Nov 19 12:38:34 UTC 2020 on sn-devel-184
* VERSION: Bump version up to 4.11.17...Karolin Seeger2020-11-041-2/+2
| | | | | | and re-enable GIT_SNAPSHOT. Signed-off-by: Karolin Seeger <kseeger@samba.org>
* VERSION: Disable GIT_SNAPSHOT for the 4.11.16 release.samba-4.11.16Karolin Seeger2020-11-041-1/+1
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* WHATSNEW: Add release notes for Samba 4.11.16.Karolin Seeger2020-11-041-2/+73
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return.Jeremy Allison2020-11-031-0/+2
| | | | | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Nov 3 01:56:59 UTC 2020 on sn-devel-184 (cherry picked from commit 7d846cd178d653600c71ee4bd6a491a9e48a56da) Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-11-test): Tue Nov 3 11:30:48 UTC 2020 on sn-devel-184
* s3-vfs_glusterfs: refuse connection when write-behind xlator is presentGünther Deschner2020-11-031-0/+89
| | | | | | | | | | | | | | | | | | | | | | s3-vfs_glusterfs: refuse connection when write-behind xlator is present Once the new glusterfs api is available we will programmtically disable the translator, for now we just refuse the connection as there is a potential for serious data damage. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Pair-Programmed-With: Sachin Prabhu <sprabhu@redhat.com> Pair-Programmed-With: Anoop C S <anoopcs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Nov 2 21:40:33 UTC 2020 on sn-devel-184 (cherry picked from commit 2a49ccbcf5e3ff0f6833bcb7f04b800125f1783f)
* docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfsSachin Prabhu2020-11-031-0/+22
| | | | | | | | | | | | | | | Add warning about data corruption with the write-behind translator. The data corruption is highlighted by the smbtorture test smb2.rw.rw1. More information about this data corruption issue is available in the bz. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 Signed-off-by: Sachin Prabhu <sprabhu@redhat.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> (cherry picked from commit 08f8f665d409ee7b93840c25a8142f2ce8bacfa1)
* ctdb-common: Avoid aliasing errors during code optimizationAmitay Isaacs2020-11-031-14/+17
| | | | | | | | | | | | | | | | | When compiling with GCC 10.x and -O3 optimization, the IP checksum calculation code generates wrong checksum. The function uint16_checksum gets inlined during optimization and ip4pkt->tcp data gets wrongly aliased. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14537 Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net> Autobuild-User(master): Martin Schwenke <martins@samba.org> Autobuild-Date(master): Wed Oct 21 05:52:28 UTC 2020 on sn-devel-184 (cherry picked from commit 6aa396b0cd1f83f45cb76a4f3123d99135e8dd8c)
* VERSION: Bump version up to 4.11.16.Karolin Seeger2020-10-291-1/+1
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* Merge tag 'samba-4.11.15' into v4-11-testKarolin Seeger2020-10-296-17/+228
|\ | | | | | | samba: tag release samba-4.11.15
| * VERSION: Disable GIT_SNAPSHOT for the 4.11.15 release.samba-4.11.15Karolin Seeger2020-10-271-1/+1
| | | | | | | | | | | | | | | | | | o CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify. o CVE-2020-14323: Unprivileged user can crash winbind. o CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records. Signed-off-by: Karolin Seeger <kseeger@samba.org>
| * WHATSNEW: Add release notes for Samba 4.11.15.Karolin Seeger2020-10-271-2/+95
| | | | | | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
| * CVE-2020-14383: s4/dns: do not crash when additional data not foundDouglas Bagnall2020-10-261-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Found by Francis Brosnan Blázquez <francis@aspl.es>. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14472 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12795 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Mon Aug 24 00:21:41 UTC 2020 on sn-devel-184 (based on commit df98e7db04c901259dd089e20cd557bdbdeaf379)
| * CVE-2020-14383: s4/dns: Ensure variable initialization with NULL.Douglas Bagnall2020-10-261-11/+13
| | | | | | | | | | | | | | | | | | | | | | | | Based on patches from Francis Brosnan Blázquez <francis@aspl.es> and Jeremy Allison <jra@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=14472 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12795 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> (based on commit 7afe449e7201be92bed8e53cbb37b74af720ef4e)
