From 32d4b560ed8facfc88eb1eaf047d5ce98c202ce9 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sat, 21 Mar 2020 12:49:13 +0200 Subject: [PATCH 01/26] Fix samba_requires_eq macro definition Resolves rhbz#1815739 --- samba.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 6ea36db..d2dc2a1 100644 --- a/samba.spec +++ b/samba.spec @@ -6,9 +6,9 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") +%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 5 +%define main_release 6 %define samba_version 4.12.0 %define talloc_version 2.3.1 @@ -3560,6 +3560,10 @@ fi %endif %changelog +* Sat Mar 21 2020 Alexander Bokovoy - 4.12.0-6 +- Fix samba_requires_eq macro definition +- Resolves rhbz#1815739 + * Tue Mar 10 2020 Guenther Deschner - 4.12.0-5 - Add build requirement for perl-FindBin - resolves: #1661213 - Add winexe subpackage for remote windows command execution From f7f42087f648a5a5cf06707467eae19082d4d211 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 7 Apr 2020 10:59:13 +0200 Subject: [PATCH 02/26] Update to Samba 4.12.1 Guenther --- .gitignore | 2 + samba-4.12.0-winexe.patch | 438 -------------------------------------- samba.spec | 8 +- sources | 4 +- 4 files changed, 9 insertions(+), 443 deletions(-) delete mode 100644 samba-4.12.0-winexe.patch diff --git a/.gitignore b/.gitignore index 105b67b..802994e 100644 --- a/.gitignore +++ b/.gitignore @@ -199,3 +199,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.0rc4.tar.asc /samba-4.12.0.tar.xz /samba-4.12.0.tar.asc +/samba-4.12.1.tar.xz +/samba-4.12.1.tar.asc diff --git a/samba-4.12.0-winexe.patch b/samba-4.12.0-winexe.patch deleted file mode 100644 index b5ae3bb..0000000 --- a/samba-4.12.0-winexe.patch +++ /dev/null @@ -1,438 +0,0 @@ -From a1fdd83ab776f981e992c3f2fc8c341d6b37a0d4 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Thu, 5 Mar 2020 22:45:48 +0100 -Subject: [PATCH 1/3] s4-torture: add rpc test for ChangeServiceConfigW - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit 0825324bc75d2ab10164a1f137be782d84c822b8) ---- - selftest/knownfail | 3 ++ - source4/torture/rpc/svcctl.c | 78 +++++++++++++++++++++++++++++++++++- - 2 files changed, 80 insertions(+), 1 deletion(-) - -diff --git a/selftest/knownfail b/selftest/knownfail -index c9ef0851172..20441c078b4 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -234,6 +234,9 @@ - ^samba3.rpc.eventlog.eventlog.GetNumRecords\(ad_dc\) - ^samba3.rpc.eventlog.eventlog.OpenEventLog\(ad_dc\) - ^samba3.rap.basic.netsessiongetinfo\(ad_dc\) -+# not implemented -+^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\) -+^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\) - # - # This makes less sense when not running against an AD DC - # -diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c -index ebb2bc6ad0e..bd16ed4627d 100644 ---- a/source4/torture/rpc/svcctl.c -+++ b/source4/torture/rpc/svcctl.c -@@ -3,7 +3,7 @@ - test suite for svcctl rpc operations - - Copyright (C) Jelmer Vernooij 2004 -- Copyright (C) Guenther Deschner 2008,2009 -+ Copyright (C) Guenther Deschner 2008,2009,2020 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by -@@ -623,6 +623,80 @@ static bool test_SCManager(struct torture_context *tctx, - return true; - } - -+static bool test_ChangeServiceConfigW(struct torture_context *tctx, -+ struct dcerpc_pipe *p) -+{ -+ struct svcctl_ChangeServiceConfigW r; -+ struct svcctl_QueryServiceConfigW q; -+ struct policy_handle h, s; -+ NTSTATUS status; -+ struct dcerpc_binding_handle *b = p->binding_handle; -+ struct QUERY_SERVICE_CONFIG query; -+ bool ok; -+ -+ uint32_t offered = 0; -+ uint32_t needed = 0; -+ -+ ok = test_OpenSCManager(b, tctx, &h); -+ if (!ok) { -+ return false; -+ } -+ -+ ok = test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s); -+ if (!ok) { -+ return false; -+ } -+ -+ q.in.handle = &s; -+ q.in.offered = offered; -+ q.out.query = &query; -+ q.out.needed = &needed; -+ -+ status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &q); -+ torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!"); -+ -+ if (W_ERROR_EQUAL(q.out.result, WERR_INSUFFICIENT_BUFFER)) { -+ q.in.offered = needed; -+ status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &q); -+ torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!"); -+ } -+ torture_assert_werr_ok(tctx, q.out.result, "QueryServiceConfigW failed!"); -+ -+ r.in.handle = &s; -+ r.in.type = query.service_type; -+ r.in.start_type = query.start_type; -+ r.in.error_control = query.error_control; -+ -+ /* -+ * according to MS-SCMR 3.1.4.11 NULL params are supposed to leave the -+ * existing values intact. -+ */ -+ -+ r.in.binary_path = NULL; -+ r.in.load_order_group = NULL; -+ r.in.dependencies = NULL; -+ r.in.service_start_name = NULL; -+ r.in.password = NULL; -+ r.in.display_name = NULL; -+ r.out.tag_id = NULL; -+ -+ status = dcerpc_svcctl_ChangeServiceConfigW_r(b, tctx, &r); -+ torture_assert_ntstatus_ok(tctx, status, "ChangeServiceConfigW failed!"); -+ torture_assert_werr_ok(tctx, r.out.result, "ChangeServiceConfigW failed!"); -+ -+ ok = test_CloseServiceHandle(b, tctx, &s); -+ if (!ok) { -+ return false; -+ } -+ -+ ok = test_CloseServiceHandle(b, tctx, &h); -+ if (!ok) { -+ return false; -+ } -+ -+ return true; -+} -+ - struct torture_suite *torture_rpc_svcctl(TALLOC_CTX *mem_ctx) - { - struct torture_suite *suite = torture_suite_create(mem_ctx, "svcctl"); -@@ -652,6 +726,8 @@ struct torture_suite *torture_rpc_svcctl(TALLOC_CTX *mem_ctx) - test_StartServiceW); - torture_rpc_tcase_add_test(tcase, "ControlService", - test_ControlService); -+ torture_rpc_tcase_add_test(tcase, "ChangeServiceConfigW", -+ test_ChangeServiceConfigW); - - return suite; - } --- -2.24.1 - - -From 1168f1c392b3e315b5a4af9be793b93234420786 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Thu, 5 Mar 2020 20:42:21 +0100 -Subject: [PATCH 2/3] s4-torture: add ndr svcctl testsuite - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit c3fa0b2df9fc53dddcc3160b6a3dc751bbb389a4) ---- - librpc/idl/svcctl.idl | 2 +- - selftest/knownfail | 5 +++ - source4/torture/ndr/ndr.c | 1 + - source4/torture/ndr/svcctl.c | 85 +++++++++++++++++++++++++++++++++++ - source4/torture/wscript_build | 1 + - 5 files changed, 93 insertions(+), 1 deletion(-) - create mode 100644 source4/torture/ndr/svcctl.c - -diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl -index 671a1dc47be..e909bf2dbed 100644 ---- a/librpc/idl/svcctl.idl -+++ b/librpc/idl/svcctl.idl -@@ -188,7 +188,7 @@ import "misc.idl", "security.idl"; - SVCCTL_DISABLED = 0x00000004 - } svcctl_StartType; - -- WERROR svcctl_ChangeServiceConfigW( -+ [public] WERROR svcctl_ChangeServiceConfigW( - [in,ref] policy_handle *handle, - [in] uint32 type, - [in] svcctl_StartType start_type, -diff --git a/selftest/knownfail b/selftest/knownfail -index 20441c078b4..c5d4cdd9419 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -237,6 +237,11 @@ - # not implemented - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\) - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\) -+# broken IDL -+^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_IN -+^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_OUT -+^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_IN -+^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_OUT - # - # This makes less sense when not running against an AD DC - # -diff --git a/source4/torture/ndr/ndr.c b/source4/torture/ndr/ndr.c -index 32efe90757d..690301f31b1 100644 ---- a/source4/torture/ndr/ndr.c -+++ b/source4/torture/ndr/ndr.c -@@ -708,6 +708,7 @@ struct torture_suite *torture_local_ndr(TALLOC_CTX *mem_ctx) - torture_suite_add_suite(suite, ndr_krb5pac_suite(suite)); - torture_suite_add_suite(suite, ndr_cabinet_suite(suite)); - torture_suite_add_suite(suite, ndr_charset_suite(suite)); -+ torture_suite_add_suite(suite, ndr_svcctl_suite(suite)); - - torture_suite_add_simple_test(suite, "string terminator", - test_check_string_terminator); -diff --git a/source4/torture/ndr/svcctl.c b/source4/torture/ndr/svcctl.c -new file mode 100644 -index 00000000000..1c9404597cd ---- /dev/null -+++ b/source4/torture/ndr/svcctl.c -@@ -0,0 +1,85 @@ -+/* -+ Unix SMB/CIFS implementation. -+ test suite for svcctl ndr operations -+ -+ Copyright (C) Guenther Deschner 2020 -+ -+ This program is free software; you can redistribute it and/or modify -+ it under the terms of the GNU General Public License as published by -+ the Free Software Foundation; either version 3 of the License, or -+ (at your option) any later version. -+ -+ This program is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ GNU General Public License for more details. -+ -+ You should have received a copy of the GNU General Public License -+ along with this program. If not, see . -+*/ -+ -+#include "includes.h" -+#include "torture/ndr/ndr.h" -+#include "librpc/gen_ndr/ndr_svcctl.h" -+#include "torture/ndr/proto.h" -+#include "param/param.h" -+ -+static const uint8_t svcctl_ChangeServiceConfigW_req_data[] = { -+ 0x00, 0x00, 0x00, 0x00, 0xcd, 0x94, 0x05, 0x40, 0x30, 0x28, 0x00, 0x49, -+ 0x8d, 0xe4, 0x8e, 0x85, 0xb7, 0x19, 0x5c, 0x83, 0x10, 0x01, 0x00, 0x00, -+ 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 -+}; -+ -+static bool svcctl_ChangeServiceConfigW_req_check(struct torture_context *tctx, -+ struct svcctl_ChangeServiceConfigW *r) -+{ -+ struct policy_handle handle = { 0 }; -+ GUID_from_string("400594cd-2830-4900-8de4-8e85b7195c83", &handle.uuid); -+ -+ torture_assert_guid_equal(tctx, r->in.handle->uuid, handle.uuid, "handle"); -+ torture_assert_u32_equal(tctx, r->in.type, 0x00000110, "type"); -+ torture_assert_u32_equal(tctx, r->in.start_type, SVCCTL_AUTO_START, "start_type"); -+ torture_assert_u32_equal(tctx, r->in.error_control, SVCCTL_SVC_ERROR_NORMAL, "error_control"); -+ torture_assert_str_equal(tctx, r->in.binary_path, NULL, "binary_path"); -+ torture_assert_str_equal(tctx, r->in.load_order_group, NULL, "load_order_group"); -+ torture_assert_str_equal(tctx, r->in.dependencies, NULL, "dependencies"); -+ torture_assert_str_equal(tctx, r->in.service_start_name, NULL, "service_start_name"); -+ torture_assert_str_equal(tctx, r->in.password, NULL, "password"); -+ torture_assert_str_equal(tctx, r->in.display_name, NULL, "display_name"); -+ -+ return true; -+} -+ -+static const uint8_t svcctl_ChangeServiceConfigW_rep_data[] = { -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 -+}; -+ -+static bool svcctl_ChangeServiceConfigW_rep_check(struct torture_context *tctx, -+ struct svcctl_ChangeServiceConfigW *r) -+{ -+ torture_assert(tctx, r->out.tag_id == NULL, "tag_id"); -+ torture_assert_werr_ok(tctx, r->out.result, "result"); -+ -+ return true; -+} -+ -+struct torture_suite *ndr_svcctl_suite(TALLOC_CTX *ctx) -+{ -+ struct torture_suite *suite = torture_suite_create(ctx, "svcctl"); -+ -+ torture_suite_add_ndr_pull_fn_test(suite, -+ svcctl_ChangeServiceConfigW, -+ svcctl_ChangeServiceConfigW_req_data, -+ NDR_IN, -+ svcctl_ChangeServiceConfigW_req_check); -+ -+ torture_suite_add_ndr_pull_fn_test(suite, -+ svcctl_ChangeServiceConfigW, -+ svcctl_ChangeServiceConfigW_rep_data, -+ NDR_OUT, -+ svcctl_ChangeServiceConfigW_rep_check); -+ return suite; -+} -diff --git a/source4/torture/wscript_build b/source4/torture/wscript_build -index 65af160b322..05a6fbcbf14 100644 ---- a/source4/torture/wscript_build -+++ b/source4/torture/wscript_build -@@ -71,6 +71,7 @@ bld.SAMBA_SUBSYSTEM('TORTURE_NDR', - ndr/winspool.c - ndr/cabinet.c - ndr/charset.c -+ ndr/svcctl.c - ''', - autoproto='ndr/proto.h', - deps='torture krb5samba', --- -2.24.1 - - -From 28d86d48adfee6c1d03ea192b69be87a0b9ce400 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Wed, 4 Mar 2020 15:23:43 +0100 -Subject: [PATCH 3/3] librpc: fix IDL for svcctl_ChangeServiceConfigW - -Found while trying to run winexe against Windows Server 2019. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit ebda529b59105e9b70cc74377fe4d54cc16b4f37) ---- - examples/winexe/winexe.c | 2 ++ - librpc/idl/svcctl.idl | 23 ++++++++++++++++++----- - selftest/knownfail | 5 ----- - source4/torture/ndr/svcctl.c | 3 +++ - source4/torture/rpc/svcctl.c | 3 +++ - 5 files changed, 26 insertions(+), 10 deletions(-) - -diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c -index 22f748b1d45..fc6b15f8e52 100644 ---- a/examples/winexe/winexe.c -+++ b/examples/winexe/winexe.c -@@ -625,8 +625,10 @@ static NTSTATUS winexe_svc_install( - NULL, /* load_order_group */ - NULL, /* tag_id */ - NULL, /* dependencies */ -+ 0, /* dwDependSize */ - NULL, /* service_start_name */ - NULL, /* password */ -+ 0, /* dwPwSize */ - NULL, /* display_name */ - &werr); - -diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl -index e909bf2dbed..a9dd3dec990 100644 ---- a/librpc/idl/svcctl.idl -+++ b/librpc/idl/svcctl.idl -@@ -13,6 +13,17 @@ import "misc.idl", "security.idl"; - helpstring("Service Control") - ] interface svcctl - { -+ const int MAX_SERVICE_NAME_LENGTH = 256; -+ const short SC_MAX_DEPEND_SIZE = 4 * 1024; -+ const short SC_MAX_NAME_LENGTH = MAX_SERVICE_NAME_LENGTH + 1; -+ const short SC_MAX_PATH_LENGTH = 32 * 1024; -+ const short SC_MAX_PWD_SIZE = 514; -+ const short SC_MAX_COMPUTER_NAME_LENGTH = 1024; -+ const short SC_MAX_ACCOUNT_NAME_LENGTH = 2 * 1024; -+ const short SC_MAX_COMMENT_LENGTH = 128; -+ const short SC_MAX_ARGUMENT_LENGTH = 1024; -+ const short SC_MAX_ARGUMENTS = 1024; -+ - typedef struct { - uint32 is_locked; - [string,charset(UTF16)] uint16 *lock_owner; -@@ -195,11 +206,13 @@ import "misc.idl", "security.idl"; - [in] svcctl_ErrorControl error_control, - [in,unique] [string,charset(UTF16)] uint16 *binary_path, - [in,unique] [string,charset(UTF16)] uint16 *load_order_group, -- [out,ref] uint32 *tag_id, -- [in,unique] [string,charset(UTF16)] uint16 *dependencies, -- [in,unique] [string,charset(UTF16)] uint16 *service_start_name, -- [in,unique] [string,charset(UTF16)] uint16 *password, -- [in,unique] [string,charset(UTF16)] uint16 *display_name -+ [in,out,unique] uint32 *tag_id, -+ [in,unique,size_is(dwDependSize)] [string,charset(UTF16)] uint16 *dependencies, -+ [in,range(0, SC_MAX_DEPEND_SIZE)] uint32 dwDependSize, -+ [in,unique,range(0, SC_MAX_ACCOUNT_NAME_LENGTH)] [string,charset(UTF16)] uint16 *service_start_name, -+ [in,unique,size_is(dwPwSize)] [string,charset(UTF16)] uint16 *password, -+ [in,range(0, SC_MAX_PWD_SIZE)] uint32 dwPwSize, -+ [in,unique,range(0, SC_MAX_NAME_LENGTH)] [string,charset(UTF16)] uint16 *display_name - ); - - /*****************/ -diff --git a/selftest/knownfail b/selftest/knownfail -index c5d4cdd9419..20441c078b4 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -237,11 +237,6 @@ - # not implemented - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\) - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\) --# broken IDL --^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_IN --^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_OUT --^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_IN --^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_OUT - # - # This makes less sense when not running against an AD DC - # -diff --git a/source4/torture/ndr/svcctl.c b/source4/torture/ndr/svcctl.c -index 1c9404597cd..6592beda02e 100644 ---- a/source4/torture/ndr/svcctl.c -+++ b/source4/torture/ndr/svcctl.c -@@ -45,9 +45,12 @@ static bool svcctl_ChangeServiceConfigW_req_check(struct torture_context *tctx, - torture_assert_u32_equal(tctx, r->in.error_control, SVCCTL_SVC_ERROR_NORMAL, "error_control"); - torture_assert_str_equal(tctx, r->in.binary_path, NULL, "binary_path"); - torture_assert_str_equal(tctx, r->in.load_order_group, NULL, "load_order_group"); -+ torture_assert(tctx, r->in.tag_id == NULL, "tag_id"); - torture_assert_str_equal(tctx, r->in.dependencies, NULL, "dependencies"); -+ torture_assert_u32_equal(tctx, r->in.dwDependSize, 0, "dwDependSize"); - torture_assert_str_equal(tctx, r->in.service_start_name, NULL, "service_start_name"); - torture_assert_str_equal(tctx, r->in.password, NULL, "password"); -+ torture_assert_u32_equal(tctx, r->in.dwPwSize, 0, "dwPwSize"); - torture_assert_str_equal(tctx, r->in.display_name, NULL, "display_name"); - - return true; -diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c -index bd16ed4627d..746b399360e 100644 ---- a/source4/torture/rpc/svcctl.c -+++ b/source4/torture/rpc/svcctl.c -@@ -675,9 +675,12 @@ static bool test_ChangeServiceConfigW(struct torture_context *tctx, - r.in.binary_path = NULL; - r.in.load_order_group = NULL; - r.in.dependencies = NULL; -+ r.in.dwDependSize = 0; - r.in.service_start_name = NULL; - r.in.password = NULL; -+ r.in.dwPwSize = 0; - r.in.display_name = NULL; -+ r.in.tag_id = NULL; - r.out.tag_id = NULL; - - status = dcerpc_svcctl_ChangeServiceConfigW_r(b, tctx, &r); --- -2.24.1 - diff --git a/samba.spec b/samba.spec index d2dc2a1..e4fd049 100644 --- a/samba.spec +++ b/samba.spec @@ -8,9 +8,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 6 +%define main_release 0 -%define samba_version 4.12.0 +%define samba_version 4.12.1 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -125,7 +125,6 @@ Source14: samba.pamd Source201: README.downgrade Patch100: new_mit_118.patch -Patch101: samba-4.12.0-winexe.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3560,6 +3559,9 @@ fi %endif %changelog +* Tue Apr 07 2020 Guenther Deschner - 4.12.1-0 +- Update to Samba 4.12.1 + * Sat Mar 21 2020 Alexander Bokovoy - 4.12.0-6 - Fix samba_requires_eq macro definition - Resolves rhbz#1815739 diff --git a/sources b/sources index 85d472a..15a3c5c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.0.tar.xz) = d9d99136702d339803c96004d68c978405759059e6f71fa303b52d21f4bf5093c43bcec44b22aeee3610a1cdf033edf758ccb4c551de20b7d66632e9a23866b1 -SHA512 (samba-4.12.0.tar.asc) = b833e0917b3b244ce727d80c0b600a88aa986455b7dfa24df1306fd848e2d192a46e2dfd5a5e878cd0ca3f76e0827ee42f704f93ac86b063e57027b786d262f0 +SHA512 (samba-4.12.1.tar.xz) = 46b68312cd0b390ccb0644cc48a551c5edcd336fcb4ca9fea7602466f3127b6238037a3372933427739c927bfa96816c6c70d96627cce740bd98f4c6ba984a2d +SHA512 (samba-4.12.1.tar.asc) = a2abe3445ee2eb9b2b5a97fad89b0cf59d31d8e90a008584e14e6a8d63c28e7f7c15644c9ebd67b535c80ec5849ea5770ba078c437ff20ba3b5773f90e20eed6 From 9449c82b064eba58683e3f2ac082b755136fee36 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 12 Apr 2020 11:01:50 +0300 Subject: [PATCH 03/26] Revert POSIX stat tuning code Resolves: rhbz#1801442 --- ...-to-find-posix-stat-info-in-SMBC_get.patch | 91 +++++++++++++++++++ samba.spec | 7 +- 2 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch diff --git a/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch b/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch new file mode 100644 index 0000000..ba901a4 --- /dev/null +++ b/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch @@ -0,0 +1,91 @@ +From 686ea46cbc9538355815fe800e441d67fee6a9db Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Thu, 19 Mar 2020 11:01:41 +0100 +Subject: [PATCH] libsmb: Don't try to find posix stat info in SMBC_getatr() + +This wrongly used "frame" instead of "fname", which can never have +worked. A first attempt to fix in 51551e0d53fa6 caused a few followup +patches in an attempt to clean up the test failures 51551e0d53fa6 +introduced. They were reverted after a few discussions. So rather than +changing behaviour, just remove the code that introduced the valgrind +error again. + +Signed-off-by: Volker Lendecke +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Jeremy Allison +Autobuild-Date(master): Fri Mar 20 05:06:07 UTC 2020 on sn-devel-184 + +(cherry picked from commit 39c910fd9cba3caf7414274b678b9eee33d7e20b) +--- + source3/include/libsmb_internal.h | 1 - + source3/libsmb/libsmb_file.c | 20 -------------------- + source3/libsmb/libsmb_server.c | 9 --------- + 3 files changed, 30 deletions(-) + +diff --git a/source3/include/libsmb_internal.h b/source3/include/libsmb_internal.h +index 21a11c1a024..feedddd0877 100644 +--- a/source3/include/libsmb_internal.h ++++ b/source3/include/libsmb_internal.h +@@ -76,7 +76,6 @@ typedef struct DOS_ATTR_DESC { + struct _SMBCSRV { + struct cli_state *cli; + dev_t dev; +- bool try_posixinfo; + bool no_pathinfo; + bool no_pathinfo2; + bool no_pathinfo3; +diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c +index 1577010e490..f0a16c61a83 100644 +--- a/source3/libsmb/libsmb_file.c ++++ b/source3/libsmb/libsmb_file.c +@@ -504,26 +504,6 @@ SMBC_getatr(SMBCCTX * context, + return False; + } + +- if (srv->try_posixinfo) { +- SMB_STRUCT_STAT sbuf; +- +- status = cli_posix_stat(targetcli, frame, &sbuf); +- if (NT_STATUS_IS_OK(status)) { +- setup_stat_from_stat_ex(&sbuf, path, sb); +- +- TALLOC_FREE(frame); +- return true; +- } +- if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED) || +- NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL)) { +- /* +- * Turn this off if the server doesn't +- * support it. +- */ +- srv->try_posixinfo = false; +- } +- } +- + if (!srv->no_pathinfo2) { + status = cli_qpathinfo2(targetcli, + targetpath, +diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index d4f71d8c8b7..0067df48cac 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -657,15 +657,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, + ZERO_STRUCTP(srv); + DLIST_ADD(srv->cli, c); + srv->dev = (dev_t)(str_checksum(server) ^ str_checksum(share)); +- srv->try_posixinfo = false; +- /* +- * Until SMB2 POSIX is done, only +- * try POSIX stat on SMB1 with POSIX capabilities. +- */ +- if ((smbXcli_conn_protocol(c->conn) < PROTOCOL_SMB2_02) && +- (smb1cli_conn_capabilities(c->conn) & CAP_UNIX)) { +- srv->try_posixinfo = true; +- } + srv->no_pathinfo = False; + srv->no_pathinfo2 = False; + srv->no_pathinfo3 = False; +-- +2.26.0 + diff --git a/samba.spec b/samba.spec index e4fd049..fa722cc 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.12.1 %define talloc_version 2.3.1 @@ -125,6 +125,7 @@ Source14: samba.pamd Source201: README.downgrade Patch100: new_mit_118.patch +Patch101: 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3559,6 +3560,10 @@ fi %endif %changelog +* Sun Apr 12 2020 Alexander Bokovoy - 4.12.1-1 +- Revert POSIX stat tuning in libsmbclient +- Resolves rhbz#1801442 + * Tue Apr 07 2020 Guenther Deschner - 4.12.1-0 - Update to Samba 4.12.1 From 62cd094850a5dab9bbda81230ed9cc78590f908e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 28 Apr 2020 11:07:56 +0200 Subject: [PATCH 04/26] Update to Samba 4.12.2 resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 Guenther --- .gitignore | 2 ++ samba.spec | 13 ++++++++++--- sources | 4 ++-- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 802994e..fe44f1a 100644 --- a/.gitignore +++ b/.gitignore @@ -201,3 +201,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.0.tar.asc /samba-4.12.1.tar.xz /samba-4.12.1.tar.asc +/samba-4.12.2.tar.xz +/samba-4.12.2.tar.asc diff --git a/samba.spec b/samba.spec index fa722cc..856c9c8 100644 --- a/samba.spec +++ b/samba.spec @@ -8,13 +8,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 0 -%define samba_version 4.12.1 +%define samba_version 4.12.2 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.1.1 +%define ldb_version 2.1.2 # This should be rc1 or nil %define pre_release %nil @@ -2299,6 +2299,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc @@ -2484,6 +2485,7 @@ fi %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %{python3_sitearch}/samba/tests/krb5_credentials.py +%{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py @@ -3560,6 +3562,11 @@ fi %endif %changelog +* Tue Apr 28 2020 Guenther Deschner - 4.12.2-0 +- Update to Samba 4.12.2 +- resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 +- resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 + * Sun Apr 12 2020 Alexander Bokovoy - 4.12.1-1 - Revert POSIX stat tuning in libsmbclient - Resolves rhbz#1801442 diff --git a/sources b/sources index 15a3c5c..ada3fb2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.1.tar.xz) = 46b68312cd0b390ccb0644cc48a551c5edcd336fcb4ca9fea7602466f3127b6238037a3372933427739c927bfa96816c6c70d96627cce740bd98f4c6ba984a2d -SHA512 (samba-4.12.1.tar.asc) = a2abe3445ee2eb9b2b5a97fad89b0cf59d31d8e90a008584e14e6a8d63c28e7f7c15644c9ebd67b535c80ec5849ea5770ba078c437ff20ba3b5773f90e20eed6 +SHA512 (samba-4.12.2.tar.xz) = ab89b8f6f0c14b5e8712bf281f7f2cc8e3dae6a69147a826bb58538ed5a22457f4d9a1ec500cbd49da42a5918fe2dd1f2726bb9a7838d9ee5507424ecf75774b +SHA512 (samba-4.12.2.tar.asc) = b585cc5e919405a0910f1aea303959e92e293645296654805c65f20b92bd58098fc08be82ae17a9a281e04339f6af5579658f1b5c768498c75127c9dc254cd3d From c3fc35c53dfad24526e5e2b2dd13449ca410c247 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 4 May 2020 16:30:30 +0200 Subject: [PATCH 05/26] Add support for building the new experimental io_uring VFS module Guenther --- samba-4.12.3-vfs_io_uring-bz14361.patch | 2423 +++++++++++++++++++++++ samba.spec | 18 +- 2 files changed, 2440 insertions(+), 1 deletion(-) create mode 100644 samba-4.12.3-vfs_io_uring-bz14361.patch diff --git a/samba-4.12.3-vfs_io_uring-bz14361.patch b/samba-4.12.3-vfs_io_uring-bz14361.patch new file mode 100644 index 0000000..ad796ba --- /dev/null +++ b/samba-4.12.3-vfs_io_uring-bz14361.patch @@ -0,0 +1,2423 @@ +From d7ab59f80f535e960780ec3a643101dfe96627ac Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 11 May 2020 12:37:41 +0200 +Subject: [PATCH 01/31] s4:torture: add tests to test the SMB2 read/write + offset/length boundaries + +[MS-FSA] 2.1.5.2 Server Requests a Read and +2.1.5.3 Server Requests a Write define some contraints. + +These tests demonstrate that ((int64_t)offset) < 0) is +not allowed for both reads and writes for SMB. +Also the special case for writes at offset -2 is not possible +nor the append mode with offset < 0. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 54de0e4a3e46a53db5262963e64b109c567554a1) +--- + selftest/knownfail.d/rw-invalid | 2 + + source4/torture/smb2/read_write.c | 189 ++++++++++++++++++++++++++++++ + 2 files changed, 191 insertions(+) + create mode 100644 selftest/knownfail.d/rw-invalid + +diff --git a/selftest/knownfail.d/rw-invalid b/selftest/knownfail.d/rw-invalid +new file mode 100644 +index 00000000000..c6f11e03d20 +--- /dev/null ++++ b/selftest/knownfail.d/rw-invalid +@@ -0,0 +1,2 @@ ++samba3.smb2.rw.invalid ++samba4.smb2.rw.invalid +diff --git a/source4/torture/smb2/read_write.c b/source4/torture/smb2/read_write.c +index bc8898cec31..b0eea55d7f1 100644 +--- a/source4/torture/smb2/read_write.c ++++ b/source4/torture/smb2/read_write.c +@@ -23,8 +23,19 @@ + #include "libcli/smb2/smb2.h" + #include "libcli/smb2/smb2_calls.h" + #include "torture/torture.h" ++#include "torture/util.h" + #include "torture/smb2/proto.h" + ++#define CHECK_STATUS(_status, _expected) \ ++ torture_assert_ntstatus_equal_goto(torture, _status, _expected, \ ++ ret, done, "Incorrect status") ++ ++#define CHECK_VALUE(v, correct) \ ++ torture_assert_int_equal_goto(torture, v, correct, \ ++ ret, done, "Incorrect value") ++ ++#define FNAME "smb2_writetest.dat" ++ + static bool run_smb2_readwritetest(struct torture_context *tctx, + struct smb2_tree *t1, struct smb2_tree *t2) + { +@@ -150,12 +161,190 @@ static bool run_smb2_wrap_readwritetest(struct torture_context *tctx, + return run_smb2_readwritetest(tctx, tree1, tree1); + } + ++static bool test_rw_invalid(struct torture_context *torture, struct smb2_tree *tree) ++{ ++ bool ret = true; ++ NTSTATUS status; ++ struct smb2_handle h; ++ uint8_t buf[64*1024]; ++ struct smb2_read rd; ++ struct smb2_write w = {0}; ++ TALLOC_CTX *tmp_ctx = talloc_new(tree); ++ ++ ZERO_STRUCT(buf); ++ ++ smb2_util_unlink(tree, FNAME); ++ ++ status = torture_smb2_testfile(tree, FNAME, &h); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ ++ status = smb2_util_write(tree, h, buf, 0, ARRAY_SIZE(buf)); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ ++ ZERO_STRUCT(rd); ++ rd.in.file.handle = h; ++ rd.in.length = 10; ++ rd.in.offset = 0; ++ rd.in.min_count = 1; ++ ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(rd.out.data.length, 10); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 10; ++ rd.in.offset = sizeof(buf); ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_END_OF_FILE); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = sizeof(buf); ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(rd.out.data.length, 0); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 1; ++ rd.in.offset = INT64_MAX - 1; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_END_OF_FILE); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = INT64_MAX; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(rd.out.data.length, 0); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 1; ++ rd.in.offset = INT64_MAX; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = (uint64_t)INT64_MAX + 1; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = (uint64_t)INT64_MIN; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = (uint64_t)(int64_t)-1; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = (uint64_t)(int64_t)-2; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = (uint64_t)(int64_t)-3; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = (int64_t)-1; ++ w.in.data.data = buf; ++ w.in.data.length = ARRAY_SIZE(buf); ++ ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = (int64_t)-2; ++ w.in.data.data = buf; ++ w.in.data.length = ARRAY_SIZE(buf); ++ ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = INT64_MIN; ++ w.in.data.data = buf; ++ w.in.data.length = 1; ++ ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = INT64_MIN; ++ w.in.data.data = buf; ++ w.in.data.length = 0; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = INT64_MAX; ++ w.in.data.data = buf; ++ w.in.data.length = 0; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(w.out.nwritten, 0); ++ ++ w.in.file.handle = h; ++ w.in.offset = INT64_MAX; ++ w.in.data.data = buf; ++ w.in.data.length = 1; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = (uint64_t)INT64_MAX + 1; ++ w.in.data.data = buf; ++ w.in.data.length = 0; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = 0xfffffff0000; /* MAXFILESIZE */ ++ w.in.data.data = buf; ++ w.in.data.length = 1; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = 0xfffffff0000 - 1; /* MAXFILESIZE - 1 */ ++ w.in.data.data = buf; ++ w.in.data.length = 1; ++ status = smb2_write(tree, &w); ++ if (TARGET_IS_SAMBA3(torture) || TARGET_IS_SAMBA4(torture)) { ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(w.out.nwritten, 1); ++ } else { ++ CHECK_STATUS(status, NT_STATUS_DISK_FULL); ++ } ++ ++ w.in.file.handle = h; ++ w.in.offset = 0xfffffff0000; /* MAXFILESIZE */ ++ w.in.data.data = buf; ++ w.in.data.length = 0; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(w.out.nwritten, 0); ++ ++done: ++ talloc_free(tmp_ctx); ++ return ret; ++} ++ + struct torture_suite *torture_smb2_readwrite_init(TALLOC_CTX *ctx) + { + struct torture_suite *suite = torture_suite_create(ctx, "rw"); + + torture_suite_add_2smb2_test(suite, "rw1", run_smb2_readwritetest); + torture_suite_add_2smb2_test(suite, "rw2", run_smb2_wrap_readwritetest); ++ torture_suite_add_1smb2_test(suite, "invalid", test_rw_invalid); + + suite->description = talloc_strdup(suite, "SMB2 Samba4 Read/Write"); + +-- +2.20.1 + + +From cb8661162b9d344288a776a9e4ff29a47f2cc37d Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 13:06:54 +0200 +Subject: [PATCH 02/31] lib: util: Add sys_valid_io_range() + +This implements the contraints of +[MS-FSA] 2.1.5.2 Server Requests a Read. + +The special handling of [MS-FSA] 2.1.5.3 Server Requests a Write +with offset < 0, should be handled by higher layers! +Which means the check can also be used for writes. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit e02cbd5c3ea6903d2b7b43c3193b8662d029ecdd) +--- + lib/util/sys_rw.c | 24 ++++++++++++++++++++++++ + lib/util/sys_rw.h | 1 + + 2 files changed, 25 insertions(+) + +diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c +index 9a6cdcaa606..6fa7ca57365 100644 +--- a/lib/util/sys_rw.c ++++ b/lib/util/sys_rw.c +@@ -24,6 +24,30 @@ + #include "system/filesys.h" + #include "lib/util/sys_rw.h" + ++bool sys_valid_io_range(off_t offset, size_t length) ++{ ++ uint64_t last_byte_ofs; ++ ++ if (offset < 0) { ++ return false; ++ } ++ ++ if (offset > INT64_MAX) { ++ return false; ++ } ++ ++ if (length > UINT32_MAX) { ++ return false; ++ } ++ ++ last_byte_ofs = (uint64_t)offset + (uint64_t)length; ++ if (last_byte_ofs > INT64_MAX) { ++ return false; ++ } ++ ++ return true; ++} ++ + /******************************************************************* + A read wrapper that will deal with EINTR/EWOULDBLOCK + ********************************************************************/ +diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h +index ab456d87b22..70864cb2b74 100644 +--- a/lib/util/sys_rw.h ++++ b/lib/util/sys_rw.h +@@ -27,6 +27,7 @@ + + struct iovec; + ++bool sys_valid_io_range(off_t offset, size_t length); + ssize_t sys_read(int fd, void *buf, size_t count); + void sys_read_v(int fd, void *buf, size_t count); + ssize_t sys_write(int fd, const void *buf, size_t count); +-- +2.20.1 + + +From 640a6715dacfaf7ec9a2b4e4b36fa22b625f571f Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:32:48 -0700 +Subject: [PATCH 03/31] lib: util: Add sys_pread_full(). + +A pread wrapper that will deal with EINTR and never return a short +read unless pread returns zero meaning EOF. + +Thread-safe so may be used as a replacement for pread +inside pread_do() thread functions. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Pair-Programmed-With: Stefan Metzmacher + +Signed-off-by: Jeremy Allison +Signed-off-by: Stefan Metzmacher +(cherry picked from commit 36af33bf9fcdf93fce5ef1520fcb7ddbb07b355e) +--- + lib/util/sys_rw.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++ + lib/util/sys_rw.h | 1 + + 2 files changed, 49 insertions(+) + +diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c +index 6fa7ca57365..bfeb2e6b466 100644 +--- a/lib/util/sys_rw.c ++++ b/lib/util/sys_rw.c +@@ -143,6 +143,54 @@ ssize_t sys_pread(int fd, void *buf, size_t count, off_t off) + return ret; + } + ++/******************************************************************* ++ A pread wrapper that will deal with EINTR and never return a short ++ read unless pread returns zero meaning EOF. ++********************************************************************/ ++ ++ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off) ++{ ++ ssize_t total_read = 0; ++ uint8_t *curr_buf = (uint8_t *)buf; ++ size_t curr_count = count; ++ off_t curr_off = off; ++ bool ok; ++ ++ ok = sys_valid_io_range(off, count); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } ++ ++ while (curr_count != 0) { ++ ssize_t ret = sys_pread(fd, ++ curr_buf, ++ curr_count, ++ curr_off); ++ ++ if (ret == -1) { ++ return -1; ++ } ++ if (ret == 0) { ++ /* EOF */ ++ break; ++ } ++ ++ if (ret > curr_count) { ++ errno = EIO; ++ return -1; ++ } ++ ++ curr_buf += ret; ++ curr_count -= ret; ++ curr_off += ret; ++ ++ total_read += ret; ++ } ++ ++ return total_read; ++} ++ + /******************************************************************* + A write wrapper that will deal with EINTR + ********************************************************************/ +diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h +index 70864cb2b74..1e0dd3730a6 100644 +--- a/lib/util/sys_rw.h ++++ b/lib/util/sys_rw.h +@@ -34,6 +34,7 @@ ssize_t sys_write(int fd, const void *buf, size_t count); + void sys_write_v(int fd, const void *buf, size_t count); + ssize_t sys_writev(int fd, const struct iovec *iov, int iovcnt); + ssize_t sys_pread(int fd, void *buf, size_t count, off_t off); ++ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off); + ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off); + + #endif +-- +2.20.1 + + +From c1f14bb9bb4dc2601814dda398e361a9ef097b12 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:34:32 -0700 +Subject: [PATCH 04/31] lib: util: Add sys_pwrite_full(). + +A pwrite wrapper that will deal with EINTR and never return a short +write unless the file system returns an error. Copes with the +unspecified edge condition of pwrite returning zero by changing +the return to -1, errno = ENOSPC. + +Thread-safe so may be used as a replacement for pwrite +inside pwrite_do() thread functions. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Pair-Programmed-With: Stefan Metzmacher + +Signed-off-by: Jeremy Allison +Signed-off-by: Stefan Metzmacher +(cherry picked from commit 3ba7a89cea85d134eacf1e624e011fe6f66146fc) +--- + lib/util/sys_rw.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++ + lib/util/sys_rw.h | 1 + + 2 files changed, 50 insertions(+) + +diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c +index bfeb2e6b466..d74395fc409 100644 +--- a/lib/util/sys_rw.c ++++ b/lib/util/sys_rw.c +@@ -204,3 +204,52 @@ ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off) + } while (ret == -1 && errno == EINTR); + return ret; + } ++ ++/******************************************************************* ++ A pwrite wrapper that will deal with EINTR and never allow a short ++ write unless the file system returns an error. ++********************************************************************/ ++ ++ssize_t sys_pwrite_full(int fd, const void *buf, size_t count, off_t off) ++{ ++ ssize_t total_written = 0; ++ const uint8_t *curr_buf = (const uint8_t *)buf; ++ size_t curr_count = count; ++ off_t curr_off = off; ++ bool ok; ++ ++ ok = sys_valid_io_range(off, count); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } ++ ++ while (curr_count != 0) { ++ ssize_t ret = sys_pwrite(fd, ++ curr_buf, ++ curr_count, ++ curr_off); ++ ++ if (ret == -1) { ++ return -1; ++ } ++ if (ret == 0) { ++ /* Ensure we can never spin. */ ++ errno = ENOSPC; ++ return -1; ++ } ++ ++ if (ret > curr_count) { ++ errno = EIO; ++ return -1; ++ } ++ ++ curr_buf += ret; ++ curr_count -= ret; ++ curr_off += ret; ++ ++ total_written += ret; ++ } ++ ++ return total_written; ++} +diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h +index 1e0dd3730a6..b224ecb30ac 100644 +--- a/lib/util/sys_rw.h ++++ b/lib/util/sys_rw.h +@@ -36,5 +36,6 @@ ssize_t sys_writev(int fd, const struct iovec *iov, int iovcnt); + ssize_t sys_pread(int fd, void *buf, size_t count, off_t off); + ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off); + ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off); ++ssize_t sys_pwrite_full(int fd, const void *buf, size_t count, off_t off); + + #endif +-- +2.20.1 + + +From c4a08bd0b1ecebdbbbbbb257696e0f9b93eebeaa Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 11 May 2020 18:18:24 +0200 +Subject: [PATCH 05/31] smb2_server: fix smbd_smb2_request_verify_sizes() for + SMB2_OP_WRITE + +Writes with a length of 0 are allowed. + +The readfile related check we had before was not really useful +as min_dyn_len can only every be 0 or 1 (and for SMB2_OP_WRITE it's +always 1). So we checked + if (unread_bytes > 0) { + if (unread_bytes < 1) { + return error; + } + } + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit a6eee38ba2f89280676f0a32d26745afd95b551c) +--- + source3/smbd/smb2_server.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c +index 8c66d74c8de..88937ac19b0 100644 +--- a/source3/smbd/smb2_server.c ++++ b/source3/smbd/smb2_server.c +@@ -2073,16 +2073,8 @@ NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req, + switch (opcode) { + case SMB2_OP_IOCTL: + case SMB2_OP_GETINFO: +- min_dyn_size = 0; +- break; + case SMB2_OP_WRITE: +- if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) { +- if (req->smb1req->unread_bytes < min_dyn_size) { +- return NT_STATUS_INVALID_PARAMETER; +- } +- +- min_dyn_size = 0; +- } ++ min_dyn_size = 0; + break; + } + +-- +2.20.1 + + +From 74fadf2f083daaf4358a9b64c1092586595894d5 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 11 May 2020 18:18:24 +0200 +Subject: [PATCH 06/31] s3:smbd: handle 0 length writes as no-op. + +They should never touch the SMB_VFS layer +and they never trigger an DISK_FULL error. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit ba68f21286c2c2f1fef8bf8c9cd500a622077887) +--- + source3/smbd/aio.c | 5 +++++ + source3/smbd/fileio.c | 4 ++++ + 2 files changed, 9 insertions(+) + +diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c +index cf35f3297ec..088ea603788 100644 +--- a/source3/smbd/aio.c ++++ b/source3/smbd/aio.c +@@ -339,6 +339,11 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, + state->fsp = fsp; + state->write_through = write_through; + ++ if (n == 0) { ++ tevent_req_done(req); ++ return tevent_req_post(req, ev); ++ } ++ + subreq = SMB_VFS_PWRITE_SEND(state, ev, fsp, data, n, offset); + if (tevent_req_nomem(subreq, req)) { + return tevent_req_post(req, ev); +diff --git a/source3/smbd/fileio.c b/source3/smbd/fileio.c +index 31d5b7510b7..f4a3dde66b7 100644 +--- a/source3/smbd/fileio.c ++++ b/source3/smbd/fileio.c +@@ -70,6 +70,10 @@ static ssize_t real_write_file(struct smb_request *req, + { + ssize_t ret; + ++ if (n == 0) { ++ return 0; ++ } ++ + fsp->fh->pos = pos; + if (pos && lp_strict_allocate(SNUM(fsp->conn) && + !fsp->is_sparse)) { +-- +2.20.1 + + +From c593b105e646792cf19901e94ed764dc3b50d752 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 11 May 2020 22:00:37 +0200 +Subject: [PATCH 07/31] s3:smbd: add vfs_valid_{pread,pwrite}_range() helper + functions + +These implement the SMB2 visible behavior of the [MS-FSA] +2.1.5.2 Server Requests a Read and 2.1.5.3 Server Requests a Write +constraints. Note that offset < 0 is not allowed over SMB. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 70fa4b884d2c22669984c25fe757c2fc528f7331) +--- + source3/smbd/proto.h | 2 ++ + source3/smbd/vfs.c | 32 ++++++++++++++++++++++++++++++++ + 2 files changed, 34 insertions(+) + +diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h +index 8e33c473d44..60941ce6c1b 100644 +--- a/source3/smbd/proto.h ++++ b/source3/smbd/proto.h +@@ -1246,6 +1246,8 @@ void sys_utmp_yield(const char *username, const char *hostname, + bool vfs_init_custom(connection_struct *conn, const char *vfs_object); + bool smbd_vfs_init(connection_struct *conn); + NTSTATUS vfs_file_exist(connection_struct *conn, struct smb_filename *smb_fname); ++bool vfs_valid_pread_range(off_t offset, size_t length); ++bool vfs_valid_pwrite_range(off_t offset, size_t length); + ssize_t vfs_pwrite_data(struct smb_request *req, + files_struct *fsp, + const char *buffer, +diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c +index 7dc15158ccb..566eed35d9b 100644 +--- a/source3/smbd/vfs.c ++++ b/source3/smbd/vfs.c +@@ -32,6 +32,7 @@ + #include "ntioctl.h" + #include "lib/util/tevent_unix.h" + #include "lib/util/tevent_ntstatus.h" ++#include "lib/util/sys_rw.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_VFS +@@ -399,6 +400,37 @@ NTSTATUS vfs_file_exist(connection_struct *conn, struct smb_filename *smb_fname) + return NT_STATUS_OBJECT_NAME_NOT_FOUND; + } + ++bool vfs_valid_pread_range(off_t offset, size_t length) ++{ ++ return sys_valid_io_range(offset, length); ++} ++ ++bool vfs_valid_pwrite_range(off_t offset, size_t length) ++{ ++ /* ++ * See MAXFILESIZE in [MS-FSA] 2.1.5.3 Server Requests a Write ++ */ ++ static const uint64_t maxfilesize = 0xfffffff0000; ++ uint64_t last_byte_ofs; ++ bool ok; ++ ++ ok = sys_valid_io_range(offset, length); ++ if (!ok) { ++ return false; ++ } ++ ++ if (length == 0) { ++ return true; ++ } ++ ++ last_byte_ofs = offset + length; ++ if (last_byte_ofs > maxfilesize) { ++ return false; ++ } ++ ++ return true; ++} ++ + ssize_t vfs_pwrite_data(struct smb_request *req, + files_struct *fsp, + const char *buffer, +-- +2.20.1 + + +From 9e1f6bb08d5e814e9894d643c46ff1aac6a8da0b Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 11 May 2020 18:18:24 +0200 +Subject: [PATCH 08/31] smbd: add vfs_valid_{pread,pwrite}_range() checks where + needed + +I checked all callers of SMB_VFS_PWRITE[_SEND](), +all callers of SMB_VFS_PREAD[_SEND]() and also +places where we append to the file and allocate +more space. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 6fa753a1a67d563cd22d0cad73ae15ee267512fc) +--- + selftest/knownfail.d/rw-invalid | 3 +-- + source3/modules/vfs_default.c | 7 +++++++ + source3/smbd/aio.c | 19 ++++++++++++++++++ + source3/smbd/fileio.c | 14 ++++++++++++++ + source3/smbd/vfs.c | 34 +++++++++++++++++++++++++++++++-- + 5 files changed, 73 insertions(+), 4 deletions(-) + +diff --git a/selftest/knownfail.d/rw-invalid b/selftest/knownfail.d/rw-invalid +index c6f11e03d20..ac5fe573239 100644 +--- a/selftest/knownfail.d/rw-invalid ++++ b/selftest/knownfail.d/rw-invalid +@@ -1,2 +1 @@ +-samba3.smb2.rw.invalid +-samba4.smb2.rw.invalid ++samba4.smb2.rw.invalid.ad_dc_ntvfs +diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c +index a30f3ba1d31..3511c548166 100644 +--- a/source3/modules/vfs_default.c ++++ b/source3/modules/vfs_default.c +@@ -2582,6 +2582,13 @@ static int strict_allocate_ftruncate(vfs_handle_struct *handle, files_struct *fs + int ret; + NTSTATUS status; + SMB_STRUCT_STAT *pst; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(len, 0); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + status = vfs_stat_fsp(fsp); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c +index 088ea603788..af8a01461a7 100644 +--- a/source3/smbd/aio.c ++++ b/source3/smbd/aio.c +@@ -166,6 +166,12 @@ NTSTATUS schedule_aio_read_and_X(connection_struct *conn, + size_t bufsize; + size_t min_aio_read_size = lp_aio_read_size(SNUM(conn)); + struct tevent_req *req; ++ bool ok; ++ ++ ok = vfs_valid_pread_range(startpos, smb_maxcnt); ++ if (!ok) { ++ return NT_STATUS_INVALID_PARAMETER; ++ } + + if (fsp->base_fsp != NULL) { + /* No AIO on streams yet */ +@@ -330,6 +336,7 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, + { + struct tevent_req *req, *subreq; + struct pwrite_fsync_state *state; ++ bool ok; + + req = tevent_req_create(mem_ctx, &state, struct pwrite_fsync_state); + if (req == NULL) { +@@ -339,6 +346,12 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, + state->fsp = fsp; + state->write_through = write_through; + ++ ok = vfs_valid_pwrite_range(offset, n); ++ if (!ok) { ++ tevent_req_error(req, EINVAL); ++ return tevent_req_post(req, ev); ++ } ++ + if (n == 0) { + tevent_req_done(req); + return tevent_req_post(req, ev); +@@ -665,6 +678,12 @@ NTSTATUS schedule_smb2_aio_read(connection_struct *conn, + struct aio_extra *aio_ex; + size_t min_aio_read_size = lp_aio_read_size(SNUM(conn)); + struct tevent_req *req; ++ bool ok; ++ ++ ok = vfs_valid_pread_range(startpos, smb_maxcnt); ++ if (!ok) { ++ return NT_STATUS_INVALID_PARAMETER; ++ } + + if (fsp->base_fsp != NULL) { + /* No AIO on streams yet */ +diff --git a/source3/smbd/fileio.c b/source3/smbd/fileio.c +index f4a3dde66b7..000a01e2c0f 100644 +--- a/source3/smbd/fileio.c ++++ b/source3/smbd/fileio.c +@@ -32,6 +32,7 @@ + ssize_t read_file(files_struct *fsp,char *data,off_t pos,size_t n) + { + ssize_t ret = 0; ++ bool ok; + + /* you can't read from print files */ + if (fsp->print_file) { +@@ -39,6 +40,12 @@ ssize_t read_file(files_struct *fsp,char *data,off_t pos,size_t n) + return -1; + } + ++ ok = vfs_valid_pread_range(pos, n); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } ++ + fsp->fh->pos = pos; + + if (n > 0) { +@@ -69,6 +76,13 @@ static ssize_t real_write_file(struct smb_request *req, + size_t n) + { + ssize_t ret; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(pos, n); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + if (n == 0) { + return 0; +diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c +index 566eed35d9b..96067e45005 100644 +--- a/source3/smbd/vfs.c ++++ b/source3/smbd/vfs.c +@@ -439,6 +439,13 @@ ssize_t vfs_pwrite_data(struct smb_request *req, + { + size_t total=0; + ssize_t ret; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(offset, N); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + if (req && req->unread_bytes) { + int sockfd = req->xconn->transport.sock; +@@ -515,6 +522,7 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) + uint64_t space_avail; + uint64_t bsize,dfree,dsize; + NTSTATUS status; ++ bool ok; + + /* + * Actually try and commit the space on disk.... +@@ -523,8 +531,9 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) + DEBUG(10,("vfs_allocate_file_space: file %s, len %.0f\n", + fsp_str_dbg(fsp), (double)len)); + +- if (((off_t)len) < 0) { +- DEBUG(0,("vfs_allocate_file_space: %s negative len " ++ ok = vfs_valid_pwrite_range((off_t)len, 0); ++ if (!ok) { ++ DEBUG(0,("vfs_allocate_file_space: %s negative/invalid len " + "requested.\n", fsp_str_dbg(fsp))); + errno = EINVAL; + return -1; +@@ -609,6 +618,13 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) + int vfs_set_filelen(files_struct *fsp, off_t len) + { + int ret; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(len, 0); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + contend_level2_oplocks_begin(fsp, LEVEL2_CONTEND_SET_FILE_LEN); + +@@ -640,6 +656,13 @@ int vfs_slow_fallocate(files_struct *fsp, off_t offset, off_t len) + { + ssize_t pwrite_ret; + size_t total = 0; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(offset, len); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + if (!sparse_buf) { + sparse_buf = SMB_CALLOC_ARRAY(char, SPARSE_BUF_WRITE_SIZE); +@@ -680,6 +703,13 @@ int vfs_fill_sparse(files_struct *fsp, off_t len) + NTSTATUS status; + off_t offset; + size_t num_to_write; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(len, 0); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + status = vfs_stat_fsp(fsp); + if (!NT_STATUS_IS_OK(status)) { +-- +2.20.1 + + +From af989582036a929eb0e2594b1e2ee54145d41286 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:42:10 -0700 +Subject: [PATCH 09/31] s3: VFS: aio_fork: Change sys_pread() -> + sys_pread_full() to protect against short reads. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 60f590000d545292760018694deb34a7cc4ded6d) +--- + source3/modules/vfs_aio_fork.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_aio_fork.c b/source3/modules/vfs_aio_fork.c +index a1fed5c0655..285b331ff9c 100644 +--- a/source3/modules/vfs_aio_fork.c ++++ b/source3/modules/vfs_aio_fork.c +@@ -342,7 +342,7 @@ static void aio_child_loop(int sockfd, struct mmap_area *map) + + switch (cmd_struct.cmd) { + case READ_CMD: +- ret_struct.size = sys_pread( ++ ret_struct.size = sys_pread_full( + fd, discard_const(map->ptr), cmd_struct.n, + cmd_struct.offset); + #if 0 +-- +2.20.1 + + +From 52b13fda0509f3bb28026a3d0f7d304c3bf28b08 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:42:53 -0700 +Subject: [PATCH 10/31] s3: VFS: aio_fork: Change sys_pwrite() -> + sys_pwrite_full() to protect against short writes. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 20ee8b03bbe5bef4ea968170808e3c4c9d22318e) +--- + source3/modules/vfs_aio_fork.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_aio_fork.c b/source3/modules/vfs_aio_fork.c +index 285b331ff9c..7c6f4b00fd0 100644 +--- a/source3/modules/vfs_aio_fork.c ++++ b/source3/modules/vfs_aio_fork.c +@@ -353,7 +353,7 @@ static void aio_child_loop(int sockfd, struct mmap_area *map) + #endif + break; + case WRITE_CMD: +- ret_struct.size = sys_pwrite( ++ ret_struct.size = sys_pwrite_full( + fd, discard_const(map->ptr), cmd_struct.n, + cmd_struct.offset); + break; +-- +2.20.1 + + +From bd99244e029ef1df6a60a276d794bcd465a7bb5b Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:43:34 -0700 +Subject: [PATCH 11/31] s3: VFS: default. Change sys_pread() -> + sys_pread_full() in SMB_VFS_PREAD() to protect against short reads. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 7daa79908b6a0362db30276b3b6f0db176b6ae3c) +--- + source3/modules/vfs_default.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c +index 3511c548166..1170629b084 100644 +--- a/source3/modules/vfs_default.c ++++ b/source3/modules/vfs_default.c +@@ -739,7 +739,7 @@ static ssize_t vfswrap_pread(vfs_handle_struct *handle, files_struct *fsp, void + + #if defined(HAVE_PREAD) || defined(HAVE_PREAD64) + START_PROFILE_BYTES(syscall_pread, n); +- result = sys_pread(fsp->fh->fd, data, n, offset); ++ result = sys_pread_full(fsp->fh->fd, data, n, offset); + END_PROFILE_BYTES(syscall_pread); + + if (result == -1 && errno == ESPIPE) { +-- +2.20.1 + + +From 26ec59040879427166e04cdadbff175a40018c87 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:44:26 -0700 +Subject: [PATCH 12/31] s3: VFS: default. Change sys_pwrite() -> + sys_pwrite_full() in SMB_VFS_PWRITE() to protect against short writes. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit ca8c3619f657dc38db7cb248f1a657f5bfe20757) +--- + source3/modules/vfs_default.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c +index 1170629b084..e516c733e69 100644 +--- a/source3/modules/vfs_default.c ++++ b/source3/modules/vfs_default.c +@@ -763,7 +763,7 @@ static ssize_t vfswrap_pwrite(vfs_handle_struct *handle, files_struct *fsp, cons + + #if defined(HAVE_PWRITE) || defined(HAVE_PRWITE64) + START_PROFILE_BYTES(syscall_pwrite, n); +- result = sys_pwrite(fsp->fh->fd, data, n, offset); ++ result = sys_pwrite_full(fsp->fh->fd, data, n, offset); + END_PROFILE_BYTES(syscall_pwrite); + + if (result == -1 && errno == ESPIPE) { +-- +2.20.1 + + +From fa25bd26d1fe02c7480f2af7e22af8a03127157e Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:45:10 -0700 +Subject: [PATCH 13/31] s3: VFS: default. Change pread() -> sys_pread_full() in + SMB_VFS_PREAD_SEND() to protect against short reads. + +Note that as sys_pread_full() deals with the EINTR case +we can remove the do {} while loop here. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit bf2e546be38abfc77cf40e0b0fef42937696dcde) +--- + source3/modules/vfs_default.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c +index e516c733e69..809c9b3d92f 100644 +--- a/source3/modules/vfs_default.c ++++ b/source3/modules/vfs_default.c +@@ -843,10 +843,10 @@ static void vfs_pread_do(void *private_data) + + PROFILE_TIMESTAMP(&start_time); + +- do { +- state->ret = pread(state->fd, state->buf, state->count, +- state->offset); +- } while ((state->ret == -1) && (errno == EINTR)); ++ state->ret = sys_pread_full(state->fd, ++ state->buf, ++ state->count, ++ state->offset); + + if (state->ret == -1) { + state->vfs_aio_state.error = errno; +-- +2.20.1 + + +From 9a4639d6500900e18dfb685fbf4dc597f98cc63c Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:48:49 -0700 +Subject: [PATCH 14/31] s3: VFS: default. Change pwrite() -> sys_pwrite_full() + in SMB_VFS_PWRITE_SEND() to protect against short writes. + +Note that as sys_pwrite_full() deals with the EINTR case +we can remove the do {} while loop here. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 801c06f4c9400343b72cad998086288931f7c6b3) +--- + source3/modules/vfs_default.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c +index 809c9b3d92f..4cf553411cb 100644 +--- a/source3/modules/vfs_default.c ++++ b/source3/modules/vfs_default.c +@@ -971,10 +971,10 @@ static void vfs_pwrite_do(void *private_data) + + PROFILE_TIMESTAMP(&start_time); + +- do { +- state->ret = pwrite(state->fd, state->buf, state->count, +- state->offset); +- } while ((state->ret == -1) && (errno == EINTR)); ++ state->ret = sys_pwrite_full(state->fd, ++ state->buf, ++ state->count, ++ state->offset); + + if (state->ret == -1) { + state->vfs_aio_state.error = errno; +-- +2.20.1 + + +From 9ecf0e23c6b5f40cf73df600b4ce2e6469d32065 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Wed, 6 May 2020 03:05:47 -0700 +Subject: [PATCH 15/31] vfs_io_uring: fix the prefix for parametric options + from 'vfs_io_uring' to 'io_uring' + +This is what the manpage describes. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit fadc7043a71b409ad60a1a4076a7f88f379d2056) +--- + source3/modules/vfs_io_uring.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 378e48d112f..b409d075337 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -172,13 +172,13 @@ static int vfs_io_uring_connect(vfs_handle_struct *handle, const char *service, + } + + num_entries = lp_parm_ulong(SNUM(handle->conn), +- "vfs_io_uring", ++ "io_uring", + "num_entries", + 128); + num_entries = MAX(num_entries, 1); + + sqpoll = lp_parm_bool(SNUM(handle->conn), +- "vfs_io_uring", ++ "io_uring", + "sqpoll", + false); + if (sqpoll) { +-- +2.20.1 + + +From 0f22fb3e27bdda29e4969e4ddb64f0287deb5599 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 10:39:52 +0200 +Subject: [PATCH 16/31] vfs_io_uring: replace vfs_io_uring_request->state with + _tevent_req_data() + +We don't need a direct pointer to the state... + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit f78e98e0226fe70899b613e0aa5c804d8458bdb0) +--- + source3/modules/vfs_io_uring.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index b409d075337..988b309da52 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -42,7 +42,6 @@ struct vfs_io_uring_request { + struct vfs_io_uring_request **list_head; + struct vfs_io_uring_config *config; + struct tevent_req *req; +- void *state; + struct io_uring_sqe sqe; + struct io_uring_cqe cqe; + struct timespec start_time; +@@ -58,8 +57,9 @@ static void vfs_io_uring_finish_req(struct vfs_io_uring_request *cur, + struct tevent_req *req = + talloc_get_type_abort(cur->req, + struct tevent_req); ++ void *state = _tevent_req_data(req); + +- talloc_set_destructor(cur->state, NULL); ++ talloc_set_destructor(state, NULL); + if (cur->list_head != NULL) { + DLIST_REMOVE((*cur->list_head), cur); + cur->list_head = NULL; +@@ -238,6 +238,7 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) + + for (cur = config->queue; cur != NULL; cur = next) { + struct io_uring_sqe *sqe = NULL; ++ void *state = _tevent_req_data(cur->req); + + next = cur->next; + +@@ -246,7 +247,7 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) + break; + } + +- talloc_set_destructor(cur->state, ++ talloc_set_destructor(state, + vfs_io_uring_request_state_deny_destructor); + DLIST_REMOVE(config->queue, cur); + *sqe = cur->sqe; +@@ -318,7 +319,6 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + } + state->ur.config = config; + state->ur.req = req; +- state->ur.state = state; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pread, profile_p, + state->ur.profile_bytes, n); +@@ -398,7 +398,6 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + } + state->ur.config = config; + state->ur.req = req; +- state->ur.state = state; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pwrite, profile_p, + state->ur.profile_bytes, n); +@@ -475,7 +474,6 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand + } + state->ur.config = config; + state->ur.req = req; +- state->ur.state = state; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_fsync, profile_p, + state->ur.profile_bytes, 0); +-- +2.20.1 + + +From 61d1e13c927a8fb8439d576026dc56a2379f127d Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 10:42:59 +0200 +Subject: [PATCH 17/31] vfs_io_uring: introduce + vfs_io_uring_request->completion_fn() + +We'll need to add more logic than a simple _tevent_req_done() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 456533c9cfc332d3a83ea03a6f969b0d64ccbeb6) +--- + source3/modules/vfs_io_uring.c | 49 +++++++++++++++++++++++++++++++++- + 1 file changed, 48 insertions(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 988b309da52..abdd4d16e9f 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -44,6 +44,8 @@ struct vfs_io_uring_request { + struct tevent_req *req; + struct io_uring_sqe sqe; + struct io_uring_cqe cqe; ++ void (*completion_fn)(struct vfs_io_uring_request *cur, ++ const char *location); + struct timespec start_time; + struct timespec end_time; + SMBPROFILE_BYTES_ASYNC_STATE(profile_bytes); +@@ -74,7 +76,7 @@ static void vfs_io_uring_finish_req(struct vfs_io_uring_request *cur, + * or tevent_req_defer_callback() being called + * already. + */ +- _tevent_req_done(req, location); ++ cur->completion_fn(cur, location); + } + + static void vfs_io_uring_config_destroy(struct vfs_io_uring_config *config, +@@ -297,6 +299,9 @@ struct vfs_io_uring_pread_state { + struct iovec iov; + }; + ++static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, ++ const char *location); ++ + static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *handle, + TALLOC_CTX *mem_ctx, + struct tevent_context *ev, +@@ -319,6 +324,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + } + state->ur.config = config; + state->ur.req = req; ++ state->ur.completion_fn = vfs_io_uring_pread_completion; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pread, profile_p, + state->ur.profile_bytes, n); +@@ -344,6 +350,17 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + return req; + } + ++static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, ++ const char *location) ++{ ++ /* ++ * We rely on being inside the _send() function ++ * or tevent_req_defer_callback() being called ++ * already. ++ */ ++ _tevent_req_done(cur->req, location); ++} ++ + static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, + struct vfs_aio_state *vfs_aio_state) + { +@@ -376,6 +393,9 @@ struct vfs_io_uring_pwrite_state { + struct iovec iov; + }; + ++static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, ++ const char *location); ++ + static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *handle, + TALLOC_CTX *mem_ctx, + struct tevent_context *ev, +@@ -398,6 +418,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + } + state->ur.config = config; + state->ur.req = req; ++ state->ur.completion_fn = vfs_io_uring_pwrite_completion; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pwrite, profile_p, + state->ur.profile_bytes, n); +@@ -423,6 +444,17 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + return req; + } + ++static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, ++ const char *location) ++{ ++ /* ++ * We rely on being inside the _send() function ++ * or tevent_req_defer_callback() being called ++ * already. ++ */ ++ _tevent_req_done(cur->req, location); ++} ++ + static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, + struct vfs_aio_state *vfs_aio_state) + { +@@ -454,6 +486,9 @@ struct vfs_io_uring_fsync_state { + struct vfs_io_uring_request ur; + }; + ++static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, ++ const char *location); ++ + static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *handle, + TALLOC_CTX *mem_ctx, + struct tevent_context *ev, +@@ -474,6 +509,7 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand + } + state->ur.config = config; + state->ur.req = req; ++ state->ur.completion_fn = vfs_io_uring_fsync_completion; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_fsync, profile_p, + state->ur.profile_bytes, 0); +@@ -496,6 +532,17 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand + return req; + } + ++static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, ++ const char *location) ++{ ++ /* ++ * We rely on being inside the _send() function ++ * or tevent_req_defer_callback() being called ++ * already. ++ */ ++ _tevent_req_done(cur->req, location); ++} ++ + static int vfs_io_uring_fsync_recv(struct tevent_req *req, + struct vfs_aio_state *vfs_aio_state) + { +-- +2.20.1 + + +From 1d670bd14381a00c872ec56033f602b9e18f11b0 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 10:52:52 +0200 +Subject: [PATCH 18/31] vfs_io_uring: move error handling out of + vfs_io_uring_pread_recv() + +We should do that as early as possible and that's in +vfs_io_uring_pread_completion(). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit a1487067a6c9df3136fd5d4d16dda4c0f63cb662) +--- + source3/modules/vfs_io_uring.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index abdd4d16e9f..0d8e1833009 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -297,6 +297,7 @@ static void vfs_io_uring_fd_handler(struct tevent_context *ev, + struct vfs_io_uring_pread_state { + struct vfs_io_uring_request ur; + struct iovec iov; ++ size_t nread; + }; + + static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, +@@ -353,12 +354,23 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + const char *location) + { ++ struct vfs_io_uring_pread_state *state = tevent_req_data( ++ cur->req, struct vfs_io_uring_pread_state); ++ + /* + * We rely on being inside the _send() function + * or tevent_req_defer_callback() being called + * already. + */ +- _tevent_req_done(cur->req, location); ++ ++ if (cur->cqe.res < 0) { ++ int err = -cur->cqe.res; ++ _tevent_req_error(cur->req, err, location); ++ return; ++ } ++ ++ state->nread = state->ur.cqe.res; ++ tevent_req_done(cur->req); + } + + static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, +@@ -366,23 +378,19 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, + { + struct vfs_io_uring_pread_state *state = tevent_req_data( + req, struct vfs_io_uring_pread_state); +- int ret; ++ ssize_t ret; + + SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); + vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, + &state->ur.start_time); + + if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { ++ tevent_req_received(req); + return -1; + } + +- if (state->ur.cqe.res < 0) { +- vfs_aio_state->error = -state->ur.cqe.res; +- ret = -1; +- } else { +- vfs_aio_state->error = 0; +- ret = state->ur.cqe.res; +- } ++ vfs_aio_state->error = 0; ++ ret = state->nread; + + tevent_req_received(req); + return ret; +-- +2.20.1 + + +From d340f961466be94d1467b4953389b721421fb86a Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 10:52:52 +0200 +Subject: [PATCH 19/31] vfs_io_uring: move error handling out of + vfs_io_uring_pwrite_recv() + +We should do that as early as possible and that's in +vfs_io_uring_pwrite_completion(). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit a51969b8c7e6e49c0d3b776d897aea4f309f8678) +--- + source3/modules/vfs_io_uring.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 0d8e1833009..a8da341e7b7 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -399,6 +399,7 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, + struct vfs_io_uring_pwrite_state { + struct vfs_io_uring_request ur; + struct iovec iov; ++ size_t nwritten; + }; + + static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, +@@ -455,12 +456,23 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + const char *location) + { ++ struct vfs_io_uring_pwrite_state *state = tevent_req_data( ++ cur->req, struct vfs_io_uring_pwrite_state); ++ + /* + * We rely on being inside the _send() function + * or tevent_req_defer_callback() being called + * already. + */ +- _tevent_req_done(cur->req, location); ++ ++ if (cur->cqe.res < 0) { ++ int err = -cur->cqe.res; ++ _tevent_req_error(cur->req, err, location); ++ return; ++ } ++ ++ state->nwritten = state->ur.cqe.res; ++ tevent_req_done(cur->req); + } + + static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, +@@ -468,23 +480,19 @@ static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, + { + struct vfs_io_uring_pwrite_state *state = tevent_req_data( + req, struct vfs_io_uring_pwrite_state); +- int ret; ++ ssize_t ret; + + SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); + vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, + &state->ur.start_time); + + if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { ++ tevent_req_received(req); + return -1; + } + +- if (state->ur.cqe.res < 0) { +- vfs_aio_state->error = -state->ur.cqe.res; +- ret = -1; +- } else { +- vfs_aio_state->error = 0; +- ret = state->ur.cqe.res; +- } ++ vfs_aio_state->error = 0; ++ ret = state->nwritten; + + tevent_req_received(req); + return ret; +-- +2.20.1 + + +From 3da1624f4f6a674dd1e83d2b327e7a38cca7c252 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 10:52:52 +0200 +Subject: [PATCH 20/31] vfs_io_uring: move error handling out of + vfs_io_uring_fsync_recv() + +We should do that as early as possible and that's in +vfs_io_uring_fsync_completion(). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 40be2232a44a86cb5dfdda330801e615826408ba) +--- + source3/modules/vfs_io_uring.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index a8da341e7b7..0f560c95b67 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -556,7 +556,14 @@ static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, + * or tevent_req_defer_callback() being called + * already. + */ +- _tevent_req_done(cur->req, location); ++ ++ if (cur->cqe.res < 0) { ++ int err = -cur->cqe.res; ++ _tevent_req_error(cur->req, err, location); ++ return; ++ } ++ ++ tevent_req_done(cur->req); + } + + static int vfs_io_uring_fsync_recv(struct tevent_req *req, +@@ -564,26 +571,20 @@ static int vfs_io_uring_fsync_recv(struct tevent_req *req, + { + struct vfs_io_uring_fsync_state *state = tevent_req_data( + req, struct vfs_io_uring_fsync_state); +- int ret; + + SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); + vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, + &state->ur.start_time); + + if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { ++ tevent_req_received(req); + return -1; + } + +- if (state->ur.cqe.res < 0) { +- vfs_aio_state->error = -state->ur.cqe.res; +- ret = -1; +- } else { +- vfs_aio_state->error = 0; +- ret = state->ur.cqe.res; +- } ++ vfs_aio_state->error = 0; + + tevent_req_received(req); +- return ret; ++ return 0; + } + + static struct vfs_fn_pointers vfs_io_uring_fns = { +-- +2.20.1 + + +From 8bac62120864dc40285ae680f4493116dd2abe6d Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 13:17:05 +0200 +Subject: [PATCH 21/31] vfs_io_uring: make use of sys_valid_io_range() in + vfs_io_uring_pread_send() + +This makes the follow up commits easier as we don't have to care +about overflows. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 5005ae3fb24018e370ae60cc23c5e9cfe8357bc9) +--- + source3/modules/vfs_io_uring.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 0f560c95b67..c7565b8c39d 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -25,6 +25,7 @@ + #include "smbd/smbd.h" + #include "smbd/globals.h" + #include "lib/util/tevent_unix.h" ++#include "lib/util/sys_rw.h" + #include "smbprofile.h" + #include + +@@ -313,6 +314,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + struct tevent_req *req = NULL; + struct vfs_io_uring_pread_state *state = NULL; + struct vfs_io_uring_config *config = NULL; ++ bool ok; + + SMB_VFS_HANDLE_GET_DATA(handle, config, + struct vfs_io_uring_config, +@@ -331,6 +333,12 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + state->ur.profile_bytes, n); + SMBPROFILE_BYTES_ASYNC_SET_IDLE(state->ur.profile_bytes); + ++ ok = sys_valid_io_range(offset, n); ++ if (!ok) { ++ tevent_req_error(req, EINVAL); ++ return tevent_req_post(req, ev); ++ } ++ + state->iov.iov_base = (void *)data; + state->iov.iov_len = n; + io_uring_prep_readv(&state->ur.sqe, +-- +2.20.1 + + +From 371195310fc9510692e0ee7f63361094bd7a4911 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 13:17:05 +0200 +Subject: [PATCH 22/31] vfs_io_uring: make use of sys_valid_io_range() in + vfs_io_uring_pwrite_send() + +This makes the follow up commits easier as we don't have to care +about overflows. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 388bc2e6e44470ea4043ecb22750e241145355d2) +--- + source3/modules/vfs_io_uring.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index c7565b8c39d..ee23449c63c 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -423,6 +423,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + struct tevent_req *req = NULL; + struct vfs_io_uring_pwrite_state *state = NULL; + struct vfs_io_uring_config *config = NULL; ++ bool ok; + + SMB_VFS_HANDLE_GET_DATA(handle, config, + struct vfs_io_uring_config, +@@ -441,6 +442,12 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + state->ur.profile_bytes, n); + SMBPROFILE_BYTES_ASYNC_SET_IDLE(state->ur.profile_bytes); + ++ ok = sys_valid_io_range(offset, n); ++ if (!ok) { ++ tevent_req_error(req, EINVAL); ++ return tevent_req_post(req, ev); ++ } ++ + state->iov.iov_base = discard_const(data); + state->iov.iov_len = n; + io_uring_prep_writev(&state->ur.sqe, +-- +2.20.1 + + +From fec90a44a6eb56a883e19268c399b9475a20220d Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 21:29:53 +0200 +Subject: [PATCH 23/31] vfs_io_uring: avoid stack recursion of + vfs_io_uring_queue_run() + +Instead we remember if recursion was triggered and jump to +the start of the function again from the end. + +This should make it safe to be called from the completion_fn(). + +This is hideously complex stuff, so document the hell +out of it. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit f96f45c9ba8d4c8fa4026c22ac4201d66335e5c4) +--- + source3/modules/vfs_io_uring.c | 93 +++++++++++++++++++++++++++++++++- + 1 file changed, 92 insertions(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index ee23449c63c..f94453d9995 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -34,6 +34,10 @@ struct vfs_io_uring_request; + struct vfs_io_uring_config { + struct io_uring uring; + struct tevent_fd *fde; ++ /* recursion guard. See comment above vfs_io_uring_queue_run() */ ++ bool busy; ++ /* recursion guard. See comment above vfs_io_uring_queue_run() */ ++ bool need_retry; + struct vfs_io_uring_request *queue; + struct vfs_io_uring_request *pending; + }; +@@ -222,7 +226,7 @@ static int vfs_io_uring_connect(vfs_handle_struct *handle, const char *service, + return 0; + } + +-static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) ++static void _vfs_io_uring_queue_run(struct vfs_io_uring_config *config) + { + struct vfs_io_uring_request *cur = NULL, *next = NULL; + struct io_uring_cqe *cqe = NULL; +@@ -280,6 +284,93 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) + io_uring_cq_advance(&config->uring, nr); + } + ++/* ++ * Wrapper function to prevent recursion which could happen ++ * if we called _vfs_io_uring_queue_run() directly without ++ * recursion checks. ++ * ++ * Looking at the pread call, we can have: ++ * ++ * vfs_io_uring_pread_send() ++ * ->vfs_io_uring_pread_submit() <----------------------------------- ++ * ->vfs_io_uring_request_submit() | ++ * ->vfs_io_uring_queue_run() | ++ * ->_vfs_io_uring_queue_run() | ++ * | ++ * But inside _vfs_io_uring_queue_run() looks like: | ++ * | ++ * _vfs_io_uring_queue_run() { | ++ * if (THIS_IO_COMPLETED) { | ++ * ->vfs_io_uring_finish_req() | ++ * ->cur->completion_fn() | ++ * } | ++ * } | ++ * | ++ * cur->completion_fn() for pread is set to vfs_io_uring_pread_completion() | ++ * | ++ * vfs_io_uring_pread_completion() { | ++ * if (READ_TERMINATED) { | ++ * -> tevent_req_done() - We're done, go back up the stack. | ++ * return; | ++ * } | ++ * | ++ * We have a short read - adjust the io vectors | ++ * | ++ * ->vfs_io_uring_pread_submit() --------------------------------------- ++ * } ++ * ++ * So before calling _vfs_io_uring_queue_run() we backet it with setting ++ * a flag config->busy, and unset it once _vfs_io_uring_queue_run() finally ++ * exits the retry loop. ++ * ++ * If we end up back into vfs_io_uring_queue_run() we notice we've done so ++ * as config->busy is set and don't recurse into _vfs_io_uring_queue_run(). ++ * ++ * We set the second flag config->need_retry that tells us to loop in the ++ * vfs_io_uring_queue_run() call above us in the stack and return. ++ * ++ * When the outer call to _vfs_io_uring_queue_run() returns we are in ++ * a loop checking if config->need_retry was set. That happens if ++ * the short read case occurs and _vfs_io_uring_queue_run() ended up ++ * recursing into vfs_io_uring_queue_run(). ++ * ++ * Once vfs_io_uring_pread_completion() finishes without a short ++ * read (the READ_TERMINATED case, tevent_req_done() is called) ++ * then config->need_retry is left as false, we exit the loop, ++ * set config->busy to false so the next top level call into ++ * vfs_io_uring_queue_run() won't think it's a recursed call ++ * and return. ++ * ++ */ ++ ++static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) ++{ ++ if (config->busy) { ++ /* ++ * We've recursed due to short read/write. ++ * Set need_retry to ensure we retry the ++ * io_uring_submit(). ++ */ ++ config->need_retry = true; ++ return; ++ } ++ ++ /* ++ * Bracket the loop calling _vfs_io_uring_queue_run() ++ * with busy = true / busy = false. ++ * so we can detect recursion above. ++ */ ++ ++ config->busy = true; ++ ++ do { ++ config->need_retry = false; ++ _vfs_io_uring_queue_run(config); ++ } while (config->need_retry); ++ ++ config->busy = false; ++} ++ + static void vfs_io_uring_fd_handler(struct tevent_context *ev, + struct tevent_fd *fde, + uint16_t flags, +-- +2.20.1 + + +From f7baf726bbb2c048c243857347731628ae1f112b Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:17:51 +0200 +Subject: [PATCH 24/31] vfs_io_uring: split out a vfs_io_uring_request_submit() + function + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit ab89b8e75354c5fd571985e924e1ccbec99de990) +--- + source3/modules/vfs_io_uring.c | 29 ++++++++++++++--------------- + 1 file changed, 14 insertions(+), 15 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index f94453d9995..1d48bd192fe 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -371,6 +371,17 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) + config->busy = false; + } + ++static void vfs_io_uring_request_submit(struct vfs_io_uring_request *cur) ++{ ++ struct vfs_io_uring_config *config = cur->config; ++ ++ io_uring_sqe_set_data(&cur->sqe, cur); ++ DLIST_ADD_END(config->queue, cur); ++ cur->list_head = &config->queue; ++ ++ vfs_io_uring_queue_run(config); ++} ++ + static void vfs_io_uring_fd_handler(struct tevent_context *ev, + struct tevent_fd *fde, + uint16_t flags, +@@ -436,11 +447,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + fsp->fh->fd, + &state->iov, 1, + offset); +- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); +- DLIST_ADD_END(config->queue, &state->ur); +- state->ur.list_head = &config->queue; +- +- vfs_io_uring_queue_run(config); ++ vfs_io_uring_request_submit(&state->ur); + + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); +@@ -545,11 +552,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + fsp->fh->fd, + &state->iov, 1, + offset); +- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); +- DLIST_ADD_END(config->queue, &state->ur); +- state->ur.list_head = &config->queue; +- +- vfs_io_uring_queue_run(config); ++ vfs_io_uring_request_submit(&state->ur); + + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); +@@ -640,11 +643,7 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand + io_uring_prep_fsync(&state->ur.sqe, + fsp->fh->fd, + 0); /* fsync_flags */ +- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); +- DLIST_ADD_END(config->queue, &state->ur); +- state->ur.list_head = &config->queue; +- +- vfs_io_uring_queue_run(config); ++ vfs_io_uring_request_submit(&state->ur); + + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); +-- +2.20.1 + + +From ccda7ef339d743ee90df6739ddcdce22c169b70e Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:17:51 +0200 +Subject: [PATCH 25/31] vfs_io_uring: split out a vfs_io_uring_pread_submit() + function + +This can be reused when we add handling for short reads. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 9de4f8be1dc8b4274891016191a5ca1f724e08b3) +--- + source3/modules/vfs_io_uring.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 1d48bd192fe..19e268e63db 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -399,10 +399,13 @@ static void vfs_io_uring_fd_handler(struct tevent_context *ev, + + struct vfs_io_uring_pread_state { + struct vfs_io_uring_request ur; ++ struct files_struct *fsp; ++ off_t offset; + struct iovec iov; + size_t nread; + }; + ++static void vfs_io_uring_pread_submit(struct vfs_io_uring_pread_state *state); + static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + const char *location); + +@@ -441,13 +444,11 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + return tevent_req_post(req, ev); + } + ++ state->fsp = fsp; ++ state->offset = offset; + state->iov.iov_base = (void *)data; + state->iov.iov_len = n; +- io_uring_prep_readv(&state->ur.sqe, +- fsp->fh->fd, +- &state->iov, 1, +- offset); +- vfs_io_uring_request_submit(&state->ur); ++ vfs_io_uring_pread_submit(state); + + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); +@@ -457,6 +458,15 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + return req; + } + ++static void vfs_io_uring_pread_submit(struct vfs_io_uring_pread_state *state) ++{ ++ io_uring_prep_readv(&state->ur.sqe, ++ state->fsp->fh->fd, ++ &state->iov, 1, ++ state->offset); ++ vfs_io_uring_request_submit(&state->ur); ++} ++ + static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + const char *location) + { +-- +2.20.1 + + +From def543bf2c96db54475b3a48a77f68a500f7a248 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:17:51 +0200 +Subject: [PATCH 26/31] vfs_io_uring: split out a vfs_io_uring_pwrite_submit() + function + +This can be reused when we add handling for short writes. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 2f6abb00b0daeb4de9ad0aea1b5c56559391aef9) +--- + source3/modules/vfs_io_uring.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 19e268e63db..3e004f48aa0 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -514,10 +514,13 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, + + struct vfs_io_uring_pwrite_state { + struct vfs_io_uring_request ur; ++ struct files_struct *fsp; ++ off_t offset; + struct iovec iov; + size_t nwritten; + }; + ++static void vfs_io_uring_pwrite_submit(struct vfs_io_uring_pwrite_state *state); + static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + const char *location); + +@@ -556,13 +559,11 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + return tevent_req_post(req, ev); + } + ++ state->fsp = fsp; ++ state->offset = offset; + state->iov.iov_base = discard_const(data); + state->iov.iov_len = n; +- io_uring_prep_writev(&state->ur.sqe, +- fsp->fh->fd, +- &state->iov, 1, +- offset); +- vfs_io_uring_request_submit(&state->ur); ++ vfs_io_uring_pwrite_submit(state); + + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); +@@ -572,6 +573,15 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + return req; + } + ++static void vfs_io_uring_pwrite_submit(struct vfs_io_uring_pwrite_state *state) ++{ ++ io_uring_prep_writev(&state->ur.sqe, ++ state->fsp->fh->fd, ++ &state->iov, 1, ++ state->offset); ++ vfs_io_uring_request_submit(&state->ur); ++} ++ + static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + const char *location) + { +-- +2.20.1 + + +From 92a105453c9479ff70efc9a1cf5b4fd3b36764e0 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:38:56 +0200 +Subject: [PATCH 27/31] vfs_io_uring: protect vfs_io_uring_pread_completion() + against invalid results + +We should never get back more than we asked for. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit f085dbf8b2bed2695e0065a5bf4523232cb532c7) +--- + source3/modules/vfs_io_uring.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 3e004f48aa0..46fab116e9d 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -26,6 +26,7 @@ + #include "smbd/globals.h" + #include "lib/util/tevent_unix.h" + #include "lib/util/sys_rw.h" ++#include "lib/util/iov_buf.h" + #include "smbprofile.h" + #include + +@@ -472,6 +473,9 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + { + struct vfs_io_uring_pread_state *state = tevent_req_data( + cur->req, struct vfs_io_uring_pread_state); ++ struct iovec *iov = &state->iov; ++ int num_iov = 1; ++ bool ok; + + /* + * We rely on being inside the _send() function +@@ -485,6 +489,16 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + return; + } + ++ ok = iov_advance(&iov, &num_iov, cur->cqe.res); ++ if (!ok) { ++ /* This is not expected! */ ++ DBG_ERR("iov_advance() failed cur->cqe.res=%d > iov_len=%d\n", ++ (int)cur->cqe.res, ++ (int)state->iov.iov_len); ++ tevent_req_error(cur->req, EIO); ++ return; ++ } ++ + state->nread = state->ur.cqe.res; + tevent_req_done(cur->req); + } +-- +2.20.1 + + +From 2153f89d521d61f303a1ab55abb4b3e65825c7bd Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:38:56 +0200 +Subject: [PATCH 28/31] vfs_io_uring: protect vfs_io_uring_pwrite_completion() + against invalid results + +We should never get more acked than we asked for. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 283f96872237517f0b3bc4e63e8d3c482ecd5fa4) +--- + source3/modules/vfs_io_uring.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 46fab116e9d..0ea785aae85 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -601,6 +601,9 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + { + struct vfs_io_uring_pwrite_state *state = tevent_req_data( + cur->req, struct vfs_io_uring_pwrite_state); ++ struct iovec *iov = &state->iov; ++ int num_iov = 1; ++ bool ok; + + /* + * We rely on being inside the _send() function +@@ -614,6 +617,16 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + return; + } + ++ ok = iov_advance(&iov, &num_iov, cur->cqe.res); ++ if (!ok) { ++ /* This is not expected! */ ++ DBG_ERR("iov_advance() failed cur->cqe.res=%d > iov_len=%d\n", ++ (int)cur->cqe.res, ++ (int)state->iov.iov_len); ++ tevent_req_error(cur->req, EIO); ++ return; ++ } ++ + state->nwritten = state->ur.cqe.res; + tevent_req_done(cur->req); + } +-- +2.20.1 + + +From 16fe7c511d019990318db5b44278ed9f6ae18a00 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:38:56 +0200 +Subject: [PATCH 29/31] vfs_io_uring: protect vfs_io_uring_fsync_completion() + against invalid results + +We should never get back a value > 0. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit c57a731c4ce395fd710f0b066cd6f1b72223ae07) +--- + source3/modules/vfs_io_uring.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 0ea785aae85..0b1583f962a 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -715,6 +715,13 @@ static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, + return; + } + ++ if (cur->cqe.res > 0) { ++ /* This is not expected! */ ++ DBG_ERR("got cur->cqe.res=%d\n", (int)cur->cqe.res); ++ tevent_req_error(cur->req, EIO); ++ return; ++ } ++ + tevent_req_done(cur->req); + } + +-- +2.20.1 + + +From 81deb9fe0b2991c7da3f0165c24fb449c5ce879b Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 13:30:17 +0200 +Subject: [PATCH 30/31] vfs_io_uring: retry after a short read in + vfs_io_uring_pread_completion() + +We need to be prepared for short reads from the kernel depending on +the state of the page cache. Windows and Mac clients don't +expect short reads for files, so we need to retry ourself. + +For the future we may be able to play with some io_uring flags +in order to avoid the retries in userspace, but for now we just fix +the data corruption bug... + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 42e77c4cf245d8420641d216d1abefe81f7a3b79) +--- + source3/modules/vfs_io_uring.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 0b1583f962a..f16c9ae56d3 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -489,6 +489,14 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + return; + } + ++ if (cur->cqe.res == 0) { ++ /* ++ * We reached EOF, we're done ++ */ ++ tevent_req_done(cur->req); ++ return; ++ } ++ + ok = iov_advance(&iov, &num_iov, cur->cqe.res); + if (!ok) { + /* This is not expected! */ +@@ -499,8 +507,20 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + return; + } + +- state->nread = state->ur.cqe.res; +- tevent_req_done(cur->req); ++ /* sys_valid_io_range() already checked the boundaries */ ++ state->nread += state->ur.cqe.res; ++ if (num_iov == 0) { ++ /* We're done */ ++ tevent_req_done(cur->req); ++ return; ++ } ++ ++ /* ++ * sys_valid_io_range() already checked the boundaries ++ * now try to get the rest. ++ */ ++ state->offset += state->ur.cqe.res; ++ vfs_io_uring_pread_submit(state); + } + + static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, +-- +2.20.1 + + +From 382b5a8b7263ff1dfb428cdebef0c17d622e2066 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 13:30:17 +0200 +Subject: [PATCH 31/31] vfs_io_uring: retry after a short writes in + vfs_io_uring_pwrite_completion() + +We need to be prepared for short writes from the kernel depending on +the state of the page cache. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 0f01b10679c06dbd28da72ca6c6280ddf81672ba) +--- + source3/modules/vfs_io_uring.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index f16c9ae56d3..4625e16c37e 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -637,6 +637,14 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + return; + } + ++ if (cur->cqe.res == 0) { ++ /* ++ * Ensure we can never spin. ++ */ ++ tevent_req_error(cur->req, ENOSPC); ++ return; ++ } ++ + ok = iov_advance(&iov, &num_iov, cur->cqe.res); + if (!ok) { + /* This is not expected! */ +@@ -647,8 +655,20 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + return; + } + +- state->nwritten = state->ur.cqe.res; +- tevent_req_done(cur->req); ++ /* sys_valid_io_range() already checked the boundaries */ ++ state->nwritten += state->ur.cqe.res; ++ if (num_iov == 0) { ++ /* We're done */ ++ tevent_req_done(cur->req); ++ return; ++ } ++ ++ /* ++ * sys_valid_io_range() already checked the boundaries ++ * now try to write the rest. ++ */ ++ state->offset += state->ur.cqe.res; ++ vfs_io_uring_pwrite_submit(state); + } + + static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, +-- +2.20.1 + diff --git a/samba.spec b/samba.spec index 856c9c8..faf182f 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.12.2 %define talloc_version 2.3.1 @@ -88,6 +88,8 @@ %global with_winexe 0 %endif +%global with_vfs_io_uring 1 + %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" Name: samba @@ -126,6 +128,7 @@ Source201: README.downgrade Patch100: new_mit_118.patch Patch101: 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch +Patch102: samba-4.12.3-vfs_io_uring-bz14361.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -224,6 +227,10 @@ BuildRequires: glusterfs-devel >= 3.4.0.16 BuildRequires: libcephfs-devel %endif +%if %{with_vfs_io_uring} +BuildRequires: liburing-devel +%endif + %if %{with_dc} # Add python3-iso8601 to avoid that the # version in Samba is being packaged @@ -1299,6 +1306,9 @@ fi %{_libdir}/samba/vfs/full_audit.so %{_libdir}/samba/vfs/gpfs.so %{_libdir}/samba/vfs/glusterfs_fuse.so +%if %{with_vfs_io_uring} +%{_libdir}/samba/vfs/io_uring.so +%endif %{_libdir}/samba/vfs/linux_xfs_sgid.so %{_libdir}/samba/vfs/media_harmony.so %{_libdir}/samba/vfs/offline.so @@ -1348,6 +1358,9 @@ fi %{_mandir}/man8/vfs_full_audit.8* %{_mandir}/man8/vfs_gpfs.8* %{_mandir}/man8/vfs_glusterfs_fuse.8* +%if %{with_vfs_io_uring} +%{_mandir}/man8/vfs_io_uring.8* +%endif %{_mandir}/man8/vfs_linux_xfs_sgid.8* %{_mandir}/man8/vfs_media_harmony.8* %{_mandir}/man8/vfs_offline.8* @@ -3562,6 +3575,9 @@ fi %endif %changelog +* Wed May 13 2020 Guenther Deschner - 4.12.2-1 +- Add support for building the new experimental io_uring VFS module + * Tue Apr 28 2020 Guenther Deschner - 4.12.2-0 - Update to Samba 4.12.2 - resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 From 3193ace05edbe3072c2577dcfae6f341ae6cdf02 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 13 May 2020 15:35:56 +0200 Subject: [PATCH 06/26] Fix build on arm (which does not have liburing) Guenther --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index faf182f..a363e3c 100644 --- a/samba.spec +++ b/samba.spec @@ -88,7 +88,10 @@ %global with_winexe 0 %endif +%global with_vfs_io_uring 0 +%ifarch aarch64 ppc64le s390x x86_64 i686 %global with_vfs_io_uring 1 +%endif %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" From 4d223e30d17bffb3bda77d9875c59dc55b6dcf6e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 22 May 2020 16:10:39 +0200 Subject: [PATCH 07/26] Update to samba 4.12.3 Guenther --- .gitignore | 2 + ...-to-find-posix-stat-info-in-SMBC_get.patch | 91 - new_mit_118.patch | 174 -- samba-4.12.3-vfs_io_uring-bz14361.patch | 2423 ----------------- samba.spec | 13 +- sources | 4 +- 6 files changed, 10 insertions(+), 2697 deletions(-) delete mode 100644 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch delete mode 100644 new_mit_118.patch delete mode 100644 samba-4.12.3-vfs_io_uring-bz14361.patch diff --git a/.gitignore b/.gitignore index fe44f1a..0081dcb 100644 --- a/.gitignore +++ b/.gitignore @@ -203,3 +203,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.1.tar.asc /samba-4.12.2.tar.xz /samba-4.12.2.tar.asc +/samba-4.12.3.tar.xz +/samba-4.12.3.tar.asc diff --git a/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch b/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch deleted file mode 100644 index ba901a4..0000000 --- a/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 686ea46cbc9538355815fe800e441d67fee6a9db Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Thu, 19 Mar 2020 11:01:41 +0100 -Subject: [PATCH] libsmb: Don't try to find posix stat info in SMBC_getatr() - -This wrongly used "frame" instead of "fname", which can never have -worked. A first attempt to fix in 51551e0d53fa6 caused a few followup -patches in an attempt to clean up the test failures 51551e0d53fa6 -introduced. They were reverted after a few discussions. So rather than -changing behaviour, just remove the code that introduced the valgrind -error again. - -Signed-off-by: Volker Lendecke -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Jeremy Allison -Autobuild-Date(master): Fri Mar 20 05:06:07 UTC 2020 on sn-devel-184 - -(cherry picked from commit 39c910fd9cba3caf7414274b678b9eee33d7e20b) ---- - source3/include/libsmb_internal.h | 1 - - source3/libsmb/libsmb_file.c | 20 -------------------- - source3/libsmb/libsmb_server.c | 9 --------- - 3 files changed, 30 deletions(-) - -diff --git a/source3/include/libsmb_internal.h b/source3/include/libsmb_internal.h -index 21a11c1a024..feedddd0877 100644 ---- a/source3/include/libsmb_internal.h -+++ b/source3/include/libsmb_internal.h -@@ -76,7 +76,6 @@ typedef struct DOS_ATTR_DESC { - struct _SMBCSRV { - struct cli_state *cli; - dev_t dev; -- bool try_posixinfo; - bool no_pathinfo; - bool no_pathinfo2; - bool no_pathinfo3; -diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c -index 1577010e490..f0a16c61a83 100644 ---- a/source3/libsmb/libsmb_file.c -+++ b/source3/libsmb/libsmb_file.c -@@ -504,26 +504,6 @@ SMBC_getatr(SMBCCTX * context, - return False; - } - -- if (srv->try_posixinfo) { -- SMB_STRUCT_STAT sbuf; -- -- status = cli_posix_stat(targetcli, frame, &sbuf); -- if (NT_STATUS_IS_OK(status)) { -- setup_stat_from_stat_ex(&sbuf, path, sb); -- -- TALLOC_FREE(frame); -- return true; -- } -- if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED) || -- NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL)) { -- /* -- * Turn this off if the server doesn't -- * support it. -- */ -- srv->try_posixinfo = false; -- } -- } -- - if (!srv->no_pathinfo2) { - status = cli_qpathinfo2(targetcli, - targetpath, -diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c -index d4f71d8c8b7..0067df48cac 100644 ---- a/source3/libsmb/libsmb_server.c -+++ b/source3/libsmb/libsmb_server.c -@@ -657,15 +657,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, - ZERO_STRUCTP(srv); - DLIST_ADD(srv->cli, c); - srv->dev = (dev_t)(str_checksum(server) ^ str_checksum(share)); -- srv->try_posixinfo = false; -- /* -- * Until SMB2 POSIX is done, only -- * try POSIX stat on SMB1 with POSIX capabilities. -- */ -- if ((smbXcli_conn_protocol(c->conn) < PROTOCOL_SMB2_02) && -- (smb1cli_conn_capabilities(c->conn) & CAP_UNIX)) { -- srv->try_posixinfo = true; -- } - srv->no_pathinfo = False; - srv->no_pathinfo2 = False; - srv->no_pathinfo3 = False; --- -2.26.0 - diff --git a/new_mit_118.patch b/new_mit_118.patch deleted file mode 100644 index 78177ef..0000000 --- a/new_mit_118.patch +++ /dev/null @@ -1,174 +0,0 @@ -From 04b262f686b5b16ba659ade1e4b5778e2b219f0a Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Mon, 16 Sep 2019 16:40:12 +0300 -Subject: [PATCH 1/2] Adapt sign_authdata in our KDB module for krb5 v1.18 - -Signed-off-by: Isaac Boukris ---- - source4/kdc/mit-kdb/kdb_samba.c | 2 +- - source4/kdc/mit-kdb/kdb_samba.h | 21 +++++++++++++++++++++ - source4/kdc/mit-kdb/kdb_samba_policies.c | 24 ++++++++++++++++++++++++ - 3 files changed, 46 insertions(+), 1 deletion(-) - -diff --git a/source4/kdc/mit-kdb/kdb_samba.c b/source4/kdc/mit-kdb/kdb_samba.c -index c5157d6ed1b..02bbdca9f54 100644 ---- a/source4/kdc/mit-kdb/kdb_samba.c -+++ b/source4/kdc/mit-kdb/kdb_samba.c -@@ -139,7 +139,7 @@ static void kdb_samba_db_free_principal_e_data(krb5_context context, - - kdb_vftabl kdb_function_table = { - .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION, -- .min_ver = 1, -+ .min_ver = KRB5_KDB_DAL_MAJOR_VERSION == 6 ? 1 : 0, - - .init_library = kdb_samba_init_library, - .fini_library = kdb_samba_fini_library, -diff --git a/source4/kdc/mit-kdb/kdb_samba.h b/source4/kdc/mit-kdb/kdb_samba.h -index 22ef9085b6a..ad4f6e27573 100644 ---- a/source4/kdc/mit-kdb/kdb_samba.h -+++ b/source4/kdc/mit-kdb/kdb_samba.h -@@ -114,6 +114,7 @@ krb5_error_code kdb_samba_dbekd_encrypt_key_data(krb5_context context, - - /* from kdb_samba_policies.c */ - -+#if KRB5_KDB_API_VERSION < 10 - krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - unsigned int flags, - krb5_const_principal client_princ, -@@ -127,6 +128,26 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_timestamp authtime, - krb5_authdata **tgt_auth_data, - krb5_authdata ***signed_auth_data); -+#else -+krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, -+ unsigned int flags, -+ krb5_const_principal client_princ, -+ krb5_const_principal server_princ, -+ krb5_db_entry *client, -+ krb5_db_entry *server, -+ krb5_db_entry *krbtgt, -+ krb5_db_entry *local_krbtgt, -+ krb5_keyblock *client_key, -+ krb5_keyblock *server_key, -+ krb5_keyblock *krbtgt_key, -+ krb5_keyblock *local_krbtgt_key, -+ krb5_keyblock *session_key, -+ krb5_timestamp authtime, -+ krb5_authdata **tgt_auth_data, -+ void *authdata_info, -+ krb5_data ***auth_indicators, -+ krb5_authdata ***signed_auth_data); -+#endif - - krb5_error_code kdb_samba_db_check_policy_as(krb5_context context, - krb5_kdc_req *kdcreq, -diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index fc80329f221..e2f7174b0c2 100644 ---- a/source4/kdc/mit-kdb/kdb_samba_policies.c -+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -287,6 +287,7 @@ done: - return code; - } - -+#if KRB5_KDB_API_VERSION < 10 - krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - unsigned int flags, - krb5_const_principal client_princ, -@@ -301,6 +302,29 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_authdata **tgt_auth_data, - krb5_authdata ***signed_auth_data) - { -+#else -+krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, -+ unsigned int flags, -+ krb5_const_principal client_princ, -+ krb5_const_principal server_princ, -+ krb5_db_entry *client, -+ krb5_db_entry *server, -+ krb5_db_entry *krbtgt, -+ krb5_db_entry *local_krbtgt, -+ krb5_keyblock *client_key, -+ krb5_keyblock *server_key, -+ krb5_keyblock *krbtgt_key, -+ krb5_keyblock *local_krbtgt_key, -+ krb5_keyblock *session_key, -+ krb5_timestamp authtime, -+ krb5_authdata **tgt_auth_data, -+ void *authdata_info, -+ krb5_data ***auth_indicators, -+ krb5_authdata ***signed_auth_data) -+{ -+ krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; -+ krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; -+#endif - krb5_const_principal ks_client_princ; - krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; --- -2.24.1 - - -From c968ec07fa403ed919dcda7b3087e0d10d1e7a32 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 16 Jan 2020 22:00:21 +0100 -Subject: [PATCH 2/2] Sign and verify PAC with ticket principal instead of - canon principal - -With MIT library 1.18 the KDC no longer set -KRB5_KDB_FLAG_CANONICALIZE for enterprise principals which allows -us to not canonicalize them (like in Windwos / Heimdal). - -However, it now breaks the PAC signature verification as it was -wrongly done using canonical client rather than ticket client name. - -Signed-off-by: Isaac Boukris ---- - source4/kdc/mit-kdb/kdb_samba_policies.c | 12 ++---------- - 1 file changed, 2 insertions(+), 10 deletions(-) - -diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index e2f7174b0c2..6a5f06a8a8c 100644 ---- a/source4/kdc/mit-kdb/kdb_samba_policies.c -+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -325,20 +325,12 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; - krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; - #endif -- krb5_const_principal ks_client_princ; - krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; - krb5_error_code code; - krb5_pac pac = NULL; - krb5_data pac_data; - -- /* Prefer canonicalised name from client entry */ -- if (client != NULL) { -- ks_client_princ = client->princ; -- } else { -- ks_client_princ = client_princ; -- } -- - is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); - - if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { -@@ -351,7 +343,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (!is_as_req) { - code = ks_verify_pac(context, - flags, -- ks_client_princ, -+ client_princ, - client, - server, - krbtgt, -@@ -378,7 +370,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - goto done; - } - -- code = krb5_pac_sign(context, pac, authtime, ks_client_princ, -+ code = krb5_pac_sign(context, pac, authtime, client_princ, - server_key, krbtgt_key, &pac_data); - if (code != 0) { - DBG_ERR("krb5_pac_sign failed: %d\n", code); --- -2.24.1 - diff --git a/samba-4.12.3-vfs_io_uring-bz14361.patch b/samba-4.12.3-vfs_io_uring-bz14361.patch deleted file mode 100644 index ad796ba..0000000 --- a/samba-4.12.3-vfs_io_uring-bz14361.patch +++ /dev/null @@ -1,2423 +0,0 @@ -From d7ab59f80f535e960780ec3a643101dfe96627ac Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 11 May 2020 12:37:41 +0200 -Subject: [PATCH 01/31] s4:torture: add tests to test the SMB2 read/write - offset/length boundaries - -[MS-FSA] 2.1.5.2 Server Requests a Read and -2.1.5.3 Server Requests a Write define some contraints. - -These tests demonstrate that ((int64_t)offset) < 0) is -not allowed for both reads and writes for SMB. -Also the special case for writes at offset -2 is not possible -nor the append mode with offset < 0. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 54de0e4a3e46a53db5262963e64b109c567554a1) ---- - selftest/knownfail.d/rw-invalid | 2 + - source4/torture/smb2/read_write.c | 189 ++++++++++++++++++++++++++++++ - 2 files changed, 191 insertions(+) - create mode 100644 selftest/knownfail.d/rw-invalid - -diff --git a/selftest/knownfail.d/rw-invalid b/selftest/knownfail.d/rw-invalid -new file mode 100644 -index 00000000000..c6f11e03d20 ---- /dev/null -+++ b/selftest/knownfail.d/rw-invalid -@@ -0,0 +1,2 @@ -+samba3.smb2.rw.invalid -+samba4.smb2.rw.invalid -diff --git a/source4/torture/smb2/read_write.c b/source4/torture/smb2/read_write.c -index bc8898cec31..b0eea55d7f1 100644 ---- a/source4/torture/smb2/read_write.c -+++ b/source4/torture/smb2/read_write.c -@@ -23,8 +23,19 @@ - #include "libcli/smb2/smb2.h" - #include "libcli/smb2/smb2_calls.h" - #include "torture/torture.h" -+#include "torture/util.h" - #include "torture/smb2/proto.h" - -+#define CHECK_STATUS(_status, _expected) \ -+ torture_assert_ntstatus_equal_goto(torture, _status, _expected, \ -+ ret, done, "Incorrect status") -+ -+#define CHECK_VALUE(v, correct) \ -+ torture_assert_int_equal_goto(torture, v, correct, \ -+ ret, done, "Incorrect value") -+ -+#define FNAME "smb2_writetest.dat" -+ - static bool run_smb2_readwritetest(struct torture_context *tctx, - struct smb2_tree *t1, struct smb2_tree *t2) - { -@@ -150,12 +161,190 @@ static bool run_smb2_wrap_readwritetest(struct torture_context *tctx, - return run_smb2_readwritetest(tctx, tree1, tree1); - } - -+static bool test_rw_invalid(struct torture_context *torture, struct smb2_tree *tree) -+{ -+ bool ret = true; -+ NTSTATUS status; -+ struct smb2_handle h; -+ uint8_t buf[64*1024]; -+ struct smb2_read rd; -+ struct smb2_write w = {0}; -+ TALLOC_CTX *tmp_ctx = talloc_new(tree); -+ -+ ZERO_STRUCT(buf); -+ -+ smb2_util_unlink(tree, FNAME); -+ -+ status = torture_smb2_testfile(tree, FNAME, &h); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ -+ status = smb2_util_write(tree, h, buf, 0, ARRAY_SIZE(buf)); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ -+ ZERO_STRUCT(rd); -+ rd.in.file.handle = h; -+ rd.in.length = 10; -+ rd.in.offset = 0; -+ rd.in.min_count = 1; -+ -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(rd.out.data.length, 10); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 10; -+ rd.in.offset = sizeof(buf); -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_END_OF_FILE); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = sizeof(buf); -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(rd.out.data.length, 0); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 1; -+ rd.in.offset = INT64_MAX - 1; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_END_OF_FILE); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = INT64_MAX; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(rd.out.data.length, 0); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 1; -+ rd.in.offset = INT64_MAX; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = (uint64_t)INT64_MAX + 1; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = (uint64_t)INT64_MIN; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = (uint64_t)(int64_t)-1; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = (uint64_t)(int64_t)-2; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = (uint64_t)(int64_t)-3; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = (int64_t)-1; -+ w.in.data.data = buf; -+ w.in.data.length = ARRAY_SIZE(buf); -+ -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = (int64_t)-2; -+ w.in.data.data = buf; -+ w.in.data.length = ARRAY_SIZE(buf); -+ -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = INT64_MIN; -+ w.in.data.data = buf; -+ w.in.data.length = 1; -+ -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = INT64_MIN; -+ w.in.data.data = buf; -+ w.in.data.length = 0; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = INT64_MAX; -+ w.in.data.data = buf; -+ w.in.data.length = 0; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(w.out.nwritten, 0); -+ -+ w.in.file.handle = h; -+ w.in.offset = INT64_MAX; -+ w.in.data.data = buf; -+ w.in.data.length = 1; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = (uint64_t)INT64_MAX + 1; -+ w.in.data.data = buf; -+ w.in.data.length = 0; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = 0xfffffff0000; /* MAXFILESIZE */ -+ w.in.data.data = buf; -+ w.in.data.length = 1; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = 0xfffffff0000 - 1; /* MAXFILESIZE - 1 */ -+ w.in.data.data = buf; -+ w.in.data.length = 1; -+ status = smb2_write(tree, &w); -+ if (TARGET_IS_SAMBA3(torture) || TARGET_IS_SAMBA4(torture)) { -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(w.out.nwritten, 1); -+ } else { -+ CHECK_STATUS(status, NT_STATUS_DISK_FULL); -+ } -+ -+ w.in.file.handle = h; -+ w.in.offset = 0xfffffff0000; /* MAXFILESIZE */ -+ w.in.data.data = buf; -+ w.in.data.length = 0; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(w.out.nwritten, 0); -+ -+done: -+ talloc_free(tmp_ctx); -+ return ret; -+} -+ - struct torture_suite *torture_smb2_readwrite_init(TALLOC_CTX *ctx) - { - struct torture_suite *suite = torture_suite_create(ctx, "rw"); - - torture_suite_add_2smb2_test(suite, "rw1", run_smb2_readwritetest); - torture_suite_add_2smb2_test(suite, "rw2", run_smb2_wrap_readwritetest); -+ torture_suite_add_1smb2_test(suite, "invalid", test_rw_invalid); - - suite->description = talloc_strdup(suite, "SMB2 Samba4 Read/Write"); - --- -2.20.1 - - -From cb8661162b9d344288a776a9e4ff29a47f2cc37d Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 13:06:54 +0200 -Subject: [PATCH 02/31] lib: util: Add sys_valid_io_range() - -This implements the contraints of -[MS-FSA] 2.1.5.2 Server Requests a Read. - -The special handling of [MS-FSA] 2.1.5.3 Server Requests a Write -with offset < 0, should be handled by higher layers! -Which means the check can also be used for writes. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit e02cbd5c3ea6903d2b7b43c3193b8662d029ecdd) ---- - lib/util/sys_rw.c | 24 ++++++++++++++++++++++++ - lib/util/sys_rw.h | 1 + - 2 files changed, 25 insertions(+) - -diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c -index 9a6cdcaa606..6fa7ca57365 100644 ---- a/lib/util/sys_rw.c -+++ b/lib/util/sys_rw.c -@@ -24,6 +24,30 @@ - #include "system/filesys.h" - #include "lib/util/sys_rw.h" - -+bool sys_valid_io_range(off_t offset, size_t length) -+{ -+ uint64_t last_byte_ofs; -+ -+ if (offset < 0) { -+ return false; -+ } -+ -+ if (offset > INT64_MAX) { -+ return false; -+ } -+ -+ if (length > UINT32_MAX) { -+ return false; -+ } -+ -+ last_byte_ofs = (uint64_t)offset + (uint64_t)length; -+ if (last_byte_ofs > INT64_MAX) { -+ return false; -+ } -+ -+ return true; -+} -+ - /******************************************************************* - A read wrapper that will deal with EINTR/EWOULDBLOCK - ********************************************************************/ -diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h -index ab456d87b22..70864cb2b74 100644 ---- a/lib/util/sys_rw.h -+++ b/lib/util/sys_rw.h -@@ -27,6 +27,7 @@ - - struct iovec; - -+bool sys_valid_io_range(off_t offset, size_t length); - ssize_t sys_read(int fd, void *buf, size_t count); - void sys_read_v(int fd, void *buf, size_t count); - ssize_t sys_write(int fd, const void *buf, size_t count); --- -2.20.1 - - -From 640a6715dacfaf7ec9a2b4e4b36fa22b625f571f Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:32:48 -0700 -Subject: [PATCH 03/31] lib: util: Add sys_pread_full(). - -A pread wrapper that will deal with EINTR and never return a short -read unless pread returns zero meaning EOF. - -Thread-safe so may be used as a replacement for pread -inside pread_do() thread functions. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Pair-Programmed-With: Stefan Metzmacher - -Signed-off-by: Jeremy Allison -Signed-off-by: Stefan Metzmacher -(cherry picked from commit 36af33bf9fcdf93fce5ef1520fcb7ddbb07b355e) ---- - lib/util/sys_rw.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++ - lib/util/sys_rw.h | 1 + - 2 files changed, 49 insertions(+) - -diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c -index 6fa7ca57365..bfeb2e6b466 100644 ---- a/lib/util/sys_rw.c -+++ b/lib/util/sys_rw.c -@@ -143,6 +143,54 @@ ssize_t sys_pread(int fd, void *buf, size_t count, off_t off) - return ret; - } - -+/******************************************************************* -+ A pread wrapper that will deal with EINTR and never return a short -+ read unless pread returns zero meaning EOF. -+********************************************************************/ -+ -+ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off) -+{ -+ ssize_t total_read = 0; -+ uint8_t *curr_buf = (uint8_t *)buf; -+ size_t curr_count = count; -+ off_t curr_off = off; -+ bool ok; -+ -+ ok = sys_valid_io_range(off, count); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } -+ -+ while (curr_count != 0) { -+ ssize_t ret = sys_pread(fd, -+ curr_buf, -+ curr_count, -+ curr_off); -+ -+ if (ret == -1) { -+ return -1; -+ } -+ if (ret == 0) { -+ /* EOF */ -+ break; -+ } -+ -+ if (ret > curr_count) { -+ errno = EIO; -+ return -1; -+ } -+ -+ curr_buf += ret; -+ curr_count -= ret; -+ curr_off += ret; -+ -+ total_read += ret; -+ } -+ -+ return total_read; -+} -+ - /******************************************************************* - A write wrapper that will deal with EINTR - ********************************************************************/ -diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h -index 70864cb2b74..1e0dd3730a6 100644 ---- a/lib/util/sys_rw.h -+++ b/lib/util/sys_rw.h -@@ -34,6 +34,7 @@ ssize_t sys_write(int fd, const void *buf, size_t count); - void sys_write_v(int fd, const void *buf, size_t count); - ssize_t sys_writev(int fd, const struct iovec *iov, int iovcnt); - ssize_t sys_pread(int fd, void *buf, size_t count, off_t off); -+ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off); - ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off); - - #endif --- -2.20.1 - - -From c1f14bb9bb4dc2601814dda398e361a9ef097b12 Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:34:32 -0700 -Subject: [PATCH 04/31] lib: util: Add sys_pwrite_full(). - -A pwrite wrapper that will deal with EINTR and never return a short -write unless the file system returns an error. Copes with the -unspecified edge condition of pwrite returning zero by changing -the return to -1, errno = ENOSPC. - -Thread-safe so may be used as a replacement for pwrite -inside pwrite_do() thread functions. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Pair-Programmed-With: Stefan Metzmacher - -Signed-off-by: Jeremy Allison -Signed-off-by: Stefan Metzmacher -(cherry picked from commit 3ba7a89cea85d134eacf1e624e011fe6f66146fc) ---- - lib/util/sys_rw.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++ - lib/util/sys_rw.h | 1 + - 2 files changed, 50 insertions(+) - -diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c -index bfeb2e6b466..d74395fc409 100644 ---- a/lib/util/sys_rw.c -+++ b/lib/util/sys_rw.c -@@ -204,3 +204,52 @@ ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off) - } while (ret == -1 && errno == EINTR); - return ret; - } -+ -+/******************************************************************* -+ A pwrite wrapper that will deal with EINTR and never allow a short -+ write unless the file system returns an error. -+********************************************************************/ -+ -+ssize_t sys_pwrite_full(int fd, const void *buf, size_t count, off_t off) -+{ -+ ssize_t total_written = 0; -+ const uint8_t *curr_buf = (const uint8_t *)buf; -+ size_t curr_count = count; -+ off_t curr_off = off; -+ bool ok; -+ -+ ok = sys_valid_io_range(off, count); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } -+ -+ while (curr_count != 0) { -+ ssize_t ret = sys_pwrite(fd, -+ curr_buf, -+ curr_count, -+ curr_off); -+ -+ if (ret == -1) { -+ return -1; -+ } -+ if (ret == 0) { -+ /* Ensure we can never spin. */ -+ errno = ENOSPC; -+ return -1; -+ } -+ -+ if (ret > curr_count) { -+ errno = EIO; -+ return -1; -+ } -+ -+ curr_buf += ret; -+ curr_count -= ret; -+ curr_off += ret; -+ -+ total_written += ret; -+ } -+ -+ return total_written; -+} -diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h -index 1e0dd3730a6..b224ecb30ac 100644 ---- a/lib/util/sys_rw.h -+++ b/lib/util/sys_rw.h -@@ -36,5 +36,6 @@ ssize_t sys_writev(int fd, const struct iovec *iov, int iovcnt); - ssize_t sys_pread(int fd, void *buf, size_t count, off_t off); - ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off); - ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off); -+ssize_t sys_pwrite_full(int fd, const void *buf, size_t count, off_t off); - - #endif --- -2.20.1 - - -From c4a08bd0b1ecebdbbbbbb257696e0f9b93eebeaa Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 11 May 2020 18:18:24 +0200 -Subject: [PATCH 05/31] smb2_server: fix smbd_smb2_request_verify_sizes() for - SMB2_OP_WRITE - -Writes with a length of 0 are allowed. - -The readfile related check we had before was not really useful -as min_dyn_len can only every be 0 or 1 (and for SMB2_OP_WRITE it's -always 1). So we checked - if (unread_bytes > 0) { - if (unread_bytes < 1) { - return error; - } - } - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit a6eee38ba2f89280676f0a32d26745afd95b551c) ---- - source3/smbd/smb2_server.c | 10 +--------- - 1 file changed, 1 insertion(+), 9 deletions(-) - -diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c -index 8c66d74c8de..88937ac19b0 100644 ---- a/source3/smbd/smb2_server.c -+++ b/source3/smbd/smb2_server.c -@@ -2073,16 +2073,8 @@ NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req, - switch (opcode) { - case SMB2_OP_IOCTL: - case SMB2_OP_GETINFO: -- min_dyn_size = 0; -- break; - case SMB2_OP_WRITE: -- if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) { -- if (req->smb1req->unread_bytes < min_dyn_size) { -- return NT_STATUS_INVALID_PARAMETER; -- } -- -- min_dyn_size = 0; -- } -+ min_dyn_size = 0; - break; - } - --- -2.20.1 - - -From 74fadf2f083daaf4358a9b64c1092586595894d5 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 11 May 2020 18:18:24 +0200 -Subject: [PATCH 06/31] s3:smbd: handle 0 length writes as no-op. - -They should never touch the SMB_VFS layer -and they never trigger an DISK_FULL error. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit ba68f21286c2c2f1fef8bf8c9cd500a622077887) ---- - source3/smbd/aio.c | 5 +++++ - source3/smbd/fileio.c | 4 ++++ - 2 files changed, 9 insertions(+) - -diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c -index cf35f3297ec..088ea603788 100644 ---- a/source3/smbd/aio.c -+++ b/source3/smbd/aio.c -@@ -339,6 +339,11 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, - state->fsp = fsp; - state->write_through = write_through; - -+ if (n == 0) { -+ tevent_req_done(req); -+ return tevent_req_post(req, ev); -+ } -+ - subreq = SMB_VFS_PWRITE_SEND(state, ev, fsp, data, n, offset); - if (tevent_req_nomem(subreq, req)) { - return tevent_req_post(req, ev); -diff --git a/source3/smbd/fileio.c b/source3/smbd/fileio.c -index 31d5b7510b7..f4a3dde66b7 100644 ---- a/source3/smbd/fileio.c -+++ b/source3/smbd/fileio.c -@@ -70,6 +70,10 @@ static ssize_t real_write_file(struct smb_request *req, - { - ssize_t ret; - -+ if (n == 0) { -+ return 0; -+ } -+ - fsp->fh->pos = pos; - if (pos && lp_strict_allocate(SNUM(fsp->conn) && - !fsp->is_sparse)) { --- -2.20.1 - - -From c593b105e646792cf19901e94ed764dc3b50d752 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 11 May 2020 22:00:37 +0200 -Subject: [PATCH 07/31] s3:smbd: add vfs_valid_{pread,pwrite}_range() helper - functions - -These implement the SMB2 visible behavior of the [MS-FSA] -2.1.5.2 Server Requests a Read and 2.1.5.3 Server Requests a Write -constraints. Note that offset < 0 is not allowed over SMB. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 70fa4b884d2c22669984c25fe757c2fc528f7331) ---- - source3/smbd/proto.h | 2 ++ - source3/smbd/vfs.c | 32 ++++++++++++++++++++++++++++++++ - 2 files changed, 34 insertions(+) - -diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h -index 8e33c473d44..60941ce6c1b 100644 ---- a/source3/smbd/proto.h -+++ b/source3/smbd/proto.h -@@ -1246,6 +1246,8 @@ void sys_utmp_yield(const char *username, const char *hostname, - bool vfs_init_custom(connection_struct *conn, const char *vfs_object); - bool smbd_vfs_init(connection_struct *conn); - NTSTATUS vfs_file_exist(connection_struct *conn, struct smb_filename *smb_fname); -+bool vfs_valid_pread_range(off_t offset, size_t length); -+bool vfs_valid_pwrite_range(off_t offset, size_t length); - ssize_t vfs_pwrite_data(struct smb_request *req, - files_struct *fsp, - const char *buffer, -diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c -index 7dc15158ccb..566eed35d9b 100644 ---- a/source3/smbd/vfs.c -+++ b/source3/smbd/vfs.c -@@ -32,6 +32,7 @@ - #include "ntioctl.h" - #include "lib/util/tevent_unix.h" - #include "lib/util/tevent_ntstatus.h" -+#include "lib/util/sys_rw.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_VFS -@@ -399,6 +400,37 @@ NTSTATUS vfs_file_exist(connection_struct *conn, struct smb_filename *smb_fname) - return NT_STATUS_OBJECT_NAME_NOT_FOUND; - } - -+bool vfs_valid_pread_range(off_t offset, size_t length) -+{ -+ return sys_valid_io_range(offset, length); -+} -+ -+bool vfs_valid_pwrite_range(off_t offset, size_t length) -+{ -+ /* -+ * See MAXFILESIZE in [MS-FSA] 2.1.5.3 Server Requests a Write -+ */ -+ static const uint64_t maxfilesize = 0xfffffff0000; -+ uint64_t last_byte_ofs; -+ bool ok; -+ -+ ok = sys_valid_io_range(offset, length); -+ if (!ok) { -+ return false; -+ } -+ -+ if (length == 0) { -+ return true; -+ } -+ -+ last_byte_ofs = offset + length; -+ if (last_byte_ofs > maxfilesize) { -+ return false; -+ } -+ -+ return true; -+} -+ - ssize_t vfs_pwrite_data(struct smb_request *req, - files_struct *fsp, - const char *buffer, --- -2.20.1 - - -From 9e1f6bb08d5e814e9894d643c46ff1aac6a8da0b Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 11 May 2020 18:18:24 +0200 -Subject: [PATCH 08/31] smbd: add vfs_valid_{pread,pwrite}_range() checks where - needed - -I checked all callers of SMB_VFS_PWRITE[_SEND](), -all callers of SMB_VFS_PREAD[_SEND]() and also -places where we append to the file and allocate -more space. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 6fa753a1a67d563cd22d0cad73ae15ee267512fc) ---- - selftest/knownfail.d/rw-invalid | 3 +-- - source3/modules/vfs_default.c | 7 +++++++ - source3/smbd/aio.c | 19 ++++++++++++++++++ - source3/smbd/fileio.c | 14 ++++++++++++++ - source3/smbd/vfs.c | 34 +++++++++++++++++++++++++++++++-- - 5 files changed, 73 insertions(+), 4 deletions(-) - -diff --git a/selftest/knownfail.d/rw-invalid b/selftest/knownfail.d/rw-invalid -index c6f11e03d20..ac5fe573239 100644 ---- a/selftest/knownfail.d/rw-invalid -+++ b/selftest/knownfail.d/rw-invalid -@@ -1,2 +1 @@ --samba3.smb2.rw.invalid --samba4.smb2.rw.invalid -+samba4.smb2.rw.invalid.ad_dc_ntvfs -diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c -index a30f3ba1d31..3511c548166 100644 ---- a/source3/modules/vfs_default.c -+++ b/source3/modules/vfs_default.c -@@ -2582,6 +2582,13 @@ static int strict_allocate_ftruncate(vfs_handle_struct *handle, files_struct *fs - int ret; - NTSTATUS status; - SMB_STRUCT_STAT *pst; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(len, 0); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - status = vfs_stat_fsp(fsp); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c -index 088ea603788..af8a01461a7 100644 ---- a/source3/smbd/aio.c -+++ b/source3/smbd/aio.c -@@ -166,6 +166,12 @@ NTSTATUS schedule_aio_read_and_X(connection_struct *conn, - size_t bufsize; - size_t min_aio_read_size = lp_aio_read_size(SNUM(conn)); - struct tevent_req *req; -+ bool ok; -+ -+ ok = vfs_valid_pread_range(startpos, smb_maxcnt); -+ if (!ok) { -+ return NT_STATUS_INVALID_PARAMETER; -+ } - - if (fsp->base_fsp != NULL) { - /* No AIO on streams yet */ -@@ -330,6 +336,7 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, - { - struct tevent_req *req, *subreq; - struct pwrite_fsync_state *state; -+ bool ok; - - req = tevent_req_create(mem_ctx, &state, struct pwrite_fsync_state); - if (req == NULL) { -@@ -339,6 +346,12 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, - state->fsp = fsp; - state->write_through = write_through; - -+ ok = vfs_valid_pwrite_range(offset, n); -+ if (!ok) { -+ tevent_req_error(req, EINVAL); -+ return tevent_req_post(req, ev); -+ } -+ - if (n == 0) { - tevent_req_done(req); - return tevent_req_post(req, ev); -@@ -665,6 +678,12 @@ NTSTATUS schedule_smb2_aio_read(connection_struct *conn, - struct aio_extra *aio_ex; - size_t min_aio_read_size = lp_aio_read_size(SNUM(conn)); - struct tevent_req *req; -+ bool ok; -+ -+ ok = vfs_valid_pread_range(startpos, smb_maxcnt); -+ if (!ok) { -+ return NT_STATUS_INVALID_PARAMETER; -+ } - - if (fsp->base_fsp != NULL) { - /* No AIO on streams yet */ -diff --git a/source3/smbd/fileio.c b/source3/smbd/fileio.c -index f4a3dde66b7..000a01e2c0f 100644 ---- a/source3/smbd/fileio.c -+++ b/source3/smbd/fileio.c -@@ -32,6 +32,7 @@ - ssize_t read_file(files_struct *fsp,char *data,off_t pos,size_t n) - { - ssize_t ret = 0; -+ bool ok; - - /* you can't read from print files */ - if (fsp->print_file) { -@@ -39,6 +40,12 @@ ssize_t read_file(files_struct *fsp,char *data,off_t pos,size_t n) - return -1; - } - -+ ok = vfs_valid_pread_range(pos, n); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } -+ - fsp->fh->pos = pos; - - if (n > 0) { -@@ -69,6 +76,13 @@ static ssize_t real_write_file(struct smb_request *req, - size_t n) - { - ssize_t ret; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(pos, n); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - if (n == 0) { - return 0; -diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c -index 566eed35d9b..96067e45005 100644 ---- a/source3/smbd/vfs.c -+++ b/source3/smbd/vfs.c -@@ -439,6 +439,13 @@ ssize_t vfs_pwrite_data(struct smb_request *req, - { - size_t total=0; - ssize_t ret; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(offset, N); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - if (req && req->unread_bytes) { - int sockfd = req->xconn->transport.sock; -@@ -515,6 +522,7 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) - uint64_t space_avail; - uint64_t bsize,dfree,dsize; - NTSTATUS status; -+ bool ok; - - /* - * Actually try and commit the space on disk.... -@@ -523,8 +531,9 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) - DEBUG(10,("vfs_allocate_file_space: file %s, len %.0f\n", - fsp_str_dbg(fsp), (double)len)); - -- if (((off_t)len) < 0) { -- DEBUG(0,("vfs_allocate_file_space: %s negative len " -+ ok = vfs_valid_pwrite_range((off_t)len, 0); -+ if (!ok) { -+ DEBUG(0,("vfs_allocate_file_space: %s negative/invalid len " - "requested.\n", fsp_str_dbg(fsp))); - errno = EINVAL; - return -1; -@@ -609,6 +618,13 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) - int vfs_set_filelen(files_struct *fsp, off_t len) - { - int ret; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(len, 0); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - contend_level2_oplocks_begin(fsp, LEVEL2_CONTEND_SET_FILE_LEN); - -@@ -640,6 +656,13 @@ int vfs_slow_fallocate(files_struct *fsp, off_t offset, off_t len) - { - ssize_t pwrite_ret; - size_t total = 0; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(offset, len); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - if (!sparse_buf) { - sparse_buf = SMB_CALLOC_ARRAY(char, SPARSE_BUF_WRITE_SIZE); -@@ -680,6 +703,13 @@ int vfs_fill_sparse(files_struct *fsp, off_t len) - NTSTATUS status; - off_t offset; - size_t num_to_write; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(len, 0); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - status = vfs_stat_fsp(fsp); - if (!NT_STATUS_IS_OK(status)) { --- -2.20.1 - - -From af989582036a929eb0e2594b1e2ee54145d41286 Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:42:10 -0700 -Subject: [PATCH 09/31] s3: VFS: aio_fork: Change sys_pread() -> - sys_pread_full() to protect against short reads. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 60f590000d545292760018694deb34a7cc4ded6d) ---- - source3/modules/vfs_aio_fork.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_aio_fork.c b/source3/modules/vfs_aio_fork.c -index a1fed5c0655..285b331ff9c 100644 ---- a/source3/modules/vfs_aio_fork.c -+++ b/source3/modules/vfs_aio_fork.c -@@ -342,7 +342,7 @@ static void aio_child_loop(int sockfd, struct mmap_area *map) - - switch (cmd_struct.cmd) { - case READ_CMD: -- ret_struct.size = sys_pread( -+ ret_struct.size = sys_pread_full( - fd, discard_const(map->ptr), cmd_struct.n, - cmd_struct.offset); - #if 0 --- -2.20.1 - - -From 52b13fda0509f3bb28026a3d0f7d304c3bf28b08 Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:42:53 -0700 -Subject: [PATCH 10/31] s3: VFS: aio_fork: Change sys_pwrite() -> - sys_pwrite_full() to protect against short writes. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 20ee8b03bbe5bef4ea968170808e3c4c9d22318e) ---- - source3/modules/vfs_aio_fork.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_aio_fork.c b/source3/modules/vfs_aio_fork.c -index 285b331ff9c..7c6f4b00fd0 100644 ---- a/source3/modules/vfs_aio_fork.c -+++ b/source3/modules/vfs_aio_fork.c -@@ -353,7 +353,7 @@ static void aio_child_loop(int sockfd, struct mmap_area *map) - #endif - break; - case WRITE_CMD: -- ret_struct.size = sys_pwrite( -+ ret_struct.size = sys_pwrite_full( - fd, discard_const(map->ptr), cmd_struct.n, - cmd_struct.offset); - break; --- -2.20.1 - - -From bd99244e029ef1df6a60a276d794bcd465a7bb5b Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:43:34 -0700 -Subject: [PATCH 11/31] s3: VFS: default. Change sys_pread() -> - sys_pread_full() in SMB_VFS_PREAD() to protect against short reads. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 7daa79908b6a0362db30276b3b6f0db176b6ae3c) ---- - source3/modules/vfs_default.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c -index 3511c548166..1170629b084 100644 ---- a/source3/modules/vfs_default.c -+++ b/source3/modules/vfs_default.c -@@ -739,7 +739,7 @@ static ssize_t vfswrap_pread(vfs_handle_struct *handle, files_struct *fsp, void - - #if defined(HAVE_PREAD) || defined(HAVE_PREAD64) - START_PROFILE_BYTES(syscall_pread, n); -- result = sys_pread(fsp->fh->fd, data, n, offset); -+ result = sys_pread_full(fsp->fh->fd, data, n, offset); - END_PROFILE_BYTES(syscall_pread); - - if (result == -1 && errno == ESPIPE) { --- -2.20.1 - - -From 26ec59040879427166e04cdadbff175a40018c87 Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:44:26 -0700 -Subject: [PATCH 12/31] s3: VFS: default. Change sys_pwrite() -> - sys_pwrite_full() in SMB_VFS_PWRITE() to protect against short writes. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit ca8c3619f657dc38db7cb248f1a657f5bfe20757) ---- - source3/modules/vfs_default.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c -index 1170629b084..e516c733e69 100644 ---- a/source3/modules/vfs_default.c -+++ b/source3/modules/vfs_default.c -@@ -763,7 +763,7 @@ static ssize_t vfswrap_pwrite(vfs_handle_struct *handle, files_struct *fsp, cons - - #if defined(HAVE_PWRITE) || defined(HAVE_PRWITE64) - START_PROFILE_BYTES(syscall_pwrite, n); -- result = sys_pwrite(fsp->fh->fd, data, n, offset); -+ result = sys_pwrite_full(fsp->fh->fd, data, n, offset); - END_PROFILE_BYTES(syscall_pwrite); - - if (result == -1 && errno == ESPIPE) { --- -2.20.1 - - -From fa25bd26d1fe02c7480f2af7e22af8a03127157e Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:45:10 -0700 -Subject: [PATCH 13/31] s3: VFS: default. Change pread() -> sys_pread_full() in - SMB_VFS_PREAD_SEND() to protect against short reads. - -Note that as sys_pread_full() deals with the EINTR case -we can remove the do {} while loop here. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit bf2e546be38abfc77cf40e0b0fef42937696dcde) ---- - source3/modules/vfs_default.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c -index e516c733e69..809c9b3d92f 100644 ---- a/source3/modules/vfs_default.c -+++ b/source3/modules/vfs_default.c -@@ -843,10 +843,10 @@ static void vfs_pread_do(void *private_data) - - PROFILE_TIMESTAMP(&start_time); - -- do { -- state->ret = pread(state->fd, state->buf, state->count, -- state->offset); -- } while ((state->ret == -1) && (errno == EINTR)); -+ state->ret = sys_pread_full(state->fd, -+ state->buf, -+ state->count, -+ state->offset); - - if (state->ret == -1) { - state->vfs_aio_state.error = errno; --- -2.20.1 - - -From 9a4639d6500900e18dfb685fbf4dc597f98cc63c Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:48:49 -0700 -Subject: [PATCH 14/31] s3: VFS: default. Change pwrite() -> sys_pwrite_full() - in SMB_VFS_PWRITE_SEND() to protect against short writes. - -Note that as sys_pwrite_full() deals with the EINTR case -we can remove the do {} while loop here. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 801c06f4c9400343b72cad998086288931f7c6b3) ---- - source3/modules/vfs_default.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c -index 809c9b3d92f..4cf553411cb 100644 ---- a/source3/modules/vfs_default.c -+++ b/source3/modules/vfs_default.c -@@ -971,10 +971,10 @@ static void vfs_pwrite_do(void *private_data) - - PROFILE_TIMESTAMP(&start_time); - -- do { -- state->ret = pwrite(state->fd, state->buf, state->count, -- state->offset); -- } while ((state->ret == -1) && (errno == EINTR)); -+ state->ret = sys_pwrite_full(state->fd, -+ state->buf, -+ state->count, -+ state->offset); - - if (state->ret == -1) { - state->vfs_aio_state.error = errno; --- -2.20.1 - - -From 9ecf0e23c6b5f40cf73df600b4ce2e6469d32065 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Wed, 6 May 2020 03:05:47 -0700 -Subject: [PATCH 15/31] vfs_io_uring: fix the prefix for parametric options - from 'vfs_io_uring' to 'io_uring' - -This is what the manpage describes. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit fadc7043a71b409ad60a1a4076a7f88f379d2056) ---- - source3/modules/vfs_io_uring.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 378e48d112f..b409d075337 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -172,13 +172,13 @@ static int vfs_io_uring_connect(vfs_handle_struct *handle, const char *service, - } - - num_entries = lp_parm_ulong(SNUM(handle->conn), -- "vfs_io_uring", -+ "io_uring", - "num_entries", - 128); - num_entries = MAX(num_entries, 1); - - sqpoll = lp_parm_bool(SNUM(handle->conn), -- "vfs_io_uring", -+ "io_uring", - "sqpoll", - false); - if (sqpoll) { --- -2.20.1 - - -From 0f22fb3e27bdda29e4969e4ddb64f0287deb5599 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 10:39:52 +0200 -Subject: [PATCH 16/31] vfs_io_uring: replace vfs_io_uring_request->state with - _tevent_req_data() - -We don't need a direct pointer to the state... - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit f78e98e0226fe70899b613e0aa5c804d8458bdb0) ---- - source3/modules/vfs_io_uring.c | 10 ++++------ - 1 file changed, 4 insertions(+), 6 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index b409d075337..988b309da52 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -42,7 +42,6 @@ struct vfs_io_uring_request { - struct vfs_io_uring_request **list_head; - struct vfs_io_uring_config *config; - struct tevent_req *req; -- void *state; - struct io_uring_sqe sqe; - struct io_uring_cqe cqe; - struct timespec start_time; -@@ -58,8 +57,9 @@ static void vfs_io_uring_finish_req(struct vfs_io_uring_request *cur, - struct tevent_req *req = - talloc_get_type_abort(cur->req, - struct tevent_req); -+ void *state = _tevent_req_data(req); - -- talloc_set_destructor(cur->state, NULL); -+ talloc_set_destructor(state, NULL); - if (cur->list_head != NULL) { - DLIST_REMOVE((*cur->list_head), cur); - cur->list_head = NULL; -@@ -238,6 +238,7 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) - - for (cur = config->queue; cur != NULL; cur = next) { - struct io_uring_sqe *sqe = NULL; -+ void *state = _tevent_req_data(cur->req); - - next = cur->next; - -@@ -246,7 +247,7 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) - break; - } - -- talloc_set_destructor(cur->state, -+ talloc_set_destructor(state, - vfs_io_uring_request_state_deny_destructor); - DLIST_REMOVE(config->queue, cur); - *sqe = cur->sqe; -@@ -318,7 +319,6 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - } - state->ur.config = config; - state->ur.req = req; -- state->ur.state = state; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pread, profile_p, - state->ur.profile_bytes, n); -@@ -398,7 +398,6 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - } - state->ur.config = config; - state->ur.req = req; -- state->ur.state = state; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pwrite, profile_p, - state->ur.profile_bytes, n); -@@ -475,7 +474,6 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand - } - state->ur.config = config; - state->ur.req = req; -- state->ur.state = state; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_fsync, profile_p, - state->ur.profile_bytes, 0); --- -2.20.1 - - -From 61d1e13c927a8fb8439d576026dc56a2379f127d Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 10:42:59 +0200 -Subject: [PATCH 17/31] vfs_io_uring: introduce - vfs_io_uring_request->completion_fn() - -We'll need to add more logic than a simple _tevent_req_done() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 456533c9cfc332d3a83ea03a6f969b0d64ccbeb6) ---- - source3/modules/vfs_io_uring.c | 49 +++++++++++++++++++++++++++++++++- - 1 file changed, 48 insertions(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 988b309da52..abdd4d16e9f 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -44,6 +44,8 @@ struct vfs_io_uring_request { - struct tevent_req *req; - struct io_uring_sqe sqe; - struct io_uring_cqe cqe; -+ void (*completion_fn)(struct vfs_io_uring_request *cur, -+ const char *location); - struct timespec start_time; - struct timespec end_time; - SMBPROFILE_BYTES_ASYNC_STATE(profile_bytes); -@@ -74,7 +76,7 @@ static void vfs_io_uring_finish_req(struct vfs_io_uring_request *cur, - * or tevent_req_defer_callback() being called - * already. - */ -- _tevent_req_done(req, location); -+ cur->completion_fn(cur, location); - } - - static void vfs_io_uring_config_destroy(struct vfs_io_uring_config *config, -@@ -297,6 +299,9 @@ struct vfs_io_uring_pread_state { - struct iovec iov; - }; - -+static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, -+ const char *location); -+ - static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *handle, - TALLOC_CTX *mem_ctx, - struct tevent_context *ev, -@@ -319,6 +324,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - } - state->ur.config = config; - state->ur.req = req; -+ state->ur.completion_fn = vfs_io_uring_pread_completion; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pread, profile_p, - state->ur.profile_bytes, n); -@@ -344,6 +350,17 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - return req; - } - -+static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, -+ const char *location) -+{ -+ /* -+ * We rely on being inside the _send() function -+ * or tevent_req_defer_callback() being called -+ * already. -+ */ -+ _tevent_req_done(cur->req, location); -+} -+ - static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, - struct vfs_aio_state *vfs_aio_state) - { -@@ -376,6 +393,9 @@ struct vfs_io_uring_pwrite_state { - struct iovec iov; - }; - -+static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, -+ const char *location); -+ - static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *handle, - TALLOC_CTX *mem_ctx, - struct tevent_context *ev, -@@ -398,6 +418,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - } - state->ur.config = config; - state->ur.req = req; -+ state->ur.completion_fn = vfs_io_uring_pwrite_completion; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pwrite, profile_p, - state->ur.profile_bytes, n); -@@ -423,6 +444,17 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - return req; - } - -+static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, -+ const char *location) -+{ -+ /* -+ * We rely on being inside the _send() function -+ * or tevent_req_defer_callback() being called -+ * already. -+ */ -+ _tevent_req_done(cur->req, location); -+} -+ - static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, - struct vfs_aio_state *vfs_aio_state) - { -@@ -454,6 +486,9 @@ struct vfs_io_uring_fsync_state { - struct vfs_io_uring_request ur; - }; - -+static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, -+ const char *location); -+ - static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *handle, - TALLOC_CTX *mem_ctx, - struct tevent_context *ev, -@@ -474,6 +509,7 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand - } - state->ur.config = config; - state->ur.req = req; -+ state->ur.completion_fn = vfs_io_uring_fsync_completion; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_fsync, profile_p, - state->ur.profile_bytes, 0); -@@ -496,6 +532,17 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand - return req; - } - -+static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, -+ const char *location) -+{ -+ /* -+ * We rely on being inside the _send() function -+ * or tevent_req_defer_callback() being called -+ * already. -+ */ -+ _tevent_req_done(cur->req, location); -+} -+ - static int vfs_io_uring_fsync_recv(struct tevent_req *req, - struct vfs_aio_state *vfs_aio_state) - { --- -2.20.1 - - -From 1d670bd14381a00c872ec56033f602b9e18f11b0 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 10:52:52 +0200 -Subject: [PATCH 18/31] vfs_io_uring: move error handling out of - vfs_io_uring_pread_recv() - -We should do that as early as possible and that's in -vfs_io_uring_pread_completion(). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit a1487067a6c9df3136fd5d4d16dda4c0f63cb662) ---- - source3/modules/vfs_io_uring.c | 26 +++++++++++++++++--------- - 1 file changed, 17 insertions(+), 9 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index abdd4d16e9f..0d8e1833009 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -297,6 +297,7 @@ static void vfs_io_uring_fd_handler(struct tevent_context *ev, - struct vfs_io_uring_pread_state { - struct vfs_io_uring_request ur; - struct iovec iov; -+ size_t nread; - }; - - static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, -@@ -353,12 +354,23 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - const char *location) - { -+ struct vfs_io_uring_pread_state *state = tevent_req_data( -+ cur->req, struct vfs_io_uring_pread_state); -+ - /* - * We rely on being inside the _send() function - * or tevent_req_defer_callback() being called - * already. - */ -- _tevent_req_done(cur->req, location); -+ -+ if (cur->cqe.res < 0) { -+ int err = -cur->cqe.res; -+ _tevent_req_error(cur->req, err, location); -+ return; -+ } -+ -+ state->nread = state->ur.cqe.res; -+ tevent_req_done(cur->req); - } - - static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, -@@ -366,23 +378,19 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, - { - struct vfs_io_uring_pread_state *state = tevent_req_data( - req, struct vfs_io_uring_pread_state); -- int ret; -+ ssize_t ret; - - SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); - vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, - &state->ur.start_time); - - if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { -+ tevent_req_received(req); - return -1; - } - -- if (state->ur.cqe.res < 0) { -- vfs_aio_state->error = -state->ur.cqe.res; -- ret = -1; -- } else { -- vfs_aio_state->error = 0; -- ret = state->ur.cqe.res; -- } -+ vfs_aio_state->error = 0; -+ ret = state->nread; - - tevent_req_received(req); - return ret; --- -2.20.1 - - -From d340f961466be94d1467b4953389b721421fb86a Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 10:52:52 +0200 -Subject: [PATCH 19/31] vfs_io_uring: move error handling out of - vfs_io_uring_pwrite_recv() - -We should do that as early as possible and that's in -vfs_io_uring_pwrite_completion(). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit a51969b8c7e6e49c0d3b776d897aea4f309f8678) ---- - source3/modules/vfs_io_uring.c | 26 +++++++++++++++++--------- - 1 file changed, 17 insertions(+), 9 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 0d8e1833009..a8da341e7b7 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -399,6 +399,7 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, - struct vfs_io_uring_pwrite_state { - struct vfs_io_uring_request ur; - struct iovec iov; -+ size_t nwritten; - }; - - static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, -@@ -455,12 +456,23 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - const char *location) - { -+ struct vfs_io_uring_pwrite_state *state = tevent_req_data( -+ cur->req, struct vfs_io_uring_pwrite_state); -+ - /* - * We rely on being inside the _send() function - * or tevent_req_defer_callback() being called - * already. - */ -- _tevent_req_done(cur->req, location); -+ -+ if (cur->cqe.res < 0) { -+ int err = -cur->cqe.res; -+ _tevent_req_error(cur->req, err, location); -+ return; -+ } -+ -+ state->nwritten = state->ur.cqe.res; -+ tevent_req_done(cur->req); - } - - static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, -@@ -468,23 +480,19 @@ static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, - { - struct vfs_io_uring_pwrite_state *state = tevent_req_data( - req, struct vfs_io_uring_pwrite_state); -- int ret; -+ ssize_t ret; - - SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); - vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, - &state->ur.start_time); - - if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { -+ tevent_req_received(req); - return -1; - } - -- if (state->ur.cqe.res < 0) { -- vfs_aio_state->error = -state->ur.cqe.res; -- ret = -1; -- } else { -- vfs_aio_state->error = 0; -- ret = state->ur.cqe.res; -- } -+ vfs_aio_state->error = 0; -+ ret = state->nwritten; - - tevent_req_received(req); - return ret; --- -2.20.1 - - -From 3da1624f4f6a674dd1e83d2b327e7a38cca7c252 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 10:52:52 +0200 -Subject: [PATCH 20/31] vfs_io_uring: move error handling out of - vfs_io_uring_fsync_recv() - -We should do that as early as possible and that's in -vfs_io_uring_fsync_completion(). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 40be2232a44a86cb5dfdda330801e615826408ba) ---- - source3/modules/vfs_io_uring.c | 21 +++++++++++---------- - 1 file changed, 11 insertions(+), 10 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index a8da341e7b7..0f560c95b67 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -556,7 +556,14 @@ static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, - * or tevent_req_defer_callback() being called - * already. - */ -- _tevent_req_done(cur->req, location); -+ -+ if (cur->cqe.res < 0) { -+ int err = -cur->cqe.res; -+ _tevent_req_error(cur->req, err, location); -+ return; -+ } -+ -+ tevent_req_done(cur->req); - } - - static int vfs_io_uring_fsync_recv(struct tevent_req *req, -@@ -564,26 +571,20 @@ static int vfs_io_uring_fsync_recv(struct tevent_req *req, - { - struct vfs_io_uring_fsync_state *state = tevent_req_data( - req, struct vfs_io_uring_fsync_state); -- int ret; - - SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); - vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, - &state->ur.start_time); - - if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { -+ tevent_req_received(req); - return -1; - } - -- if (state->ur.cqe.res < 0) { -- vfs_aio_state->error = -state->ur.cqe.res; -- ret = -1; -- } else { -- vfs_aio_state->error = 0; -- ret = state->ur.cqe.res; -- } -+ vfs_aio_state->error = 0; - - tevent_req_received(req); -- return ret; -+ return 0; - } - - static struct vfs_fn_pointers vfs_io_uring_fns = { --- -2.20.1 - - -From 8bac62120864dc40285ae680f4493116dd2abe6d Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 13:17:05 +0200 -Subject: [PATCH 21/31] vfs_io_uring: make use of sys_valid_io_range() in - vfs_io_uring_pread_send() - -This makes the follow up commits easier as we don't have to care -about overflows. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 5005ae3fb24018e370ae60cc23c5e9cfe8357bc9) ---- - source3/modules/vfs_io_uring.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 0f560c95b67..c7565b8c39d 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -25,6 +25,7 @@ - #include "smbd/smbd.h" - #include "smbd/globals.h" - #include "lib/util/tevent_unix.h" -+#include "lib/util/sys_rw.h" - #include "smbprofile.h" - #include - -@@ -313,6 +314,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - struct tevent_req *req = NULL; - struct vfs_io_uring_pread_state *state = NULL; - struct vfs_io_uring_config *config = NULL; -+ bool ok; - - SMB_VFS_HANDLE_GET_DATA(handle, config, - struct vfs_io_uring_config, -@@ -331,6 +333,12 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - state->ur.profile_bytes, n); - SMBPROFILE_BYTES_ASYNC_SET_IDLE(state->ur.profile_bytes); - -+ ok = sys_valid_io_range(offset, n); -+ if (!ok) { -+ tevent_req_error(req, EINVAL); -+ return tevent_req_post(req, ev); -+ } -+ - state->iov.iov_base = (void *)data; - state->iov.iov_len = n; - io_uring_prep_readv(&state->ur.sqe, --- -2.20.1 - - -From 371195310fc9510692e0ee7f63361094bd7a4911 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 13:17:05 +0200 -Subject: [PATCH 22/31] vfs_io_uring: make use of sys_valid_io_range() in - vfs_io_uring_pwrite_send() - -This makes the follow up commits easier as we don't have to care -about overflows. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 388bc2e6e44470ea4043ecb22750e241145355d2) ---- - source3/modules/vfs_io_uring.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index c7565b8c39d..ee23449c63c 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -423,6 +423,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - struct tevent_req *req = NULL; - struct vfs_io_uring_pwrite_state *state = NULL; - struct vfs_io_uring_config *config = NULL; -+ bool ok; - - SMB_VFS_HANDLE_GET_DATA(handle, config, - struct vfs_io_uring_config, -@@ -441,6 +442,12 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - state->ur.profile_bytes, n); - SMBPROFILE_BYTES_ASYNC_SET_IDLE(state->ur.profile_bytes); - -+ ok = sys_valid_io_range(offset, n); -+ if (!ok) { -+ tevent_req_error(req, EINVAL); -+ return tevent_req_post(req, ev); -+ } -+ - state->iov.iov_base = discard_const(data); - state->iov.iov_len = n; - io_uring_prep_writev(&state->ur.sqe, --- -2.20.1 - - -From fec90a44a6eb56a883e19268c399b9475a20220d Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 21:29:53 +0200 -Subject: [PATCH 23/31] vfs_io_uring: avoid stack recursion of - vfs_io_uring_queue_run() - -Instead we remember if recursion was triggered and jump to -the start of the function again from the end. - -This should make it safe to be called from the completion_fn(). - -This is hideously complex stuff, so document the hell -out of it. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit f96f45c9ba8d4c8fa4026c22ac4201d66335e5c4) ---- - source3/modules/vfs_io_uring.c | 93 +++++++++++++++++++++++++++++++++- - 1 file changed, 92 insertions(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index ee23449c63c..f94453d9995 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -34,6 +34,10 @@ struct vfs_io_uring_request; - struct vfs_io_uring_config { - struct io_uring uring; - struct tevent_fd *fde; -+ /* recursion guard. See comment above vfs_io_uring_queue_run() */ -+ bool busy; -+ /* recursion guard. See comment above vfs_io_uring_queue_run() */ -+ bool need_retry; - struct vfs_io_uring_request *queue; - struct vfs_io_uring_request *pending; - }; -@@ -222,7 +226,7 @@ static int vfs_io_uring_connect(vfs_handle_struct *handle, const char *service, - return 0; - } - --static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) -+static void _vfs_io_uring_queue_run(struct vfs_io_uring_config *config) - { - struct vfs_io_uring_request *cur = NULL, *next = NULL; - struct io_uring_cqe *cqe = NULL; -@@ -280,6 +284,93 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) - io_uring_cq_advance(&config->uring, nr); - } - -+/* -+ * Wrapper function to prevent recursion which could happen -+ * if we called _vfs_io_uring_queue_run() directly without -+ * recursion checks. -+ * -+ * Looking at the pread call, we can have: -+ * -+ * vfs_io_uring_pread_send() -+ * ->vfs_io_uring_pread_submit() <----------------------------------- -+ * ->vfs_io_uring_request_submit() | -+ * ->vfs_io_uring_queue_run() | -+ * ->_vfs_io_uring_queue_run() | -+ * | -+ * But inside _vfs_io_uring_queue_run() looks like: | -+ * | -+ * _vfs_io_uring_queue_run() { | -+ * if (THIS_IO_COMPLETED) { | -+ * ->vfs_io_uring_finish_req() | -+ * ->cur->completion_fn() | -+ * } | -+ * } | -+ * | -+ * cur->completion_fn() for pread is set to vfs_io_uring_pread_completion() | -+ * | -+ * vfs_io_uring_pread_completion() { | -+ * if (READ_TERMINATED) { | -+ * -> tevent_req_done() - We're done, go back up the stack. | -+ * return; | -+ * } | -+ * | -+ * We have a short read - adjust the io vectors | -+ * | -+ * ->vfs_io_uring_pread_submit() --------------------------------------- -+ * } -+ * -+ * So before calling _vfs_io_uring_queue_run() we backet it with setting -+ * a flag config->busy, and unset it once _vfs_io_uring_queue_run() finally -+ * exits the retry loop. -+ * -+ * If we end up back into vfs_io_uring_queue_run() we notice we've done so -+ * as config->busy is set and don't recurse into _vfs_io_uring_queue_run(). -+ * -+ * We set the second flag config->need_retry that tells us to loop in the -+ * vfs_io_uring_queue_run() call above us in the stack and return. -+ * -+ * When the outer call to _vfs_io_uring_queue_run() returns we are in -+ * a loop checking if config->need_retry was set. That happens if -+ * the short read case occurs and _vfs_io_uring_queue_run() ended up -+ * recursing into vfs_io_uring_queue_run(). -+ * -+ * Once vfs_io_uring_pread_completion() finishes without a short -+ * read (the READ_TERMINATED case, tevent_req_done() is called) -+ * then config->need_retry is left as false, we exit the loop, -+ * set config->busy to false so the next top level call into -+ * vfs_io_uring_queue_run() won't think it's a recursed call -+ * and return. -+ * -+ */ -+ -+static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) -+{ -+ if (config->busy) { -+ /* -+ * We've recursed due to short read/write. -+ * Set need_retry to ensure we retry the -+ * io_uring_submit(). -+ */ -+ config->need_retry = true; -+ return; -+ } -+ -+ /* -+ * Bracket the loop calling _vfs_io_uring_queue_run() -+ * with busy = true / busy = false. -+ * so we can detect recursion above. -+ */ -+ -+ config->busy = true; -+ -+ do { -+ config->need_retry = false; -+ _vfs_io_uring_queue_run(config); -+ } while (config->need_retry); -+ -+ config->busy = false; -+} -+ - static void vfs_io_uring_fd_handler(struct tevent_context *ev, - struct tevent_fd *fde, - uint16_t flags, --- -2.20.1 - - -From f7baf726bbb2c048c243857347731628ae1f112b Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:17:51 +0200 -Subject: [PATCH 24/31] vfs_io_uring: split out a vfs_io_uring_request_submit() - function - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit ab89b8e75354c5fd571985e924e1ccbec99de990) ---- - source3/modules/vfs_io_uring.c | 29 ++++++++++++++--------------- - 1 file changed, 14 insertions(+), 15 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index f94453d9995..1d48bd192fe 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -371,6 +371,17 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) - config->busy = false; - } - -+static void vfs_io_uring_request_submit(struct vfs_io_uring_request *cur) -+{ -+ struct vfs_io_uring_config *config = cur->config; -+ -+ io_uring_sqe_set_data(&cur->sqe, cur); -+ DLIST_ADD_END(config->queue, cur); -+ cur->list_head = &config->queue; -+ -+ vfs_io_uring_queue_run(config); -+} -+ - static void vfs_io_uring_fd_handler(struct tevent_context *ev, - struct tevent_fd *fde, - uint16_t flags, -@@ -436,11 +447,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - fsp->fh->fd, - &state->iov, 1, - offset); -- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); -- DLIST_ADD_END(config->queue, &state->ur); -- state->ur.list_head = &config->queue; -- -- vfs_io_uring_queue_run(config); -+ vfs_io_uring_request_submit(&state->ur); - - if (!tevent_req_is_in_progress(req)) { - return tevent_req_post(req, ev); -@@ -545,11 +552,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - fsp->fh->fd, - &state->iov, 1, - offset); -- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); -- DLIST_ADD_END(config->queue, &state->ur); -- state->ur.list_head = &config->queue; -- -- vfs_io_uring_queue_run(config); -+ vfs_io_uring_request_submit(&state->ur); - - if (!tevent_req_is_in_progress(req)) { - return tevent_req_post(req, ev); -@@ -640,11 +643,7 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand - io_uring_prep_fsync(&state->ur.sqe, - fsp->fh->fd, - 0); /* fsync_flags */ -- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); -- DLIST_ADD_END(config->queue, &state->ur); -- state->ur.list_head = &config->queue; -- -- vfs_io_uring_queue_run(config); -+ vfs_io_uring_request_submit(&state->ur); - - if (!tevent_req_is_in_progress(req)) { - return tevent_req_post(req, ev); --- -2.20.1 - - -From ccda7ef339d743ee90df6739ddcdce22c169b70e Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:17:51 +0200 -Subject: [PATCH 25/31] vfs_io_uring: split out a vfs_io_uring_pread_submit() - function - -This can be reused when we add handling for short reads. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 9de4f8be1dc8b4274891016191a5ca1f724e08b3) ---- - source3/modules/vfs_io_uring.c | 20 +++++++++++++++----- - 1 file changed, 15 insertions(+), 5 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 1d48bd192fe..19e268e63db 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -399,10 +399,13 @@ static void vfs_io_uring_fd_handler(struct tevent_context *ev, - - struct vfs_io_uring_pread_state { - struct vfs_io_uring_request ur; -+ struct files_struct *fsp; -+ off_t offset; - struct iovec iov; - size_t nread; - }; - -+static void vfs_io_uring_pread_submit(struct vfs_io_uring_pread_state *state); - static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - const char *location); - -@@ -441,13 +444,11 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - return tevent_req_post(req, ev); - } - -+ state->fsp = fsp; -+ state->offset = offset; - state->iov.iov_base = (void *)data; - state->iov.iov_len = n; -- io_uring_prep_readv(&state->ur.sqe, -- fsp->fh->fd, -- &state->iov, 1, -- offset); -- vfs_io_uring_request_submit(&state->ur); -+ vfs_io_uring_pread_submit(state); - - if (!tevent_req_is_in_progress(req)) { - return tevent_req_post(req, ev); -@@ -457,6 +458,15 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - return req; - } - -+static void vfs_io_uring_pread_submit(struct vfs_io_uring_pread_state *state) -+{ -+ io_uring_prep_readv(&state->ur.sqe, -+ state->fsp->fh->fd, -+ &state->iov, 1, -+ state->offset); -+ vfs_io_uring_request_submit(&state->ur); -+} -+ - static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - const char *location) - { --- -2.20.1 - - -From def543bf2c96db54475b3a48a77f68a500f7a248 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:17:51 +0200 -Subject: [PATCH 26/31] vfs_io_uring: split out a vfs_io_uring_pwrite_submit() - function - -This can be reused when we add handling for short writes. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 2f6abb00b0daeb4de9ad0aea1b5c56559391aef9) ---- - source3/modules/vfs_io_uring.c | 20 +++++++++++++++----- - 1 file changed, 15 insertions(+), 5 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 19e268e63db..3e004f48aa0 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -514,10 +514,13 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, - - struct vfs_io_uring_pwrite_state { - struct vfs_io_uring_request ur; -+ struct files_struct *fsp; -+ off_t offset; - struct iovec iov; - size_t nwritten; - }; - -+static void vfs_io_uring_pwrite_submit(struct vfs_io_uring_pwrite_state *state); - static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - const char *location); - -@@ -556,13 +559,11 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - return tevent_req_post(req, ev); - } - -+ state->fsp = fsp; -+ state->offset = offset; - state->iov.iov_base = discard_const(data); - state->iov.iov_len = n; -- io_uring_prep_writev(&state->ur.sqe, -- fsp->fh->fd, -- &state->iov, 1, -- offset); -- vfs_io_uring_request_submit(&state->ur); -+ vfs_io_uring_pwrite_submit(state); - - if (!tevent_req_is_in_progress(req)) { - return tevent_req_post(req, ev); -@@ -572,6 +573,15 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - return req; - } - -+static void vfs_io_uring_pwrite_submit(struct vfs_io_uring_pwrite_state *state) -+{ -+ io_uring_prep_writev(&state->ur.sqe, -+ state->fsp->fh->fd, -+ &state->iov, 1, -+ state->offset); -+ vfs_io_uring_request_submit(&state->ur); -+} -+ - static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - const char *location) - { --- -2.20.1 - - -From 92a105453c9479ff70efc9a1cf5b4fd3b36764e0 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:38:56 +0200 -Subject: [PATCH 27/31] vfs_io_uring: protect vfs_io_uring_pread_completion() - against invalid results - -We should never get back more than we asked for. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit f085dbf8b2bed2695e0065a5bf4523232cb532c7) ---- - source3/modules/vfs_io_uring.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 3e004f48aa0..46fab116e9d 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -26,6 +26,7 @@ - #include "smbd/globals.h" - #include "lib/util/tevent_unix.h" - #include "lib/util/sys_rw.h" -+#include "lib/util/iov_buf.h" - #include "smbprofile.h" - #include - -@@ -472,6 +473,9 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - { - struct vfs_io_uring_pread_state *state = tevent_req_data( - cur->req, struct vfs_io_uring_pread_state); -+ struct iovec *iov = &state->iov; -+ int num_iov = 1; -+ bool ok; - - /* - * We rely on being inside the _send() function -@@ -485,6 +489,16 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - return; - } - -+ ok = iov_advance(&iov, &num_iov, cur->cqe.res); -+ if (!ok) { -+ /* This is not expected! */ -+ DBG_ERR("iov_advance() failed cur->cqe.res=%d > iov_len=%d\n", -+ (int)cur->cqe.res, -+ (int)state->iov.iov_len); -+ tevent_req_error(cur->req, EIO); -+ return; -+ } -+ - state->nread = state->ur.cqe.res; - tevent_req_done(cur->req); - } --- -2.20.1 - - -From 2153f89d521d61f303a1ab55abb4b3e65825c7bd Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:38:56 +0200 -Subject: [PATCH 28/31] vfs_io_uring: protect vfs_io_uring_pwrite_completion() - against invalid results - -We should never get more acked than we asked for. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 283f96872237517f0b3bc4e63e8d3c482ecd5fa4) ---- - source3/modules/vfs_io_uring.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 46fab116e9d..0ea785aae85 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -601,6 +601,9 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - { - struct vfs_io_uring_pwrite_state *state = tevent_req_data( - cur->req, struct vfs_io_uring_pwrite_state); -+ struct iovec *iov = &state->iov; -+ int num_iov = 1; -+ bool ok; - - /* - * We rely on being inside the _send() function -@@ -614,6 +617,16 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - return; - } - -+ ok = iov_advance(&iov, &num_iov, cur->cqe.res); -+ if (!ok) { -+ /* This is not expected! */ -+ DBG_ERR("iov_advance() failed cur->cqe.res=%d > iov_len=%d\n", -+ (int)cur->cqe.res, -+ (int)state->iov.iov_len); -+ tevent_req_error(cur->req, EIO); -+ return; -+ } -+ - state->nwritten = state->ur.cqe.res; - tevent_req_done(cur->req); - } --- -2.20.1 - - -From 16fe7c511d019990318db5b44278ed9f6ae18a00 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:38:56 +0200 -Subject: [PATCH 29/31] vfs_io_uring: protect vfs_io_uring_fsync_completion() - against invalid results - -We should never get back a value > 0. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit c57a731c4ce395fd710f0b066cd6f1b72223ae07) ---- - source3/modules/vfs_io_uring.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 0ea785aae85..0b1583f962a 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -715,6 +715,13 @@ static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, - return; - } - -+ if (cur->cqe.res > 0) { -+ /* This is not expected! */ -+ DBG_ERR("got cur->cqe.res=%d\n", (int)cur->cqe.res); -+ tevent_req_error(cur->req, EIO); -+ return; -+ } -+ - tevent_req_done(cur->req); - } - --- -2.20.1 - - -From 81deb9fe0b2991c7da3f0165c24fb449c5ce879b Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 13:30:17 +0200 -Subject: [PATCH 30/31] vfs_io_uring: retry after a short read in - vfs_io_uring_pread_completion() - -We need to be prepared for short reads from the kernel depending on -the state of the page cache. Windows and Mac clients don't -expect short reads for files, so we need to retry ourself. - -For the future we may be able to play with some io_uring flags -in order to avoid the retries in userspace, but for now we just fix -the data corruption bug... - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 42e77c4cf245d8420641d216d1abefe81f7a3b79) ---- - source3/modules/vfs_io_uring.c | 24 ++++++++++++++++++++++-- - 1 file changed, 22 insertions(+), 2 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 0b1583f962a..f16c9ae56d3 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -489,6 +489,14 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - return; - } - -+ if (cur->cqe.res == 0) { -+ /* -+ * We reached EOF, we're done -+ */ -+ tevent_req_done(cur->req); -+ return; -+ } -+ - ok = iov_advance(&iov, &num_iov, cur->cqe.res); - if (!ok) { - /* This is not expected! */ -@@ -499,8 +507,20 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - return; - } - -- state->nread = state->ur.cqe.res; -- tevent_req_done(cur->req); -+ /* sys_valid_io_range() already checked the boundaries */ -+ state->nread += state->ur.cqe.res; -+ if (num_iov == 0) { -+ /* We're done */ -+ tevent_req_done(cur->req); -+ return; -+ } -+ -+ /* -+ * sys_valid_io_range() already checked the boundaries -+ * now try to get the rest. -+ */ -+ state->offset += state->ur.cqe.res; -+ vfs_io_uring_pread_submit(state); - } - - static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, --- -2.20.1 - - -From 382b5a8b7263ff1dfb428cdebef0c17d622e2066 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 13:30:17 +0200 -Subject: [PATCH 31/31] vfs_io_uring: retry after a short writes in - vfs_io_uring_pwrite_completion() - -We need to be prepared for short writes from the kernel depending on -the state of the page cache. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 0f01b10679c06dbd28da72ca6c6280ddf81672ba) ---- - source3/modules/vfs_io_uring.c | 24 ++++++++++++++++++++++-- - 1 file changed, 22 insertions(+), 2 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index f16c9ae56d3..4625e16c37e 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -637,6 +637,14 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - return; - } - -+ if (cur->cqe.res == 0) { -+ /* -+ * Ensure we can never spin. -+ */ -+ tevent_req_error(cur->req, ENOSPC); -+ return; -+ } -+ - ok = iov_advance(&iov, &num_iov, cur->cqe.res); - if (!ok) { - /* This is not expected! */ -@@ -647,8 +655,20 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - return; - } - -- state->nwritten = state->ur.cqe.res; -- tevent_req_done(cur->req); -+ /* sys_valid_io_range() already checked the boundaries */ -+ state->nwritten += state->ur.cqe.res; -+ if (num_iov == 0) { -+ /* We're done */ -+ tevent_req_done(cur->req); -+ return; -+ } -+ -+ /* -+ * sys_valid_io_range() already checked the boundaries -+ * now try to write the rest. -+ */ -+ state->offset += state->ur.cqe.res; -+ vfs_io_uring_pwrite_submit(state); - } - - static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, --- -2.20.1 - diff --git a/samba.spec b/samba.spec index a363e3c..182bc98 100644 --- a/samba.spec +++ b/samba.spec @@ -8,13 +8,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 0 -%define samba_version 4.12.2 +%define samba_version 4.12.3 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.1.2 +%define ldb_version 2.1.3 # This should be rc1 or nil %define pre_release %nil @@ -129,10 +129,6 @@ Source14: samba.pamd Source201: README.downgrade -Patch100: new_mit_118.patch -Patch101: 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch -Patch102: samba-4.12.3-vfs_io_uring-bz14361.patch - Requires(pre): /usr/sbin/groupadd Requires(post): systemd Requires(preun): systemd @@ -3578,6 +3574,9 @@ fi %endif %changelog +* Tue May 19 2020 Guenther Deschner - 4.12.3-0 +- Update to Samba 4.12.3 + * Wed May 13 2020 Guenther Deschner - 4.12.2-1 - Add support for building the new experimental io_uring VFS module diff --git a/sources b/sources index ada3fb2..3d96a8f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.2.tar.xz) = ab89b8f6f0c14b5e8712bf281f7f2cc8e3dae6a69147a826bb58538ed5a22457f4d9a1ec500cbd49da42a5918fe2dd1f2726bb9a7838d9ee5507424ecf75774b -SHA512 (samba-4.12.2.tar.asc) = b585cc5e919405a0910f1aea303959e92e293645296654805c65f20b92bd58098fc08be82ae17a9a281e04339f6af5579658f1b5c768498c75127c9dc254cd3d +SHA512 (samba-4.12.3.tar.xz) = 1810734a5f8645c3784f0341b5a75de240d8227aa9bc66b87b491a438b4623f6bfcf873049bf148ce73d22bfd97da9319c9d9468142063cd377d73503616b632 +SHA512 (samba-4.12.3.tar.asc) = d8911ad4b03cbeb0d35bb0dcaa83dca30dcbe1630cf888f56dc46a821b9e96c57bb3526573478cdb986e881c1577b03e30b6329166e87192fe51fdcabb415b53 From 96c7f6360cb9e9005a45806d963e269d7f69f407 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 2 Jul 2020 11:41:22 +0200 Subject: [PATCH 08/26] Update to Samba 4.12.4 resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 Guenther --- .gitignore | 2 ++ samba.spec | 15 ++++++++++++--- sources | 4 ++-- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 0081dcb..4a5eb65 100644 --- a/.gitignore +++ b/.gitignore @@ -205,3 +205,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.2.tar.asc /samba-4.12.3.tar.xz /samba-4.12.3.tar.asc +/samba-4.12.4.tar.xz +/samba-4.12.4.tar.asc diff --git a/samba.spec b/samba.spec index 182bc98..d82a372 100644 --- a/samba.spec +++ b/samba.spec @@ -10,11 +10,11 @@ %define main_release 0 -%define samba_version 4.12.3 +%define samba_version 4.12.4 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.1.3 +%define ldb_version 2.1.4 # This should be rc1 or nil %define pre_release %nil @@ -97,7 +97,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}.1 +Release: %{samba_release} %if 0%{?rhel} Epoch: 0 @@ -2292,6 +2292,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_forwarder.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_invalid.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dns_packet.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc @@ -2458,6 +2459,7 @@ fi %{python3_sitearch}/samba/tests/dns_forwarder_helpers/__pycache__/server.*.pyc %{python3_sitearch}/samba/tests/dns_forwarder_helpers/server.py %{python3_sitearch}/samba/tests/dns_invalid.py +%{python3_sitearch}/samba/tests/dns_packet.py %{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py @@ -3574,6 +3576,13 @@ fi %endif %changelog +* Thu Jul 02 2020 Guenther Deschner - 4.12.4-0 +- Update to Samba 4.12.4 +- resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 +- resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 +- resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 +- resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 + * Tue May 19 2020 Guenther Deschner - 4.12.3-0 - Update to Samba 4.12.3 diff --git a/sources b/sources index 3d96a8f..e96dccd 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.3.tar.xz) = 1810734a5f8645c3784f0341b5a75de240d8227aa9bc66b87b491a438b4623f6bfcf873049bf148ce73d22bfd97da9319c9d9468142063cd377d73503616b632 -SHA512 (samba-4.12.3.tar.asc) = d8911ad4b03cbeb0d35bb0dcaa83dca30dcbe1630cf888f56dc46a821b9e96c57bb3526573478cdb986e881c1577b03e30b6329166e87192fe51fdcabb415b53 +SHA512 (samba-4.12.4.tar.xz) = 4d6afa4a5975944ef665f081e0a761d2c71917f8226de3439fb29c7168397de110b0818e93f5db53f76628b5672b9971b9cfdd4f8fd1bdebf00717995ccc747e +SHA512 (samba-4.12.4.tar.asc) = 2f48477ed0db124349ddcbd8560ecc67f860543dd36d6f623ce7b17e3af7dfb90ee4a1f2d65dbe1c9cfdf9e2fcb0749ff91769066c64733164e4b559155d6876 From d15e8be8828c0c9dae6da6eb698c5e9a82b30efe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 2 Jul 2020 19:50:30 +0200 Subject: [PATCH 09/26] Update to Samba 4.12.5 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 4a5eb65..bbc4895 100644 --- a/.gitignore +++ b/.gitignore @@ -207,3 +207,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.3.tar.asc /samba-4.12.4.tar.xz /samba-4.12.4.tar.asc +/samba-4.12.5.tar.xz +/samba-4.12.5.tar.asc diff --git a/samba.spec b/samba.spec index d82a372..1a5a247 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.12.4 +%define samba_version 4.12.5 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3576,6 +3576,9 @@ fi %endif %changelog +* Thu Jul 02 2020 Guenther Deschner - 4.12.5-0 +- Update to Samba 4.12.5 + * Thu Jul 02 2020 Guenther Deschner - 4.12.4-0 - Update to Samba 4.12.4 - resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 diff --git a/sources b/sources index e96dccd..6113667 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.4.tar.xz) = 4d6afa4a5975944ef665f081e0a761d2c71917f8226de3439fb29c7168397de110b0818e93f5db53f76628b5672b9971b9cfdd4f8fd1bdebf00717995ccc747e -SHA512 (samba-4.12.4.tar.asc) = 2f48477ed0db124349ddcbd8560ecc67f860543dd36d6f623ce7b17e3af7dfb90ee4a1f2d65dbe1c9cfdf9e2fcb0749ff91769066c64733164e4b559155d6876 +SHA512 (samba-4.12.5.tar.xz) = 3098eeb6beda126ec718b225172e9bc7a7715db70373655f9e3df67b5139c0ee2376daf4e1defb044148f0de81ae2d2c06e34559e9293f5717e9df1176dd2ba9 +SHA512 (samba-4.12.5.tar.asc) = a8f730795a2f58c428e21fe89b249893e6fcaaf84f848642c4183517c7b2c75e23fc98311b3cb32d5ef7f289c71c9fce3646eda2adbd702e6eeb7be79fda645b From d9a57ff08dc52c2bffe6adc4f798b7f3eb6e8fe0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 14 Jul 2020 13:03:01 +0200 Subject: [PATCH 10/26] Move mdssvc data files to correct package --- samba.spec | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 1a5a247..6d80915 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.12.5 %define talloc_version 2.3.1 @@ -1328,6 +1328,10 @@ fi %{_libdir}/samba/vfs/worm.so %{_libdir}/samba/vfs/xattr_tdb.so +%dir %{_datadir}/samba +%dir %{_datadir}/samba/mdssvc +%{_datadir}/samba/mdssvc/elasticsearch_mappings.json + %{_unitdir}/nmb.service %{_unitdir}/smb.service %attr(1777,root,root) %dir /var/spool/samba @@ -1444,9 +1448,6 @@ fi %{_mandir}/man8/cifsdd.8.* %{_mandir}/man8/samba-regedit.8* %{_mandir}/man8/smbspool.8* -%dir %{_datadir}/samba -%dir %{_datadir}/samba/mdssvc -%{_datadir}/samba/mdssvc/elasticsearch_mappings.json ### CLIENT-LIBS %files client-libs @@ -3576,6 +3577,9 @@ fi %endif %changelog +* Tue Jul 14 2020 Andreas Schneider - 4.12.15-1 +- Move mdssvc data files to correct package + * Thu Jul 02 2020 Guenther Deschner - 4.12.5-0 - Update to Samba 4.12.5 From ae52bff41cc06694b3e33bfece88d571c739ccb2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 12 Aug 2020 10:16:17 +0200 Subject: [PATCH 11/26] Fix requires and missing dirs --- samba.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 6d80915..7a5a884 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 2 %define samba_version 4.12.5 %define talloc_version 2.3.1 @@ -386,7 +386,6 @@ Requires: ldb-tools # See bug 1507420 %samba_requires_eq libldb -Requires: python3-crypto Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} @@ -2680,6 +2679,7 @@ fi ### WINBIND-KRB5-LOCATOR %files winbind-krb5-locator %ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so +%dir %{_libdir}/samba/krb5 %{_libdir}/samba/krb5/winbind_krb5_locator.so %{_mandir}/man8/winbind_krb5_locator.8* @@ -3577,6 +3577,10 @@ fi %endif %changelog +* Wed Aug 12 2020 Andreas Schneider - 4.12.15-2 +- resolves: #1865831 - Add missing /usr/lib64/samba/krb5 directory +- resolves: #1866989 - Remove obsolete python3-crypto dependency + * Tue Jul 14 2020 Andreas Schneider - 4.12.15-1 - Move mdssvc data files to correct package From d2e844654812ea7ef0ca2af47265c922726c58bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 13 Aug 2020 13:07:41 +0200 Subject: [PATCH 12/26] Update to Samba 4.12.6 Guenther --- .gitignore | 2 ++ samba.spec | 14 ++++++++++++-- sources | 4 ++-- 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index bbc4895..2fd7266 100644 --- a/.gitignore +++ b/.gitignore @@ -209,3 +209,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.4.tar.asc /samba-4.12.5.tar.xz /samba-4.12.5.tar.asc +/samba-4.12.6.tar.xz +/samba-4.12.6.tar.asc diff --git a/samba.spec b/samba.spec index 7a5a884..75fac72 100644 --- a/samba.spec +++ b/samba.spec @@ -8,9 +8,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 2 +%define main_release 0 -%define samba_version 4.12.5 +%define samba_version 4.12.6 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -2574,6 +2574,9 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_check_password_script.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_base.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_gpg.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_userPassword.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_wdigest.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize_drs.*.pyc @@ -2605,6 +2608,9 @@ fi %{python3_sitearch}/samba/tests/samba_tool/user.py %{python3_sitearch}/samba/tests/samba_tool/user_check_password_script.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_base.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_userPassword.py %{python3_sitearch}/samba/tests/samba_tool/user_wdigest.py %{python3_sitearch}/samba/tests/samba_tool/visualize.py %{python3_sitearch}/samba/tests/samba_tool/visualize_drs.py @@ -3304,6 +3310,7 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ps @@ -3577,6 +3584,9 @@ fi %endif %changelog +* Thu Aug 13 2020 Guenther Deschner - 4.12.6-0 +- Update to Samba 4.12.6 + * Wed Aug 12 2020 Andreas Schneider - 4.12.15-2 - resolves: #1865831 - Add missing /usr/lib64/samba/krb5 directory - resolves: #1866989 - Remove obsolete python3-crypto dependency diff --git a/sources b/sources index 6113667..6bffe91 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.5.tar.xz) = 3098eeb6beda126ec718b225172e9bc7a7715db70373655f9e3df67b5139c0ee2376daf4e1defb044148f0de81ae2d2c06e34559e9293f5717e9df1176dd2ba9 -SHA512 (samba-4.12.5.tar.asc) = a8f730795a2f58c428e21fe89b249893e6fcaaf84f848642c4183517c7b2c75e23fc98311b3cb32d5ef7f289c71c9fce3646eda2adbd702e6eeb7be79fda645b +SHA512 (samba-4.12.6.tar.xz) = c21347c6e862ed43ec86b4b27402fa521d95fbcc603ce1aa9c8aaf727dc148442afbbf6cfe3c3c3a23e6a1aee186ab9c5f3b3d097e7b01d04903cd261fde1d6f +SHA512 (samba-4.12.6.tar.asc) = 7a3e4d383904acf484558c7c6e10ab1bcaa02b080e50a536fb2788932969de8aaa289cbaad4e42374854d638c91036f345515052c5efbd8eb74cbfea257ba72c From 6a17bf060e8aad5dbe31cab458d5772b9b7b462d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 8 Jun 2020 09:24:32 +0200 Subject: [PATCH 13/26] Move libdcerpc-server-core to samba-libs This is used by the AD and FS RPC server implementation. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 75fac72..88d36e3 100644 --- a/samba.spec +++ b/samba.spec @@ -1711,7 +1711,6 @@ fi %{_libdir}/samba/service/winbindd.so %{_libdir}/samba/service/wrepl.so %{_libdir}/libdcerpc-server.so.* -%{_libdir}/libdcerpc-server-core.so.* %{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libdsdb-module-samba4.so %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so @@ -1816,6 +1815,7 @@ fi %{_includedir}/samba-4.0/util_ldb.h %{_libdir}/libdcerpc-binding.so %{_libdir}/libdcerpc-samr.so +%{_libdir}/libdcerpc-server-core.so %{_libdir}/libdcerpc.so %{_libdir}/libndr-krb5pac.so %{_libdir}/libndr-nbt.so @@ -1846,7 +1846,6 @@ fi %if %with_dc %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so -%{_libdir}/libdcerpc-server-core.so %{_libdir}/pkgconfig/dcerpc_server.pc %endif @@ -1884,6 +1883,7 @@ fi ### LIBS %files libs %{_libdir}/libdcerpc-samr.so.* +%{_libdir}/libdcerpc-server-core.so.* %{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so %{_libdir}/samba/libauth4-samba4.so From dc112b2d52069575071ddbae8f5d07f3077f6599 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 19 Sep 2020 02:48:17 +0200 Subject: [PATCH 14/26] Update to Samba 4.12.7 resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 Guenther --- .gitignore | 2 ++ samba.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2fd7266..e66e44f 100644 --- a/.gitignore +++ b/.gitignore @@ -211,3 +211,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.5.tar.asc /samba-4.12.6.tar.xz /samba-4.12.6.tar.asc +/samba-4.12.7.tar.xz +/samba-4.12.7.tar.asc diff --git a/samba.spec b/samba.spec index 88d36e3..a72a20f 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.12.6 +%define samba_version 4.12.7 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3584,6 +3584,10 @@ fi %endif %changelog +* Fri Sep 18 2020 Guenther Deschner - 4.12.7-0 +- Update to Samba 4.12.7 +- resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 + * Thu Aug 13 2020 Guenther Deschner - 4.12.6-0 - Update to Samba 4.12.6 diff --git a/sources b/sources index 6bffe91..8f5ff94 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.6.tar.xz) = c21347c6e862ed43ec86b4b27402fa521d95fbcc603ce1aa9c8aaf727dc148442afbbf6cfe3c3c3a23e6a1aee186ab9c5f3b3d097e7b01d04903cd261fde1d6f -SHA512 (samba-4.12.6.tar.asc) = 7a3e4d383904acf484558c7c6e10ab1bcaa02b080e50a536fb2788932969de8aaa289cbaad4e42374854d638c91036f345515052c5efbd8eb74cbfea257ba72c +SHA512 (samba-4.12.7.tar.xz) = 2d16ebec869cfc74e40342487634d3855b507852308efef1cf1db4ee838153c7756efc39f0f02142c1a624e8002a8a7e5de223ccd2045cd720c0fe0ce664881b +SHA512 (samba-4.12.7.tar.asc) = e82d890004f74fb93dd06c84cd28d7e69e47f065b46057a878bab2f17edb0f5f65ebfebf931692468cfa6cf8b904449932601ef597367d8c6a4f67c18ee99053 From 8d61cef69909814bbf0a18713ca7f6f6f59ef4c0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 7 Oct 2020 13:10:33 +0200 Subject: [PATCH 15/26] Update to Samba 4.12.8 Guenther --- .gitignore | 2 ++ samba-winexe-build.patch | 67 ++++++++++++++++++++++++++++++++++++++++ samba.spec | 8 ++++- sources | 4 +-- 4 files changed, 78 insertions(+), 3 deletions(-) create mode 100644 samba-winexe-build.patch diff --git a/.gitignore b/.gitignore index e66e44f..2e87fad 100644 --- a/.gitignore +++ b/.gitignore @@ -213,3 +213,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.6.tar.asc /samba-4.12.7.tar.xz /samba-4.12.7.tar.asc +/samba-4.12.8.tar.xz +/samba-4.12.8.tar.asc diff --git a/samba-winexe-build.patch b/samba-winexe-build.patch new file mode 100644 index 0000000..63f8a9e --- /dev/null +++ b/samba-winexe-build.patch @@ -0,0 +1,67 @@ +From 54c21a99e6ca54bdb963c70d322f6778b57a384f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Deschner?