| * CVE-2020-14323 torture4: Add a simple test for invalid lookup_sids winbind callVolker Lendecke2020-10-261-0/+27
| | | | | | | | | | | | | | | | | | | | | | We can't add this test before the fix, add it to knownfail and have the fix remove the knownfail entry again. As this crashes winbind, many tests after this one will fail. Reported by Bas Alberts of the GitHub Security Lab Team as GHSL-2020-134 Bug: https://bugzilla.samba.org/show_bug.cgi?id=14436 Signed-off-by: Volker Lendecke <vl@samba.org>
| * CVE-2020-14323 winbind: Fix invalid lookupsids DoSVolker Lendecke2020-10-261-1/+1
| | | | | | | | | | | | | | | | | | | | A lookupsids request without extra_data will lead to "state->domain==NULL", which makes winbindd_lookupsids_recv trying to dereference it. Reported by Bas Alberts of the GitHub Security Lab Team as GHSL-2020-134 Bug: https://bugzilla.samba.org/show_bug.cgi?id=14436 Signed-off-by: Volker Lendecke <vl@samba.org>
| * s3: smbd: Ensure change notifies can't get set unless the directory handle ↵Jeremy Allison2020-10-262-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | is open for SEC_DIR_LIST. Remove knownfail entry. CVE-2020-14318 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14434 Signed-off-by: Jeremy Allison <jra@samba.org>
| * s4: torture: Add smb2.notify.handle-permissions test.Jeremy Allison2020-10-262-0/+82
| | | | | | | | | | | | | | | | | | | | Add knownfail entry. CVE-2020-14318 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14434 Signed-off-by: Jeremy Allison <jra@samba.org>
| * VERSION: Bump version up to 4.11.15...Karolin Seeger2020-10-261-2/+2
| | | | | | | | | | | | and re-enable GIT_SNAPSHOT. Signed-off-by: Karolin Seeger <kseeger@samba.org>
* | VERSION: Bump version up to 4.11.15...Karolin Seeger2020-10-061-2/+2
|/ | | | | | and re-enable GIT_SNAPSHOT. Signed-off-by: Karolin Seeger <kseeger@samba.org>
* VERSION: Disable GIT_SNAPSHOT for the 4.11.14 release.samba-4.11.14Karolin Seeger2020-10-061-1/+1
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* WHATSNEW: Add release notes for Samba 4.11.14.Karolin Seeger2020-10-061-4/+60
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* winbind: Fix a memleakLaurent Menase2020-10-051-0/+1
| | | | | | | | | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=14388 Signed-off-by: Laurent Menase <laurent.menase@hpe.com> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Noel Power <noel.power@suse.com> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Mon Sep 14 13:33:13 UTC 2020 on sn-devel-184 (cherry picked from commit 8f868b0ea0b4795668f7bc0b028cd85686b249fb) Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-11-test): Mon Oct 5 11:17:23 UTC 2020 on sn-devel-184
* VERSION: Bump version up to 4.11.14...Stefan Metzmacher2020-09-181-2/+2
| | | | | | and re-enable GIT_SNAPSHOT. Signed-off-by: Stefan Metzmacher <metze@samba.org>
* Merge tag 'samba-4.11.13' into v4-11-testStefan Metzmacher2020-09-1811-110/+943
|\ | | | | | | | | | | samba: tag release samba-4.11.13 Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * VERSION: Disable GIT_SNAPSHOT for the 4.11.13 release.samba-4.11.13Karolin Seeger2020-09-181-1/+1
| | | | | | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
| * WHATSNEW: Add release notes for Samba 4.11.13.Karolin Seeger2020-09-181-2/+105
| | | | | | | | | | | | CVE-2020-1472: Samba impact of "ZeroLogon". Signed-off-by: Karolin Seeger <kseeger@samba.org>
| * CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challengeGary Lockyer2020-09-181-0/+335
| | | | | | | | | | | | | | | | | | | | | | Ensure that client challenges with the first 5 bytes identical are rejected. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> [abartlet@samba.org: backported from master as test order was flipped]
| * CVE-2020-1472(ZeroLogon): s4 torture rpc: Test empty machine acct pwdGary Lockyer2020-09-181-35/+29
| | | | | | | | | | | | | | | | | | Ensure that an empty machine account password can't be set by netr_ServerPasswordSet2 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2020-1472(ZeroLogon): docs-xml: document 'server require ↵Stefan Metzmacher2020-09-181-15/+54
| | | | | | | | | | | | | | | | schannel:COMPUTERACCOUNT' BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: log warnings about ↵Günther Deschner2020-09-181-4/+66
| | | | | | | | | | | | | | | | | | | | | | unsecure configurations BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Günther Deschner <gd@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: support "server require ↵Günther Deschner2020-09-181-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | schannel:WORKSTATION$ = no" This allows to add expections for individual workstations, when using "server schannel = yes". "server schannel = auto" is very insecure and will be removed soon. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Günther Deschner <gd@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: refactor ↵Günther Deschner2020-09-181-8/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | dcesrv_netr_creds_server_step_check() We should debug more details about the failing request. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Günther Deschner <gd@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: log warnings about ↵Stefan Metzmacher2020-09-181-3/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | unsecure configurations This should give admins wawrnings until they have a secure configuration. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
| * CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: support "server require ↵Stefan Metzmacher2020-09-181-1/+8
| | | | | | | | | | | | | | | | | | | | | | schannel:WORKSTATION$ = no" This allows to add expections for individual workstations, when using "server schannel = yes". "server schannel = auto" is very insecure and will be removed soon. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: refactor ↵Stefan Metzmacher2020-09-181-12/+33
| | | | | | | | | | | | | | | | | | | | dcesrv_netr_creds_server_step_check() We should debug more details about the failing request. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: protect ↵Jeremy Allison2020-09-181-6/+92
| | | | | | | | | | | | | | | | | | | | | | netr_ServerPasswordSet2 against unencrypted passwords BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Fix mem leak onto ↵Jeremy Allison2020-09-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | p->mem_ctx in error path of _netr_ServerPasswordSet2(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Jeremy Allison <jra@samba.org> [dbagnall@samba.org, abartlet@samba.org: adapt for indentation changes]
| * CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: protect ↵Stefan Metzmacher2020-09-181-1/+59
| | | | | | | | | | | | | | | | netr_ServerPasswordSet2 against unencrypted passwords BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): libcli/auth: reject weak client challenges in ↵Stefan Metzmacher2020-09-182-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | netlogon_creds_server_init() This implements the note from MS-NRPC 3.1.4.1 Session-Key Negotiation: 7. If none of the first 5 bytes of the client challenge is unique, the server MUST fail session-key negotiation without further processing of the following steps. It lets ./zerologon_tester.py from https://github.com/SecuraBV/CVE-2020-1472.git report: "Attack failed. Target is probably patched." BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): libcli/auth: add ↵Stefan Metzmacher2020-09-182-1/+23
| | | | | | | | | | | | | | | | | | | | | | netlogon_creds_is_random_challenge() to avoid weak values This is the check Windows is using, so we won't generate challenges, which are rejected by Windows DCs (and future Samba DCs). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): s4:rpc_server:netlogon: make use of ↵Stefan Metzmacher2020-09-181-2/+1
| | | | | | | | | | | | | | | | | | | | netlogon_creds_random_challenge() This is not strictly needed, but makes things more clear. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): s3:rpc_server:netlogon: make use of ↵Stefan Metzmacher2020-09-181-2/+1
| | | | | | | | | | | | | | | | | | | | netlogon_creds_random_challenge() This is not strictly needed, but makes things more clear. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): libcli/auth: make use of ↵Stefan Metzmacher2020-09-181-2/+1
| | | | | | | | | | | | | | | | | | | | | | netlogon_creds_random_challenge() in netlogon_creds_cli.c This will avoid getting rejected by the server if we generate a weak challenge. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2020-1472(ZeroLogon): s4:torture/rpc: make use of ↵Stefan Metzmacher2020-09-182-23/+13
| | | | | | | | | | | | | | | | | | | | | | netlogon_creds_random_challenge() This will avoid getting flakey tests once our server starts to reject weak challenges. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org>
View Lorry Controller Status