= +Date: Wed, 4 Mar 2020 18:51:01 +0100 +Subject: [PATCH] winexe: add configure option to control whether to build it + (default: auto) + +Guenther + +Signed-off-by: Guenther Deschner +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Mon Mar 9 16:27:21 UTC 2020 on sn-devel-184 +--- + examples/winexe/wscript_build | 3 ++- + source3/wscript | 17 +++++++++++++++++ + 2 files changed, 19 insertions(+), 1 deletion(-) + +diff --git a/examples/winexe/wscript_build b/examples/winexe/wscript_build +index 43c09717e3d..559ed3fc706 100644 +--- a/examples/winexe/wscript_build ++++ b/examples/winexe/wscript_build +@@ -106,4 +106,5 @@ if winexesvc_binaries != '': + LOADPARM_CTX + libsmb + msrpc3 +- ''') ++ ''', ++ enabled=bld.env.build_winexe) +diff --git a/source3/wscript b/source3/wscript +index 85466b493fa..6d5bd22ca49 100644 +--- a/source3/wscript ++++ b/source3/wscript +@@ -63,6 +63,7 @@ def options(opt): + opt.samba_add_onoff_option('cluster-support', default=False) + + opt.samba_add_onoff_option('regedit', default=None) ++ opt.samba_add_onoff_option('winexe', default=None) + + opt.samba_add_onoff_option('fake-kaserver', + help=("Include AFS fake-kaserver support"), default=False) +@@ -1782,6 +1783,22 @@ main() { + if conf.CHECK_HEADERS('ftw.h') and conf.CHECK_FUNCS('nftw'): + conf.env.build_mvxattr = True + ++ conf.env.build_winexe = False ++ if not Options.options.with_winexe == False: ++ if conf.CONFIG_SET('HAVE_WINEXE_CC_WIN32') or conf.CONFIG_SET('HAVE_WINEXE_CC_WIN64'): ++ conf.env.build_winexe = True ++ ++ if conf.env.build_winexe: ++ Logs.info("building winexe") ++ else: ++ if Options.options.with_winexe == False: ++ Logs.info("not building winexe (--without-winexe)") ++ elif Options.options.with_winexe == True: ++ Logs.error("mingw not available, cannot build winexe") ++ conf.fatal("mingw not available, but --with-winexe was specified") ++ else: ++ Logs.info("mingw not available, not building winexe") ++ + conf.CHECK_FUNCS_IN('DES_pcbc_encrypt', 'crypto') + if Options.options.with_fake_kaserver == True: + conf.CHECK_HEADERS('afs/param.h afs/stds.h', together=True) +-- +2.26.2 + diff --git a/samba.spec b/samba.spec index a72a20f..ca0d48b 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.12.7 +%define samba_version 4.12.8 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -129,6 +129,8 @@ Source14: samba.pamd Source201: README.downgrade +Patch: samba-winexe-build.patch + Requires(pre): /usr/sbin/groupadd Requires(post): systemd Requires(preun): systemd @@ -3581,9 +3583,13 @@ fi ### WINEXE %files winexe %{_bindir}/winexe +%{_mandir}/man1/winexe.1* %endif %changelog +* Wed Oct 07 2020 Guenther Deschner - 4.12.8-0 +- Update to Samba 4.12.8 + * Fri Sep 18 2020 Guenther Deschner - 4.12.7-0 - Update to Samba 4.12.7 - resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 diff --git a/sources b/sources index 8f5ff94..24ded22 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.7.tar.xz) = 2d16ebec869cfc74e40342487634d3855b507852308efef1cf1db4ee838153c7756efc39f0f02142c1a624e8002a8a7e5de223ccd2045cd720c0fe0ce664881b -SHA512 (samba-4.12.7.tar.asc) = e82d890004f74fb93dd06c84cd28d7e69e47f065b46057a878bab2f17edb0f5f65ebfebf931692468cfa6cf8b904449932601ef597367d8c6a4f67c18ee99053 +SHA512 (samba-4.12.8.tar.xz) = 8d4ed3f0daf5859766e48fed9ebf1c1fca5c8894aa28ca70a3163bf3e946a83f9413faea562f6bea751a90eecd0717afdf61266d9f1dd38d5e6d8c628d34fd59 +SHA512 (samba-4.12.8.tar.asc) = 771aca96be911869b8d383d4e16957b2e5f95bba1aa6cd4092f581cf68cf145a6c85ecfe4a47e4d27c0ac1f8e3175c3dfbc25d669fd2fe699dc4420cf617539f From bf08b1efb15e24768dd608ff9abba53a6f9c9143 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 19:05:57 +0200 Subject: [PATCH 16/26] Add preliminary S4U support resolves: #1836630 - Samba DC: Remote Desktop cannot access files (cherry picked from commit a1725106468cb513a1d9d85e5d0ca8d6db98ba67) --- samba-s4u.patch | 726 ++++++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 7 +- 2 files changed, 732 insertions(+), 1 deletion(-) create mode 100644 samba-s4u.patch diff --git a/samba-s4u.patch b/samba-s4u.patch new file mode 100644 index 0000000..83ed873 --- /dev/null +++ b/samba-s4u.patch @@ -0,0 +1,726 @@ +From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Fri, 27 Sep 2019 18:25:03 +0300 +Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support + +Signed-off-by: Isaac Boukris +Pair-Programmed-With: Andreas Schneider +--- + source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++--------- + source4/kdc/mit_samba.c | 47 ++---- + source4/kdc/mit_samba.h | 6 +- + wscript_configure_system_mitkrb5 | 3 + + 6 files changed, 91 insertions(+), 115 deletions(-) + +diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c +index 9197551ed61..944324d9a2f 100644 +--- a/source4/kdc/mit-kdb/kdb_samba_policies.c ++++ b/source4/kdc/mit-kdb/kdb_samba_policies.c +@@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, + krb5_keyblock *krbtgt_key, + krb5_timestamp authtime, + krb5_authdata **tgt_auth_data, +- krb5_pac *pac) ++ krb5_pac *out_pac) + { + struct mit_samba_context *mit_ctx; + krb5_authdata **authdata = NULL; +- krb5_pac ipac = NULL; +- DATA_BLOB logon_data = { NULL, 0 }; ++ krb5_keyblock *header_server_key = NULL; ++ krb5_key_data *impersonator_kd = NULL; ++ krb5_keyblock impersonator_key = {0}; + krb5_error_code code; ++ krb5_pac pac; ++ ++ *out_pac = NULL; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { +@@ -230,41 +234,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, + code = krb5_pac_parse(context, + authdata[0]->contents, + authdata[0]->length, +- &ipac); ++ &pac); + if (code != 0) { + goto done; + } + +- /* TODO: verify this is correct +- * +- * In the constrained delegation case, the PAC is from a service +- * ticket rather than a TGT; we must verify the server and KDC +- * signatures to assert that the server did not forge the PAC. ++ /* ++ * For constrained delegation in MIT version < 1.18 we aren't provided ++ * with the 2nd ticket server key to verify the PAC. ++ * We can workaround that by fetching the key from the client db entry, ++ * which is the impersonator account in that version. ++ * TODO: use the provided entry in the new 1.18 version. + */ + if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { +- code = krb5_pac_verify(context, +- ipac, +- authtime, +- client_princ, +- server_key, +- krbtgt_key); ++ /* The impersonator must be local. */ ++ if (client == NULL) { ++ code = KRB5KDC_ERR_BADOPTION; ++ goto done; ++ } ++ /* Fetch and decrypt 2nd ticket server's current key. */ ++ code = krb5_dbe_find_enctype(context, client, -1, -1, 0, ++ &impersonator_kd); ++ if (code != 0) { ++ goto done; ++ } ++ code = krb5_dbe_decrypt_key_data(context, NULL, ++ impersonator_kd, ++ &impersonator_key, NULL); ++ if (code != 0) { ++ goto done; ++ } ++ header_server_key = &impersonator_key; + } else { +- code = krb5_pac_verify(context, +- ipac, +- authtime, +- client_princ, +- krbtgt_key, +- NULL); +- } +- if (code != 0) { +- goto done; ++ header_server_key = krbtgt_key; + } + +- /* check and update PAC */ +- code = krb5_pac_parse(context, +- authdata[0]->contents, +- authdata[0]->length, +- pac); ++ code = krb5_pac_verify(context, pac, authtime, client_princ, ++ header_server_key, NULL); + if (code != 0) { + goto done; + } +@@ -272,17 +278,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, + code = mit_samba_reget_pac(mit_ctx, + context, + flags, +- client_princ, + client, + server, + krbtgt, + krbtgt_key, +- pac); ++ &pac); ++ if (code != 0) { ++ goto done; ++ } ++ ++ *out_pac = pac; ++ pac = NULL; + + done: ++ krb5_free_keyblock_contents(context, &impersonator_key); + krb5_free_authdata(context, authdata); +- krb5_pac_free(context, ipac); +- free(logon_data.data); ++ krb5_pac_free(context, pac); + + return code; + } +@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + { + #endif + krb5_authdata **authdata = NULL; +- krb5_boolean is_as_req; ++ krb5_const_principal pac_client; + krb5_error_code code; + krb5_pac pac = NULL; + krb5_data pac_data; +@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; + #endif + +- /* FIXME: We don't support S4U yet */ +- if (flags & KRB5_KDB_FLAGS_S4U) { +- return KRB5_KDB_DBTYPE_NOSUP; +- } +- +- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); +- +- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { +- code = ks_get_pac(context, client, client_key, &pac); +- if (code != 0) { +- goto done; +- } ++ /* In protocol transition, we are currently not provided with the tgt ++ * client name to verify the PAC, we could probably skip the name ++ * verification and just verify the signatures, but since we don't ++ * support cross-realm nor aliases, we can just use server->princ */ ++ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { ++ pac_client = server->princ; ++ } else { ++ pac_client = client_princ; + } + +- if (!is_as_req) { ++ /* TGS request */ ++ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) { + code = ks_verify_pac(context, + flags, +- client_princ, ++ pac_client, + client, + server, + krbtgt, +@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + if (code != 0) { + goto done; + } ++ ++ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */ ++ if (pac == NULL) { ++ code = KRB5_KDB_DBTYPE_NOSUP; ++ goto done; ++ } + } + +- if (pac == NULL && client != NULL) { ++ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { ++ krb5_pac_free(context, pac); ++ pac = NULL; ++ } + ++ /* AS request or local realm protocol transition */ ++ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) || ++ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) { + code = ks_get_pac(context, client, client_key, &pac); + if (code != 0) { + goto done; + } ++ /* We require a pac! */ ++ SMB_ASSERT(pac != NULL); + } + + if (pac == NULL) { +@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + } + + code = krb5_pac_sign(context, pac, authtime, client_princ, +- server_key, krbtgt_key, &pac_data); ++ server_key, krbtgt_key, &pac_data); + if (code != 0) { + DBG_ERR("krb5_pac_sign failed: %d\n", code); + goto done; +@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + KRB5_AUTHDATA_IF_RELEVANT, + authdata, + signed_auth_data); +- if (code != 0) { +- goto done; +- } +- +- code = 0; + + done: + krb5_pac_free(context, pac); +@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + * server; -> delegating service + * proxy; -> target principal + */ +- krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server); +- +- char *target_name = NULL; +- bool is_enterprise; +- krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + +- code = krb5_unparse_name(context, proxy, &target_name); +- if (code) { +- goto done; +- } +- +- is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL); +- +- code = mit_samba_check_s4u2proxy(mit_ctx, +- delegating_service, +- target_name, +- is_enterprise); +- +-done: +- free(target_name); +- return code; ++ return mit_samba_check_s4u2proxy(mit_ctx, server, proxy); + } + + +diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c +index 54dcd545ea1..f23327c9613 100644 +--- a/source4/kdc/mit_samba.c ++++ b/source4/kdc/mit_samba.c +@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, + krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + krb5_context context, + int flags, +- krb5_const_principal client_principal, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, +@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + context, + *pac, + server->princ, +- discard_const(client_principal), ++ client->princ, + deleg_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("Update delegation info failed: %s\n", +@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, + } + + int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, +- krb5_db_entry *kentry, +- const char *target_name, +- bool is_nt_enterprise_name) ++ const krb5_db_entry *server, ++ krb5_const_principal target_principal) + { +-#if 1 +- /* +- * This is disabled because mit_samba_update_pac_data() does not handle +- * S4U_DELEGATION_INFO +- */ +- +- return KRB5KDC_ERR_BADOPTION; +-#else +- krb5_principal target_principal; +- int flags = 0; +- int ret; +- +- if (is_nt_enterprise_name) { +- flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE; +- } +- +- ret = krb5_parse_name_flags(ctx->context, target_name, +- flags, &target_principal); +- if (ret) { +- return ret; +- } +- +- ret = samba_kdc_check_s4u2proxy(ctx->context, +- ctx->db_ctx, +- skdc_entry, +- target_principal); +- +- krb5_free_principal(ctx->context, target_principal); +- +- return ret; +-#endif ++ struct samba_kdc_entry *server_skdc_entry = ++ talloc_get_type_abort(server->e_data, ++ struct samba_kdc_entry); ++ ++ return samba_kdc_check_s4u2proxy(ctx->context, ++ ctx->db_ctx, ++ server_skdc_entry, ++ target_principal); + } + + static krb5_error_code mit_samba_change_pwd_error(krb5_context context, +diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h +index ba824557bd5..5aadf206443 100644 +--- a/source4/kdc/mit_samba.h ++++ b/source4/kdc/mit_samba.h +@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, + krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + krb5_context context, + int flags, +- krb5_const_principal client_principal, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, +@@ -73,9 +72,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, + DATA_BLOB *e_data); + + int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, +- krb5_db_entry *kentry, +- const char *target_name, +- bool is_nt_enterprise_name); ++ const krb5_db_entry *server, ++ krb5_const_principal target_principal); + + int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, + char *pwd, +-- +2.25.4 + +From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Fri, 27 Sep 2019 18:35:30 +0300 +Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build + +Signed-off-by: Isaac Boukris +Pair-Programmed-With: Andreas Schneider +--- + lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ + lib/krb5_wrap/krb5_samba.h | 2 - + source4/auth/kerberos/kerberos_util.c | 11 -- + 4 files changed, 185 insertions(+), 14 deletions(-) + +diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c +index 20ce86c708d..e72ab3c30f7 100644 +--- a/lib/krb5_wrap/krb5_samba.c ++++ b/lib/krb5_wrap/krb5_samba.c +@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + + return 0; + } ++ ++#else /* MIT */ ++ ++static bool princ_compare_no_dollar(krb5_context ctx, ++ krb5_principal a, ++ krb5_principal b) ++{ ++ bool cmp; ++ krb5_principal mod = NULL; ++ ++ if (a->length == 1 && b->length == 1 && ++ a->data[0].length != 0 && b->data[0].length != 0 && ++ a->data[0].data[a->data[0].length -1] != ++ b->data[0].data[b->data[0].length -1]) { ++ if (a->data[0].data[a->data[0].length -1] == '$') { ++ mod = a; ++ mod->data[0].length--; ++ } else if (b->data[0].data[b->data[0].length -1] == '$') { ++ mod = b; ++ mod->data[0].length--; ++ } ++ } ++ ++ cmp = krb5_principal_compare_flags(ctx, a, b, ++ KRB5_PRINCIPAL_COMPARE_CASEFOLD); ++ ++ if (mod != NULL) { ++ mod->data[0].length++; ++ } ++ ++ return cmp; ++} ++ ++krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, ++ krb5_ccache store_cc, ++ krb5_principal init_principal, ++ const char *init_password, ++ krb5_principal impersonate_principal, ++ const char *self_service, ++ const char *target_service, ++ krb5_get_init_creds_opt *krb_options, ++ time_t *expire_time, ++ time_t *kdc_time) ++{ ++ krb5_error_code code; ++ krb5_principal self_princ = NULL; ++ krb5_principal target_princ = NULL; ++ krb5_creds *store_creds; ++ krb5_creds *s4u2self_creds = NULL; ++ krb5_creds *s4u2proxy_creds = NULL; ++ krb5_creds init_creds = {0}; ++ krb5_creds mcreds = {0}; ++ krb5_flags options = KRB5_GC_NO_STORE; ++ krb5_ccache tmp_cc; ++ bool s4u2proxy; ++ ++ code = krb5_cc_new_unique(ctx, "MEMORY", NULL, &tmp_cc); ++ if (code != 0) { ++ return code; ++ } ++ ++ code = krb5_get_init_creds_password(ctx, &init_creds, ++ init_principal, ++ init_password, ++ NULL, NULL, ++ 0, ++ NULL, ++ krb_options); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_initialize(ctx, tmp_cc, init_creds.client); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_store_cred(ctx, tmp_cc, &init_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* ++ * Check if we also need S4U2Proxy or if S4U2Self is ++ * enough in order to get a ticket for the target. ++ */ ++ if (target_service == NULL) { ++ s4u2proxy = false; ++ } else if (strcmp(target_service, self_service) == 0) { ++ s4u2proxy = false; ++ } else { ++ s4u2proxy = true; ++ } ++ ++ code = krb5_parse_name(ctx, self_service, &self_princ); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* MIT lacks aliases support in S4U, for S4U2Self we require the tgt ++ * client and the request server to be the same principal name. */ ++ if (!princ_compare_no_dollar(ctx, init_creds.client, self_princ)) { ++ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; ++ goto done; ++ } ++ ++ mcreds.client = impersonate_principal; ++ mcreds.server = init_creds.client; ++ ++ code = krb5_get_credentials_for_user(ctx, options, tmp_cc, &mcreds, ++ NULL, &s4u2self_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ if (s4u2proxy) { ++ code = krb5_parse_name(ctx, target_service, &target_princ); ++ if (code != 0) { ++ goto done; ++ } ++ ++ mcreds.client = init_creds.client; ++ mcreds.server = target_princ; ++ mcreds.second_ticket = s4u2self_creds->ticket; ++ ++ code = krb5_get_credentials(ctx, options | ++ KRB5_GC_CONSTRAINED_DELEGATION, ++ tmp_cc, &mcreds, &s4u2proxy_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* Check KDC support of S4U2Proxy extension */ ++ if (!krb5_principal_compare(ctx, s4u2self_creds->client, ++ s4u2proxy_creds->client)) { ++ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; ++ goto done; ++ } ++ ++ store_creds = s4u2proxy_creds; ++ } else { ++ store_creds = s4u2self_creds;; ++ ++ /* We need to save the ticket with the requested server name ++ * or the caller won't be able to find it in cache. */ ++ if (!krb5_principal_compare(ctx, self_princ, ++ store_creds->server)) { ++ krb5_free_principal(ctx, store_creds->server); ++ store_creds->server = NULL; ++ code = krb5_copy_principal(ctx, self_princ, ++ &store_creds->server); ++ if (code != 0) { ++ goto done; ++ } ++ } ++ } ++ ++ code = krb5_cc_initialize(ctx, store_cc, store_creds->client); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_store_cred(ctx, store_cc, store_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ if (expire_time) { ++ *expire_time = (time_t) store_creds->times.endtime; ++ } ++ ++ if (kdc_time) { ++ *kdc_time = (time_t) store_creds->times.starttime; ++ } ++ ++done: ++ krb5_cc_destroy(ctx, tmp_cc); ++ krb5_free_cred_contents(ctx, &init_creds); ++ krb5_free_creds(ctx, s4u2self_creds); ++ krb5_free_creds(ctx, s4u2proxy_creds); ++ krb5_free_principal(ctx, self_princ); ++ krb5_free_principal(ctx, target_princ); ++ ++ return code; ++} + #endif + + #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) +diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h +index ca9a893e4f7..3264ce5eb3b 100644 +--- a/lib/krb5_wrap/krb5_samba.h ++++ b/lib/krb5_wrap/krb5_samba.h +@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, + krb5_get_init_creds_opt *krb_options, + time_t *expire_time, + time_t *kdc_time); +-#ifdef SAMBA4_USES_HEIMDAL + krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + krb5_ccache store_cc, + krb5_principal init_principal, +@@ -263,7 +262,6 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + krb5_get_init_creds_opt *krb_options, + time_t *expire_time, + time_t *kdc_time); +-#endif + + #if defined(HAVE_KRB5_MAKE_PRINCIPAL) + #define smb_krb5_make_principal krb5_make_principal +diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c +index 544d9d853cc..c14d8c72d8c 100644 +--- a/source4/auth/kerberos/kerberos_util.c ++++ b/source4/auth/kerberos/kerberos_util.c +@@ -234,9 +234,7 @@ done: + { + krb5_error_code ret; + const char *password; +-#ifdef SAMBA4_USES_HEIMDAL + const char *self_service; +-#endif + const char *target_service; + time_t kdc_time = 0; + krb5_principal princ; +@@ -268,9 +266,7 @@ done: + return ret; + } + +-#ifdef SAMBA4_USES_HEIMDAL + self_service = cli_credentials_get_self_service(credentials); +-#endif + target_service = cli_credentials_get_target_service(credentials); + + password = cli_credentials_get_password(credentials); +@@ -331,7 +327,6 @@ done: + #endif + if (password) { + if (impersonate_principal) { +-#ifdef SAMBA4_USES_HEIMDAL + ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context, + ccache, + princ, +@@ -342,12 +337,6 @@ done: + krb_options, + NULL, + &kdc_time); +-#else +- talloc_free(mem_ctx); +- (*error_string) = "INTERNAL error: s4u2 ops " +- "are not supported with MIT build yet"; +- return EINVAL; +-#endif + } else { + ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, + ccache, +-- +2.25.4 + + + +From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Sat, 19 Sep 2020 14:16:20 +0200 +Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code + +--- + source4/heimdal/lib/hdb/hdb.h | 1 + + source4/kdc/db-glue.c | 8 ++++++-- + source4/kdc/mit_samba.c | 3 +++ + source4/kdc/sdb.h | 1 + + 4 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h +index 6a09ecb6fe1..bc5211fef35 100644 +--- a/source4/heimdal/lib/hdb/hdb.h ++++ b/source4/heimdal/lib/hdb/hdb.h +@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; + #define HDB_F_ALL_KVNOS 2048 /* we want all the keys, live or not */ + #define HDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ + #define HDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ ++#define HDB_F_FORCE_CANON 16384 /* force canonicalition */ + + /* hdb_capability_flags */ + #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 +diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c +index a560a1cd84b..c27b6a8ef4c 100644 +--- a/source4/kdc/db-glue.c ++++ b/source4/kdc/db-glue.c +@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, + } + } + +- } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { ++ } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { // was this supposed to be || ? + ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); + if (ret) { + krb5_clear_error_message(context); + goto out; + } +- } else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) { ++ } else if (((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) || (flags & SDB_F_FORCE_CANON)){ + /* + * SDB_F_CANON maps from the canonicalize flag in the + * packet, and has a different meaning between AS-REQ + * and TGS-REQ. We only change the principal in the AS-REQ case ++ * ++ * The SDB_F_FORCE_CANON if for the new MIT kdc code that wants ++ * the canonical name in all lookups, and takes care to canonicalize ++ * only when appropriate. + */ + ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); + if (ret) { +diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c +index f23327c9613..4084e893cc2 100644 +--- a/source4/kdc/mit_samba.c ++++ b/source4/kdc/mit_samba.c +@@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, + if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { + sflags |= SDB_F_CANON; + } ++#if KRB5_KDB_API_VERSION >= 10 ++ sflags |= SDB_F_FORCE_CANON; ++#endif + if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY | + KRB5_KDB_FLAG_INCLUDE_PAC)) { + /* +diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h +index c929acccce6..a9115ec23d7 100644 +--- a/source4/kdc/sdb.h ++++ b/source4/kdc/sdb.h +@@ -116,6 +116,7 @@ struct sdb_entry_ex { + #define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */ + #define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ + #define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ ++#define SDB_F_FORCE_CANON 16384 /* force canonicalition */ + + void sdb_free_entry(struct sdb_entry_ex *e); + void free_sdb_entry(struct sdb_entry *s); +-- +2.25.4 + diff --git a/samba.spec b/samba.spec index ca0d48b..e0e9432 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.12.8 %define talloc_version 2.3.1 @@ -130,6 +130,7 @@ Source14: samba.pamd Source201: README.downgrade Patch: samba-winexe-build.patch +Patch1: samba-s4u.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3587,6 +3588,10 @@ fi %endif %changelog +* Thu Oct 22 2020 Alexander Bokovoy - 4.12.8-1 +- Add preliminary support for S4U operations in Samba AD DC + resolves: #1836630 - Samba DC: Remote Desktop cannot access files + * Wed Oct 07 2020 Guenther Deschner - 4.12.8-0 - Update to Samba 4.12.8 From 8765be8a0c0ad441e6677590e93343dabe630b16 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 22 Oct 2020 10:12:06 +0300 Subject: [PATCH 17/26] Fix lookup_unix_user_name to support realm-qualified lookups Fixes lookups from Windows clients when using Global Catalog searches. Required for upcoming FreeIPA Global Catalog support. (cherry picked from commit 1e29c417eb5e3dbfad31e7e7ff121367d4397a3d) --- ...user_name-allow-lookup-for-own-realm.patch | 210 ++++++++++++++++++ samba.spec | 3 + 2 files changed, 213 insertions(+) create mode 100644 samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch diff --git a/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch b/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch new file mode 100644 index 0000000..e0ed8ae --- /dev/null +++ b/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch @@ -0,0 +1,210 @@ +From 81d6949acdad70ecfb130d3286eeab1b3a51937f Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 7 Oct 2020 19:25:24 +0300 +Subject: [PATCH 1/2] cli_credentials_parse_string: fix parsing of principals + +When parsing a principal-like name, user name was left with full +principal instead of taking only the left part before '@' sign. + +>>> from samba import credentials +>>> t = credentials.Credentials() +>>> t.parse_string('admin@realm.test', credentials.SPECIFIED) +>>> t.get_username() +'admin@realm.test' + +The issue is that cli_credentials_set_username() does a talloc_strdup() +of the argument, so we need to change order of assignment to allow +talloc_strdup() to copy the right part of the string. + +Signed-off-by: Alexander Bokovoy +--- + auth/credentials/credentials.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 77c35dd104b..06ac79058f9 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -840,11 +840,10 @@ _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials, + * in order to undo the effect of + * cli_credentials_guess(). + */ +- cli_credentials_set_username(credentials, uname, obtained); +- cli_credentials_set_domain(credentials, "", obtained); +- + cli_credentials_set_principal(credentials, uname, obtained); + *p = 0; ++ cli_credentials_set_username(credentials, uname, obtained); ++ cli_credentials_set_domain(credentials, "", obtained); + cli_credentials_set_realm(credentials, p+1, obtained); + return; + } else if ((p = strchr_m(uname,'\\')) +-- +2.28.0 + + +From fa38bebb993011428612d51819530218d8358f5e Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Mon, 13 Jan 2020 16:04:20 +0200 +Subject: [PATCH 2/2] lookup_name: allow lookup for own realm + +When using security tab in Windows Explorer, a lookup over a trusted +forest might come as realm\name instead of NetBIOS domain name: + +-------------------------------------------------------------------- +[2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) + lsa_LookupNames3: struct lsa_LookupNames3 + in: struct lsa_LookupNames3 + handle : * + handle: struct policy_handle + handle_type : 0x00000000 (0) + uuid : 0000000e-0000-0000-1c5e-a750e5810000 + num_names : 0x00000001 (1) + names: ARRAY(1) + names: struct lsa_String + length : 0x001e (30) + size : 0x0020 (32) + string : * + string : 'ipa.test\admins' + sids : * + sids: struct lsa_TransSidArray3 + count : 0x00000000 (0) + sids : NULL + level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) + count : * + count : 0x00000000 (0) + lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) + client_revision : LSA_CLIENT_REVISION_2 (2) +-------------------------------------------------------------------- + +Allow this lookup using realm to be done against primary domain. + +Refactor user name parsing code to reuse cli_credentials_* API to be +consistent with other places. cli_credentials_parse_string() handles +both domain and realm-based user name variants. + +Signed-off-by: Alexander Bokovoy +--- + source3/passdb/lookup_sid.c | 75 ++++++++++++++++++++++++++----------- + 1 file changed, 53 insertions(+), 22 deletions(-) + +diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c +index 82c47b3145b..39d599fed27 100644 +--- a/source3/passdb/lookup_sid.c ++++ b/source3/passdb/lookup_sid.c +@@ -29,6 +29,7 @@ + #include "../libcli/security/security.h" + #include "lib/winbind_util.h" + #include "../librpc/gen_ndr/idmap.h" ++#include "auth/credentials/credentials.h" + + static bool lookup_unix_user_name(const char *name, struct dom_sid *sid) + { +@@ -78,52 +79,82 @@ bool lookup_name(TALLOC_CTX *mem_ctx, + const char **ret_domain, const char **ret_name, + struct dom_sid *ret_sid, enum lsa_SidType *ret_type) + { +- char *p; + const char *tmp; + const char *domain = NULL; + const char *name = NULL; ++ const char *realm = NULL; + uint32_t rid; + struct dom_sid sid; + enum lsa_SidType type; + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); ++ struct cli_credentials *creds = NULL; + + if (tmp_ctx == NULL) { + DEBUG(0, ("talloc_new failed\n")); + return false; + } + +- p = strchr_m(full_name, '\\'); +- +- if (p != NULL) { +- domain = talloc_strndup(tmp_ctx, full_name, +- PTR_DIFF(p, full_name)); +- name = talloc_strdup(tmp_ctx, p+1); +- } else { +- domain = talloc_strdup(tmp_ctx, ""); +- name = talloc_strdup(tmp_ctx, full_name); ++ creds = cli_credentials_init(tmp_ctx); ++ if (creds == NULL) { ++ DEBUG(0, ("cli_credentials_init failed\n")); ++ return false; + } + +- if ((domain == NULL) || (name == NULL)) { +- DEBUG(0, ("talloc failed\n")); +- TALLOC_FREE(tmp_ctx); ++ cli_credentials_parse_string(creds, full_name, CRED_SPECIFIED); ++ name = cli_credentials_get_username(creds); ++ domain = cli_credentials_get_domain(creds); ++ realm = cli_credentials_get_realm(creds); ++ ++ /* At this point we have: ++ * - name -- normal name or empty string ++ * - domain -- either NULL or domain name ++ * - realm -- either NULL or realm name ++ * ++ * domain and realm are exclusive to each other ++ * the code below in lookup_name assumes domain ++ * to be at least empty string, not NULL ++ */ ++ ++ if ((name == NULL) || (name[0] == '\0')) { ++ DEBUG(0, ("lookup_name with empty name, exit\n")); + return false; + } + ++ if ((domain == NULL) && (realm == NULL)) { ++ domain = talloc_strdup(creds, ""); ++ } ++ + DEBUG(10,("lookup_name: %s => domain=[%s], name=[%s]\n", + full_name, domain, name)); + DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); + +- if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && +- strequal(domain, get_global_sam_name())) +- { ++ /* Windows clients may send a LookupNames request with both NetBIOS ++ * domain name- and realm-qualified user names. Thus, we need to check ++ * both against both of the SAM domain name and realm, if set. Since ++ * domain name and realm in the request are exclusive, test the one ++ * that is specified. cli_credentials_parse_string() will either set ++ * realm or wouldn't so we can use it to detect if realm was specified. ++ */ ++ if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) { ++ const char *domain_name = realm ? realm : domain; ++ bool check_global_sam = false; ++ ++ if (domain_name[0] != '\0') { ++ check_global_sam = strequal(domain_name, get_global_sam_name()); ++ if (!check_global_sam && lp_realm() != NULL) { ++ check_global_sam = strequal(domain_name, lp_realm()); ++ } ++ } + +- /* It's our own domain, lookup the name in passdb */ +- if (lookup_global_sam_name(name, flags, &rid, &type)) { +- sid_compose(&sid, get_global_sam_sid(), rid); +- goto ok; ++ if (check_global_sam) { ++ /* It's our own domain, lookup the name in passdb */ ++ if (lookup_global_sam_name(name, flags, &rid, &type)) { ++ sid_compose(&sid, get_global_sam_sid(), rid); ++ goto ok; ++ } ++ TALLOC_FREE(tmp_ctx); ++ return false; + } +- TALLOC_FREE(tmp_ctx); +- return false; + } + + if ((flags & LOOKUP_NAME_BUILTIN) && +-- +2.28.0 + diff --git a/samba.spec b/samba.spec index e0e9432..e5971ff 100644 --- a/samba.spec +++ b/samba.spec @@ -131,6 +131,7 @@ Source201: README.downgrade Patch: samba-winexe-build.patch Patch1: samba-s4u.patch +Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3591,6 +3592,8 @@ fi * Thu Oct 22 2020 Alexander Bokovoy - 4.12.8-1 - Add preliminary support for S4U operations in Samba AD DC resolves: #1836630 - Samba DC: Remote Desktop cannot access files +- Fix lookup_unix_user_name to allow lookup of realm-qualified users and groups + required for upcoming FreeIPA Global Catalog support * Wed Oct 07 2020 Guenther Deschner - 4.12.8-0 - Update to Samba 4.12.8 From 32d6e0b192d28ab3a3c7ac3f64a6bf47029dcbad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Oct 2020 10:16:59 +0100 Subject: [PATCH 18/26] Update to Samba 4.12.9 resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 Guenther --- .gitignore | 2 ++ samba.spec | 10 ++++++++-- sources | 4 ++-- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 2e87fad..6c22b3d 100644 --- a/.gitignore +++ b/.gitignore @@ -215,3 +215,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.7.tar.asc /samba-4.12.8.tar.xz /samba-4.12.8.tar.asc +/samba-4.12.9.tar.xz +/samba-4.12.9.tar.asc diff --git a/samba.spec b/samba.spec index e5971ff..46c7833 100644 --- a/samba.spec +++ b/samba.spec @@ -8,9 +8,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 0 -%define samba_version 4.12.8 +%define samba_version 4.12.9 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3589,6 +3589,12 @@ fi %endif %changelog +* Thu Oct 29 2020 Guenther Deschner - 4.12.9-0 +- Update to Samba 4.12.9 +- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 +- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 +- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 + * Thu Oct 22 2020 Alexander Bokovoy - 4.12.8-1 - Add preliminary support for S4U operations in Samba AD DC resolves: #1836630 - Samba DC: Remote Desktop cannot access files diff --git a/sources b/sources index 24ded22..e6ad17a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.8.tar.xz) = 8d4ed3f0daf5859766e48fed9ebf1c1fca5c8894aa28ca70a3163bf3e946a83f9413faea562f6bea751a90eecd0717afdf61266d9f1dd38d5e6d8c628d34fd59 -SHA512 (samba-4.12.8.tar.asc) = 771aca96be911869b8d383d4e16957b2e5f95bba1aa6cd4092f581cf68cf145a6c85ecfe4a47e4d27c0ac1f8e3175c3dfbc25d669fd2fe699dc4420cf617539f +SHA512 (samba-4.12.9.tar.xz) = b9bc189c9866cdbe30646728f39b47188f408f8edecd4e8332077a73a73fdfbd4a6393c0bf3d32acf4eecc84e1161de41933e0cc75933332ff4ca410f7aecaae +SHA512 (samba-4.12.9.tar.asc) = 79989cc64a7212bdfee315e8adaaa0a447506ba079b7b39223f8925894309c80564b5bf4e114c4d77d54a17e18c138fb3c8a838e3a87ab1a480ae8c4245ce2e6 From 0ed44241f38e49d201601f8cd2d77d1483c279cb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 5 Nov 2020 11:23:08 +0100 Subject: [PATCH 19/26] Update to Samba 4.12.10 Guenther --- .gitignore | 2 ++ samba-winexe-build.patch | 67 ---------------------------------------- samba.spec | 8 +++-- sources | 4 +-- 4 files changed, 10 insertions(+), 71 deletions(-) delete mode 100644 samba-winexe-build.patch diff --git a/.gitignore b/.gitignore index 6c22b3d..58e1ec8 100644 --- a/.gitignore +++ b/.gitignore @@ -217,3 +217,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.8.tar.asc /samba-4.12.9.tar.xz /samba-4.12.9.tar.asc +/samba-4.12.10.tar.xz +/samba-4.12.10.tar.asc diff --git a/samba-winexe-build.patch b/samba-winexe-build.patch deleted file mode 100644 index 63f8a9e..0000000 --- a/samba-winexe-build.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 54c21a99e6ca54bdb963c70d322f6778b57a384f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Wed, 4 Mar 2020 18:51:01 +0100 -Subject: [PATCH] winexe: add configure option to control whether to build it - (default: auto) - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Mon Mar 9 16:27:21 UTC 2020 on sn-devel-184 ---- - examples/winexe/wscript_build | 3 ++- - source3/wscript | 17 +++++++++++++++++ - 2 files changed, 19 insertions(+), 1 deletion(-) - -diff --git a/examples/winexe/wscript_build b/examples/winexe/wscript_build -index 43c09717e3d..559ed3fc706 100644 ---- a/examples/winexe/wscript_build -+++ b/examples/winexe/wscript_build -@@ -106,4 +106,5 @@ if winexesvc_binaries != '': - LOADPARM_CTX - libsmb - msrpc3 -- ''') -+ ''', -+ enabled=bld.env.build_winexe) -diff --git a/source3/wscript b/source3/wscript -index 85466b493fa..6d5bd22ca49 100644 ---- a/source3/wscript -+++ b/source3/wscript -@@ -63,6 +63,7 @@ def options(opt): - opt.samba_add_onoff_option('cluster-support', default=False) - - opt.samba_add_onoff_option('regedit', default=None) -+ opt.samba_add_onoff_option('winexe', default=None) - - opt.samba_add_onoff_option('fake-kaserver', - help=("Include AFS fake-kaserver support"), default=False) -@@ -1782,6 +1783,22 @@ main() { - if conf.CHECK_HEADERS('ftw.h') and conf.CHECK_FUNCS('nftw'): - conf.env.build_mvxattr = True - -+ conf.env.build_winexe = False -+ if not Options.options.with_winexe == False: -+ if conf.CONFIG_SET('HAVE_WINEXE_CC_WIN32') or conf.CONFIG_SET('HAVE_WINEXE_CC_WIN64'): -+ conf.env.build_winexe = True -+ -+ if conf.env.build_winexe: -+ Logs.info("building winexe") -+ else: -+ if Options.options.with_winexe == False: -+ Logs.info("not building winexe (--without-winexe)") -+ elif Options.options.with_winexe == True: -+ Logs.error("mingw not available, cannot build winexe") -+ conf.fatal("mingw not available, but --with-winexe was specified") -+ else: -+ Logs.info("mingw not available, not building winexe") -+ - conf.CHECK_FUNCS_IN('DES_pcbc_encrypt', 'crypto') - if Options.options.with_fake_kaserver == True: - conf.CHECK_HEADERS('afs/param.h afs/stds.h', together=True) --- -2.26.2 - diff --git a/samba.spec b/samba.spec index 46c7833..bc4055e 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.12.9 +%define samba_version 4.12.10 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -129,7 +129,6 @@ Source14: samba.pamd Source201: README.downgrade -Patch: samba-winexe-build.patch Patch1: samba-s4u.patch Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch @@ -1729,6 +1728,8 @@ fi %{_libdir}/samba/bind9/dlz_bind9_10.so %{_libdir}/samba/bind9/dlz_bind9_11.so %{_libdir}/samba/bind9/dlz_bind9_12.so +%{_libdir}/samba/bind9/dlz_bind9_14.so +%{_libdir}/samba/bind9/dlz_bind9_16.so #endif with_dc %endif @@ -3589,6 +3590,9 @@ fi %endif %changelog +* Thu Nov 05 2020 Guenther Deschner - 4.12.10-0 +- Update to Samba 4.12.10 + * Thu Oct 29 2020 Guenther Deschner - 4.12.9-0 - Update to Samba 4.12.9 - resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 diff --git a/sources b/sources index e6ad17a..2d294fb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.9.tar.xz) = b9bc189c9866cdbe30646728f39b47188f408f8edecd4e8332077a73a73fdfbd4a6393c0bf3d32acf4eecc84e1161de41933e0cc75933332ff4ca410f7aecaae -SHA512 (samba-4.12.9.tar.asc) = 79989cc64a7212bdfee315e8adaaa0a447506ba079b7b39223f8925894309c80564b5bf4e114c4d77d54a17e18c138fb3c8a838e3a87ab1a480ae8c4245ce2e6 +SHA512 (samba-4.12.10.tar.xz) = d9ebe1fc558067f20c7b348ca273d3f4b251d07bf9a5d358f555e96f415bbfd8748a8875d591cce5e17e6e5d4b3127289f8f7268a8a4902f7595feb407db4a48 +SHA512 (samba-4.12.10.tar.asc) = 99914cee7b0cf5e3cb214bee45ef6d461a0860182d57f8d7dbc5af516589aec938bf0c9b126175d12be995624d59cd04b7c191667226bef89a9321dfaaafd00b From 4b26702db646b849efc22094d2ff3b54819ccb70 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 14 Jan 2021 16:18:02 +0100 Subject: [PATCH 20/26] Update to Samba 4.12.11 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 58e1ec8..995a704 100644 --- a/.gitignore +++ b/.gitignore @@ -219,3 +219,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.9.tar.asc /samba-4.12.10.tar.xz /samba-4.12.10.tar.asc +/samba-4.12.11.tar.xz +/samba-4.12.11.tar.asc diff --git a/samba.spec b/samba.spec index bc4055e..b738568 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.12.10 +%define samba_version 4.12.11 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3590,6 +3590,9 @@ fi %endif %changelog +* Thu Jan 14 2021 Guenther Deschner - 4.12.11-0 +- Update to Samba 4.12.11 + * Thu Nov 05 2020 Guenther Deschner - 4.12.10-0 - Update to Samba 4.12.10 diff --git a/sources b/sources index 2d294fb..7622acf 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.10.tar.xz) = d9ebe1fc558067f20c7b348ca273d3f4b251d07bf9a5d358f555e96f415bbfd8748a8875d591cce5e17e6e5d4b3127289f8f7268a8a4902f7595feb407db4a48 -SHA512 (samba-4.12.10.tar.asc) = 99914cee7b0cf5e3cb214bee45ef6d461a0860182d57f8d7dbc5af516589aec938bf0c9b126175d12be995624d59cd04b7c191667226bef89a9321dfaaafd00b +SHA512 (samba-4.12.11.tar.xz) = dde43c06e618c140e28210a605b31da201ac0a5c2e8d9320127d9255c20981c481afc628ffc382f65d9cdac2c80656e631280c663d97517e45320ae3004bec71 +SHA512 (samba-4.12.11.tar.asc) = 1391a3783c52ab42e6eae793668ba320b15efa29e2ec67cf63f5c8babe7fffc61086076edace5509fd24b6538dcb44c084ca49f1419fcd0d8b49483beea34baa From 38398b649b37cf9e0b36407d76482c6b01f982d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Mar 2021 14:43:32 +0100 Subject: [PATCH 21/26] Update to Samba 4.12.12 Guenther --- .gitignore | 2 ++ ...-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg | Bin 1275 -> 0 bytes samba-pubkey_AA99442FB680B620.gpg | Bin 0 -> 2290 bytes samba.spec | 8 +++++--- sources | 4 ++-- 5 files changed, 9 insertions(+), 5 deletions(-) delete mode 100644 gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg create mode 100644 samba-pubkey_AA99442FB680B620.gpg diff --git a/.gitignore b/.gitignore index 995a704..1d140c9 100644 --- a/.gitignore +++ b/.gitignore @@ -221,3 +221,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.10.tar.asc /samba-4.12.11.tar.xz /samba-4.12.11.tar.asc +/samba-4.12.12.tar.xz +/samba-4.12.12.tar.asc diff --git a/gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg b/gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg deleted file mode 100644 index a61ebc450995a418da1144e95cbfb66bc1edcd0b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1275 zcmVW;H$ADVghZ2A8yO#p&`LaP9v$kcn*MvBhO zXtSVV1{<`oJX4V01OSk=yI-^RYHqjk7NgeC^OBK0^w(V+Z_~KS`{p0C@r-)1Ma9}( zRF97Mv;p*<%jsnY7sT_J!3G?3t&Vb{WF5~4HvnRke5Fu#)6QRfN=4sjobF^ZE8@OC zLV!i5a>0E`ErggqW)RdDn6==$g-dDuO(N0Fb|f*l256-u#y|uBqO+N-dX?&qw9dlbo*hlQ0(DCgAaI6|J zY8UK)DNW$72QJpZ%TuxTMrZmO^~lj0J=rMvZd(i9mZM~9og?)2qIv$>daZTBEQkgF zH76JnS0v-VZ z7k~u9mb&d^hg2gzhs(tRS{#34s2%P|* zf4YbL#idQe@gIs;4J;N^Jsq0TxdIIYMaDT{5C{OsIbIW`QM$A>)a`)vRx)?@7jB|x zmQD|Nbc2I~R@of8@KLTv)qeA`HYS1=c|oq0#Mvip9I#q;kI?gsT_Y@|Ri~&F6J|;A zbP7yt!~~L!DLj;m!PLXw?K0*YczM_K@v9bfAXDcn?&RjA;P29FbNQ6g9`Oy*jrx&d zB$wA~mV&3D`(kWBE_5!xYo9+rGBT=UOm@Gu%A6@Np`misd=8}e$+U})6{Lvd>!&u$ zp0ar7;UF)rPeW(VTf!%4S}`4Y=_Zl|T#V#~m%^-Js~@a*qj z{^c!?PL*}(;rT-}8ItmUJ$WQWbTuMcFOvIttf-zGEO?)!8E>0i^b3G_7HRL57ZDS? zrE-SdkV-&6_;`B{q7v}k(+Uk?x`eb};ADKi>`E+Huc>Bu%jkM#yS)^ z1DnZ&#fVP?7!d*h4+0wu1p-#6p34OZ62q9^0162ZZ!?iwWoWnRP&)vipS-vOdP4v< l{LI?!5F)xxa87n$=!Jmo%9)YS<7;&9{>B}if@Dw z(oCC>JU&|4`so(*Jy(Bh>uh}Oq48D|OHlJE`)&?bj5M6%ar~{y?*;|d@0u7enGOL} z#+bE<^m(nlQiVi|@^q+t;%4c+>oehWTJAi{lvV3&l6u13$LfL+>9uZ(=lXRIn8wzi zWmzzD4gD{M1b|uA^~b;F7>ealR~$qV9J8uOTAx2e&yS0%Jlz#QEX7A!K5BCLwQz7C zca;xtH6(j@F!(#l%FU<2B1H6*ad2dvD77pTymf47>s`=m7TWA7t(1crE#zTG8cY&j z{frRKJd<+uop~v4z=LItsNoN2(##3{Q=M!oZi+a>wePCEPi_NBv?FH)ygMCol`f!c zjYLPN4ZDOVyJ01imns{Ds!W%i04Q{-nC{5xmXU&rwZ+5P5*N6uCe=@1L%h;a9U4N{ zJ#xSDgI^o|E+@2jdZv6mN8yv^u!`T4yu)8|1+R~i*$MI0Nn3JP!-N zb+KtX$*!827uW1OE3$xNSNCs4q>07KO4Kp}5g;P~HxK}9*06N-b8{8dMF(So&~70Z zbb!C8jb{-0F52DocQEpNC<+h$=Skiz#4A|)_o)yNjVbrHC?s{#hDG5X`^=e&q#VU}Irs0x|NlvM{rOAm>3~Am|Su2pS7u zW#RfyX{45t2!nTU|cnp9INM-Nj! z8xHj3uA7J~7Zujt1Xq9ypN%FNSyJIQzIY|cH%k0;45r|fnfTJ0D?Z>(SBD)uc+;Ip zx~R%g)o?<7txDiFNs&D9_;iyQ()?uz_R)-kEQHMI?wI|&WPZ9$fRJ#M#u%R);#4)qBEq{e`A_BtO&Y4EeY+oOV z#D%je2l^5E_lAzWE_0Qh>XbkJPQm3|Xg)6dm<-B#tDedmWGZYYL;+V#M;RAfWbWyo z^w0I4Gik9sS>Wy+_gNVqtv%kvAI!ogeN~qgbVHW-5h}F`^_|13XW2;^VdMQ`8yAoC zir=+%&Uu(0xrE<1Pd?e$NyCJrh*l1M$%1=*79NN=^aHF%i>pgkh@5FN3Bnqkj zCF;Wl|3q~if`QnrL-X5(`Y*`kmtfR_w-+1obXc@5)-ZWqjBF74;7RYH3{^VX7eZ8d zYZ}Sj=Ds7wuU%tPR*6>W6@FMPLBv`Mky!I`I6c$tNKKvEgaE4cf~pr~h1Xyugr@$0 zqc_lRH4~^2i(J;rGK)Goos*%5Nt0zY3LZ4}l;MF*x@4G4^k#^E$&tpzQwN!a&jP&z z91%)5<*rG&7osofsS@@pKV-& z^p(a(hBm|vI*WT*E-L2YgIpo@*k~1>PkjN)Ff|eD|V=Q%_fq2^(ca zVax~`-ma|ba%-7ASP)yh#(*5M5DCTf)gOQ;;hYuy1y#20c+B>GgNp_q-h@;FtWzMb z0^+MY3^B|~MGW+)I$byqtIO+sLa~=C_-jTm?5sF{DJ0+A4yR5E`w?rN)2+1B7-eok z*}ueDo{ZstWBSnjwN2(gBUa~Z;DbMH{5x;y7WtSmVquZ??p-c=4zf(~6DBi8gC*Z61USMLAb9X77Tp>G*|f z=?!J{9#yKm+&ITGHmJ8hJpwZuU-!S?KJ}zhB^~eRskw84*EWXNxcuuoLQ^k=Yz>vF z&Nkwf>@HLIKpU`G&y6`Z_wxh`HpKEf?R@mP=S!1)aHo(JTF@~gm&SI9Lsj!dZ`)V5 zB!)9Ubu1wjAhmWuIQYHkM!g2Vd< z&UBb`f|^wUjG&EblJar+p^8ci+pwfE|B7r1Zf#5L`v4by3zn|g#;E2 zQ#K3y^ZrAda{TQ1-{QM;Ipp>k;kd~v(ig?>T(?V^3 zC}bM7h=M~_evuqB;_(yK7S|0@ac`*srrj{PzMEdBU23s(I&5Kb21wg|es`W(*T?IL F^WPx2REz)s literal 0 HcmV?d00001 diff --git a/samba.spec b/samba.spec index b738568..891af39 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.12.11 +%define samba_version 4.12.12 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -118,7 +118,7 @@ URL: https://www.samba.org # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz Source0: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.gz#/samba-%{version}%{pre_release}.tar.xz Source1: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.asc -Source2: gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg +Source2: samba-pubkey_AA99442FB680B620.gpg # Red Hat specific replacement-files Source10: samba.logrotate @@ -1537,7 +1537,6 @@ fi %{_libdir}/samba/libsmb-transport-samba4.so %{_libdir}/samba/libsmbclient-raw-samba4.so %{_libdir}/samba/libsmbd-base-samba4.so -%{_libdir}/samba/libsmbd-conn-samba4.so %{_libdir}/samba/libsmbd-shim-samba4.so %{_libdir}/samba/libsmbldaphelper-samba4.so %{_libdir}/samba/libsys-rw-samba4.so @@ -3590,6 +3589,9 @@ fi %endif %changelog +* Thu Mar 11 2021 Guenther Deschner - 4.12.12-0 +- Update to Samba 4.12.12 + * Thu Jan 14 2021 Guenther Deschner - 4.12.11-0 - Update to Samba 4.12.11 diff --git a/sources b/sources index 7622acf..e060510 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.11.tar.xz) = dde43c06e618c140e28210a605b31da201ac0a5c2e8d9320127d9255c20981c481afc628ffc382f65d9cdac2c80656e631280c663d97517e45320ae3004bec71 -SHA512 (samba-4.12.11.tar.asc) = 1391a3783c52ab42e6eae793668ba320b15efa29e2ec67cf63f5c8babe7fffc61086076edace5509fd24b6538dcb44c084ca49f1419fcd0d8b49483beea34baa +SHA512 (samba-4.12.12.tar.xz) = 5d0d817225830123a3a99b0957499191c0fd430d3c4cbec90e33164a2220395644ad64b9fd1148d66c9a8dd1b626529739e28d18c500bd3b23720272ca5169b2 +SHA512 (samba-4.12.12.tar.asc) = 63af417c87f1f42bd115d4af5f2d6f24d7ca17194b20d2978f25e982091eed72e96a0c2a98e1cef2b69bc6f8b54597e6c7e8eb195e8f26c0430b608cf1136535 From 3a9f5d3bb220acf9102619db6c70d9f5ee442eb5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 24 Mar 2021 20:11:19 +0100 Subject: [PATCH 22/26] Update to Samba 4.12.13 resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 Guenther --- .gitignore | 2 ++ samba.spec | 7 ++++++- sources | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 1d140c9..74bccc9 100644 --- a/.gitignore +++ b/.gitignore @@ -223,3 +223,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.11.tar.asc /samba-4.12.12.tar.xz /samba-4.12.12.tar.asc +/samba-4.12.13.tar.xz +/samba-4.12.13.tar.asc diff --git a/samba.spec b/samba.spec index 891af39..4eb5105 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.12.12 +%define samba_version 4.12.13 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3589,6 +3589,11 @@ fi %endif %changelog +* Wed Mar 24 2021 Guenther Deschner - 4.12.13-0 +- Update to Samba 4.12.13 +- resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 + * Thu Mar 11 2021 Guenther Deschner - 4.12.12-0 - Update to Samba 4.12.12 diff --git a/sources b/sources index e060510..7d46212 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.12.tar.xz) = 5d0d817225830123a3a99b0957499191c0fd430d3c4cbec90e33164a2220395644ad64b9fd1148d66c9a8dd1b626529739e28d18c500bd3b23720272ca5169b2 -SHA512 (samba-4.12.12.tar.asc) = 63af417c87f1f42bd115d4af5f2d6f24d7ca17194b20d2978f25e982091eed72e96a0c2a98e1cef2b69bc6f8b54597e6c7e8eb195e8f26c0430b608cf1136535 +SHA512 (samba-4.12.13.tar.xz) = 6595da57c583eb92f2d250b8cf932856674d52a35fe7ff92234284c0dcf8340a43b439d0759e589a28505d822011e1998ea34aa3641b6f421621f866653e9081 +SHA512 (samba-4.12.13.tar.asc) = 9ec0c89a7eb95f2f0d18d24898891bb6c4dfccaf578f0fd7b3cd634e361750c8d900a0c4aaaaa082e4f2697e1996c7d6f1156c305706d99a2a7d0c2831eff688 From 3f06841aefff6ce42bb5a358687fe54b400f92df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 25 Mar 2021 12:22:57 +0100 Subject: [PATCH 23/26] Update to Samba 4.12.14 related: #1941400, #1942496 - Security fixes for CVE-2020-27840 related: #1941402, #1942497 - Security fixes for CVE-2021-20277 Guenther --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 74bccc9..d88121c 100644 --- a/.gitignore +++ b/.gitignore @@ -225,3 +225,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.12.tar.asc /samba-4.12.13.tar.xz /samba-4.12.13.tar.asc +/samba-4.12.14.tar.xz +/samba-4.12.14.tar.asc diff --git a/samba.spec b/samba.spec index 4eb5105..860b2ce 100644 --- a/samba.spec +++ b/samba.spec @@ -10,11 +10,11 @@ %define main_release 0 -%define samba_version 4.12.13 +%define samba_version 4.12.14 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.1.4 +%define ldb_version 2.1.5 # This should be rc1 or nil %define pre_release %nil @@ -3589,6 +3589,11 @@ fi %endif %changelog +* Thu Mar 25 2021 Guenther Deschner - 4.12.14-0 +- Update to Samba 4.12.14 +- related: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- related: #1941402, #1942497 - Security fixes for CVE-2021-20277 + * Wed Mar 24 2021 Guenther Deschner - 4.12.13-0 - Update to Samba 4.12.13 - resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 diff --git a/sources b/sources index 7d46212..40f940a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.13.tar.xz) = 6595da57c583eb92f2d250b8cf932856674d52a35fe7ff92234284c0dcf8340a43b439d0759e589a28505d822011e1998ea34aa3641b6f421621f866653e9081 -SHA512 (samba-4.12.13.tar.asc) = 9ec0c89a7eb95f2f0d18d24898891bb6c4dfccaf578f0fd7b3cd634e361750c8d900a0c4aaaaa082e4f2697e1996c7d6f1156c305706d99a2a7d0c2831eff688 +SHA512 (samba-4.12.14.tar.xz) = 3af3b9f43645c1ca085bda59f1ec9188212d47f4643c9bebf8d5f952a9ca0e04be4514c4d62371c2a869a9de185fab2eea37d7c69dd906040650d73ab4a64b19 +SHA512 (samba-4.12.14.tar.asc) = 051882a9be20a7ec29570b4e90b414b5056c9c6b5a971fad15fff6d2ad27a106493a79fa4d6f5a26da23a8d7ac32d436728d875e8381b55ac1cc348e24feaa9f From 702128d53c70b6d57c2bf10cf19c07b47c5ad8d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Apr 2021 11:58:17 +0200 Subject: [PATCH 24/26] Update to Samba 4.12.15 resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 Guenther --- .gitignore | 2 ++ samba.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d88121c..302c057 100644 --- a/.gitignore +++ b/.gitignore @@ -227,3 +227,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.13.tar.asc /samba-4.12.14.tar.xz /samba-4.12.14.tar.asc +/samba-4.12.15.tar.xz +/samba-4.12.15.tar.asc diff --git a/samba.spec b/samba.spec index 860b2ce..fcc6b19 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.12.14 +%define samba_version 4.12.15 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3589,6 +3589,10 @@ fi %endif %changelog +* Thu Apr 29 2021 Guenther Deschner - 4.12.15-0 +- Update to Samba 4.12.15 +- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 + * Thu Mar 25 2021 Guenther Deschner - 4.12.14-0 - Update to Samba 4.12.14 - related: #1941400, #1942496 - Security fixes for CVE-2020-27840 diff --git a/sources b/sources index 40f940a..098d343 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.14.tar.xz) = 3af3b9f43645c1ca085bda59f1ec9188212d47f4643c9bebf8d5f952a9ca0e04be4514c4d62371c2a869a9de185fab2eea37d7c69dd906040650d73ab4a64b19 -SHA512 (samba-4.12.14.tar.asc) = 051882a9be20a7ec29570b4e90b414b5056c9c6b5a971fad15fff6d2ad27a106493a79fa4d6f5a26da23a8d7ac32d436728d875e8381b55ac1cc348e24feaa9f +SHA512 (samba-4.12.15.tar.xz) = fbacacd429f368238127196b120d1492da55a14102715f065e70ec5f729d30734452f05095780146baa4afed82efebf425f1118e823ed603af9f4c6f04c07978 +SHA512 (samba-4.12.15.tar.asc) = b5e96bebf12d594f63e81293b254211146bdd3799e3e3c3586c8ace5dc126a433d75f2cce3a10c3081bba893e245175df06a2d194f1937bbbaa28a6917e65aa2 From 9d960aa7dc4b5c8e8e80d35b791f6b6f08bc251f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Apr 2021 16:43:18 +0200 Subject: [PATCH 25/26] Removing GC patch, GC support continues on more recent fedora versions. Guenther --- ...user_name-allow-lookup-for-own-realm.patch | 210 ------------------ 1 file changed, 210 deletions(-) delete mode 100644 samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch diff --git a/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch b/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch deleted file mode 100644 index e0ed8ae..0000000 --- a/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch +++ /dev/null @@ -1,210 +0,0 @@ -From 81d6949acdad70ecfb130d3286eeab1b3a51937f Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 7 Oct 2020 19:25:24 +0300 -Subject: [PATCH 1/2] cli_credentials_parse_string: fix parsing of principals - -When parsing a principal-like name, user name was left with full -principal instead of taking only the left part before '@' sign. - ->>> from samba import credentials ->>> t = credentials.Credentials() ->>> t.parse_string('admin@realm.test', credentials.SPECIFIED) ->>> t.get_username() -'admin@realm.test' - -The issue is that cli_credentials_set_username() does a talloc_strdup() -of the argument, so we need to change order of assignment to allow -talloc_strdup() to copy the right part of the string. - -Signed-off-by: Alexander Bokovoy ---- - auth/credentials/credentials.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index 77c35dd104b..06ac79058f9 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -840,11 +840,10 @@ _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials, - * in order to undo the effect of - * cli_credentials_guess(). - */ -- cli_credentials_set_username(credentials, uname, obtained); -- cli_credentials_set_domain(credentials, "", obtained); -- - cli_credentials_set_principal(credentials, uname, obtained); - *p = 0; -+ cli_credentials_set_username(credentials, uname, obtained); -+ cli_credentials_set_domain(credentials, "", obtained); - cli_credentials_set_realm(credentials, p+1, obtained); - return; - } else if ((p = strchr_m(uname,'\\')) --- -2.28.0 - - -From fa38bebb993011428612d51819530218d8358f5e Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Mon, 13 Jan 2020 16:04:20 +0200 -Subject: [PATCH 2/2] lookup_name: allow lookup for own realm - -When using security tab in Windows Explorer, a lookup over a trusted -forest might come as realm\name instead of NetBIOS domain name: - --------------------------------------------------------------------- -[2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) - lsa_LookupNames3: struct lsa_LookupNames3 - in: struct lsa_LookupNames3 - handle : * - handle: struct policy_handle - handle_type : 0x00000000 (0) - uuid : 0000000e-0000-0000-1c5e-a750e5810000 - num_names : 0x00000001 (1) - names: ARRAY(1) - names: struct lsa_String - length : 0x001e (30) - size : 0x0020 (32) - string : * - string : 'ipa.test\admins' - sids : * - sids: struct lsa_TransSidArray3 - count : 0x00000000 (0) - sids : NULL - level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) - count : * - count : 0x00000000 (0) - lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) - client_revision : LSA_CLIENT_REVISION_2 (2) --------------------------------------------------------------------- - -Allow this lookup using realm to be done against primary domain. - -Refactor user name parsing code to reuse cli_credentials_* API to be -consistent with other places. cli_credentials_parse_string() handles -both domain and realm-based user name variants. - -Signed-off-by: Alexander Bokovoy ---- - source3/passdb/lookup_sid.c | 75 ++++++++++++++++++++++++++----------- - 1 file changed, 53 insertions(+), 22 deletions(-) - -diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c -index 82c47b3145b..39d599fed27 100644 ---- a/source3/passdb/lookup_sid.c -+++ b/source3/passdb/lookup_sid.c -@@ -29,6 +29,7 @@ - #include "../libcli/security/security.h" - #include "lib/winbind_util.h" - #include "../librpc/gen_ndr/idmap.h" -+#include "auth/credentials/credentials.h" - - static bool lookup_unix_user_name(const char *name, struct dom_sid *sid) - { -@@ -78,52 +79,82 @@ bool lookup_name(TALLOC_CTX *mem_ctx, - const char **ret_domain, const char **ret_name, - struct dom_sid *ret_sid, enum lsa_SidType *ret_type) - { -- char *p; - const char *tmp; - const char *domain = NULL; - const char *name = NULL; -+ const char *realm = NULL; - uint32_t rid; - struct dom_sid sid; - enum lsa_SidType type; - TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); -+ struct cli_credentials *creds = NULL; - - if (tmp_ctx == NULL) { - DEBUG(0, ("talloc_new failed\n")); - return false; - } - -- p = strchr_m(full_name, '\\'); -- -- if (p != NULL) { -- domain = talloc_strndup(tmp_ctx, full_name, -- PTR_DIFF(p, full_name)); -- name = talloc_strdup(tmp_ctx, p+1); -- } else { -- domain = talloc_strdup(tmp_ctx, ""); -- name = talloc_strdup(tmp_ctx, full_name); -+ creds = cli_credentials_init(tmp_ctx); -+ if (creds == NULL) { -+ DEBUG(0, ("cli_credentials_init failed\n")); -+ return false; - } - -- if ((domain == NULL) || (name == NULL)) { -- DEBUG(0, ("talloc failed\n")); -- TALLOC_FREE(tmp_ctx); -+ cli_credentials_parse_string(creds, full_name, CRED_SPECIFIED); -+ name = cli_credentials_get_username(creds); -+ domain = cli_credentials_get_domain(creds); -+ realm = cli_credentials_get_realm(creds); -+ -+ /* At this point we have: -+ * - name -- normal name or empty string -+ * - domain -- either NULL or domain name -+ * - realm -- either NULL or realm name -+ * -+ * domain and realm are exclusive to each other -+ * the code below in lookup_name assumes domain -+ * to be at least empty string, not NULL -+ */ -+ -+ if ((name == NULL) || (name[0] == '\0')) { -+ DEBUG(0, ("lookup_name with empty name, exit\n")); - return false; - } - -+ if ((domain == NULL) && (realm == NULL)) { -+ domain = talloc_strdup(creds, ""); -+ } -+ - DEBUG(10,("lookup_name: %s => domain=[%s], name=[%s]\n", - full_name, domain, name)); - DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); - -- if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && -- strequal(domain, get_global_sam_name())) -- { -+ /* Windows clients may send a LookupNames request with both NetBIOS -+ * domain name- and realm-qualified user names. Thus, we need to check -+ * both against both of the SAM domain name and realm, if set. Since -+ * domain name and realm in the request are exclusive, test the one -+ * that is specified. cli_credentials_parse_string() will either set -+ * realm or wouldn't so we can use it to detect if realm was specified. -+ */ -+ if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) { -+ const char *domain_name = realm ? realm : domain; -+ bool check_global_sam = false; -+ -+ if (domain_name[0] != '\0') { -+ check_global_sam = strequal(domain_name, get_global_sam_name()); -+ if (!check_global_sam && lp_realm() != NULL) { -+ check_global_sam = strequal(domain_name, lp_realm()); -+ } -+ } - -- /* It's our own domain, lookup the name in passdb */ -- if (lookup_global_sam_name(name, flags, &rid, &type)) { -- sid_compose(&sid, get_global_sam_sid(), rid); -- goto ok; -+ if (check_global_sam) { -+ /* It's our own domain, lookup the name in passdb */ -+ if (lookup_global_sam_name(name, flags, &rid, &type)) { -+ sid_compose(&sid, get_global_sam_sid(), rid); -+ goto ok; -+ } -+ TALLOC_FREE(tmp_ctx); -+ return false; - } -- TALLOC_FREE(tmp_ctx); -- return false; - } - - if ((flags & LOOKUP_NAME_BUILTIN) && --- -2.28.0 - From 1d12bc92cba4838dea6cb2d47d7be9c19e1c9eb3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Apr 2021 20:34:27 +0200 Subject: [PATCH 26/26] Do not try to apply non-existing patch. Guenther --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index fcc6b19..7ea2912 100644 --- a/samba.spec +++ b/samba.spec @@ -130,7 +130,6 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch -Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd