From 8954603ac9205145b6f988779f4538eb8b46b2a8 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 19:05:57 +0200 Subject: [PATCH 01/30] Add preliminary S4U support resolves: #1836630 - Samba DC: Remote Desktop cannot access files (cherry picked from commit a1725106468cb513a1d9d85e5d0ca8d6db98ba67) --- samba-s4u.patch | 726 ++++++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 7 +- 2 files changed, 732 insertions(+), 1 deletion(-) create mode 100644 samba-s4u.patch diff --git a/samba-s4u.patch b/samba-s4u.patch new file mode 100644 index 0000000..83ed873 --- /dev/null +++ b/samba-s4u.patch @@ -0,0 +1,726 @@ +From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Fri, 27 Sep 2019 18:25:03 +0300 +Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support + +Signed-off-by: Isaac Boukris +Pair-Programmed-With: Andreas Schneider +--- + source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++--------- + source4/kdc/mit_samba.c | 47 ++---- + source4/kdc/mit_samba.h | 6 +- + wscript_configure_system_mitkrb5 | 3 + + 6 files changed, 91 insertions(+), 115 deletions(-) + +diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c +index 9197551ed61..944324d9a2f 100644 +--- a/source4/kdc/mit-kdb/kdb_samba_policies.c ++++ b/source4/kdc/mit-kdb/kdb_samba_policies.c +@@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, + krb5_keyblock *krbtgt_key, + krb5_timestamp authtime, + krb5_authdata **tgt_auth_data, +- krb5_pac *pac) ++ krb5_pac *out_pac) + { + struct mit_samba_context *mit_ctx; + krb5_authdata **authdata = NULL; +- krb5_pac ipac = NULL; +- DATA_BLOB logon_data = { NULL, 0 }; ++ krb5_keyblock *header_server_key = NULL; ++ krb5_key_data *impersonator_kd = NULL; ++ krb5_keyblock impersonator_key = {0}; + krb5_error_code code; ++ krb5_pac pac; ++ ++ *out_pac = NULL; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { +@@ -230,41 +234,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, + code = krb5_pac_parse(context, + authdata[0]->contents, + authdata[0]->length, +- &ipac); ++ &pac); + if (code != 0) { + goto done; + } + +- /* TODO: verify this is correct +- * +- * In the constrained delegation case, the PAC is from a service +- * ticket rather than a TGT; we must verify the server and KDC +- * signatures to assert that the server did not forge the PAC. ++ /* ++ * For constrained delegation in MIT version < 1.18 we aren't provided ++ * with the 2nd ticket server key to verify the PAC. ++ * We can workaround that by fetching the key from the client db entry, ++ * which is the impersonator account in that version. ++ * TODO: use the provided entry in the new 1.18 version. + */ + if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { +- code = krb5_pac_verify(context, +- ipac, +- authtime, +- client_princ, +- server_key, +- krbtgt_key); ++ /* The impersonator must be local. */ ++ if (client == NULL) { ++ code = KRB5KDC_ERR_BADOPTION; ++ goto done; ++ } ++ /* Fetch and decrypt 2nd ticket server's current key. */ ++ code = krb5_dbe_find_enctype(context, client, -1, -1, 0, ++ &impersonator_kd); ++ if (code != 0) { ++ goto done; ++ } ++ code = krb5_dbe_decrypt_key_data(context, NULL, ++ impersonator_kd, ++ &impersonator_key, NULL); ++ if (code != 0) { ++ goto done; ++ } ++ header_server_key = &impersonator_key; + } else { +- code = krb5_pac_verify(context, +- ipac, +- authtime, +- client_princ, +- krbtgt_key, +- NULL); +- } +- if (code != 0) { +- goto done; ++ header_server_key = krbtgt_key; + } + +- /* check and update PAC */ +- code = krb5_pac_parse(context, +- authdata[0]->contents, +- authdata[0]->length, +- pac); ++ code = krb5_pac_verify(context, pac, authtime, client_princ, ++ header_server_key, NULL); + if (code != 0) { + goto done; + } +@@ -272,17 +278,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, + code = mit_samba_reget_pac(mit_ctx, + context, + flags, +- client_princ, + client, + server, + krbtgt, + krbtgt_key, +- pac); ++ &pac); ++ if (code != 0) { ++ goto done; ++ } ++ ++ *out_pac = pac; ++ pac = NULL; + + done: ++ krb5_free_keyblock_contents(context, &impersonator_key); + krb5_free_authdata(context, authdata); +- krb5_pac_free(context, ipac); +- free(logon_data.data); ++ krb5_pac_free(context, pac); + + return code; + } +@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + { + #endif + krb5_authdata **authdata = NULL; +- krb5_boolean is_as_req; ++ krb5_const_principal pac_client; + krb5_error_code code; + krb5_pac pac = NULL; + krb5_data pac_data; +@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; + #endif + +- /* FIXME: We don't support S4U yet */ +- if (flags & KRB5_KDB_FLAGS_S4U) { +- return KRB5_KDB_DBTYPE_NOSUP; +- } +- +- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); +- +- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { +- code = ks_get_pac(context, client, client_key, &pac); +- if (code != 0) { +- goto done; +- } ++ /* In protocol transition, we are currently not provided with the tgt ++ * client name to verify the PAC, we could probably skip the name ++ * verification and just verify the signatures, but since we don't ++ * support cross-realm nor aliases, we can just use server->princ */ ++ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { ++ pac_client = server->princ; ++ } else { ++ pac_client = client_princ; + } + +- if (!is_as_req) { ++ /* TGS request */ ++ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) { + code = ks_verify_pac(context, + flags, +- client_princ, ++ pac_client, + client, + server, + krbtgt, +@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + if (code != 0) { + goto done; + } ++ ++ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */ ++ if (pac == NULL) { ++ code = KRB5_KDB_DBTYPE_NOSUP; ++ goto done; ++ } + } + +- if (pac == NULL && client != NULL) { ++ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { ++ krb5_pac_free(context, pac); ++ pac = NULL; ++ } + ++ /* AS request or local realm protocol transition */ ++ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) || ++ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) { + code = ks_get_pac(context, client, client_key, &pac); + if (code != 0) { + goto done; + } ++ /* We require a pac! */ ++ SMB_ASSERT(pac != NULL); + } + + if (pac == NULL) { +@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + } + + code = krb5_pac_sign(context, pac, authtime, client_princ, +- server_key, krbtgt_key, &pac_data); ++ server_key, krbtgt_key, &pac_data); + if (code != 0) { + DBG_ERR("krb5_pac_sign failed: %d\n", code); + goto done; +@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + KRB5_AUTHDATA_IF_RELEVANT, + authdata, + signed_auth_data); +- if (code != 0) { +- goto done; +- } +- +- code = 0; + + done: + krb5_pac_free(context, pac); +@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + * server; -> delegating service + * proxy; -> target principal + */ +- krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server); +- +- char *target_name = NULL; +- bool is_enterprise; +- krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + +- code = krb5_unparse_name(context, proxy, &target_name); +- if (code) { +- goto done; +- } +- +- is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL); +- +- code = mit_samba_check_s4u2proxy(mit_ctx, +- delegating_service, +- target_name, +- is_enterprise); +- +-done: +- free(target_name); +- return code; ++ return mit_samba_check_s4u2proxy(mit_ctx, server, proxy); + } + + +diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c +index 54dcd545ea1..f23327c9613 100644 +--- a/source4/kdc/mit_samba.c ++++ b/source4/kdc/mit_samba.c +@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, + krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + krb5_context context, + int flags, +- krb5_const_principal client_principal, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, +@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + context, + *pac, + server->princ, +- discard_const(client_principal), ++ client->princ, + deleg_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("Update delegation info failed: %s\n", +@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, + } + + int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, +- krb5_db_entry *kentry, +- const char *target_name, +- bool is_nt_enterprise_name) ++ const krb5_db_entry *server, ++ krb5_const_principal target_principal) + { +-#if 1 +- /* +- * This is disabled because mit_samba_update_pac_data() does not handle +- * S4U_DELEGATION_INFO +- */ +- +- return KRB5KDC_ERR_BADOPTION; +-#else +- krb5_principal target_principal; +- int flags = 0; +- int ret; +- +- if (is_nt_enterprise_name) { +- flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE; +- } +- +- ret = krb5_parse_name_flags(ctx->context, target_name, +- flags, &target_principal); +- if (ret) { +- return ret; +- } +- +- ret = samba_kdc_check_s4u2proxy(ctx->context, +- ctx->db_ctx, +- skdc_entry, +- target_principal); +- +- krb5_free_principal(ctx->context, target_principal); +- +- return ret; +-#endif ++ struct samba_kdc_entry *server_skdc_entry = ++ talloc_get_type_abort(server->e_data, ++ struct samba_kdc_entry); ++ ++ return samba_kdc_check_s4u2proxy(ctx->context, ++ ctx->db_ctx, ++ server_skdc_entry, ++ target_principal); + } + + static krb5_error_code mit_samba_change_pwd_error(krb5_context context, +diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h +index ba824557bd5..5aadf206443 100644 +--- a/source4/kdc/mit_samba.h ++++ b/source4/kdc/mit_samba.h +@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, + krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + krb5_context context, + int flags, +- krb5_const_principal client_principal, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, +@@ -73,9 +72,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, + DATA_BLOB *e_data); + + int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, +- krb5_db_entry *kentry, +- const char *target_name, +- bool is_nt_enterprise_name); ++ const krb5_db_entry *server, ++ krb5_const_principal target_principal); + + int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, + char *pwd, +-- +2.25.4 + +From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Fri, 27 Sep 2019 18:35:30 +0300 +Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build + +Signed-off-by: Isaac Boukris +Pair-Programmed-With: Andreas Schneider +--- + lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ + lib/krb5_wrap/krb5_samba.h | 2 - + source4/auth/kerberos/kerberos_util.c | 11 -- + 4 files changed, 185 insertions(+), 14 deletions(-) + +diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c +index 20ce86c708d..e72ab3c30f7 100644 +--- a/lib/krb5_wrap/krb5_samba.c ++++ b/lib/krb5_wrap/krb5_samba.c +@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + + return 0; + } ++ ++#else /* MIT */ ++ ++static bool princ_compare_no_dollar(krb5_context ctx, ++ krb5_principal a, ++ krb5_principal b) ++{ ++ bool cmp; ++ krb5_principal mod = NULL; ++ ++ if (a->length == 1 && b->length == 1 && ++ a->data[0].length != 0 && b->data[0].length != 0 && ++ a->data[0].data[a->data[0].length -1] != ++ b->data[0].data[b->data[0].length -1]) { ++ if (a->data[0].data[a->data[0].length -1] == '$') { ++ mod = a; ++ mod->data[0].length--; ++ } else if (b->data[0].data[b->data[0].length -1] == '$') { ++ mod = b; ++ mod->data[0].length--; ++ } ++ } ++ ++ cmp = krb5_principal_compare_flags(ctx, a, b, ++ KRB5_PRINCIPAL_COMPARE_CASEFOLD); ++ ++ if (mod != NULL) { ++ mod->data[0].length++; ++ } ++ ++ return cmp; ++} ++ ++krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, ++ krb5_ccache store_cc, ++ krb5_principal init_principal, ++ const char *init_password, ++ krb5_principal impersonate_principal, ++ const char *self_service, ++ const char *target_service, ++ krb5_get_init_creds_opt *krb_options, ++ time_t *expire_time, ++ time_t *kdc_time) ++{ ++ krb5_error_code code; ++ krb5_principal self_princ = NULL; ++ krb5_principal target_princ = NULL; ++ krb5_creds *store_creds; ++ krb5_creds *s4u2self_creds = NULL; ++ krb5_creds *s4u2proxy_creds = NULL; ++ krb5_creds init_creds = {0}; ++ krb5_creds mcreds = {0}; ++ krb5_flags options = KRB5_GC_NO_STORE; ++ krb5_ccache tmp_cc; ++ bool s4u2proxy; ++ ++ code = krb5_cc_new_unique(ctx, "MEMORY", NULL, &tmp_cc); ++ if (code != 0) { ++ return code; ++ } ++ ++ code = krb5_get_init_creds_password(ctx, &init_creds, ++ init_principal, ++ init_password, ++ NULL, NULL, ++ 0, ++ NULL, ++ krb_options); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_initialize(ctx, tmp_cc, init_creds.client); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_store_cred(ctx, tmp_cc, &init_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* ++ * Check if we also need S4U2Proxy or if S4U2Self is ++ * enough in order to get a ticket for the target. ++ */ ++ if (target_service == NULL) { ++ s4u2proxy = false; ++ } else if (strcmp(target_service, self_service) == 0) { ++ s4u2proxy = false; ++ } else { ++ s4u2proxy = true; ++ } ++ ++ code = krb5_parse_name(ctx, self_service, &self_princ); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* MIT lacks aliases support in S4U, for S4U2Self we require the tgt ++ * client and the request server to be the same principal name. */ ++ if (!princ_compare_no_dollar(ctx, init_creds.client, self_princ)) { ++ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; ++ goto done; ++ } ++ ++ mcreds.client = impersonate_principal; ++ mcreds.server = init_creds.client; ++ ++ code = krb5_get_credentials_for_user(ctx, options, tmp_cc, &mcreds, ++ NULL, &s4u2self_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ if (s4u2proxy) { ++ code = krb5_parse_name(ctx, target_service, &target_princ); ++ if (code != 0) { ++ goto done; ++ } ++ ++ mcreds.client = init_creds.client; ++ mcreds.server = target_princ; ++ mcreds.second_ticket = s4u2self_creds->ticket; ++ ++ code = krb5_get_credentials(ctx, options | ++ KRB5_GC_CONSTRAINED_DELEGATION, ++ tmp_cc, &mcreds, &s4u2proxy_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* Check KDC support of S4U2Proxy extension */ ++ if (!krb5_principal_compare(ctx, s4u2self_creds->client, ++ s4u2proxy_creds->client)) { ++ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; ++ goto done; ++ } ++ ++ store_creds = s4u2proxy_creds; ++ } else { ++ store_creds = s4u2self_creds;; ++ ++ /* We need to save the ticket with the requested server name ++ * or the caller won't be able to find it in cache. */ ++ if (!krb5_principal_compare(ctx, self_princ, ++ store_creds->server)) { ++ krb5_free_principal(ctx, store_creds->server); ++ store_creds->server = NULL; ++ code = krb5_copy_principal(ctx, self_princ, ++ &store_creds->server); ++ if (code != 0) { ++ goto done; ++ } ++ } ++ } ++ ++ code = krb5_cc_initialize(ctx, store_cc, store_creds->client); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_store_cred(ctx, store_cc, store_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ if (expire_time) { ++ *expire_time = (time_t) store_creds->times.endtime; ++ } ++ ++ if (kdc_time) { ++ *kdc_time = (time_t) store_creds->times.starttime; ++ } ++ ++done: ++ krb5_cc_destroy(ctx, tmp_cc); ++ krb5_free_cred_contents(ctx, &init_creds); ++ krb5_free_creds(ctx, s4u2self_creds); ++ krb5_free_creds(ctx, s4u2proxy_creds); ++ krb5_free_principal(ctx, self_princ); ++ krb5_free_principal(ctx, target_princ); ++ ++ return code; ++} + #endif + + #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) +diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h +index ca9a893e4f7..3264ce5eb3b 100644 +--- a/lib/krb5_wrap/krb5_samba.h ++++ b/lib/krb5_wrap/krb5_samba.h +@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, + krb5_get_init_creds_opt *krb_options, + time_t *expire_time, + time_t *kdc_time); +-#ifdef SAMBA4_USES_HEIMDAL + krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + krb5_ccache store_cc, + krb5_principal init_principal, +@@ -263,7 +262,6 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + krb5_get_init_creds_opt *krb_options, + time_t *expire_time, + time_t *kdc_time); +-#endif + + #if defined(HAVE_KRB5_MAKE_PRINCIPAL) + #define smb_krb5_make_principal krb5_make_principal +diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c +index 544d9d853cc..c14d8c72d8c 100644 +--- a/source4/auth/kerberos/kerberos_util.c ++++ b/source4/auth/kerberos/kerberos_util.c +@@ -234,9 +234,7 @@ done: + { + krb5_error_code ret; + const char *password; +-#ifdef SAMBA4_USES_HEIMDAL + const char *self_service; +-#endif + const char *target_service; + time_t kdc_time = 0; + krb5_principal princ; +@@ -268,9 +266,7 @@ done: + return ret; + } + +-#ifdef SAMBA4_USES_HEIMDAL + self_service = cli_credentials_get_self_service(credentials); +-#endif + target_service = cli_credentials_get_target_service(credentials); + + password = cli_credentials_get_password(credentials); +@@ -331,7 +327,6 @@ done: + #endif + if (password) { + if (impersonate_principal) { +-#ifdef SAMBA4_USES_HEIMDAL + ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context, + ccache, + princ, +@@ -342,12 +337,6 @@ done: + krb_options, + NULL, + &kdc_time); +-#else +- talloc_free(mem_ctx); +- (*error_string) = "INTERNAL error: s4u2 ops " +- "are not supported with MIT build yet"; +- return EINVAL; +-#endif + } else { + ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, + ccache, +-- +2.25.4 + + + +From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Sat, 19 Sep 2020 14:16:20 +0200 +Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code + +--- + source4/heimdal/lib/hdb/hdb.h | 1 + + source4/kdc/db-glue.c | 8 ++++++-- + source4/kdc/mit_samba.c | 3 +++ + source4/kdc/sdb.h | 1 + + 4 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h +index 6a09ecb6fe1..bc5211fef35 100644 +--- a/source4/heimdal/lib/hdb/hdb.h ++++ b/source4/heimdal/lib/hdb/hdb.h +@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; + #define HDB_F_ALL_KVNOS 2048 /* we want all the keys, live or not */ + #define HDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ + #define HDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ ++#define HDB_F_FORCE_CANON 16384 /* force canonicalition */ + + /* hdb_capability_flags */ + #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 +diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c +index a560a1cd84b..c27b6a8ef4c 100644 +--- a/source4/kdc/db-glue.c ++++ b/source4/kdc/db-glue.c +@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, + } + } + +- } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { ++ } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { // was this supposed to be || ? + ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); + if (ret) { + krb5_clear_error_message(context); + goto out; + } +- } else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) { ++ } else if (((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) || (flags & SDB_F_FORCE_CANON)){ + /* + * SDB_F_CANON maps from the canonicalize flag in the + * packet, and has a different meaning between AS-REQ + * and TGS-REQ. We only change the principal in the AS-REQ case ++ * ++ * The SDB_F_FORCE_CANON if for the new MIT kdc code that wants ++ * the canonical name in all lookups, and takes care to canonicalize ++ * only when appropriate. + */ + ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); + if (ret) { +diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c +index f23327c9613..4084e893cc2 100644 +--- a/source4/kdc/mit_samba.c ++++ b/source4/kdc/mit_samba.c +@@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, + if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { + sflags |= SDB_F_CANON; + } ++#if KRB5_KDB_API_VERSION >= 10 ++ sflags |= SDB_F_FORCE_CANON; ++#endif + if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY | + KRB5_KDB_FLAG_INCLUDE_PAC)) { + /* +diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h +index c929acccce6..a9115ec23d7 100644 +--- a/source4/kdc/sdb.h ++++ b/source4/kdc/sdb.h +@@ -116,6 +116,7 @@ struct sdb_entry_ex { + #define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */ + #define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ + #define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ ++#define SDB_F_FORCE_CANON 16384 /* force canonicalition */ + + void sdb_free_entry(struct sdb_entry_ex *e); + void free_sdb_entry(struct sdb_entry *s); +-- +2.25.4 + diff --git a/samba.spec b/samba.spec index 7948d6b..dac3754 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 11 +%define main_release 12 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -130,6 +130,7 @@ Source13: pam_winbind.conf Source14: samba.pamd Source201: README.downgrade +Patch1: samba-s4u.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3619,6 +3620,10 @@ fi %endif %changelog +* Thu Oct 22 2020 Alexander Bokovoy - 4.13.0-12 +- Add preliminary support for S4U operations in Samba AD DC + resolves: #1836630 - Samba DC: Remote Desktop cannot access files + * Tue Sep 22 2020 Guenther Deschner - 4.13.0-11 - Update to Samba 4.13.0 From 3037ed05f4c5a5a880e0cc43e9da6137866af344 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 22 Oct 2020 10:12:06 +0300 Subject: [PATCH 02/30] Fix lookup_unix_user_name to support realm-qualified lookups Fixes lookups from Windows clients when using Global Catalog searches. Required for upcoming FreeIPA Global Catalog support. (cherry picked from commit 1e29c417eb5e3dbfad31e7e7ff121367d4397a3d) --- ...user_name-allow-lookup-for-own-realm.patch | 210 ++++++++++++++++++ samba.spec | 3 + 2 files changed, 213 insertions(+) create mode 100644 samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch diff --git a/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch b/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch new file mode 100644 index 0000000..e0ed8ae --- /dev/null +++ b/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch @@ -0,0 +1,210 @@ +From 81d6949acdad70ecfb130d3286eeab1b3a51937f Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 7 Oct 2020 19:25:24 +0300 +Subject: [PATCH 1/2] cli_credentials_parse_string: fix parsing of principals + +When parsing a principal-like name, user name was left with full +principal instead of taking only the left part before '@' sign. + +>>> from samba import credentials +>>> t = credentials.Credentials() +>>> t.parse_string('admin@realm.test', credentials.SPECIFIED) +>>> t.get_username() +'admin@realm.test' + +The issue is that cli_credentials_set_username() does a talloc_strdup() +of the argument, so we need to change order of assignment to allow +talloc_strdup() to copy the right part of the string. + +Signed-off-by: Alexander Bokovoy +--- + auth/credentials/credentials.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 77c35dd104b..06ac79058f9 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -840,11 +840,10 @@ _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials, + * in order to undo the effect of + * cli_credentials_guess(). + */ +- cli_credentials_set_username(credentials, uname, obtained); +- cli_credentials_set_domain(credentials, "", obtained); +- + cli_credentials_set_principal(credentials, uname, obtained); + *p = 0; ++ cli_credentials_set_username(credentials, uname, obtained); ++ cli_credentials_set_domain(credentials, "", obtained); + cli_credentials_set_realm(credentials, p+1, obtained); + return; + } else if ((p = strchr_m(uname,'\\')) +-- +2.28.0 + + +From fa38bebb993011428612d51819530218d8358f5e Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Mon, 13 Jan 2020 16:04:20 +0200 +Subject: [PATCH 2/2] lookup_name: allow lookup for own realm + +When using security tab in Windows Explorer, a lookup over a trusted +forest might come as realm\name instead of NetBIOS domain name: + +-------------------------------------------------------------------- +[2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) + lsa_LookupNames3: struct lsa_LookupNames3 + in: struct lsa_LookupNames3 + handle : * + handle: struct policy_handle + handle_type : 0x00000000 (0) + uuid : 0000000e-0000-0000-1c5e-a750e5810000 + num_names : 0x00000001 (1) + names: ARRAY(1) + names: struct lsa_String + length : 0x001e (30) + size : 0x0020 (32) + string : * + string : 'ipa.test\admins' + sids : * + sids: struct lsa_TransSidArray3 + count : 0x00000000 (0) + sids : NULL + level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) + count : * + count : 0x00000000 (0) + lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) + client_revision : LSA_CLIENT_REVISION_2 (2) +-------------------------------------------------------------------- + +Allow this lookup using realm to be done against primary domain. + +Refactor user name parsing code to reuse cli_credentials_* API to be +consistent with other places. cli_credentials_parse_string() handles +both domain and realm-based user name variants. + +Signed-off-by: Alexander Bokovoy +--- + source3/passdb/lookup_sid.c | 75 ++++++++++++++++++++++++++----------- + 1 file changed, 53 insertions(+), 22 deletions(-) + +diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c +index 82c47b3145b..39d599fed27 100644 +--- a/source3/passdb/lookup_sid.c ++++ b/source3/passdb/lookup_sid.c +@@ -29,6 +29,7 @@ + #include "../libcli/security/security.h" + #include "lib/winbind_util.h" + #include "../librpc/gen_ndr/idmap.h" ++#include "auth/credentials/credentials.h" + + static bool lookup_unix_user_name(const char *name, struct dom_sid *sid) + { +@@ -78,52 +79,82 @@ bool lookup_name(TALLOC_CTX *mem_ctx, + const char **ret_domain, const char **ret_name, + struct dom_sid *ret_sid, enum lsa_SidType *ret_type) + { +- char *p; + const char *tmp; + const char *domain = NULL; + const char *name = NULL; ++ const char *realm = NULL; + uint32_t rid; + struct dom_sid sid; + enum lsa_SidType type; + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); ++ struct cli_credentials *creds = NULL; + + if (tmp_ctx == NULL) { + DEBUG(0, ("talloc_new failed\n")); + return false; + } + +- p = strchr_m(full_name, '\\'); +- +- if (p != NULL) { +- domain = talloc_strndup(tmp_ctx, full_name, +- PTR_DIFF(p, full_name)); +- name = talloc_strdup(tmp_ctx, p+1); +- } else { +- domain = talloc_strdup(tmp_ctx, ""); +- name = talloc_strdup(tmp_ctx, full_name); ++ creds = cli_credentials_init(tmp_ctx); ++ if (creds == NULL) { ++ DEBUG(0, ("cli_credentials_init failed\n")); ++ return false; + } + +- if ((domain == NULL) || (name == NULL)) { +- DEBUG(0, ("talloc failed\n")); +- TALLOC_FREE(tmp_ctx); ++ cli_credentials_parse_string(creds, full_name, CRED_SPECIFIED); ++ name = cli_credentials_get_username(creds); ++ domain = cli_credentials_get_domain(creds); ++ realm = cli_credentials_get_realm(creds); ++ ++ /* At this point we have: ++ * - name -- normal name or empty string ++ * - domain -- either NULL or domain name ++ * - realm -- either NULL or realm name ++ * ++ * domain and realm are exclusive to each other ++ * the code below in lookup_name assumes domain ++ * to be at least empty string, not NULL ++ */ ++ ++ if ((name == NULL) || (name[0] == '\0')) { ++ DEBUG(0, ("lookup_name with empty name, exit\n")); + return false; + } + ++ if ((domain == NULL) && (realm == NULL)) { ++ domain = talloc_strdup(creds, ""); ++ } ++ + DEBUG(10,("lookup_name: %s => domain=[%s], name=[%s]\n", + full_name, domain, name)); + DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); + +- if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && +- strequal(domain, get_global_sam_name())) +- { ++ /* Windows clients may send a LookupNames request with both NetBIOS ++ * domain name- and realm-qualified user names. Thus, we need to check ++ * both against both of the SAM domain name and realm, if set. Since ++ * domain name and realm in the request are exclusive, test the one ++ * that is specified. cli_credentials_parse_string() will either set ++ * realm or wouldn't so we can use it to detect if realm was specified. ++ */ ++ if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) { ++ const char *domain_name = realm ? realm : domain; ++ bool check_global_sam = false; ++ ++ if (domain_name[0] != '\0') { ++ check_global_sam = strequal(domain_name, get_global_sam_name()); ++ if (!check_global_sam && lp_realm() != NULL) { ++ check_global_sam = strequal(domain_name, lp_realm()); ++ } ++ } + +- /* It's our own domain, lookup the name in passdb */ +- if (lookup_global_sam_name(name, flags, &rid, &type)) { +- sid_compose(&sid, get_global_sam_sid(), rid); +- goto ok; ++ if (check_global_sam) { ++ /* It's our own domain, lookup the name in passdb */ ++ if (lookup_global_sam_name(name, flags, &rid, &type)) { ++ sid_compose(&sid, get_global_sam_sid(), rid); ++ goto ok; ++ } ++ TALLOC_FREE(tmp_ctx); ++ return false; + } +- TALLOC_FREE(tmp_ctx); +- return false; + } + + if ((flags & LOOKUP_NAME_BUILTIN) && +-- +2.28.0 + diff --git a/samba.spec b/samba.spec index dac3754..16edcd2 100644 --- a/samba.spec +++ b/samba.spec @@ -131,6 +131,7 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch +Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3623,6 +3624,8 @@ fi * Thu Oct 22 2020 Alexander Bokovoy - 4.13.0-12 - Add preliminary support for S4U operations in Samba AD DC resolves: #1836630 - Samba DC: Remote Desktop cannot access files +- Fix lookup_unix_user_name to allow lookup of realm-qualified users and groups + required for upcoming FreeIPA Global Catalog support * Tue Sep 22 2020 Guenther Deschner - 4.13.0-11 - Update to Samba 4.13.0 From 54b7288a2201509d47754f9098358042b49a7e2e Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 25 Oct 2020 09:54:45 +0200 Subject: [PATCH 03/30] Fix Samba AD DC operations on F33 or later - Report 'samba' daemon status back to systemd - Support dnspython 2.0.0 or later in samba_dnsupdate --- samba-dnspython-2.0.0-v4.13.patch | 143 ++++++++++++++++++++++++++++++ samba-systemd-notification.patch | 118 ++++++++++++++++++++++++ samba.spec | 10 ++- 3 files changed, 270 insertions(+), 1 deletion(-) create mode 100644 samba-dnspython-2.0.0-v4.13.patch create mode 100644 samba-systemd-notification.patch diff --git a/samba-dnspython-2.0.0-v4.13.patch b/samba-dnspython-2.0.0-v4.13.patch new file mode 100644 index 0000000..88aead2 --- /dev/null +++ b/samba-dnspython-2.0.0-v4.13.patch @@ -0,0 +1,143 @@ +From 12b51be8633689763080f2eb1e0b13487e3e71e1 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Sat, 24 Oct 2020 12:17:44 +0300 +Subject: [PATCH] DNS Resolver: support both dnspython before and after 2.0.0 + +`dnspython` 2.0.0 has many changes and several deprecations like: + +``` +> dns.resolver.resolve() has been added, allowing control of whether +search lists are used. dns.resolver.query() is retained for backwards +compatibility, but deprecated. The default for search list behavior can +be set at in the resolver object with the use_search_by_default +parameter. The default is False. + +> dns.resolver.resolve_address() has been added, allowing easy +address-to-name lookups. +``` + +The new class `DNSResolver`: +- provides the compatibility layer +- defaults the previous behavior (the search list configured in the + system's resolver configuration is used for relative names) +- defaults lifetime to 15sec (determines the number of seconds + to spend trying to get an answer to the question) + +The compatibility shim was developed by Stanislav Levin for FreeIPA and +adopted for Samba by Alexander Bokovoy. + +Signed-off-by: Stanislav Levin +Signed-off-by: Alexander Bokovoy +--- + python/samba/dnsresolver.py | 68 +++++++++++++++++++++++++++ + source4/scripting/bin/samba_dnsupdate | 5 +- + 2 files changed, 71 insertions(+), 2 deletions(-) + create mode 100644 python/samba/dnsresolver.py + +diff --git a/python/samba/dnsresolver.py b/python/samba/dnsresolver.py +new file mode 100644 +index 00000000000..a627555a855 +--- /dev/null ++++ b/python/samba/dnsresolver.py +@@ -0,0 +1,68 @@ ++# Samba wrapper for DNS resolvers ++# ++# Copyright (C) Stanislav Levin ++# Copyright (C) Alexander Bokovoy ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++import dns.resolver ++import dns.rdatatype ++import dns.reversename ++ ++class DNSResolver(dns.resolver.Resolver): ++ """DNS stub resolver compatible with both dnspython < 2.0.0 ++ and dnspython >= 2.0.0. ++ ++ Set `use_search_by_default` attribute to `True`, which ++ determines the default for whether the search list configured ++ in the system's resolver configuration is used for relative ++ names, and whether the resolver's domain may be added to relative ++ names. ++ ++ Increase the default lifetime which determines the number of seconds ++ to spend trying to get an answer to the question. dnspython 2.0.0 ++ changes this to 5sec, while the previous one was 30sec. ++ """ ++ def __init__(self, *args, **kwargs): ++ super().__init__(*args, **kwargs) ++ self.reset_defaults() ++ self.resolve = getattr(super(), "resolve", self.query) ++ self.resolve_address = getattr( ++ super(), ++ "resolve_address", ++ self._resolve_address ++ ) ++ ++ def reset_defaults(self): ++ self.use_search_by_default = True ++ # the default is 5sec ++ self.lifetime = 15 ++ ++ def reset(self): ++ super().reset() ++ self.reset_defaults() ++ ++ def _resolve_address(self, ip_address, *args, **kwargs): ++ """Query nameservers for PTR records. ++ ++ :param ip_address: IPv4 or IPv6 address ++ :type ip_address: str ++ """ ++ return self.resolve( ++ dns.reversename.from_address(ip_address), ++ rdtype=dns.rdatatype.PTR, ++ *args, ++ **kwargs, ++ ) +diff --git a/source4/scripting/bin/samba_dnsupdate b/source4/scripting/bin/samba_dnsupdate +index 44eb1cadd27..fe04ce71338 100755 +--- a/source4/scripting/bin/samba_dnsupdate ++++ b/source4/scripting/bin/samba_dnsupdate +@@ -53,6 +53,7 @@ from samba.compat import get_string + from samba.compat import text_type + import ldb + ++from samba.dnsresolver import DNSResolver + import dns.resolver + import dns.exception + +@@ -259,7 +260,7 @@ def hostname_match(h1, h2): + + def get_resolver(d=None): + resolv_conf = os.getenv('RESOLV_CONF', default='/etc/resolv.conf') +- resolver = dns.resolver.Resolver(filename=resolv_conf, configure=True) ++ resolver = DNSResolver(filename=resolv_conf, configure=True) + + if d is not None and d.nameservers != []: + resolver.nameservers = d.nameservers +@@ -271,7 +272,7 @@ def check_one_dns_name(name, name_type, d=None): + if d and not d.nameservers: + d.nameservers = resolver.nameservers + # dns.resolver.Answer +- return resolver.query(name, name_type) ++ return resolver.resolve(name, name_type) + + def check_dns_name(d): + """check that a DNS entry exists.""" +-- +2.28.0 + diff --git a/samba-systemd-notification.patch b/samba-systemd-notification.patch new file mode 100644 index 0000000..1011460 --- /dev/null +++ b/samba-systemd-notification.patch @@ -0,0 +1,118 @@ +From 9dd1a4809b1b6d65bfb2258b443b0fe36e0a32f7 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Sat, 24 Oct 2020 16:52:43 +0300 +Subject: [PATCH] daemons: report status to systemd even when running in + foreground + +When systemd launches samba services, the configuration we have in +systemd service files expects that the main process (/usr/sbin/*) +would use sd_notify() to report back its status. However, we only use +sd_notify() when running become_daemon(). + +As a result, samba/smbd/winbindd/nmbd processes never report back its +status and the status updates from other childs (smbd, winbindd, etc) +are not accepted as we now have implied NotifyAccess=main since commit +d1740fb3d5a72cb49e30b330bb0b01e7ef3e09cc + +This leads to a timeout and killing samba process by systemd. Situation +is reproducible in Fedora 33, for example. + +Make sure that we have required status updates for all daemons in case +we aren't runnning in interactive mode. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14552 + +Signed-off-by: Alexander Bokovoy +--- + source3/nmbd/nmbd.c | 4 +++- + source3/smbd/server.c | 4 +++- + source3/winbindd/winbindd.c | 5 ++++- + source4/smbd/server.c | 4 +++- + 4 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c +index 0b881d13f7b..f6aeba1f714 100644 +--- a/source3/nmbd/nmbd.c ++++ b/source3/nmbd/nmbd.c +@@ -1009,6 +1009,8 @@ static bool open_sockets(bool isdaemon, int port) + if (is_daemon && !opt_interactive) { + DEBUG(3, ("Becoming a daemon.\n")); + become_daemon(Fork, no_process_group, log_stdout); ++ } else if (!opt_interactive) { ++ daemon_status("nmbd", "Starting process..."); + } + + #ifdef HAVE_SETPGID +@@ -1135,7 +1137,7 @@ static bool open_sockets(bool isdaemon, int port) + exit_daemon( "NMBD failed to setup packet server.", EACCES); + } + +- if (is_daemon && !opt_interactive) { ++ if (!opt_interactive) { + daemon_ready("nmbd"); + } + +diff --git a/source3/smbd/server.c b/source3/smbd/server.c +index 153dd3c9323..3d9db5d8407 100644 +--- a/source3/smbd/server.c ++++ b/source3/smbd/server.c +@@ -1893,6 +1893,8 @@ extern void build_options(bool screen); + if (is_daemon && !interactive) { + DEBUG(3, ("Becoming a daemon.\n")); + become_daemon(Fork, no_process_group, log_stdout); ++ } else { ++ daemon_status("smbd", "Starting process ..."); + } + + #ifdef HAVE_SETPGID +@@ -2100,7 +2102,7 @@ extern void build_options(bool screen); + exit_daemon("Samba cannot setup ep pipe", EACCES); + } + +- if (is_daemon && !interactive) { ++ if (!interactive) { + daemon_ready("smbd"); + } + +diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c +index 4397a1bc0d1..1e08237905a 100644 +--- a/source3/winbindd/winbindd.c ++++ b/source3/winbindd/winbindd.c +@@ -1880,8 +1880,11 @@ int main(int argc, const char **argv) + BlockSignals(False, SIGHUP); + BlockSignals(False, SIGCHLD); + +- if (!interactive) ++ if (!interactive) { + become_daemon(Fork, no_process_group, log_stdout); ++ } else { ++ daemon_status("winbindd", "Starting process ..."); ++ } + + pidfile_create(lp_pid_directory(), "winbindd"); + +diff --git a/source4/smbd/server.c b/source4/smbd/server.c +index 95acb99b86c..ee2e7508bb3 100644 +--- a/source4/smbd/server.c ++++ b/source4/smbd/server.c +@@ -648,6 +648,8 @@ static int binary_smbd_main(const char *binary_name, + if (opt_daemon) { + DBG_NOTICE("Becoming a daemon.\n"); + become_daemon(opt_fork, opt_no_process_group, false); ++ } else if (!opt_interactive) { ++ daemon_status("samba", "Starting process..."); + } + + /* Create the memory context to hang everything off. */ +@@ -931,7 +933,7 @@ static int binary_smbd_main(const char *binary_name, + } + } + +- if (opt_daemon) { ++ if (!opt_interactive) { + daemon_ready("samba"); + } + +-- +2.28.0 + diff --git a/samba.spec b/samba.spec index 16edcd2..2a8bab3 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 12 +%define main_release 13 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -132,6 +132,8 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch +Patch3: samba-dnspython-2.0.0-v4.13.patch +Patch4: samba-systemd-notification.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -1984,6 +1986,7 @@ fi %{python3_sitearch}/samba/__pycache__/compat.*.pyc %{python3_sitearch}/samba/__pycache__/dbchecker.*.pyc %{python3_sitearch}/samba/__pycache__/descriptor.*.pyc +%{python3_sitearch}/samba/__pycache__/dnsresolver.*.pyc %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc %{python3_sitearch}/samba/__pycache__/gpclass.*.pyc @@ -2061,6 +2064,7 @@ fi %{python3_sitearch}/samba/dcerpc/wkssvc.*.so %{python3_sitearch}/samba/dcerpc/xattr.*.so %{python3_sitearch}/samba/descriptor.py +%{python3_sitearch}/samba/dnsresolver.py %{python3_sitearch}/samba/drs_utils.py %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py @@ -3621,6 +3625,10 @@ fi %endif %changelog +* Sun Oct 25 2020 Alexander Bokovoy - 4.13.0-13 +- Report 'samba' daemon status back to systemd +- Support dnspython 2.0.0 or later in samba_dnsupdate + * Thu Oct 22 2020 Alexander Bokovoy - 4.13.0-12 - Add preliminary support for S4U operations in Samba AD DC resolves: #1836630 - Samba DC: Remote Desktop cannot access files From 72564d3e4e1f7abe00450049645d33cbcd2de0b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Oct 2020 10:11:56 +0100 Subject: [PATCH 04/30] Update to Samba 4.13.1 resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 Guenther --- .gitignore | 2 ++ samba.spec | 10 ++++++++-- sources | 4 ++-- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 78dd1f3..474af1a 100644 --- a/.gitignore +++ b/.gitignore @@ -223,3 +223,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.0rc6.tar.asc /samba-4.13.0.tar.xz /samba-4.13.0.tar.asc +/samba-4.13.1.tar.xz +/samba-4.13.1.tar.asc diff --git a/samba.spec b/samba.spec index 2a8bab3..ea82fce 100644 --- a/samba.spec +++ b/samba.spec @@ -8,9 +8,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 13 +%define main_release 0 -%define samba_version 4.13.0 +%define samba_version 4.13.1 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3625,6 +3625,12 @@ fi %endif %changelog +* Thu Oct 29 2020 Guenther Deschner - 4.13.1-0 +- Update to Samba 4.13.1 +- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 +- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 +- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 + * Sun Oct 25 2020 Alexander Bokovoy - 4.13.0-13 - Report 'samba' daemon status back to systemd - Support dnspython 2.0.0 or later in samba_dnsupdate diff --git a/sources b/sources index 36e8498..3dda01b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.0.tar.xz) = 38370adfad7b7a9a8633d48782f0bcf812299858be20770d2e3406c7f450a2fd1ae646e2a143d22ce3c5ac22d54c4a229b019686ff2f16ca503c958d4afed825 -SHA512 (samba-4.13.0.tar.asc) = 7f71d1402d752cbdb09ec9e2539d35347c4025c332c4acb8590d5cab190b2b23bc2b1f99f3d66c3488bbdb6898528dd78e3893c33c92e3d9167236e8048dfbf2 +SHA512 (samba-4.13.1.tar.xz) = 251664d53eb4a53509a3032d3519b11ddd07231887ec7a1965d20bae92bb03e0dc63898aef0bb7565de66c77e9cbc34fcf42a078190c97425c3662c5da4d5480 +SHA512 (samba-4.13.1.tar.asc) = 1ead1ae10f4d25a1f43842e31eb24ecfa1e0076b48a8b7c57d9286f7162d4b0c12cf29de6526447f16c60e04cb5f07105bdc0b48a51d72e63cc8cc9fe7782b01 From 9fb579caaa3ffa39b58a20d5164bd8f00c30f62e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Nov 2020 11:11:51 +0100 Subject: [PATCH 05/30] Update to Samba 4.13.2 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 474af1a..6578c2a 100644 --- a/.gitignore +++ b/.gitignore @@ -225,3 +225,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.0.tar.asc /samba-4.13.1.tar.xz /samba-4.13.1.tar.asc +/samba-4.13.2.tar.xz +/samba-4.13.2.tar.asc diff --git a/samba.spec b/samba.spec index ea82fce..1ef00b6 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.13.1 +%define samba_version 4.13.2 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3625,6 +3625,9 @@ fi %endif %changelog +* Tue Nov 03 2020 Guenther Deschner - 4.13.2-0 +- Update to Samba 4.13.2 + * Thu Oct 29 2020 Guenther Deschner - 4.13.1-0 - Update to Samba 4.13.1 - resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 diff --git a/sources b/sources index 3dda01b..b1e4a0b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.1.tar.xz) = 251664d53eb4a53509a3032d3519b11ddd07231887ec7a1965d20bae92bb03e0dc63898aef0bb7565de66c77e9cbc34fcf42a078190c97425c3662c5da4d5480 -SHA512 (samba-4.13.1.tar.asc) = 1ead1ae10f4d25a1f43842e31eb24ecfa1e0076b48a8b7c57d9286f7162d4b0c12cf29de6526447f16c60e04cb5f07105bdc0b48a51d72e63cc8cc9fe7782b01 +SHA512 (samba-4.13.2.tar.xz) = c5d1c4b74b458ab6da9314540043edb8129a17870a9a335fb26bbdaf194aeae647aa3d6cdc00fd4487fd459c123cc8feecb58d02633515c62f00287b652a502b +SHA512 (samba-4.13.2.tar.asc) = 07cce2f4f5130c56548ea14193b3d829dac7926141da56f7e1624fd48f73afcd875af6eaae0ce56396d5b23837b3bc7e3518f569d581afd6c5ee1dc7d49a8eb7 From 7935db43f9fb282d52c9e9515b88096b1a34b6ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Nov 2020 13:49:44 +0100 Subject: [PATCH 06/30] Remove obsolete patches Guenther --- samba-dnspython-2.0.0-v4.13.patch | 143 ------------------------------ samba-systemd-notification.patch | 118 ------------------------ samba.spec | 2 - 3 files changed, 263 deletions(-) delete mode 100644 samba-dnspython-2.0.0-v4.13.patch delete mode 100644 samba-systemd-notification.patch diff --git a/samba-dnspython-2.0.0-v4.13.patch b/samba-dnspython-2.0.0-v4.13.patch deleted file mode 100644 index 88aead2..0000000 --- a/samba-dnspython-2.0.0-v4.13.patch +++ /dev/null @@ -1,143 +0,0 @@ -From 12b51be8633689763080f2eb1e0b13487e3e71e1 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Sat, 24 Oct 2020 12:17:44 +0300 -Subject: [PATCH] DNS Resolver: support both dnspython before and after 2.0.0 - -`dnspython` 2.0.0 has many changes and several deprecations like: - -``` -> dns.resolver.resolve() has been added, allowing control of whether -search lists are used. dns.resolver.query() is retained for backwards -compatibility, but deprecated. The default for search list behavior can -be set at in the resolver object with the use_search_by_default -parameter. The default is False. - -> dns.resolver.resolve_address() has been added, allowing easy -address-to-name lookups. -``` - -The new class `DNSResolver`: -- provides the compatibility layer -- defaults the previous behavior (the search list configured in the - system's resolver configuration is used for relative names) -- defaults lifetime to 15sec (determines the number of seconds - to spend trying to get an answer to the question) - -The compatibility shim was developed by Stanislav Levin for FreeIPA and -adopted for Samba by Alexander Bokovoy. - -Signed-off-by: Stanislav Levin -Signed-off-by: Alexander Bokovoy ---- - python/samba/dnsresolver.py | 68 +++++++++++++++++++++++++++ - source4/scripting/bin/samba_dnsupdate | 5 +- - 2 files changed, 71 insertions(+), 2 deletions(-) - create mode 100644 python/samba/dnsresolver.py - -diff --git a/python/samba/dnsresolver.py b/python/samba/dnsresolver.py -new file mode 100644 -index 00000000000..a627555a855 ---- /dev/null -+++ b/python/samba/dnsresolver.py -@@ -0,0 +1,68 @@ -+# Samba wrapper for DNS resolvers -+# -+# Copyright (C) Stanislav Levin -+# Copyright (C) Alexander Bokovoy -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation; either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+# -+ -+import dns.resolver -+import dns.rdatatype -+import dns.reversename -+ -+class DNSResolver(dns.resolver.Resolver): -+ """DNS stub resolver compatible with both dnspython < 2.0.0 -+ and dnspython >= 2.0.0. -+ -+ Set `use_search_by_default` attribute to `True`, which -+ determines the default for whether the search list configured -+ in the system's resolver configuration is used for relative -+ names, and whether the resolver's domain may be added to relative -+ names. -+ -+ Increase the default lifetime which determines the number of seconds -+ to spend trying to get an answer to the question. dnspython 2.0.0 -+ changes this to 5sec, while the previous one was 30sec. -+ """ -+ def __init__(self, *args, **kwargs): -+ super().__init__(*args, **kwargs) -+ self.reset_defaults() -+ self.resolve = getattr(super(), "resolve", self.query) -+ self.resolve_address = getattr( -+ super(), -+ "resolve_address", -+ self._resolve_address -+ ) -+ -+ def reset_defaults(self): -+ self.use_search_by_default = True -+ # the default is 5sec -+ self.lifetime = 15 -+ -+ def reset(self): -+ super().reset() -+ self.reset_defaults() -+ -+ def _resolve_address(self, ip_address, *args, **kwargs): -+ """Query nameservers for PTR records. -+ -+ :param ip_address: IPv4 or IPv6 address -+ :type ip_address: str -+ """ -+ return self.resolve( -+ dns.reversename.from_address(ip_address), -+ rdtype=dns.rdatatype.PTR, -+ *args, -+ **kwargs, -+ ) -diff --git a/source4/scripting/bin/samba_dnsupdate b/source4/scripting/bin/samba_dnsupdate -index 44eb1cadd27..fe04ce71338 100755 ---- a/source4/scripting/bin/samba_dnsupdate -+++ b/source4/scripting/bin/samba_dnsupdate -@@ -53,6 +53,7 @@ from samba.compat import get_string - from samba.compat import text_type - import ldb - -+from samba.dnsresolver import DNSResolver - import dns.resolver - import dns.exception - -@@ -259,7 +260,7 @@ def hostname_match(h1, h2): - - def get_resolver(d=None): - resolv_conf = os.getenv('RESOLV_CONF', default='/etc/resolv.conf') -- resolver = dns.resolver.Resolver(filename=resolv_conf, configure=True) -+ resolver = DNSResolver(filename=resolv_conf, configure=True) - - if d is not None and d.nameservers != []: - resolver.nameservers = d.nameservers -@@ -271,7 +272,7 @@ def check_one_dns_name(name, name_type, d=None): - if d and not d.nameservers: - d.nameservers = resolver.nameservers - # dns.resolver.Answer -- return resolver.query(name, name_type) -+ return resolver.resolve(name, name_type) - - def check_dns_name(d): - """check that a DNS entry exists.""" --- -2.28.0 - diff --git a/samba-systemd-notification.patch b/samba-systemd-notification.patch deleted file mode 100644 index 1011460..0000000 --- a/samba-systemd-notification.patch +++ /dev/null @@ -1,118 +0,0 @@ -From 9dd1a4809b1b6d65bfb2258b443b0fe36e0a32f7 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Sat, 24 Oct 2020 16:52:43 +0300 -Subject: [PATCH] daemons: report status to systemd even when running in - foreground - -When systemd launches samba services, the configuration we have in -systemd service files expects that the main process (/usr/sbin/*) -would use sd_notify() to report back its status. However, we only use -sd_notify() when running become_daemon(). - -As a result, samba/smbd/winbindd/nmbd processes never report back its -status and the status updates from other childs (smbd, winbindd, etc) -are not accepted as we now have implied NotifyAccess=main since commit -d1740fb3d5a72cb49e30b330bb0b01e7ef3e09cc - -This leads to a timeout and killing samba process by systemd. Situation -is reproducible in Fedora 33, for example. - -Make sure that we have required status updates for all daemons in case -we aren't runnning in interactive mode. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14552 - -Signed-off-by: Alexander Bokovoy ---- - source3/nmbd/nmbd.c | 4 +++- - source3/smbd/server.c | 4 +++- - source3/winbindd/winbindd.c | 5 ++++- - source4/smbd/server.c | 4 +++- - 4 files changed, 13 insertions(+), 4 deletions(-) - -diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c -index 0b881d13f7b..f6aeba1f714 100644 ---- a/source3/nmbd/nmbd.c -+++ b/source3/nmbd/nmbd.c -@@ -1009,6 +1009,8 @@ static bool open_sockets(bool isdaemon, int port) - if (is_daemon && !opt_interactive) { - DEBUG(3, ("Becoming a daemon.\n")); - become_daemon(Fork, no_process_group, log_stdout); -+ } else if (!opt_interactive) { -+ daemon_status("nmbd", "Starting process..."); - } - - #ifdef HAVE_SETPGID -@@ -1135,7 +1137,7 @@ static bool open_sockets(bool isdaemon, int port) - exit_daemon( "NMBD failed to setup packet server.", EACCES); - } - -- if (is_daemon && !opt_interactive) { -+ if (!opt_interactive) { - daemon_ready("nmbd"); - } - -diff --git a/source3/smbd/server.c b/source3/smbd/server.c -index 153dd3c9323..3d9db5d8407 100644 ---- a/source3/smbd/server.c -+++ b/source3/smbd/server.c -@@ -1893,6 +1893,8 @@ extern void build_options(bool screen); - if (is_daemon && !interactive) { - DEBUG(3, ("Becoming a daemon.\n")); - become_daemon(Fork, no_process_group, log_stdout); -+ } else { -+ daemon_status("smbd", "Starting process ..."); - } - - #ifdef HAVE_SETPGID -@@ -2100,7 +2102,7 @@ extern void build_options(bool screen); - exit_daemon("Samba cannot setup ep pipe", EACCES); - } - -- if (is_daemon && !interactive) { -+ if (!interactive) { - daemon_ready("smbd"); - } - -diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c -index 4397a1bc0d1..1e08237905a 100644 ---- a/source3/winbindd/winbindd.c -+++ b/source3/winbindd/winbindd.c -@@ -1880,8 +1880,11 @@ int main(int argc, const char **argv) - BlockSignals(False, SIGHUP); - BlockSignals(False, SIGCHLD); - -- if (!interactive) -+ if (!interactive) { - become_daemon(Fork, no_process_group, log_stdout); -+ } else { -+ daemon_status("winbindd", "Starting process ..."); -+ } - - pidfile_create(lp_pid_directory(), "winbindd"); - -diff --git a/source4/smbd/server.c b/source4/smbd/server.c -index 95acb99b86c..ee2e7508bb3 100644 ---- a/source4/smbd/server.c -+++ b/source4/smbd/server.c -@@ -648,6 +648,8 @@ static int binary_smbd_main(const char *binary_name, - if (opt_daemon) { - DBG_NOTICE("Becoming a daemon.\n"); - become_daemon(opt_fork, opt_no_process_group, false); -+ } else if (!opt_interactive) { -+ daemon_status("samba", "Starting process..."); - } - - /* Create the memory context to hang everything off. */ -@@ -931,7 +933,7 @@ static int binary_smbd_main(const char *binary_name, - } - } - -- if (opt_daemon) { -+ if (!opt_interactive) { - daemon_ready("samba"); - } - --- -2.28.0 - diff --git a/samba.spec b/samba.spec index 1ef00b6..6a22d12 100644 --- a/samba.spec +++ b/samba.spec @@ -132,8 +132,6 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch -Patch3: samba-dnspython-2.0.0-v4.13.patch -Patch4: samba-systemd-notification.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd From 8e9460d4b5e09bc63d6cdf07eeb24477113b2b47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Nov 2020 14:47:34 +0100 Subject: [PATCH 07/30] Add missing dlz_bind.so files Guenther --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 6a22d12..03c2c1d 100644 --- a/samba.spec +++ b/samba.spec @@ -1731,6 +1731,8 @@ fi %{_libdir}/samba/bind9/dlz_bind9_10.so %{_libdir}/samba/bind9/dlz_bind9_11.so %{_libdir}/samba/bind9/dlz_bind9_12.so +%{_libdir}/samba/bind9/dlz_bind9_14.so +%{_libdir}/samba/bind9/dlz_bind9_16.so #endif with_dc %endif From 4416117f2aa7757de2bc7de53bf8023d88d2a227 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 3 Nov 2020 17:17:46 +0100 Subject: [PATCH 08/30] Split out a python3-samba-devel package This fixes a dependency of python3-samba on libtalloc-devel --- samba.spec | 40 +++++++++++++++++----------------------- 1 file changed, 17 insertions(+), 23 deletions(-) diff --git a/samba.spec b/samba.spec index 03c2c1d..b7972be 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.13.2 %define talloc_version 2.3.1 @@ -586,6 +586,13 @@ Requires: libwbclient = %{samba_depver} The python3-%{name} package contains the Python 3 libraries needed by programs that use SMB, RPC and other Samba provided protocols in Python 3 programs. +%package -n python3-%{name}-devel +Summary: Samba python devel files +Requires: python3-%{name} = %{samba_depver} + +%description -n python3-%{name}-devel +The python3-%{name}-devel package contains the Python 3 defel files. + %package -n python3-samba-test Summary: Samba Python libraries Requires: python3-%{name} = %{samba_depver} @@ -1082,16 +1089,6 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* # the ldconfig-created links be recorded in the RPM. /sbin/ldconfig -N -n %{buildroot}%{_libdir} -%if ! %with_dc -for f in samba/libsamba-net-samba4.so \ - samba/libsamba-python-samba4.so \ - libsamba-policy.so* \ - pkgconfig/samba-policy.pc ; do - rm -f %{buildroot}%{_libdir}/$f -done -#endif ! with_dc -%endif - pushd pidl make DESTDIR=%{buildroot} install_vendor @@ -2203,19 +2200,13 @@ fi %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so %{python3_sitearch}/samba/xattr_tdb.*.so -# FIXME: -# /usr/lib64/libsamba-policy.cpython-36m-x86-64-linux-gnu.so -# /usr/lib64/libsamba-policy.cpython-36m-x86-64-linux-gnu.so.0 -# /usr/lib64/libsamba-policy.cpython-36m-x86-64-linux-gnu.so.0.0.1 -%{_libdir}/libsamba-policy.*.so* -# FIXME: -# /usr/lib64/pkgconfig/samba-policy.cpython-36m-x86_64-linux-gnu.pc +%{_libdir}/libsamba-policy.cpython*.so.* +%{_libdir}/samba/libsamba-net.cpython*.so +%{_libdir}/samba/libsamba-python.cpython*.so + +%files -n python3-%{name}-devel +%{_libdir}/libsamba-policy.cpython*.so %{_libdir}/pkgconfig/samba-policy.*.pc -# FIXME: -# /usr/lib64/samba/libsamba-net.cpython-36m-x86-64-linux-gnu-samba4.so -# /usr/lib64/samba/libsamba-python.cpython-36m-x86-64-linux-gnu-samba4.so -%{_libdir}/samba/libsamba-net.*-samba4.so -%{_libdir}/samba/libsamba-python.*-samba4.so %if %{with_dc} %files -n python3-%{name}-dc @@ -3625,6 +3616,9 @@ fi %endif %changelog +* Tue Nov 03 2020 Andreas Schneider - 4.13.2-1 +- Create a python3-samba-devel package to avoid unnessary dependencies + * Tue Nov 03 2020 Guenther Deschner - 4.13.2-0 - Update to Samba 4.13.2 From 4e36f6e2eb75eb3835f1a142609cbffbd0374ac3 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 25 Nov 2020 13:47:13 +0200 Subject: [PATCH 09/30] Merge RHEL 8.4 patches These patches are part of the https://gitlab.com/samba-redhat/samba/-/tree/v4-13-redhat [PATCH 001/105] libcli:smb2: Do not leak ptext on error [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF [PATCH 004/105] param: Add 'server smb encrypt' parameter [PATCH 005/105] param: Create and use enum_smb_encryption_vals [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values [PATCH 007/105] docs-xml: Add 'client smb encrypt' [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline [PATCH 012/105] auth:creds: Remove unused credentials autoproto [PATCH 013/105] auth:creds: Add [PATCH 014/105] auth:creds: Add python bindings for [PATCH 015/105] auth:creds: Add [PATCH 016/105] auth:creds: Add python bindings for [PATCH 017/105] auth:creds: Add [PATCH 018/105] auth:creds: Add python bindings for [PATCH 019/105] auth:creds: Add python bindings for [PATCH 020/105] auth:creds: Bump library version [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API [PATCH 023/105] python: Remove unused sign argument from [PATCH 024/105] python: Set smb signing via the creds API [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC [PATCH 026/105] s3:pylibsmb: Add ipc=True support for [PATCH 027/105] python:tests: Mark libsmb connection as an IPC [PATCH 028/105] python:tests: Set smb ipc signing via the creds API [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in [PATCH 030/105] s3:client: Turn off smb signing for message op [PATCH 031/105] s3:libsmb: Remove signing_state from [PATCH 032/105] s3:libsmb: Remove signing_state from [PATCH 033/105] s3:libsmb: Add encryption support to [PATCH 034/105] python: Add a test for SMB encryption [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() [PATCH 037/105] s3:client: Remove unused smb encryption code [PATCH 038/105] s3:utils: Remove obsolete force encryption from [PATCH 039/105] s3:utils: Remove obsolete force encryption from [PATCH 040/105] s3:utils: Remove obsolete force encryption from [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from [PATCH 042/105] examples: Remove obsolete force encryption from [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() [PATCH 044/105] s4:libcli: Return NTSTATUS errors for [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() [PATCH 048/105] s4:libcli: Require signing for SMB encryption [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel [PATCH 055/105] auth:creds: Add cli_credentials_init_server() [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb [PATCH 059/105] selftest: Move enc_desired to provision to have it in [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb [PATCH 061/105] s3:client: Remove global smb_encrypt [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs [PATCH 065/105] s3:libsmb: Remove force_encrypt from [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() [PATCH 069/105] s3:libsmb: Pass cli_credentials to [PATCH 070/105] s3:client: Remove global max_protocol [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs [PATCH 074/105] s3:include: Move loadparm prototypes to own header [PATCH 075/105] s3:lib: Move interface prototypes to own header file [PATCH 076/105] idl: Add SID_SAMBA_SMB3 [PATCH 077/105] s3:smbd: Add SMB3 connection information to session [PATCH 078/105] librpc: Add dcerpc helper [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam [PATCH 084/105] python:tests: Add SAMR password change tests for fips [PATCH 085/105] python:tests: Add SAMR password change tests for fips [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test [PATCH 088/105] s3-vfs_glusterfs: always disable write-behind [PATCH 089/105] Add smb2cli_session_get_encryption_cipher() [PATCH 090/105] Add dcerpc_transport_encrypted() [PATCH 091/105] Add py binding for dcerpc_transport_encrypted [PATCH 092/105] selftest: add a test for py dce transport_encrypted [PATCH 093/105] Add CreateTrustedDomainRelax wrapper for fips mode [PATCH 094/105] Use the new CreateTrustedDomainRelax() [PATCH 095/105] selftest: add a test for the CreateTrustedDomainRelax [PATCH 096/105] Remove source4/scripting/devel/createtrust script [PATCH 097/105] s3:rpc_server: Use gnutls_cipher_decrypt() in [PATCH 098/105] s4:rpc_server: Use gnutls_cipher_decrypt() in [PATCH 099/105] s3:rpc_server: Allow to use RC4 for creating trusts [PATCH 100/105] s4:rpc_server: Allow to use RC4 for creating trusts [PATCH 101/105] sefltest: Enable the dcerpc.createtrustrelax test [PATCH 102/105] s3: spoolss: Make parameters in call to [PATCH 103/105] s3:smbd: Fix possible null pointer dereference in [PATCH 104/105] lookup_name: allow lookup names prefixed with DNS [PATCH 105/105] auth_sam: use pdb_get_domain_info to look up DNS --- samba-4.13-redhat.patch | 12614 ++++++++++++++++++++++++++++++++++++++ samba.spec | 9 +- 2 files changed, 12621 insertions(+), 2 deletions(-) create mode 100644 samba-4.13-redhat.patch diff --git a/samba-4.13-redhat.patch b/samba-4.13-redhat.patch new file mode 100644 index 0000000..33b84bd --- /dev/null +++ b/samba-4.13-redhat.patch @@ -0,0 +1,12614 @@ +From 77a771be72a6084216ea848f2d851eb7192ae9b9 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 13 Jul 2020 16:15:03 +0200 +Subject: [PATCH 001/105] libcli:smb2: Do not leak ptext on error + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + libcli/smb/smb2_signing.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c +index 623fc23fb18..bba80817018 100644 +--- a/libcli/smb/smb2_signing.c ++++ b/libcli/smb/smb2_signing.c +@@ -522,6 +522,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, + + ctext = talloc_size(talloc_tos(), ctext_size); + if (ctext == NULL) { ++ TALLOC_FREE(ptext); + status = NT_STATUS_NO_MEMORY; + goto out; + } +-- +2.28.0 + + +From eb5fbbd3090cbdea95b14e9ac167253fafe633f8 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 13 Jul 2020 17:23:37 +0200 +Subject: [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have + a stackframe + +If we execute this code from python we don't have a talloc stackframe +around and segfault with talloc_tos(). + +To fix the crash we use the NULL context as we take care for freeing the +memory as soon as possible. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + libcli/smb/smb2_signing.c | 30 ++++++++++++++++++++++++++---- + 1 file changed, 26 insertions(+), 4 deletions(-) + +diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c +index bba80817018..7669b219bbe 100644 +--- a/libcli/smb/smb2_signing.c ++++ b/libcli/smb/smb2_signing.c +@@ -513,14 +513,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, + uint8_t *ctext = NULL; + size_t len = 0; + int i; ++ TALLOC_CTX *tmp_ctx = NULL; + +- ptext = talloc_size(talloc_tos(), ptext_size); ++ /* ++ * If we come from python bindings, we don't have a stackframe ++ * around, so use the NULL context. ++ * ++ * This is fine as we make sure we free the memory. ++ */ ++ if (talloc_stackframe_exists()) { ++ tmp_ctx = talloc_tos(); ++ } ++ ++ ptext = talloc_size(tmp_ctx, ptext_size); + if (ptext == NULL) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + +- ctext = talloc_size(talloc_tos(), ctext_size); ++ ctext = talloc_size(tmp_ctx, ctext_size); + if (ctext == NULL) { + TALLOC_FREE(ptext); + status = NT_STATUS_NO_MEMORY; +@@ -713,16 +724,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, + uint8_t *ptext = NULL; + size_t len = 0; + int i; ++ TALLOC_CTX *tmp_ctx = NULL; ++ ++ /* ++ * If we come from python bindings, we don't have a stackframe ++ * around, so use the NULL context. ++ * ++ * This is fine as we make sure we free the memory. ++ */ ++ if (talloc_stackframe_exists()) { ++ tmp_ctx = talloc_tos(); ++ } + + /* GnuTLS doesn't have a iovec API for decryption yet */ + +- ptext = talloc_size(talloc_tos(), ptext_size); ++ ptext = talloc_size(tmp_ctx, ptext_size); + if (ptext == NULL) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + +- ctext = talloc_size(talloc_tos(), ctext_size); ++ ctext = talloc_size(tmp_ctx, ctext_size); + if (ctext == NULL) { + TALLOC_FREE(ptext); + status = NT_STATUS_NO_MEMORY; +-- +2.28.0 + + +From 66ee204aee9a4919d94003a9a3263a44c2d5b436 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Wed, 6 Nov 2019 17:37:45 +0100 +Subject: [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF + +We have several places where we check '> CRED_UNINITIALISED', +so we better don't use CRED_UNINITIALISED for values from +our smb.conf. + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andreas Schneider +--- + auth/credentials/credentials.c | 6 +++--- + auth/credentials/credentials.h | 1 + + auth/credentials/pycredentials.c | 1 + + python/samba/tests/credentials.py | 4 ++-- + 4 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 81f9dbb9eb3..80a31b248ae 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -902,12 +902,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, + if (lpcfg_parm_is_cmdline(lp_ctx, "workgroup")) { + cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SPECIFIED); + } else { +- cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_UNINITIALISED); ++ cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SMB_CONF); + } + if (lpcfg_parm_is_cmdline(lp_ctx, "netbios name")) { + cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SPECIFIED); + } else { +- cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_UNINITIALISED); ++ cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SMB_CONF); + } + if (realm != NULL && strlen(realm) == 0) { + realm = NULL; +@@ -915,7 +915,7 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, + if (lpcfg_parm_is_cmdline(lp_ctx, "realm")) { + cli_credentials_set_realm(cred, realm, CRED_SPECIFIED); + } else { +- cli_credentials_set_realm(cred, realm, CRED_UNINITIALISED); ++ cli_credentials_set_realm(cred, realm, CRED_SMB_CONF); + } + + sep = lpcfg_winbind_separator(lp_ctx); +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 9fe6a82b1ea..7154c2a008c 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -42,6 +42,7 @@ struct db_context; + /* In order of priority */ + enum credentials_obtained { + CRED_UNINITIALISED = 0, /* We don't even have a guess yet */ ++ CRED_SMB_CONF, /* Current value should be used, which comes from smb.conf */ + CRED_CALLBACK, /* Callback should be used to obtain value */ + CRED_GUESS_ENV, /* Current value should be used, which was guessed */ + CRED_GUESS_FILE, /* A guess from a file (or file pointed at in env variable) */ +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index a5d0f9e051c..68edc282741 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -1275,6 +1275,7 @@ MODULE_INIT_FUNC(credentials) + return NULL; + + PyModule_AddObject(m, "UNINITIALISED", PyLong_FromLong(CRED_UNINITIALISED)); ++ PyModule_AddObject(m, "SMB_CONF", PyLong_FromLong(CRED_SMB_CONF)); + PyModule_AddObject(m, "CALLBACK", PyLong_FromLong(CRED_CALLBACK)); + PyModule_AddObject(m, "GUESS_ENV", PyLong_FromLong(CRED_GUESS_ENV)); + PyModule_AddObject(m, "GUESS_FILE", PyLong_FromLong(CRED_GUESS_FILE)); +diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py +index d2a81506de3..6454ac9ff7c 100644 +--- a/python/samba/tests/credentials.py ++++ b/python/samba/tests/credentials.py +@@ -332,7 +332,7 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + os.environ["USER"] = "env_user" + creds.guess(lp) + realm = "realm.example.com" +- creds.set_realm(realm, credentials.UNINITIALISED) ++ creds.set_realm(realm, credentials.SMB_CONF) + creds.parse_string("user") + self.assertEqual(creds.get_username(), "user") + self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) +@@ -360,7 +360,7 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + os.environ["USER"] = "env_user" + creds.guess(lp) + realm = "realm.example.com" +- creds.set_realm(realm, credentials.UNINITIALISED) ++ creds.set_realm(realm, credentials.SMB_CONF) + self.assertEqual(creds.get_username(), "env_user") + self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) + self.assertEqual(creds.get_realm(), realm.upper()) +-- +2.28.0 + + +From 8d2d8cdc90d0455429c9d461ebd65d21a0b29b8d Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 10 Oct 2019 14:18:23 +0200 +Subject: [PATCH 004/105] param: Add 'server smb encrypt' parameter + +And this also makes 'smb encrypt' a synonym of that. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + .../smbdotconf/security/serversmbencrypt.xml | 241 ++++++++++++++++++ + docs-xml/smbdotconf/security/smbencrypt.xml | 241 +----------------- + source3/param/loadparm.c | 2 +- + source3/smbd/service.c | 4 +- + source3/smbd/smb2_negprot.c | 2 +- + source3/smbd/smb2_sesssetup.c | 4 +- + source3/smbd/smb2_tcon.c | 4 +- + source3/smbd/trans2.c | 2 +- + 8 files changed, 257 insertions(+), 243 deletions(-) + create mode 100644 docs-xml/smbdotconf/security/serversmbencrypt.xml + +diff --git a/docs-xml/smbdotconf/security/serversmbencrypt.xml b/docs-xml/smbdotconf/security/serversmbencrypt.xml +new file mode 100644 +index 00000000000..714aacbf1ca +--- /dev/null ++++ b/docs-xml/smbdotconf/security/serversmbencrypt.xml +@@ -0,0 +1,241 @@ ++ ++ ++ ++ This parameter controls whether a remote client is allowed or required ++ to use SMB encryption. It has different effects depending on whether ++ the connection uses SMB1 or SMB2 and newer: ++ ++ ++ ++ ++ ++ If the connection uses SMB1, then this option controls the use ++ of a Samba-specific extension to the SMB protocol introduced in ++ Samba 3.2 that makes use of the Unix extensions. ++ ++ ++ ++ ++ ++ If the connection uses SMB2 or newer, then this option controls ++ the use of the SMB-level encryption that is supported in SMB ++ version 3.0 and above and available in Windows 8 and newer. ++ ++ ++ ++ ++ ++ This parameter can be set globally and on a per-share bases. ++ Possible values are ++ ++ off, ++ if_required, ++ desired, ++ and ++ required. ++ A special value is default which is ++ the implicit default setting of if_required. ++ ++ ++ ++ ++ Effects for SMB1 ++ ++ ++ The Samba-specific encryption of SMB1 connections is an ++ extension to the SMB protocol negotiated as part of the UNIX ++ extensions. SMB encryption uses the GSSAPI (SSPI on Windows) ++ ability to encrypt and sign every request/response in a SMB ++ protocol stream. When enabled it provides a secure method of ++ SMB/CIFS communication, similar to an ssh protected session, but ++ using SMB/CIFS authentication to negotiate encryption and ++ signing keys. Currently this is only supported smbclient of by ++ Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X ++ clients. Windows clients do not support this feature. ++ ++ ++ This may be set on a per-share ++ basis, but clients may chose to encrypt the entire session, not ++ just traffic to a specific share. If this is set to mandatory ++ then all traffic to a share must ++ be encrypted once the connection has been made to the share. ++ The server would return "access denied" to all non-encrypted ++ requests on such a share. Selecting encrypted traffic reduces ++ throughput as smaller packet sizes must be used (no huge UNIX ++ style read/writes allowed) as well as the overhead of encrypting ++ and signing all the data. ++ ++ ++ ++ If SMB encryption is selected, Windows style SMB signing (see ++ the option) is no longer ++ necessary, as the GSSAPI flags use select both signing and ++ sealing of the data. ++ ++ ++ ++ When set to auto or default, SMB encryption is offered, but not ++ enforced. When set to mandatory, SMB encryption is required and ++ if set to disabled, SMB encryption can not be negotiated. ++ ++ ++ ++ ++ ++ Effects for SMB2 and newer ++ ++ ++ Native SMB transport encryption is available in SMB version 3.0 ++ or newer. It is only offered by Samba if ++ server max protocol is set to ++ SMB3 or newer. ++ Clients supporting this type of encryption include ++ Windows 8 and newer, ++ Windows server 2012 and newer, ++ and smbclient of Samba 4.1 and newer. ++ ++ ++ ++ The protocol implementation offers various options: ++ ++ ++ ++ ++ ++ The capability to perform SMB encryption can be ++ negotiated during protocol negotiation. ++ ++ ++ ++ ++ ++ Data encryption can be enabled globally. In that case, ++ an encryption-capable connection will have all traffic ++ in all its sessions encrypted. In particular all share ++ connections will be encrypted. ++ ++ ++ ++ ++ ++ Data encryption can also be enabled per share if not ++ enabled globally. For an encryption-capable connection, ++ all connections to an encryption-enabled share will be ++ encrypted. ++ ++ ++ ++ ++ ++ Encryption can be enforced. This means that session ++ setups will be denied on non-encryption-capable ++ connections if data encryption has been enabled ++ globally. And tree connections will be denied for ++ non-encryption capable connections to shares with data ++ encryption enabled. ++ ++ ++ ++ ++ ++ These features can be controlled with settings of ++ server smb encrypt as follows: ++ ++ ++ ++ ++ ++ Leaving it as default, explicitly setting ++ default, or setting it to ++ if_required globally will enable ++ negotiation of encryption but will not turn on ++ data encryption globally or per share. ++ ++ ++ ++ ++ ++ Setting it to desired globally ++ will enable negotiation and will turn on data encryption ++ on sessions and share connections for those clients ++ that support it. ++ ++ ++ ++ ++ ++ Setting it to required globally ++ will enable negotiation and turn on data encryption ++ on sessions and share connections. Clients that do ++ not support encryption will be denied access to the ++ server. ++ ++ ++ ++ ++ ++ Setting it to off globally will ++ completely disable the encryption feature for all ++ connections. Setting server smb encrypt = ++ required for individual shares (while it's ++ globally off) will deny access to this shares for all ++ clients. ++ ++ ++ ++ ++ ++ Setting it to desired on a share ++ will turn on data encryption for this share for clients ++ that support encryption if negotiation has been ++ enabled globally. ++ ++ ++ ++ ++ ++ Setting it to required on a share ++ will enforce data encryption for this share if ++ negotiation has been enabled globally. I.e. clients that ++ do not support encryption will be denied access to the ++ share. ++ ++ ++ Note that this allows per-share enforcing to be ++ controlled in Samba differently from Windows: ++ In Windows, RejectUnencryptedAccess ++ is a global setting, and if it is set, all shares with ++ data encryption turned on ++ are automatically enforcing encryption. In order to ++ achieve the same effect in Samba, one ++ has to globally set server smb encrypt to ++ if_required, and then set all shares ++ that should be encrypted to ++ required. ++ Additionally, it is possible in Samba to have some ++ shares with encryption required ++ and some other shares with encryption only ++ desired, which is not possible in ++ Windows. ++ ++ ++ ++ ++ ++ Setting it to off or ++ if_required for a share has ++ no effect. ++ ++ ++ ++ ++ ++ ++ ++ ++default ++ +diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml +index 32a22cb58f5..798e616b765 100644 +--- a/docs-xml/smbdotconf/security/smbencrypt.xml ++++ b/docs-xml/smbdotconf/security/smbencrypt.xml +@@ -1,241 +1,14 @@ + ++ context="S" ++ type="enum" ++ enumlist="enum_smb_signing_vals" ++ function="server_smb_encrypt" ++ synonym="1" ++ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> + + +- This parameter controls whether a remote client is allowed or required +- to use SMB encryption. It has different effects depending on whether +- the connection uses SMB1 or SMB2 and newer: ++ This is a synonym for . + +- +- +- +- +- If the connection uses SMB1, then this option controls the use +- of a Samba-specific extension to the SMB protocol introduced in +- Samba 3.2 that makes use of the Unix extensions. +- +- +- +- +- +- If the connection uses SMB2 or newer, then this option controls +- the use of the SMB-level encryption that is supported in SMB +- version 3.0 and above and available in Windows 8 and newer. +- +- +- +- +- +- This parameter can be set globally and on a per-share bases. +- Possible values are +- off (or disabled), +- enabled (or auto, or +- if_required), +- desired, +- and +- required +- (or mandatory). +- A special value is default which is +- the implicit default setting of enabled. +- +- +- +- +- Effects for SMB1 +- +- +- The Samba-specific encryption of SMB1 connections is an +- extension to the SMB protocol negotiated as part of the UNIX +- extensions. SMB encryption uses the GSSAPI (SSPI on Windows) +- ability to encrypt and sign every request/response in a SMB +- protocol stream. When enabled it provides a secure method of +- SMB/CIFS communication, similar to an ssh protected session, but +- using SMB/CIFS authentication to negotiate encryption and +- signing keys. Currently this is only supported smbclient of by +- Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X +- clients. Windows clients do not support this feature. +- +- +- This may be set on a per-share +- basis, but clients may chose to encrypt the entire session, not +- just traffic to a specific share. If this is set to mandatory +- then all traffic to a share must +- be encrypted once the connection has been made to the share. +- The server would return "access denied" to all non-encrypted +- requests on such a share. Selecting encrypted traffic reduces +- throughput as smaller packet sizes must be used (no huge UNIX +- style read/writes allowed) as well as the overhead of encrypting +- and signing all the data. +- +- +- +- If SMB encryption is selected, Windows style SMB signing (see +- the option) is no longer +- necessary, as the GSSAPI flags use select both signing and +- sealing of the data. +- +- +- +- When set to auto or default, SMB encryption is offered, but not +- enforced. When set to mandatory, SMB encryption is required and +- if set to disabled, SMB encryption can not be negotiated. +- +- +- +- +- +- Effects for SMB2 +- +- +- Native SMB transport encryption is available in SMB version 3.0 +- or newer. It is only offered by Samba if +- server max protocol is set to +- SMB3 or newer. +- Clients supporting this type of encryption include +- Windows 8 and newer, +- Windows server 2012 and newer, +- and smbclient of Samba 4.1 and newer. +- +- +- +- The protocol implementation offers various options: +- +- +- +- +- +- The capability to perform SMB encryption can be +- negotiated during protocol negotiation. +- +- +- +- +- +- Data encryption can be enabled globally. In that case, +- an encryption-capable connection will have all traffic +- in all its sessions encrypted. In particular all share +- connections will be encrypted. +- +- +- +- +- +- Data encryption can also be enabled per share if not +- enabled globally. For an encryption-capable connection, +- all connections to an encryption-enabled share will be +- encrypted. +- +- +- +- +- +- Encryption can be enforced. This means that session +- setups will be denied on non-encryption-capable +- connections if data encryption has been enabled +- globally. And tree connections will be denied for +- non-encryption capable connections to shares with data +- encryption enabled. +- +- +- +- +- +- These features can be controlled with settings of +- smb encrypt as follows: +- +- +- +- +- +- Leaving it as default, explicitly setting +- default, or setting it to +- enabled globally will enable +- negotiation of encryption but will not turn on +- data encryption globally or per share. +- +- +- +- +- +- Setting it to desired globally +- will enable negotiation and will turn on data encryption +- on sessions and share connections for those clients +- that support it. +- +- +- +- +- +- Setting it to required globally +- will enable negotiation and turn on data encryption +- on sessions and share connections. Clients that do +- not support encryption will be denied access to the +- server. +- +- +- +- +- +- Setting it to off globally will +- completely disable the encryption feature for all +- connections. Setting smb encrypt = +- required for individual shares (while it's +- globally off) will deny access to this shares for all +- clients. +- +- +- +- +- +- Setting it to desired on a share +- will turn on data encryption for this share for clients +- that support encryption if negotiation has been +- enabled globally. +- +- +- +- +- +- Setting it to required on a share +- will enforce data encryption for this share if +- negotiation has been enabled globally. I.e. clients that +- do not support encryption will be denied access to the +- share. +- +- +- Note that this allows per-share enforcing to be +- controlled in Samba differently from Windows: +- In Windows, RejectUnencryptedAccess +- is a global setting, and if it is set, all shares with +- data encryption turned on +- are automatically enforcing encryption. In order to +- achieve the same effect in Samba, one +- has to globally set smb encrypt to +- enabled, and then set all shares +- that should be encrypted to +- required. +- Additionally, it is possible in Samba to have some +- shares with encryption required +- and some other shares with encryption only +- desired, which is not possible in +- Windows. +- +- +- +- +- +- Setting it to off or +- enabled for a share has +- no effect. +- +- +- +- +- +- + + + default +diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c +index 6674485738a..82be31e8437 100644 +--- a/source3/param/loadparm.c ++++ b/source3/param/loadparm.c +@@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = + .aio_write_size = 1, + .map_readonly = MAP_READONLY_NO, + .directory_name_cache_size = 100, +- .smb_encrypt = SMB_SIGNING_DEFAULT, ++ .server_smb_encrypt = SMB_SIGNING_DEFAULT, + .kernel_share_modes = true, + .durable_handles = true, + .check_parent_directory_delete_on_close = false, +diff --git a/source3/smbd/service.c b/source3/smbd/service.c +index ed38121f292..a263c33b7e2 100644 +--- a/source3/smbd/service.c ++++ b/source3/smbd/service.c +@@ -567,9 +567,9 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, + conn->case_preserve = lp_preserve_case(snum); + conn->short_case_preserve = lp_short_preserve_case(snum); + +- conn->encrypt_level = lp_smb_encrypt(snum); ++ conn->encrypt_level = lp_server_smb_encrypt(snum); + if (conn->encrypt_level > SMB_SIGNING_OFF) { +- if (lp_smb_encrypt(-1) == SMB_SIGNING_OFF) { ++ if (lp_server_smb_encrypt(-1) == SMB_SIGNING_OFF) { + if (conn->encrypt_level == SMB_SIGNING_REQUIRED) { + DBG_ERR("Service [%s] requires encryption, but " + "it is disabled globally!\n", +diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c +index 4071f42b5e0..674942b71de 100644 +--- a/source3/smbd/smb2_negprot.c ++++ b/source3/smbd/smb2_negprot.c +@@ -335,7 +335,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req) + } + + if ((protocol >= PROTOCOL_SMB2_24) && +- (lp_smb_encrypt(-1) != SMB_SIGNING_OFF) && ++ (lp_server_smb_encrypt(-1) != SMB_SIGNING_OFF) && + (in_capabilities & SMB2_CAP_ENCRYPTION)) { + capabilities |= SMB2_CAP_ENCRYPTION; + } +diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c +index 2b6b3a820d4..8957411e167 100644 +--- a/source3/smbd/smb2_sesssetup.c ++++ b/source3/smbd/smb2_sesssetup.c +@@ -292,12 +292,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, + x->global->signing_flags = SMBXSRV_SIGNING_REQUIRED; + } + +- if ((lp_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && ++ if ((lp_server_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && + (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) { + x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED; + } + +- if (lp_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { ++ if (lp_server_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { + x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED | + SMBXSRV_ENCRYPTION_DESIRED; + } +diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c +index 76112d04889..0dd3c653b4b 100644 +--- a/source3/smbd/smb2_tcon.c ++++ b/source3/smbd/smb2_tcon.c +@@ -302,13 +302,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req, + TALLOC_FREE(proxy); + } + +- if ((lp_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && ++ if ((lp_server_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && + (conn->smb2.server.cipher != 0)) + { + encryption_desired = true; + } + +- if (lp_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { ++ if (lp_server_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { + encryption_desired = true; + encryption_required = true; + } +diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c +index 7acde285a90..b745e0906b1 100644 +--- a/source3/smbd/trans2.c ++++ b/source3/smbd/trans2.c +@@ -4484,7 +4484,7 @@ static void call_trans2setfsinfo(connection_struct *conn, + return; + } + +- if (lp_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { ++ if (lp_server_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { + reply_nterror( + req, + NT_STATUS_NOT_SUPPORTED); +-- +2.28.0 + + +From 71b97ba1fd9260efd29e3ab3456b82d2a4f6dcc8 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 10:04:19 +0200 +Subject: [PATCH 005/105] param: Create and use enum_smb_encryption_vals + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + .../smbdotconf/security/serversmbencrypt.xml | 2 +- + docs-xml/smbdotconf/security/smbencrypt.xml | 2 +- + lib/param/param_table.c | 23 +++++++++++++++++++ + libcli/smb/smb_constants.h | 9 ++++++++ + 4 files changed, 34 insertions(+), 2 deletions(-) + +diff --git a/docs-xml/smbdotconf/security/serversmbencrypt.xml b/docs-xml/smbdotconf/security/serversmbencrypt.xml +index 714aacbf1ca..5f38b46419e 100644 +--- a/docs-xml/smbdotconf/security/serversmbencrypt.xml ++++ b/docs-xml/smbdotconf/security/serversmbencrypt.xml +@@ -1,7 +1,7 @@ + + + +diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml +index 798e616b765..60271200c0a 100644 +--- a/docs-xml/smbdotconf/security/smbencrypt.xml ++++ b/docs-xml/smbdotconf/security/smbencrypt.xml +@@ -1,7 +1,7 @@ + +diff --git a/lib/param/param_table.c b/lib/param/param_table.c +index 47b85de1f87..e2f737279dc 100644 +--- a/lib/param/param_table.c ++++ b/lib/param/param_table.c +@@ -138,6 +138,29 @@ static const struct enum_list enum_smb_signing_vals[] = { + {-1, NULL} + }; + ++static const struct enum_list enum_smb_encryption_vals[] = { ++ {SMB_ENCRYPTION_DEFAULT, "default"}, ++ {SMB_ENCRYPTION_OFF, "No"}, ++ {SMB_ENCRYPTION_OFF, "False"}, ++ {SMB_ENCRYPTION_OFF, "0"}, ++ {SMB_ENCRYPTION_OFF, "Off"}, ++ {SMB_ENCRYPTION_OFF, "disabled"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "if_required"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "Yes"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "True"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "1"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "On"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "enabled"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "auto"}, ++ {SMB_ENCRYPTION_DESIRED, "desired"}, ++ {SMB_ENCRYPTION_REQUIRED, "required"}, ++ {SMB_ENCRYPTION_REQUIRED, "mandatory"}, ++ {SMB_ENCRYPTION_REQUIRED, "force"}, ++ {SMB_ENCRYPTION_REQUIRED, "forced"}, ++ {SMB_ENCRYPTION_REQUIRED, "enforced"}, ++ {-1, NULL} ++}; ++ + static const struct enum_list enum_mdns_name_values[] = { + {MDNS_NAME_NETBIOS, "netbios"}, + {MDNS_NAME_MDNS, "mdns"}, +diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h +index b424b13cde4..2fb1fd7189e 100644 +--- a/libcli/smb/smb_constants.h ++++ b/libcli/smb/smb_constants.h +@@ -106,6 +106,15 @@ enum smb_signing_setting { + SMB_SIGNING_REQUIRED = 3, + }; + ++/* This MUST align with 'enum smb_signing_setting' */ ++enum smb_encryption_setting { ++ SMB_ENCRYPTION_DEFAULT = SMB_SIGNING_DEFAULT, ++ SMB_ENCRYPTION_OFF = SMB_SIGNING_OFF, ++ SMB_ENCRYPTION_IF_REQUIRED = SMB_SIGNING_IF_REQUIRED, ++ SMB_ENCRYPTION_DESIRED = SMB_SIGNING_DESIRED, ++ SMB_ENCRYPTION_REQUIRED = SMB_SIGNING_REQUIRED, ++}; ++ + /* types of buffers in core SMB protocol */ + #define SMB_DATA_BLOCK 0x1 + #define SMB_ASCII4 0x4 +-- +2.28.0 + + +From ca1e10a901af67327d25765bfed404e2d1c756a5 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 26 May 2020 09:34:54 +0200 +Subject: [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/param/loadparm.c | 2 +- + source3/smbd/service.c | 8 ++++---- + source3/smbd/smb2_negprot.c | 2 +- + source3/smbd/smb2_sesssetup.c | 4 ++-- + source3/smbd/smb2_tcon.c | 4 ++-- + source3/smbd/trans2.c | 3 ++- + 6 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c +index 82be31e8437..b305e34b252 100644 +--- a/source3/param/loadparm.c ++++ b/source3/param/loadparm.c +@@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = + .aio_write_size = 1, + .map_readonly = MAP_READONLY_NO, + .directory_name_cache_size = 100, +- .server_smb_encrypt = SMB_SIGNING_DEFAULT, ++ .server_smb_encrypt = SMB_ENCRYPTION_DEFAULT, + .kernel_share_modes = true, + .durable_handles = true, + .check_parent_directory_delete_on_close = false, +diff --git a/source3/smbd/service.c b/source3/smbd/service.c +index a263c33b7e2..43803e721c2 100644 +--- a/source3/smbd/service.c ++++ b/source3/smbd/service.c +@@ -568,16 +568,16 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, + conn->short_case_preserve = lp_short_preserve_case(snum); + + conn->encrypt_level = lp_server_smb_encrypt(snum); +- if (conn->encrypt_level > SMB_SIGNING_OFF) { +- if (lp_server_smb_encrypt(-1) == SMB_SIGNING_OFF) { +- if (conn->encrypt_level == SMB_SIGNING_REQUIRED) { ++ if (conn->encrypt_level > SMB_ENCRYPTION_OFF) { ++ if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_OFF) { ++ if (conn->encrypt_level == SMB_ENCRYPTION_REQUIRED) { + DBG_ERR("Service [%s] requires encryption, but " + "it is disabled globally!\n", + lp_const_servicename(snum)); + status = NT_STATUS_ACCESS_DENIED; + goto err_root_exit; + } +- conn->encrypt_level = SMB_SIGNING_OFF; ++ conn->encrypt_level = SMB_ENCRYPTION_OFF; + } + } + +diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c +index 674942b71de..99303f1b07b 100644 +--- a/source3/smbd/smb2_negprot.c ++++ b/source3/smbd/smb2_negprot.c +@@ -335,7 +335,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req) + } + + if ((protocol >= PROTOCOL_SMB2_24) && +- (lp_server_smb_encrypt(-1) != SMB_SIGNING_OFF) && ++ (lp_server_smb_encrypt(-1) != SMB_ENCRYPTION_OFF) && + (in_capabilities & SMB2_CAP_ENCRYPTION)) { + capabilities |= SMB2_CAP_ENCRYPTION; + } +diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c +index 8957411e167..907dd92321e 100644 +--- a/source3/smbd/smb2_sesssetup.c ++++ b/source3/smbd/smb2_sesssetup.c +@@ -292,12 +292,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, + x->global->signing_flags = SMBXSRV_SIGNING_REQUIRED; + } + +- if ((lp_server_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && ++ if ((lp_server_smb_encrypt(-1) >= SMB_ENCRYPTION_DESIRED) && + (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) { + x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED; + } + +- if (lp_server_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { ++ if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_REQUIRED) { + x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED | + SMBXSRV_ENCRYPTION_DESIRED; + } +diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c +index 0dd3c653b4b..d7e0cf90f47 100644 +--- a/source3/smbd/smb2_tcon.c ++++ b/source3/smbd/smb2_tcon.c +@@ -302,13 +302,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req, + TALLOC_FREE(proxy); + } + +- if ((lp_server_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && ++ if ((lp_server_smb_encrypt(snum) >= SMB_ENCRYPTION_DESIRED) && + (conn->smb2.server.cipher != 0)) + { + encryption_desired = true; + } + +- if (lp_server_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { ++ if (lp_server_smb_encrypt(snum) == SMB_ENCRYPTION_REQUIRED) { + encryption_desired = true; + encryption_required = true; + } +diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c +index b745e0906b1..2f2fdcb7260 100644 +--- a/source3/smbd/trans2.c ++++ b/source3/smbd/trans2.c +@@ -4484,7 +4484,8 @@ static void call_trans2setfsinfo(connection_struct *conn, + return; + } + +- if (lp_server_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { ++ if (lp_server_smb_encrypt(SNUM(conn)) == ++ SMB_ENCRYPTION_OFF) { + reply_nterror( + req, + NT_STATUS_NOT_SUPPORTED); +-- +2.28.0 + + +From a5630bb933393fe69ff9b7f072221b9085d6277c Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 9 Apr 2020 10:38:41 +0200 +Subject: [PATCH 007/105] docs-xml: Add 'client smb encrypt' + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + .../smbdotconf/security/clientsmbencrypt.xml | 126 ++++++++++++++++++ + lib/param/loadparm.c | 4 + + source3/param/loadparm.c | 2 + + 3 files changed, 132 insertions(+) + create mode 100644 docs-xml/smbdotconf/security/clientsmbencrypt.xml + +diff --git a/docs-xml/smbdotconf/security/clientsmbencrypt.xml b/docs-xml/smbdotconf/security/clientsmbencrypt.xml +new file mode 100644 +index 00000000000..05df152e734 +--- /dev/null ++++ b/docs-xml/smbdotconf/security/clientsmbencrypt.xml +@@ -0,0 +1,126 @@ ++ ++ ++ ++ This parameter controls whether a client should try or is required ++ to use SMB encryption. It has different effects depending on whether ++ the connection uses SMB1 or SMB3: ++ ++ ++ ++ ++ ++ If the connection uses SMB1, then this option controls the use ++ of a Samba-specific extension to the SMB protocol introduced in ++ Samba 3.2 that makes use of the Unix extensions. ++ ++ ++ ++ ++ ++ If the connection uses SMB2 or newer, then this option controls ++ the use of the SMB-level encryption that is supported in SMB ++ version 3.0 and above and available in Windows 8 and newer. ++ ++ ++ ++ ++ ++ This parameter can be set globally. Possible values are ++ ++ off, ++ if_required, ++ desired, ++ and ++ required. ++ A special value is default which is ++ the implicit default setting of if_required. ++ ++ ++ ++ ++ Effects for SMB1 ++ ++ ++ The Samba-specific encryption of SMB1 connections is an ++ extension to the SMB protocol negotiated as part of the UNIX ++ extensions. SMB encryption uses the GSSAPI (SSPI on Windows) ++ ability to encrypt and sign every request/response in a SMB ++ protocol stream. When enabled it provides a secure method of ++ SMB/CIFS communication, similar to an ssh protected session, but ++ using SMB/CIFS authentication to negotiate encryption and ++ signing keys. Currently this is only supported smbclient of by ++ Samba 3.2 and newer. Windows does not support this feature. ++ ++ ++ ++ When set to default, SMB encryption is probed, but not ++ enforced. When set to required, SMB encryption is required and ++ if set to disabled, SMB encryption can not be negotiated. ++ ++ ++ ++ ++ ++ Effects for SMB3 and newer ++ ++ ++ Native SMB transport encryption is available in SMB version 3.0 ++ or newer. It is only used by Samba if ++ client max protocol is set to ++ SMB3 or newer. ++ ++ ++ ++ These features can be controlled with settings of ++ client smb encrypt as follows: ++ ++ ++ ++ ++ ++ Leaving it as default, explicitly setting ++ default, or setting it to ++ if_required globally will enable ++ negotiation of encryption but will not turn on ++ data encryption globally. ++ ++ ++ ++ ++ ++ Setting it to desired globally ++ will enable negotiation and will turn on data encryption ++ on sessions and share connections for those servers ++ that support it. ++ ++ ++ ++ ++ ++ Setting it to required globally ++ will enable negotiation and turn on data encryption ++ on sessions and share connections. Clients that do ++ not support encryption will be denied access to the ++ server. ++ ++ ++ ++ ++ ++ Setting it to off globally will ++ completely disable the encryption feature for all ++ connections. ++ ++ ++ ++ ++ ++ ++ ++ ++default ++ +diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c +index e041f4fb01b..e167903dbd9 100644 +--- a/lib/param/loadparm.c ++++ b/lib/param/loadparm.c +@@ -3079,6 +3079,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) + lpcfg_do_global_parameter( + lp_ctx, "ldap max search request size", "256000"); + ++ lpcfg_do_global_parameter(lp_ctx, ++ "client smb encrypt", ++ "default"); ++ + for (i = 0; parm_table[i].label; i++) { + if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { + lp_ctx->flags[i] |= FLAG_DEFAULT; +diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c +index b305e34b252..9a2a309b781 100644 +--- a/source3/param/loadparm.c ++++ b/source3/param/loadparm.c +@@ -960,6 +960,8 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) + Globals.ldap_max_authenticated_request_size = 16777216; + Globals.ldap_max_search_request_size = 256000; + ++ Globals.client_smb_encrypt = SMB_ENCRYPTION_DEFAULT; ++ + /* Now put back the settings that were set with lp_set_cmdline() */ + apply_lp_set_cmdline(); + } +-- +2.28.0 + + +From 3d826b1efb4a0e1f77875c7cbad2fcd16c3ac17b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 22 Jul 2020 17:48:25 +0200 +Subject: [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + lib/param/loadparm.c | 30 ++++++++++++++++++++++++++++++ + lib/param/loadparm.h | 2 ++ + 2 files changed, 32 insertions(+) + +diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c +index e167903dbd9..952d2b49811 100644 +--- a/lib/param/loadparm.c ++++ b/lib/param/loadparm.c +@@ -3674,3 +3674,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx, + raw_value, + lp_sub->private_data); + } ++ ++/** ++ * @brief Parse a string value of a given parameter to its integer enum value. ++ * ++ * @param[in] param_name The parameter name (e.g. 'client smb encrypt') ++ * ++ * @param[in] param_value The parameter value (e.g. 'required'). ++ * ++ * @return The integer value of the enum the param_value matches or INT32_MIN ++ * on error. ++ */ ++int32_t lpcfg_parse_enum_vals(const char *param_name, ++ const char *param_value) ++{ ++ struct parm_struct *parm = NULL; ++ int32_t ret = INT32_MIN; ++ bool ok; ++ ++ parm = lpcfg_parm_struct(NULL, param_name); ++ if (parm == NULL) { ++ return INT32_MIN; ++ } ++ ++ ok = lp_set_enum_parm(parm, param_value, &ret); ++ if (!ok) { ++ return INT32_MIN; ++ } ++ ++ return ret; ++} +diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h +index 323fcf84523..e66ce2324b4 100644 +--- a/lib/param/loadparm.h ++++ b/lib/param/loadparm.h +@@ -316,6 +316,8 @@ bool lp_do_section(const char *pszSectionName, void *userdata); + bool store_lp_set_cmdline(const char *pszParmName, const char *pszParmValue); + + int num_parameters(void); ++int32_t lpcfg_parse_enum_vals(const char *param_name, ++ const char *param_value); + + struct loadparm_substitution; + #ifdef LOADPARM_SUBSTITUTION_INTERNALS +-- +2.28.0 + + +From 2f74f9d6a5d38e6eb2ca3d32f61d5d9b1c55f3c1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 9 Oct 2019 09:38:08 +0200 +Subject: [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + libcli/smb/smb_util.h | 7 ++++ + libcli/smb/test_util_translate.c | 64 ++++++++++++++++++++++++++++++++ + libcli/smb/util.c | 20 ++++++++++ + libcli/smb/wscript | 5 +++ + selftest/tests.py | 2 + + 5 files changed, 98 insertions(+) + create mode 100644 libcli/smb/test_util_translate.c + +diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h +index 8861741c92f..15bdbe856d1 100644 +--- a/libcli/smb/smb_util.h ++++ b/libcli/smb/smb_util.h +@@ -24,6 +24,9 @@ + #include "smb_constants.h" + #include + ++#ifndef _SMB_UTIL_H ++#define _SMB_UTIL_H ++ + const char *smb_protocol_types_string(enum protocol_types protocol); + char *attrib_string(TALLOC_CTX *mem_ctx, uint32_t attrib); + uint32_t unix_perms_to_wire(mode_t perms); +@@ -46,3 +49,7 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, + const uint8_t *buf, size_t buf_len, + const uint8_t *position, + size_t *_consumed); ++ ++enum smb_signing_setting smb_signing_setting_translate(const char *str); ++ ++#endif /* _SMB_UTIL_H */ +diff --git a/libcli/smb/test_util_translate.c b/libcli/smb/test_util_translate.c +new file mode 100644 +index 00000000000..4b81984affa +--- /dev/null ++++ b/libcli/smb/test_util_translate.c +@@ -0,0 +1,64 @@ ++/* ++ * Unix SMB/CIFS implementation. ++ * ++ * Copyright (C) 2020 Andreas Schneider ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include "lib/replace/replace.h" ++#include ++ ++#include "libcli/smb/util.c" ++ ++static void test_smb_signing_setting_translate(void **state) ++{ ++ enum smb_signing_setting signing_state; ++ ++ signing_state = smb_signing_setting_translate("wurst"); ++ assert_int_equal(signing_state, SMB_SIGNING_REQUIRED); ++ ++ signing_state = smb_signing_setting_translate("off"); ++ assert_int_equal(signing_state, SMB_SIGNING_OFF); ++ ++ signing_state = smb_signing_setting_translate("if_required"); ++ assert_int_equal(signing_state, SMB_SIGNING_IF_REQUIRED); ++ ++ signing_state = smb_signing_setting_translate("mandatory"); ++ assert_int_equal(signing_state, SMB_SIGNING_REQUIRED); ++ ++} ++ ++int main(int argc, char *argv[]) ++{ ++ int rc; ++ const struct CMUnitTest tests[] = { ++ cmocka_unit_test(test_smb_signing_setting_translate), ++ }; ++ ++ if (argc == 2) { ++ cmocka_set_test_filter(argv[1]); ++ } ++ cmocka_set_message_output(CM_OUTPUT_SUBUNIT); ++ ++ rc = cmocka_run_group_tests(tests, NULL, NULL); ++ ++ return rc; ++} +diff --git a/libcli/smb/util.c b/libcli/smb/util.c +index 6fdf35fbbf3..da0e4db2bf3 100644 +--- a/libcli/smb/util.c ++++ b/libcli/smb/util.c +@@ -22,6 +22,7 @@ + #include "includes.h" + #include "libcli/smb/smb_common.h" + #include "system/filesys.h" ++#include "lib/param/loadparm.h" + + const char *smb_protocol_types_string(enum protocol_types protocol) + { +@@ -428,3 +429,22 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, + return internal_bytes_pull_str(mem_ctx, _str, ucs2, true, + buf, buf_len, position, _consumed); + } ++ ++/** ++ * @brief Translate SMB signing settings as string to an enum. ++ * ++ * @param[in] str The string to translate. ++ * ++ * @return A corresponding enum @smb_signing_setting tranlated from the string. ++ */ ++enum smb_signing_setting smb_signing_setting_translate(const char *str) ++{ ++ enum smb_signing_setting signing_state = SMB_SIGNING_REQUIRED; ++ int32_t val = lpcfg_parse_enum_vals("client signing", str); ++ ++ if (val != INT32_MIN) { ++ signing_state = val; ++ } ++ ++ return signing_state; ++} +diff --git a/libcli/smb/wscript b/libcli/smb/wscript +index 86e377f570b..c047fd33278 100644 +--- a/libcli/smb/wscript ++++ b/libcli/smb/wscript +@@ -72,3 +72,8 @@ def build(bld): + source='test_smb1cli_session.c', + deps='cmocka cli_smb_common', + for_selftest=True) ++ ++ bld.SAMBA_BINARY('test_util_translate', ++ source='test_util_translate.c', ++ deps='cmocka cli_smb_common', ++ for_selftest=True) +diff --git a/selftest/tests.py b/selftest/tests.py +index 6918e1306c3..20981754db4 100644 +--- a/selftest/tests.py ++++ b/selftest/tests.py +@@ -376,6 +376,8 @@ plantestsuite("samba.unittests.lib_util_modules", "none", + + plantestsuite("samba.unittests.smb1cli_session", "none", + [os.path.join(bindir(), "default/libcli/smb/test_smb1cli_session")]) ++plantestsuite("samba.unittests.smb_util_translate", "none", ++ [os.path.join(bindir(), "default/libcli/smb/test_util_translate")]) + + plantestsuite("samba.unittests.talloc_keep_secret", "none", + [os.path.join(bindir(), "default/lib/util/test_talloc_keep_secret")]) +-- +2.28.0 + + +From 912ec83bf4ec6a965ee10ace1d74036c5c6a4c92 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 26 May 2020 08:39:34 +0200 +Subject: [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() + +Add encryption enum and function to avoid confusion when reading the +code. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + libcli/smb/smb_util.h | 1 + + libcli/smb/test_util_translate.c | 19 +++++++++++++++++++ + libcli/smb/util.c | 20 ++++++++++++++++++++ + 3 files changed, 40 insertions(+) + +diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h +index 15bdbe856d1..2a727db8b6f 100644 +--- a/libcli/smb/smb_util.h ++++ b/libcli/smb/smb_util.h +@@ -51,5 +51,6 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, + size_t *_consumed); + + enum smb_signing_setting smb_signing_setting_translate(const char *str); ++enum smb_encryption_setting smb_encryption_setting_translate(const char *str); + + #endif /* _SMB_UTIL_H */ +diff --git a/libcli/smb/test_util_translate.c b/libcli/smb/test_util_translate.c +index 4b81984affa..b300af52c09 100644 +--- a/libcli/smb/test_util_translate.c ++++ b/libcli/smb/test_util_translate.c +@@ -46,11 +46,30 @@ static void test_smb_signing_setting_translate(void **state) + + } + ++static void test_smb_encryption_setting_translate(void **state) ++{ ++ enum smb_encryption_setting encryption_state; ++ ++ encryption_state = smb_encryption_setting_translate("wurst"); ++ assert_int_equal(encryption_state, SMB_ENCRYPTION_REQUIRED); ++ ++ encryption_state = smb_encryption_setting_translate("off"); ++ assert_int_equal(encryption_state, SMB_ENCRYPTION_OFF); ++ ++ encryption_state = smb_encryption_setting_translate("if_required"); ++ assert_int_equal(encryption_state, SMB_ENCRYPTION_IF_REQUIRED); ++ ++ encryption_state = smb_encryption_setting_translate("mandatory"); ++ assert_int_equal(encryption_state, SMB_ENCRYPTION_REQUIRED); ++ ++} ++ + int main(int argc, char *argv[]) + { + int rc; + const struct CMUnitTest tests[] = { + cmocka_unit_test(test_smb_signing_setting_translate), ++ cmocka_unit_test(test_smb_encryption_setting_translate), + }; + + if (argc == 2) { +diff --git a/libcli/smb/util.c b/libcli/smb/util.c +index da0e4db2bf3..ac2887ee5c4 100644 +--- a/libcli/smb/util.c ++++ b/libcli/smb/util.c +@@ -448,3 +448,23 @@ enum smb_signing_setting smb_signing_setting_translate(const char *str) + + return signing_state; + } ++ ++/** ++ * @brief Translate SMB encryption settings as string to an enum. ++ * ++ * @param[in] str The string to translate. ++ * ++ * @return A corresponding enum @smb_encryption_setting tranlated from the ++ * string. ++ */ ++enum smb_encryption_setting smb_encryption_setting_translate(const char *str) ++{ ++ enum smb_encryption_setting encryption_state = SMB_ENCRYPTION_REQUIRED; ++ int32_t val = lpcfg_parse_enum_vals("client smb encrypt", str); ++ ++ if (val != INT32_MIN) { ++ encryption_state = val; ++ } ++ ++ return encryption_state; ++} +-- +2.28.0 + + +From 7d2c3a519805549f577b54cf72a5d95b4ae744f3 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 9 Oct 2019 09:47:59 +0200 +Subject: [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline + parsing + +The function will be removed soon. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/lib/util_cmdline.c | 17 +++-------------- + source3/wscript_build | 2 +- + 2 files changed, 4 insertions(+), 15 deletions(-) + +diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c +index 90ee67c4cb7..bc1f1c3ed25 100644 +--- a/source3/lib/util_cmdline.c ++++ b/source3/lib/util_cmdline.c +@@ -28,6 +28,7 @@ + #include "librpc/gen_ndr/samr.h" + #include "auth/credentials/credentials.h" + #include "auth/gensec/gensec.h" ++#include "libcli/smb/smb_util.h" + + /**************************************************************************n + Code to cope with username/password auth options from the commandline. +@@ -240,20 +241,8 @@ void set_cmdline_auth_info_password(struct user_auth_info *auth_info, + bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info, + const char *arg) + { +- auth_info->signing_state = SMB_SIGNING_DEFAULT; +- if (strequal(arg, "off") || strequal(arg, "no") || +- strequal(arg, "false")) { +- auth_info->signing_state = SMB_SIGNING_OFF; +- } else if (strequal(arg, "on") || strequal(arg, "yes") || +- strequal(arg, "if_required") || +- strequal(arg, "true") || strequal(arg, "auto")) { +- auth_info->signing_state = SMB_SIGNING_IF_REQUIRED; +- } else if (strequal(arg, "force") || strequal(arg, "required") || +- strequal(arg, "forced")) { +- auth_info->signing_state = SMB_SIGNING_REQUIRED; +- } else { +- return false; +- } ++ auth_info->signing_state = smb_signing_setting_translate(arg); ++ + return true; + } + +diff --git a/source3/wscript_build b/source3/wscript_build +index 5a07eddac44..6a08afe4a25 100644 +--- a/source3/wscript_build ++++ b/source3/wscript_build +@@ -279,7 +279,7 @@ bld.SAMBA3_LIBRARY('popt_samba3_cmdline', + + bld.SAMBA3_LIBRARY('util_cmdline', + source='lib/util_cmdline.c', +- deps='secrets3 samba-credentials', ++ deps='secrets3 samba-credentials cli_smb_common', + private_library=True) + + bld.SAMBA3_LIBRARY('cmdline_contexts', +-- +2.28.0 + + +From d488762aa9468bd54890a2fe3dba3fd52582b556 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 23 Jul 2020 07:47:18 +0200 +Subject: [PATCH 012/105] auth:creds: Remove unused credentials autoproto + header + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/credentials_krb5.c | 1 - + auth/credentials/credentials_secrets.c | 1 - + auth/credentials/wscript_build | 1 - + source4/auth/kerberos/kerberos_util.c | 1 - + source4/auth/tests/kerberos.c | 1 - + 5 files changed, 5 deletions(-) + +diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c +index 20e677e521a..259b35b73b0 100644 +--- a/auth/credentials/credentials_krb5.c ++++ b/auth/credentials/credentials_krb5.c +@@ -27,7 +27,6 @@ + #include "auth/kerberos/kerberos.h" + #include "auth/credentials/credentials.h" + #include "auth/credentials/credentials_internal.h" +-#include "auth/credentials/credentials_proto.h" + #include "auth/credentials/credentials_krb5.h" + #include "auth/kerberos/kerberos_credentials.h" + #include "auth/kerberos/kerberos_srv_keytab.h" +diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c +index 54f3ce2d078..52a89d4d5b4 100644 +--- a/auth/credentials/credentials_secrets.c ++++ b/auth/credentials/credentials_secrets.c +@@ -29,7 +29,6 @@ + #include "system/filesys.h" + #include "auth/credentials/credentials.h" + #include "auth/credentials/credentials_internal.h" +-#include "auth/credentials/credentials_proto.h" + #include "auth/credentials/credentials_krb5.h" + #include "auth/kerberos/kerberos_util.h" + #include "param/param.h" +diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build +index f5aba1de248..564a04fe8dd 100644 +--- a/auth/credentials/wscript_build ++++ b/auth/credentials/wscript_build +@@ -2,7 +2,6 @@ + + bld.SAMBA_LIBRARY('samba-credentials', + source='credentials.c', +- autoproto='credentials_proto.h', + public_headers='credentials.h', + pc_files='samba-credentials.pc', + deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', +diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c +index ffef24f285c..544d9d853cc 100644 +--- a/source4/auth/kerberos/kerberos_util.c ++++ b/source4/auth/kerberos/kerberos_util.c +@@ -24,7 +24,6 @@ + #include "system/kerberos.h" + #include "auth/kerberos/kerberos.h" + #include "auth/credentials/credentials.h" +-#include "auth/credentials/credentials_proto.h" + #include "auth/credentials/credentials_krb5.h" + #include "auth/kerberos/kerberos_credentials.h" + #include "auth/kerberos/kerberos_util.h" +diff --git a/source4/auth/tests/kerberos.c b/source4/auth/tests/kerberos.c +index 7711eac2afa..d9be3562adb 100644 +--- a/source4/auth/tests/kerberos.c ++++ b/source4/auth/tests/kerberos.c +@@ -10,7 +10,6 @@ + #include "system/kerberos.h" + #include "auth/kerberos/kerberos.h" + #include "auth/credentials/credentials.h" +-#include "auth/credentials/credentials_proto.h" + #include "auth/credentials/credentials_krb5.h" + #include "auth/kerberos/kerberos_credentials.h" + #include "auth/kerberos/kerberos_util.h" +-- +2.28.0 + + +From 696d2230503dada1e4369500c7c632bd7d3e5527 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 26 May 2020 09:32:44 +0200 +Subject: [PATCH 013/105] auth:creds: Add + cli_credentials_(get|set)_smb_signing() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/credentials.c | 45 +++++++++++++++++++++++++ + auth/credentials/credentials.h | 7 ++++ + auth/credentials/credentials_internal.h | 4 +++ + 3 files changed, 56 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 80a31b248ae..365a6def7ea 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -44,6 +44,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) + + cred->winbind_separator = '\\'; + ++ cred->signing_state = SMB_SIGNING_DEFAULT; ++ + return cred; + } + +@@ -922,6 +924,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, + if (sep != NULL && sep[0] != '\0') { + cred->winbind_separator = *lpcfg_winbind_separator(lp_ctx); + } ++ ++ if (cred->signing_state_obtained <= CRED_SMB_CONF) { ++ /* Will be set to default for invalid smb.conf values */ ++ cred->signing_state = lpcfg_client_signing(lp_ctx); ++ cred->signing_state_obtained = CRED_SMB_CONF; ++ } + } + + /** +@@ -1304,6 +1312,43 @@ _PUBLIC_ bool cli_credentials_parse_password_fd(struct cli_credentials *credenti + return true; + } + ++/** ++ * @brief Set the SMB signing state to request for a SMB connection. ++ * ++ * @param[in] creds The credentials structure to update. ++ * ++ * @param[in] signing_state The signing state to set. ++ * ++ * @param obtained This way the described signing state was specified. ++ * ++ * @return true if we could set the signing state, false otherwise. ++ */ ++_PUBLIC_ bool cli_credentials_set_smb_signing(struct cli_credentials *creds, ++ enum smb_signing_setting signing_state, ++ enum credentials_obtained obtained) ++{ ++ if (obtained >= creds->signing_state_obtained) { ++ creds->signing_state_obtained = obtained; ++ creds->signing_state = signing_state; ++ return true; ++ } ++ ++ return false; ++} ++ ++/** ++ * @brief Obtain the SMB signing state from a credentials structure. ++ * ++ * @param[in] creds The credential structure to obtain the SMB signing state ++ * from. ++ * ++ * @return The SMB singing state. ++ */ ++_PUBLIC_ enum smb_signing_setting ++cli_credentials_get_smb_signing(struct cli_credentials *creds) ++{ ++ return creds->signing_state; ++} + + /** + * Encrypt a data blob using the session key and the negotiated encryption +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 7154c2a008c..422391ad585 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -38,6 +38,7 @@ struct gssapi_creds_container; + struct smb_krb5_context; + struct keytab_container; + struct db_context; ++enum smb_signing_setting; + + /* In order of priority */ + enum credentials_obtained { +@@ -290,6 +291,12 @@ void *_cli_credentials_callback_data(struct cli_credentials *cred); + #define cli_credentials_callback_data_void(_cred) \ + _cli_credentials_callback_data(_cred) + ++bool cli_credentials_set_smb_signing(struct cli_credentials *cred, ++ enum smb_signing_setting signing_state, ++ enum credentials_obtained obtained); ++enum smb_signing_setting ++cli_credentials_get_smb_signing(struct cli_credentials *cred); ++ + /** + * Return attached NETLOGON credentials + */ +diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h +index 68f1f25dce1..9cde0000b5f 100644 +--- a/auth/credentials/credentials_internal.h ++++ b/auth/credentials/credentials_internal.h +@@ -24,6 +24,7 @@ + + #include "../lib/util/data_blob.h" + #include "librpc/gen_ndr/misc.h" ++#include "libcli/smb/smb_constants.h" + + struct cli_credentials { + enum credentials_obtained workstation_obtained; +@@ -36,6 +37,7 @@ struct cli_credentials { + enum credentials_obtained principal_obtained; + enum credentials_obtained keytab_obtained; + enum credentials_obtained server_gss_creds_obtained; ++ enum credentials_obtained signing_state_obtained; + + /* Threshold values (essentially a MAX() over a number of the + * above) for the ccache and GSS credentials, to ensure we +@@ -117,6 +119,8 @@ struct cli_credentials { + char winbind_separator; + + bool password_will_be_nt_hash; ++ ++ enum smb_signing_setting signing_state; + }; + + #endif /* __CREDENTIALS_INTERNAL_H__ */ +-- +2.28.0 + + +From 0176a9d55aed4bdb49ac6f703dcae778b2f4ac5c Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 3 Jun 2020 11:56:01 +0200 +Subject: [PATCH 014/105] auth:creds: Add python bindings for + (get|set)_smb_signing + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/pycredentials.c | 63 +++++++++++++++++++++++++++++++ + python/samba/tests/credentials.py | 6 +++ + 2 files changed, 69 insertions(+) + +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index 68edc282741..846c418419f 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -34,6 +34,7 @@ + #include "auth/credentials/credentials_internal.h" + #include "system/kerberos.h" + #include "auth/kerberos/kerberos.h" ++#include "libcli/smb/smb_constants.h" + + void initcredentials(void); + +@@ -929,6 +930,52 @@ static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self, + Py_RETURN_NONE; + } + ++static PyObject *py_creds_get_smb_signing(PyObject *self, PyObject *unused) ++{ ++ enum smb_signing_setting signing_state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ ++ signing_state = cli_credentials_get_smb_signing(creds); ++ return PyLong_FromLong(signing_state); ++} ++ ++static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args) ++{ ++ enum smb_signing_setting signing_state; ++ struct cli_credentials *creds = NULL; ++ enum credentials_obtained obt = CRED_SPECIFIED; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ if (!PyArg_ParseTuple(args, "i|i", &signing_state, &obt)) { ++ return NULL; ++ } ++ ++ switch (signing_state) { ++ case SMB_SIGNING_DEFAULT: ++ case SMB_SIGNING_OFF: ++ case SMB_SIGNING_IF_REQUIRED: ++ case SMB_SIGNING_DESIRED: ++ case SMB_SIGNING_REQUIRED: ++ break; ++ default: ++ PyErr_Format(PyExc_TypeError, "Invalid signing state value"); ++ return NULL; ++ } ++ ++ cli_credentials_set_smb_signing(creds, signing_state, obt); ++ Py_RETURN_NONE; ++} ++ + static PyMethodDef py_creds_methods[] = { + { + .ml_name = "get_username", +@@ -1209,6 +1256,16 @@ static PyMethodDef py_creds_methods[] = { + "Encrypt the supplied password using the session key and\n" + "the negotiated encryption algorithm in place\n" + "i.e. it overwrites the original data"}, ++ { ++ .ml_name = "get_smb_signing", ++ .ml_meth = py_creds_get_smb_signing, ++ .ml_flags = METH_NOARGS, ++ }, ++ { ++ .ml_name = "set_smb_signing", ++ .ml_meth = py_creds_set_smb_signing, ++ .ml_flags = METH_VARARGS, ++ }, + { .ml_name = NULL } + }; + +@@ -1295,6 +1352,12 @@ MODULE_INIT_FUNC(credentials) + PyModule_AddObject(m, "CLI_CRED_NTLM_AUTH", PyLong_FromLong(CLI_CRED_NTLM_AUTH)); + PyModule_AddObject(m, "CLI_CRED_CLEAR_AUTH", PyLong_FromLong(CLI_CRED_CLEAR_AUTH)); + ++ PyModule_AddObject(m, "SMB_SIGNING_DEFAULT", PyLong_FromLong(SMB_SIGNING_DEFAULT)); ++ PyModule_AddObject(m, "SMB_SIGNING_OFF", PyLong_FromLong(SMB_SIGNING_OFF)); ++ PyModule_AddObject(m, "SMB_SIGNING_IF_REQUIRED", PyLong_FromLong(SMB_SIGNING_IF_REQUIRED)); ++ PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED)); ++ PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED)); ++ + Py_INCREF(&PyCredentials); + PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials); + Py_INCREF(&PyCredentialCacheContainer); +diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py +index 6454ac9ff7c..e5f8122fa21 100644 +--- a/python/samba/tests/credentials.py ++++ b/python/samba/tests/credentials.py +@@ -456,3 +456,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + self.assertEqual(creds.get_principal(), "user@samba.org") + self.assertEqual(creds.is_anonymous(), False) + self.assertEqual(creds.authentication_requested(), True) ++ ++ def test_smb_signing(self): ++ creds = credentials.Credentials() ++ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) ++ creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) ++ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) +-- +2.28.0 + + +From 96c4ce197bb62772778d822f0e5956d5a3ffe28d Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 16:31:35 +0200 +Subject: [PATCH 015/105] auth:creds: Add + cli_credentials_(get|set)_smb_ipc_signing() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/credentials.c | 51 +++++++++++++++++++++++++ + auth/credentials/credentials.h | 6 +++ + auth/credentials/credentials_internal.h | 3 ++ + 3 files changed, 60 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 365a6def7ea..dc5d51f1424 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -46,6 +46,12 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) + + cred->signing_state = SMB_SIGNING_DEFAULT; + ++ /* ++ * The default value of lpcfg_client_ipc_signing() is REQUIRED, so use ++ * the same value here. ++ */ ++ cred->ipc_signing_state = SMB_SIGNING_REQUIRED; ++ + return cred; + } + +@@ -930,6 +936,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, + cred->signing_state = lpcfg_client_signing(lp_ctx); + cred->signing_state_obtained = CRED_SMB_CONF; + } ++ ++ if (cred->ipc_signing_state_obtained <= CRED_SMB_CONF) { ++ /* Will be set to required for invalid smb.conf values */ ++ cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx); ++ cred->ipc_signing_state_obtained = CRED_SMB_CONF; ++ } + } + + /** +@@ -1350,6 +1362,45 @@ cli_credentials_get_smb_signing(struct cli_credentials *creds) + return creds->signing_state; + } + ++/** ++ * @brief Set the SMB IPC signing state to request for a SMB connection. ++ * ++ * @param[in] creds The credentials structure to update. ++ * ++ * @param[in] signing_state The signing state to set. ++ * ++ * @param obtained This way the described signing state was specified. ++ * ++ * @return true if we could set the signing state, false otherwise. ++ */ ++_PUBLIC_ bool ++cli_credentials_set_smb_ipc_signing(struct cli_credentials *creds, ++ enum smb_signing_setting ipc_signing_state, ++ enum credentials_obtained obtained) ++{ ++ if (obtained >= creds->ipc_signing_state_obtained) { ++ creds->ipc_signing_state_obtained = obtained; ++ creds->ipc_signing_state = ipc_signing_state; ++ return true; ++ } ++ ++ return false; ++} ++ ++/** ++ * @brief Obtain the SMB IPC signing state from a credentials structure. ++ * ++ * @param[in] creds The credential structure to obtain the SMB IPC signing ++ * state from. ++ * ++ * @return The SMB singing state. ++ */ ++_PUBLIC_ enum smb_signing_setting ++cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds) ++{ ++ return creds->ipc_signing_state; ++} ++ + /** + * Encrypt a data blob using the session key and the negotiated encryption + * algorithm +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 422391ad585..25bec916278 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -297,6 +297,12 @@ bool cli_credentials_set_smb_signing(struct cli_credentials *cred, + enum smb_signing_setting + cli_credentials_get_smb_signing(struct cli_credentials *cred); + ++bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred, ++ enum smb_signing_setting ipc_signing_state, ++ enum credentials_obtained obtained); ++enum smb_signing_setting ++cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred); ++ + /** + * Return attached NETLOGON credentials + */ +diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h +index 9cde0000b5f..54e8271471f 100644 +--- a/auth/credentials/credentials_internal.h ++++ b/auth/credentials/credentials_internal.h +@@ -38,6 +38,7 @@ struct cli_credentials { + enum credentials_obtained keytab_obtained; + enum credentials_obtained server_gss_creds_obtained; + enum credentials_obtained signing_state_obtained; ++ enum credentials_obtained ipc_signing_state_obtained; + + /* Threshold values (essentially a MAX() over a number of the + * above) for the ccache and GSS credentials, to ensure we +@@ -121,6 +122,8 @@ struct cli_credentials { + bool password_will_be_nt_hash; + + enum smb_signing_setting signing_state; ++ ++ enum smb_signing_setting ipc_signing_state; + }; + + #endif /* __CREDENTIALS_INTERNAL_H__ */ +-- +2.28.0 + + +From 301adf15736a4cb10f9dca267a906efb8f885354 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 3 Jun 2020 12:32:46 +0200 +Subject: [PATCH 016/105] auth:creds: Add python bindings for + (get|set)_smb_ipc_signing + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/pycredentials.c | 56 +++++++++++++++++++++++++++++++ + python/samba/tests/credentials.py | 6 ++++ + 2 files changed, 62 insertions(+) + +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index 846c418419f..1a83c506088 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -976,6 +976,52 @@ static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args) + Py_RETURN_NONE; + } + ++static PyObject *py_creds_get_smb_ipc_signing(PyObject *self, PyObject *unused) ++{ ++ enum smb_signing_setting signing_state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ ++ signing_state = cli_credentials_get_smb_ipc_signing(creds); ++ return PyLong_FromLong(signing_state); ++} ++ ++static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args) ++{ ++ enum smb_signing_setting signing_state; ++ struct cli_credentials *creds = NULL; ++ enum credentials_obtained obt = CRED_SPECIFIED; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ if (!PyArg_ParseTuple(args, "i|i", &signing_state, &obt)) { ++ return NULL; ++ } ++ ++ switch (signing_state) { ++ case SMB_SIGNING_DEFAULT: ++ case SMB_SIGNING_OFF: ++ case SMB_SIGNING_IF_REQUIRED: ++ case SMB_SIGNING_DESIRED: ++ case SMB_SIGNING_REQUIRED: ++ break; ++ default: ++ PyErr_Format(PyExc_TypeError, "Invalid signing state value"); ++ return NULL; ++ } ++ ++ cli_credentials_set_smb_ipc_signing(creds, signing_state, obt); ++ Py_RETURN_NONE; ++} ++ + static PyMethodDef py_creds_methods[] = { + { + .ml_name = "get_username", +@@ -1266,6 +1312,16 @@ static PyMethodDef py_creds_methods[] = { + .ml_meth = py_creds_set_smb_signing, + .ml_flags = METH_VARARGS, + }, ++ { ++ .ml_name = "get_smb_ipc_signing", ++ .ml_meth = py_creds_get_smb_ipc_signing, ++ .ml_flags = METH_NOARGS, ++ }, ++ { ++ .ml_name = "set_smb_ipc_signing", ++ .ml_meth = py_creds_set_smb_ipc_signing, ++ .ml_flags = METH_VARARGS, ++ }, + { .ml_name = NULL } + }; + +diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py +index e5f8122fa21..8edf13ce6ff 100644 +--- a/python/samba/tests/credentials.py ++++ b/python/samba/tests/credentials.py +@@ -462,3 +462,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) + creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) ++ ++ def test_smb_ipc_signing(self): ++ creds = credentials.Credentials() ++ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) ++ creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) ++ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) +-- +2.28.0 + + +From cf2cafb38dd319c01ff539a73d40dac8813f03a0 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 16:10:52 +0200 +Subject: [PATCH 017/105] auth:creds: Add + cli_credentials_(get|set)_smb_encryption() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/credentials.c | 45 +++++++++++++++++++++++++ + auth/credentials/credentials.h | 7 ++++ + auth/credentials/credentials_internal.h | 3 ++ + 3 files changed, 55 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index dc5d51f1424..9168b92d3ec 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -51,6 +51,7 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) + * the same value here. + */ + cred->ipc_signing_state = SMB_SIGNING_REQUIRED; ++ cred->encryption_state = SMB_ENCRYPTION_DEFAULT; + + return cred; + } +@@ -942,6 +943,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, + cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx); + cred->ipc_signing_state_obtained = CRED_SMB_CONF; + } ++ ++ if (cred->encryption_state_obtained <= CRED_SMB_CONF) { ++ /* Will be set to default for invalid smb.conf values */ ++ cred->encryption_state = lpcfg_client_smb_encrypt(lp_ctx); ++ cred->encryption_state_obtained = CRED_SMB_CONF; ++ } + } + + /** +@@ -1401,6 +1408,44 @@ cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds) + return creds->ipc_signing_state; + } + ++/** ++ * @brief Set the SMB encryption state to request for a SMB connection. ++ * ++ * @param[in] creds The credentials structure to update. ++ * ++ * @param[in] encryption_state The encryption state to set. ++ * ++ * @param obtained This way the described encryption state was specified. ++ * ++ * @return true if we could set the encryption state, false otherwise. ++ */ ++_PUBLIC_ bool cli_credentials_set_smb_encryption(struct cli_credentials *creds, ++ enum smb_encryption_setting encryption_state, ++ enum credentials_obtained obtained) ++{ ++ if (obtained >= creds->encryption_state_obtained) { ++ creds->encryption_state_obtained = obtained; ++ creds->encryption_state = encryption_state; ++ return true; ++ } ++ ++ return false; ++} ++ ++/** ++ * @brief Obtain the SMB encryption state from a credentials structure. ++ * ++ * @param[in] creds The credential structure to obtain the SMB encryption state ++ * from. ++ * ++ * @return The SMB singing state. ++ */ ++_PUBLIC_ enum smb_encryption_setting ++cli_credentials_get_smb_encryption(struct cli_credentials *creds) ++{ ++ return creds->encryption_state; ++} ++ + /** + * Encrypt a data blob using the session key and the negotiated encryption + * algorithm +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 25bec916278..7d0cf53194b 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -39,6 +39,7 @@ struct smb_krb5_context; + struct keytab_container; + struct db_context; + enum smb_signing_setting; ++enum smb_encryption_setting; + + /* In order of priority */ + enum credentials_obtained { +@@ -303,6 +304,12 @@ bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred, + enum smb_signing_setting + cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred); + ++bool cli_credentials_set_smb_encryption(struct cli_credentials *cred, ++ enum smb_encryption_setting encryption_state, ++ enum credentials_obtained obtained); ++enum smb_encryption_setting ++cli_credentials_get_smb_encryption(struct cli_credentials *cred); ++ + /** + * Return attached NETLOGON credentials + */ +diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h +index 54e8271471f..3b86b742448 100644 +--- a/auth/credentials/credentials_internal.h ++++ b/auth/credentials/credentials_internal.h +@@ -39,6 +39,7 @@ struct cli_credentials { + enum credentials_obtained server_gss_creds_obtained; + enum credentials_obtained signing_state_obtained; + enum credentials_obtained ipc_signing_state_obtained; ++ enum credentials_obtained encryption_state_obtained; + + /* Threshold values (essentially a MAX() over a number of the + * above) for the ccache and GSS credentials, to ensure we +@@ -124,6 +125,8 @@ struct cli_credentials { + enum smb_signing_setting signing_state; + + enum smb_signing_setting ipc_signing_state; ++ ++ enum smb_encryption_setting encryption_state; + }; + + #endif /* __CREDENTIALS_INTERNAL_H__ */ +-- +2.28.0 + + +From a25732f42cf7418789c2102f093dc0b3062543fd Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 3 Jun 2020 12:38:30 +0200 +Subject: [PATCH 018/105] auth:creds: Add python bindings for + (get|set)_smb_encryption + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/pycredentials.c | 62 +++++++++++++++++++++++++++++++ + python/samba/tests/credentials.py | 6 +++ + 2 files changed, 68 insertions(+) + +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index 1a83c506088..628aae6500b 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -1022,6 +1022,52 @@ static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args) + Py_RETURN_NONE; + } + ++static PyObject *py_creds_get_smb_encryption(PyObject *self, PyObject *unused) ++{ ++ enum smb_encryption_setting encryption_state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ ++ encryption_state = cli_credentials_get_smb_encryption(creds); ++ return PyLong_FromLong(encryption_state); ++} ++ ++static PyObject *py_creds_set_smb_encryption(PyObject *self, PyObject *args) ++{ ++ enum smb_encryption_setting encryption_state; ++ struct cli_credentials *creds = NULL; ++ enum credentials_obtained obt = CRED_SPECIFIED; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ if (!PyArg_ParseTuple(args, "i|i", &encryption_state, &obt)) { ++ return NULL; ++ } ++ ++ switch (encryption_state) { ++ case SMB_ENCRYPTION_DEFAULT: ++ case SMB_ENCRYPTION_OFF: ++ case SMB_ENCRYPTION_IF_REQUIRED: ++ case SMB_ENCRYPTION_DESIRED: ++ case SMB_ENCRYPTION_REQUIRED: ++ break; ++ default: ++ PyErr_Format(PyExc_TypeError, "Invalid encryption state value"); ++ return NULL; ++ } ++ ++ cli_credentials_set_smb_encryption(creds, encryption_state, obt); ++ Py_RETURN_NONE; ++} ++ + static PyMethodDef py_creds_methods[] = { + { + .ml_name = "get_username", +@@ -1322,6 +1368,16 @@ static PyMethodDef py_creds_methods[] = { + .ml_meth = py_creds_set_smb_ipc_signing, + .ml_flags = METH_VARARGS, + }, ++ { ++ .ml_name = "get_smb_encryption", ++ .ml_meth = py_creds_get_smb_encryption, ++ .ml_flags = METH_NOARGS, ++ }, ++ { ++ .ml_name = "set_smb_encryption", ++ .ml_meth = py_creds_set_smb_encryption, ++ .ml_flags = METH_VARARGS, ++ }, + { .ml_name = NULL } + }; + +@@ -1414,6 +1470,12 @@ MODULE_INIT_FUNC(credentials) + PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED)); + PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED)); + ++ PyModule_AddObject(m, "SMB_ENCRYPTION_DEFAULT", PyLong_FromLong(SMB_ENCRYPTION_DEFAULT)); ++ PyModule_AddObject(m, "SMB_ENCRYPTION_OFF", PyLong_FromLong(SMB_ENCRYPTION_OFF)); ++ PyModule_AddObject(m, "SMB_ENCRYPTION_IF_REQUIRED", PyLong_FromLong(SMB_ENCRYPTION_IF_REQUIRED)); ++ PyModule_AddObject(m, "SMB_ENCRYPTION_DESIRED", PyLong_FromLong(SMB_ENCRYPTION_DESIRED)); ++ PyModule_AddObject(m, "SMB_ENCRYPTION_REQUIRED", PyLong_FromLong(SMB_ENCRYPTION_REQUIRED)); ++ + Py_INCREF(&PyCredentials); + PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials); + Py_INCREF(&PyCredentialCacheContainer); +diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py +index 8edf13ce6ff..e0a6248d37a 100644 +--- a/python/samba/tests/credentials.py ++++ b/python/samba/tests/credentials.py +@@ -468,3 +468,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) + creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) ++ ++ def test_smb_encryption(self): ++ creds = credentials.Credentials() ++ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) ++ creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) ++ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) +-- +2.28.0 + + +From 1a1809bd260ceff97dd4ff697f78b97a63f60b48 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 4 Jun 2020 11:19:53 +0200 +Subject: [PATCH 019/105] auth:creds: Add python bindings for + cli_credentials_set_conf() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/pycredentials.c | 41 +++++++++++++++++++++++++++++++ + python/samba/tests/credentials.py | 33 +++++++++++++++++++++++++ + 2 files changed, 74 insertions(+) + +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index 628aae6500b..17c90573f09 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -621,6 +621,42 @@ static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args) + Py_RETURN_NONE; + } + ++static PyObject *py_creds_set_conf(PyObject *self, PyObject *args) ++{ ++ PyObject *py_lp_ctx = Py_None; ++ struct loadparm_context *lp_ctx; ++ TALLOC_CTX *mem_ctx; ++ struct cli_credentials *creds; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ ++ if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx)) { ++ return NULL; ++ } ++ ++ mem_ctx = talloc_new(NULL); ++ if (mem_ctx == NULL) { ++ PyErr_NoMemory(); ++ return NULL; ++ } ++ ++ lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx); ++ if (lp_ctx == NULL) { ++ talloc_free(mem_ctx); ++ return NULL; ++ } ++ ++ cli_credentials_set_conf(creds, lp_ctx); ++ ++ talloc_free(mem_ctx); ++ ++ Py_RETURN_NONE; ++} ++ + static PyObject *py_creds_guess(PyObject *self, PyObject *args) + { + PyObject *py_lp_ctx = Py_None; +@@ -1279,6 +1315,11 @@ static PyMethodDef py_creds_methods[] = { + .ml_meth = py_creds_set_krb_forwardable, + .ml_flags = METH_VARARGS, + }, ++ { ++ .ml_name = "set_conf", ++ .ml_meth = py_creds_set_conf, ++ .ml_flags = METH_VARARGS, ++ }, + { + .ml_name = "guess", + .ml_meth = py_creds_guess, +diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py +index e0a6248d37a..6187bded0b6 100644 +--- a/python/samba/tests/credentials.py ++++ b/python/samba/tests/credentials.py +@@ -463,14 +463,47 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) + ++ def test_smb_signing_set_conf(self): ++ lp = samba.tests.env_loadparm() ++ ++ creds = credentials.Credentials() ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) ++ creds.set_smb_signing(credentials.SMB_SIGNING_OFF) ++ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF) ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF) ++ + def test_smb_ipc_signing(self): + creds = credentials.Credentials() + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) + creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) + ++ def test_smb_ipc_signing_set_conf(self): ++ lp = samba.tests.env_loadparm() ++ ++ creds = credentials.Credentials() ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) ++ creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) ++ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) ++ + def test_smb_encryption(self): + creds = credentials.Credentials() + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) + creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) ++ ++ def test_smb_encryption_set_conf(self): ++ lp = samba.tests.env_loadparm() ++ ++ creds = credentials.Credentials() ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) ++ creds.set_smb_encryption(credentials.SMB_ENCRYPTION_OFF) ++ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) +-- +2.28.0 + + +From 72b31403174eb23fe4fdf75ad918e845a740db6f Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 23 Jul 2020 08:14:23 +0200 +Subject: [PATCH 020/105] auth:creds: Bump library version + +We added new functions so bump the version. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/wscript_build | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build +index 564a04fe8dd..1e3302e3e48 100644 +--- a/auth/credentials/wscript_build ++++ b/auth/credentials/wscript_build +@@ -5,7 +5,7 @@ bld.SAMBA_LIBRARY('samba-credentials', + public_headers='credentials.h', + pc_files='samba-credentials.pc', + deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', +- vnum='0.0.1' ++ vnum='0.1.0' + ) + + bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', +-- +2.28.0 + + +From 918b87437b9c36981049ca4e3cf0220ad56ec7c2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 27 May 2020 11:10:30 +0200 +Subject: [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/lib/util_cmdline.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c +index bc1f1c3ed25..6038ec11515 100644 +--- a/source3/lib/util_cmdline.c ++++ b/source3/lib/util_cmdline.c +@@ -40,7 +40,6 @@ struct user_auth_info { + struct loadparm_context *lp_ctx; + bool got_username; + bool got_pass; +- int signing_state; + bool smb_encrypt; + bool use_machine_account; + bool use_pw_nt_hash; +@@ -70,7 +69,6 @@ struct user_auth_info *user_auth_info_init(TALLOC_CTX *mem_ctx) + + cli_credentials_set_conf(result->creds, result->lp_ctx); + +- result->signing_state = SMB_SIGNING_DEFAULT; + return result; + } + +@@ -241,15 +239,23 @@ void set_cmdline_auth_info_password(struct user_auth_info *auth_info, + bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info, + const char *arg) + { +- auth_info->signing_state = smb_signing_setting_translate(arg); ++ enum smb_signing_setting signing_state = ++ smb_signing_setting_translate(arg); ++ bool ok; + +- return true; ++ ok = cli_credentials_set_smb_signing(auth_info->creds, ++ signing_state, ++ CRED_SPECIFIED); ++ ++ return ok; + } + + void set_cmdline_auth_info_signing_state_raw(struct user_auth_info *auth_info, + int signing_state) + { +- auth_info->signing_state = signing_state; ++ cli_credentials_set_smb_signing(auth_info->creds, ++ signing_state, ++ CRED_SPECIFIED); + } + + int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info) +@@ -257,7 +263,7 @@ int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info) + if (auth_info->smb_encrypt) { + return SMB_SIGNING_REQUIRED; + } +- return auth_info->signing_state; ++ return cli_credentials_get_smb_signing(auth_info->creds); + } + + void set_cmdline_auth_info_use_ccache(struct user_auth_info *auth_info, bool b) +-- +2.28.0 + + +From 22efb02d818946e4f03ebfb72ea345e9106deca8 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:45:34 +0200 +Subject: [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/lib/util_cmdline.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c +index 6038ec11515..9c9e2f0ac0f 100644 +--- a/source3/lib/util_cmdline.c ++++ b/source3/lib/util_cmdline.c +@@ -377,6 +377,9 @@ void set_cmdline_auth_info_use_krb5_ticket(struct user_auth_info *auth_info) + /* This should only be used by lib/popt_common.c JRA */ + void set_cmdline_auth_info_smb_encrypt(struct user_auth_info *auth_info) + { ++ cli_credentials_set_smb_encryption(auth_info->creds, ++ SMB_ENCRYPTION_REQUIRED, ++ CRED_SPECIFIED); + auth_info->smb_encrypt = true; + } + +-- +2.28.0 + + +From 9abae48706106793f8952524ad2325bdd6a5101c Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 13 Aug 2020 10:40:23 +0200 +Subject: [PATCH 023/105] python: Remove unused sign argument from + smb_connection() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/netcmd/gpo.py | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py +index 1e2c2918ebe..ad60cda0690 100644 +--- a/python/samba/netcmd/gpo.py ++++ b/python/samba/netcmd/gpo.py +@@ -382,13 +382,13 @@ def create_directory_hier(conn, remotedir): + if not conn.chkpath(path): + conn.mkdir(path) + +-def smb_connection(dc_hostname, service, lp, creds, sign=False): ++def smb_connection(dc_hostname, service, lp, creds): + # SMB connect to DC + try: + # the SMB bindings rely on having a s3 loadparm + s3_lp = s3param.get_context() + s3_lp.load(lp.configfile) +- conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=sign) ++ conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) + except Exception: + raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) + return conn +@@ -998,7 +998,7 @@ class cmd_fetch(GPOCommand): + + # SMB connect to DC + conn = smb_connection(dc_hostname, service, lp=self.lp, +- creds=self.creds, sign=True) ++ creds=self.creds) + + # Copy GPT + tmpdir, gpodir = self.construct_tmpdir(tmpdir, gpo) +@@ -1629,8 +1629,7 @@ class cmd_admxload(Command): + conn = smb_connection(dc_hostname, + 'sysvol', + lp=self.lp, +- creds=self.creds, +- sign=True) ++ creds=self.creds) + + smb_dir = '\\'.join([self.lp.get('realm').lower(), + 'Policies', 'PolicyDefinitions']) +-- +2.28.0 + + +From e2f0f56ea6ec4f9696affdee08de89c0bdffa719 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 3 Jun 2020 14:02:37 +0200 +Subject: [PATCH 024/105] python: Set smb signing via the creds API + +Pair-Programmed-With: Stefan Metzmacher + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/gpclass.py | 7 +++++++ + python/samba/netcmd/domain_backup.py | 10 +++++++++- + python/samba/netcmd/gpo.py | 6 ++++++ + 3 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py +index cc574e12a42..1781a55a618 100644 +--- a/python/samba/gpclass.py ++++ b/python/samba/gpclass.py +@@ -38,6 +38,7 @@ from tempfile import NamedTemporaryFile + from samba.dcerpc import preg + from samba.dcerpc import misc + from samba.ndr import ndr_pack, ndr_unpack ++from samba.credentials import SMB_SIGNING_REQUIRED + + try: + from enum import Enum +@@ -421,7 +422,13 @@ def check_refresh_gpo_list(dc_hostname, lp, creds, gpos): + # the SMB bindings rely on having a s3 loadparm + s3_lp = s3param.get_context() + s3_lp.load(lp.configfile) ++ ++ # Force signing for the connection ++ saved_signing_state = creds.get_smb_signing() ++ creds.set_smb_signing(SMB_SIGNING_REQUIRED) + conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds, sign=True) ++ # Reset signing state ++ creds.set_smb_signing(saved_signing_state) + cache_path = lp.cache_path('gpo_cache') + for gpo in gpos: + if not gpo.file_sys_path: +diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py +index a3dc7fb454f..a9e0ba5bc67 100644 +--- a/python/samba/netcmd/domain_backup.py ++++ b/python/samba/netcmd/domain_backup.py +@@ -54,6 +54,7 @@ from subprocess import CalledProcessError + from samba import sites + from samba.dsdb import _dsdb_load_udv_v2 + from samba.ndr import ndr_pack ++from samba.credentials import SMB_SIGNING_REQUIRED + + + # work out a SID (based on a free RID) to use when the domain gets restored. +@@ -115,7 +116,14 @@ def smb_sysvol_conn(server, lp, creds): + # the SMB bindings rely on having a s3 loadparm + s3_lp = s3param.get_context() + s3_lp.load(lp.configfile) +- return libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) ++ ++ # Force signing for the connection ++ saved_signing_state = creds.get_smb_signing() ++ creds.set_smb_signing(SMB_SIGNING_REQUIRED) ++ conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) ++ # Reset signing state ++ creds.set_smb_signing(saved_signing_state) ++ return conn + + + def get_timestamp(): +diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py +index ad60cda0690..0f2f6520fc3 100644 +--- a/python/samba/netcmd/gpo.py ++++ b/python/samba/netcmd/gpo.py +@@ -62,6 +62,7 @@ from samba.gp_parse.gp_csv import GPAuditCsvParser + from samba.gp_parse.gp_inf import GptTmplInfParser + from samba.gp_parse.gp_aas import GPAasParser + from samba import param ++from samba.credentials import SMB_SIGNING_REQUIRED + + + def attr_default(msg, attrname, default): +@@ -384,6 +385,9 @@ def create_directory_hier(conn, remotedir): + + def smb_connection(dc_hostname, service, lp, creds): + # SMB connect to DC ++ # Force signing for the smb connection ++ saved_signing_state = creds.get_smb_signing() ++ creds.set_smb_signing(SMB_SIGNING_REQUIRED) + try: + # the SMB bindings rely on having a s3 loadparm + s3_lp = s3param.get_context() +@@ -391,6 +395,8 @@ def smb_connection(dc_hostname, service, lp, creds): + conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) + except Exception: + raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) ++ # Reset signing state ++ creds.set_smb_signing(saved_signing_state) + return conn + + +-- +2.28.0 + + +From 53b2d53349b8f453cd0144f01b833deca52e3626 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 17:22:12 +0200 +Subject: [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + examples/winexe/winexe.c | 2 +- + source3/include/client.h | 1 + + source3/libnet/libnet_join.c | 6 +++--- + source3/libsmb/cliconnect.c | 3 ++- + source3/rpc_server/spoolss/srv_spoolss_nt.c | 4 +++- + source3/rpcclient/cmd_spoolss.c | 2 +- + source3/rpcclient/rpcclient.c | 2 +- + source3/utils/mdfind.c | 2 +- + source3/utils/net_ads.c | 3 ++- + source3/utils/net_util.c | 9 +++++++-- + source3/utils/netlookup.c | 4 +++- + 11 files changed, 25 insertions(+), 13 deletions(-) + +diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c +index fc6b15f8e52..bb9c27e2e6d 100644 +--- a/examples/winexe/winexe.c ++++ b/examples/winexe/winexe.c +@@ -1919,7 +1919,7 @@ int main(int argc, const char *argv[]) + "IPC$", + "?????", + options.credentials, +- 0, ++ CLI_FULL_CONNECTION_IPC, + 0); + + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/include/client.h b/source3/include/client.h +index 6a3b1b02ff3..19a738900b7 100644 +--- a/source3/include/client.h ++++ b/source3/include/client.h +@@ -121,5 +121,6 @@ struct file_info { + #define CLI_FULL_CONNECTION_FORCE_ASCII 0x0100 + #define CLI_FULL_CONNECTION_FORCE_SMB1 0x0400 + #define CLI_FULL_CONNECTION_DISABLE_SMB1 0x0800 ++#define CLI_FULL_CONNECTION_IPC 0x1000 + + #endif /* _CLIENT_H */ +diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c +index 34938603606..392e3eff74f 100644 +--- a/source3/libnet/libnet_join.c ++++ b/source3/libnet/libnet_join.c +@@ -1068,7 +1068,7 @@ static NTSTATUS libnet_join_connect_dc_ipc(const char *dc, + bool use_ccache = false; + bool pw_nt_hash = false; + struct cli_credentials *creds = NULL; +- int flags = 0; ++ int flags = CLI_FULL_CONNECTION_IPC; + NTSTATUS status; + + if (use_kerberos && pass) { +@@ -1684,7 +1684,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, + struct netlogon_creds_CredentialState *creds = NULL; + uint32_t netlogon_flags = 0; + NTSTATUS status; +- int flags = 0; ++ int flags = CLI_FULL_CONNECTION_IPC; + + if (!dc_name) { + TALLOC_FREE(frame); +@@ -1734,7 +1734,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, + NULL, 0, + "IPC$", "IPC", + anon_creds, +- 0, ++ flags, + SMB_SIGNING_OFF); + } + +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index 1fb1f0127b9..f20146378e3 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -2788,7 +2788,7 @@ static struct tevent_req *cli_start_connection_send( + } + state->ev = ev; + +- if (signing_state == SMB_SIGNING_IPC_DEFAULT) { ++ if (flags & CLI_FULL_CONNECTION_IPC) { + state->min_protocol = lp_client_ipc_min_protocol(); + state->max_protocol = lp_client_ipc_max_protocol(); + } else { +@@ -3673,6 +3673,7 @@ struct cli_state *get_ipc_connect(char *server, + uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK; + + flags |= CLI_FULL_CONNECTION_FORCE_SMB1; ++ flags |= CLI_FULL_CONNECTION_IPC; + + nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", + get_cmdline_auth_info_creds(user_info), +diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c +index 8b6a803a910..16e3ee485f0 100644 +--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c ++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c +@@ -2481,7 +2481,9 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c + /* setup the connection */ + ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, + &rm_addr, 0, "IPC$", "IPC", +- anon_creds, 0, SMB_SIGNING_OFF); ++ anon_creds, ++ CLI_FULL_CONNECTION_IPC, ++ SMB_SIGNING_OFF); + TALLOC_FREE(anon_creds); + if ( !NT_STATUS_IS_OK( ret ) ) { + DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n", +diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c +index a7e0c673a65..7198a451ab7 100644 +--- a/source3/rpcclient/cmd_spoolss.c ++++ b/source3/rpcclient/cmd_spoolss.c +@@ -3537,7 +3537,7 @@ static WERROR cmd_spoolss_printercmp(struct rpc_pipe_client *cli, + "IPC$", "IPC", + get_cmdline_auth_info_creds( + popt_get_cmdline_auth_info()), +- 0, /* flags */ ++ CLI_FULL_CONNECTION_IPC, + get_cmdline_auth_info_signing_state( + popt_get_cmdline_auth_info())); + +diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c +index 67a1066fc15..c86474d08f1 100644 +--- a/source3/rpcclient/rpcclient.c ++++ b/source3/rpcclient/rpcclient.c +@@ -1019,7 +1019,7 @@ out_free: + static int opt_port = 0; + int result = 0; + TALLOC_CTX *frame = talloc_stackframe(); +- uint32_t flags = 0; ++ uint32_t flags = CLI_FULL_CONNECTION_IPC; + struct dcerpc_binding *binding = NULL; + enum dcerpc_transport_t transport; + uint32_t bflags = 0; +diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c +index 2f952c29b4f..a3c879e75fb 100644 +--- a/source3/utils/mdfind.c ++++ b/source3/utils/mdfind.c +@@ -70,7 +70,7 @@ int main(int argc, char **argv) + const char *mds_query = NULL; + struct cli_state *cli = NULL; + char *basepath = NULL; +- uint32_t flags = 0; ++ uint32_t flags = CLI_FULL_CONNECTION_IPC; + int signing_state = SMB_SIGNING_IPC_DEFAULT; + uint64_t *cnids = NULL; + size_t ncnids; +diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c +index e5db844c2f2..28ef6dc9974 100644 +--- a/source3/utils/net_ads.c ++++ b/source3/utils/net_ads.c +@@ -2437,7 +2437,8 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * + nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername, + &server_ss, 0, + "IPC$", "IPC", +- creds, 0, ++ creds, ++ CLI_FULL_CONNECTION_IPC, + SMB_SIGNING_IPC_DEFAULT); + + if (NT_STATUS_IS_ERR(nt_status)) { +diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c +index c566ecc9000..d01b2d8c771 100644 +--- a/source3/utils/net_util.c ++++ b/source3/utils/net_util.c +@@ -110,6 +110,7 @@ NTSTATUS connect_to_service(struct net_context *c, + NTSTATUS nt_status; + enum smb_signing_setting signing_setting = SMB_SIGNING_DEFAULT; + struct cli_credentials *creds = NULL; ++ int flags = 0; + + creds = net_context_creds(c, c); + if (creds == NULL) { +@@ -119,12 +120,14 @@ NTSTATUS connect_to_service(struct net_context *c, + + if (strequal(service_type, "IPC")) { + signing_setting = SMB_SIGNING_IPC_DEFAULT; ++ flags |= CLI_FULL_CONNECTION_IPC; + } + + nt_status = cli_full_connection_creds(cli_ctx, NULL, server_name, + server_ss, c->opt_port, + service_name, service_type, +- creds, 0, ++ creds, ++ flags, + signing_setting); + if (!NT_STATUS_IS_OK(nt_status)) { + d_fprintf(stderr, _("Could not connect to server %s\n"), +@@ -195,7 +198,9 @@ NTSTATUS connect_to_ipc_anonymous(struct net_context *c, + nt_status = cli_full_connection_creds(cli_ctx, c->opt_requester_name, + server_name, server_ss, c->opt_port, + "IPC$", "IPC", +- anon_creds, 0, SMB_SIGNING_OFF); ++ anon_creds, ++ CLI_FULL_CONNECTION_IPC, ++ SMB_SIGNING_OFF); + + if (NT_STATUS_IS_OK(nt_status)) { + return nt_status; +diff --git a/source3/utils/netlookup.c b/source3/utils/netlookup.c +index 6cea2ee306c..2241beb331f 100644 +--- a/source3/utils/netlookup.c ++++ b/source3/utils/netlookup.c +@@ -98,7 +98,9 @@ static struct con_struct *create_cs(struct net_context *c, + nt_status = cli_full_connection_creds(&cs->cli, lp_netbios_name(), lp_netbios_name(), + &loopback_ss, 0, + "IPC$", "IPC", +- anon_creds, 0, SMB_SIGNING_OFF); ++ anon_creds, ++ CLI_FULL_CONNECTION_IPC, ++ SMB_SIGNING_OFF); + + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); +-- +2.28.0 + + +From 975383e368a3891e92fb071ab20f2b5208167500 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 17:29:25 +0200 +Subject: [PATCH 026/105] s3:pylibsmb: Add ipc=True support for + CLI_FULL_CONNECTION_IPC + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/libsmb/pylibsmb.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c +index 3fcc3424a57..3579a040830 100644 +--- a/source3/libsmb/pylibsmb.c ++++ b/source3/libsmb/pylibsmb.c +@@ -445,6 +445,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + int signing_state = SMB_SIGNING_DEFAULT; + PyObject *py_force_smb1 = Py_False; + bool force_smb1 = false; ++ PyObject *py_ipc = Py_False; ++ bool use_ipc = false; + struct tevent_req *req; + bool ret; + int flags = 0; +@@ -452,6 +454,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + static const char *kwlist[] = { + "host", "share", "lp", "creds", + "multi_threaded", "sign", "force_smb1", ++ "ipc", + NULL + }; + +@@ -462,12 +465,13 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + } + + ret = ParseTupleAndKeywords( +- args, kwds, "ssO|O!OOO", kwlist, ++ args, kwds, "ssO|O!OOOO", kwlist, + &host, &share, &py_lp, + py_type_Credentials, &creds, + &py_multi_threaded, + &py_sign, +- &py_force_smb1); ++ &py_force_smb1, ++ &py_ipc); + + Py_DECREF(py_type_Credentials); + +@@ -493,6 +497,11 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + flags = CLI_FULL_CONNECTION_FORCE_SMB1; + } + ++ use_ipc = PyObject_IsTrue(py_ipc); ++ if (use_ipc) { ++ flags |= CLI_FULL_CONNECTION_IPC; ++ } ++ + if (multi_threaded) { + #ifdef HAVE_PTHREAD + ret = py_cli_state_setup_mt_ev(self); +-- +2.28.0 + + +From 59831141a17195b9308d75257123134b0217489c Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 24 Jul 2020 09:47:11 +0200 +Subject: [PATCH 027/105] python:tests: Mark libsmb connection as an IPC + connection + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/tests/dcerpc/raw_testcase.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py +index ba7440df13b..2c028d381db 100644 +--- a/python/samba/tests/dcerpc/raw_testcase.py ++++ b/python/samba/tests/dcerpc/raw_testcase.py +@@ -43,7 +43,7 @@ class smb_pipe_socket(object): + lp3 = s3param.get_context() + lp3.load(lp.configfile) + self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, +- creds=creds, sign=True) ++ creds=creds, ipc=True, sign=True) + self.smbfid = self.smbconn.create(pipename, + DesiredAccess=0x12019f, + ShareAccess=0x7, +-- +2.28.0 + + +From b9df53c20a753bf31b8684776f2b6aaaf1583abe Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 17 Aug 2020 12:52:39 +0200 +Subject: [PATCH 028/105] python:tests: Set smb ipc signing via the creds API + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/tests/dcerpc/raw_testcase.py | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py +index 2c028d381db..d6f5de7440a 100644 +--- a/python/samba/tests/dcerpc/raw_testcase.py ++++ b/python/samba/tests/dcerpc/raw_testcase.py +@@ -36,14 +36,18 @@ from samba.ntstatus import ( + from samba import NTSTATUSError + from samba.samba3 import param as s3param + from samba.samba3 import libsmb_samba_internal as libsmb ++from samba.credentials import SMB_SIGNING_REQUIRED + + class smb_pipe_socket(object): + + def __init__(self, target_hostname, pipename, creds, impersonation_level, lp): + lp3 = s3param.get_context() + lp3.load(lp.configfile) ++ saved_signing_state = creds.get_smb_ipc_signing() ++ creds.set_smb_ipc_signing(SMB_SIGNING_REQUIRED) + self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, + creds=creds, ipc=True, sign=True) ++ creds.set_smb_ipc_signing(saved_signing_state) + self.smbfid = self.smbconn.create(pipename, + DesiredAccess=0x12019f, + ShareAccess=0x7, +-- +2.28.0 + + +From c9e88d833db2b472099e5751b7731e337342d2c4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 17:59:19 +0200 +Subject: [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in + cliconnect.c + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/libsmb/cliconnect.c | 14 +++++++------- + source3/libsmb/proto.h | 10 +++++----- + 2 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index f20146378e3..bb20aa59385 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -2631,7 +2631,7 @@ static NTSTATUS cli_connect_sock_recv(struct tevent_req *req, + + struct cli_connect_nb_state { + const char *desthost; +- int signing_state; ++ enum smb_signing_setting signing_state; + int flags; + struct cli_state *cli; + }; +@@ -2642,7 +2642,7 @@ static struct tevent_req *cli_connect_nb_send( + TALLOC_CTX *mem_ctx, struct tevent_context *ev, + const char *host, const struct sockaddr_storage *dest_ss, + uint16_t port, int name_type, const char *myname, +- int signing_state, int flags) ++ enum smb_signing_setting signing_state, int flags) + { + struct tevent_req *req, *subreq; + struct cli_connect_nb_state *state; +@@ -2727,7 +2727,7 @@ static NTSTATUS cli_connect_nb_recv(struct tevent_req *req, + + NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss, + uint16_t port, int name_type, const char *myname, +- int signing_state, int flags, struct cli_state **pcli) ++ enum smb_signing_setting signing_state, int flags, struct cli_state **pcli) + { + struct tevent_context *ev; + struct tevent_req *req; +@@ -2776,7 +2776,7 @@ static struct tevent_req *cli_start_connection_send( + TALLOC_CTX *mem_ctx, struct tevent_context *ev, + const char *my_name, const char *dest_host, + const struct sockaddr_storage *dest_ss, int port, +- int signing_state, int flags) ++ enum smb_signing_setting signing_state, int flags) + { + struct tevent_req *req, *subreq; + struct cli_start_connection_state *state; +@@ -2881,7 +2881,7 @@ NTSTATUS cli_start_connection(struct cli_state **output_cli, + const char *my_name, + const char *dest_host, + const struct sockaddr_storage *dest_ss, int port, +- int signing_state, int flags) ++ enum smb_signing_setting signing_state, int flags) + { + struct tevent_context *ev; + struct tevent_req *req; +@@ -3361,7 +3361,7 @@ struct tevent_req *cli_full_connection_creds_send( + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, int signing_state) ++ int flags, enum smb_signing_setting signing_state) + { + struct tevent_req *req, *subreq; + struct cli_full_connection_creds_state *state; +@@ -3520,7 +3520,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, + const char *service, const char *service_type, + struct cli_credentials *creds, + int flags, +- int signing_state) ++ enum smb_signing_setting signing_state) + { + struct tevent_context *ev; + struct tevent_req *req; +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index d214cdabca4..995187e21b4 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -86,12 +86,12 @@ NTSTATUS cli_tree_connect(struct cli_state *cli, const char *share, + NTSTATUS cli_tdis(struct cli_state *cli); + NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss, + uint16_t port, int name_type, const char *myname, +- int signing_state, int flags, struct cli_state **pcli); ++ enum smb_signing_setting signing_state, int flags, struct cli_state **pcli); + NTSTATUS cli_start_connection(struct cli_state **output_cli, + const char *my_name, + const char *dest_host, + const struct sockaddr_storage *dest_ss, int port, +- int signing_state, int flags); ++ enum smb_signing_setting signing_state, int flags); + NTSTATUS cli_smb1_setup_encryption(struct cli_state *cli, + struct cli_credentials *creds); + struct tevent_req *cli_full_connection_creds_send( +@@ -100,7 +100,7 @@ struct tevent_req *cli_full_connection_creds_send( + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, int signing_state); ++ int flags, enum smb_signing_setting signing_state); + NTSTATUS cli_full_connection_creds_recv(struct tevent_req *req, + struct cli_state **output_cli); + NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, +@@ -110,7 +110,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, + const char *service, const char *service_type, + struct cli_credentials *creds, + int flags, +- int signing_state); ++ enum smb_signing_setting signing_state); + NTSTATUS cli_raw_tcon(struct cli_state *cli, + const char *service, const char *pass, const char *dev, + uint16_t *max_xmit, uint16_t *tid); +@@ -177,7 +177,7 @@ extern struct GUID cli_state_client_guid; + struct cli_state *cli_state_create(TALLOC_CTX *mem_ctx, + int fd, + const char *remote_name, +- int signing_state, ++ enum smb_signing_setting signing_state, + int flags); + void cli_nt_pipes_close(struct cli_state *cli); + void cli_shutdown(struct cli_state *cli); +-- +2.28.0 + + +From 40c201c4d1b4621e823485e3082d0ca5799a6237 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 18:11:31 +0200 +Subject: [PATCH 030/105] s3:client: Turn off smb signing for message op + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/gpclass.py | 2 +- + python/samba/netcmd/domain_backup.py | 2 +- + python/samba/netcmd/gpo.py | 2 +- + python/samba/tests/dcerpc/raw_testcase.py | 2 +- + source3/client/client.c | 5 ++++- + source3/libsmb/pylibsmb.c | 20 +++++++++----------- + 6 files changed, 17 insertions(+), 16 deletions(-) + +diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py +index 1781a55a618..2c00f5349a0 100644 +--- a/python/samba/gpclass.py ++++ b/python/samba/gpclass.py +@@ -426,7 +426,7 @@ def check_refresh_gpo_list(dc_hostname, lp, creds, gpos): + # Force signing for the connection + saved_signing_state = creds.get_smb_signing() + creds.set_smb_signing(SMB_SIGNING_REQUIRED) +- conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds, sign=True) ++ conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds) + # Reset signing state + creds.set_smb_signing(saved_signing_state) + cache_path = lp.cache_path('gpo_cache') +diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py +index a9e0ba5bc67..2977b071ec3 100644 +--- a/python/samba/netcmd/domain_backup.py ++++ b/python/samba/netcmd/domain_backup.py +@@ -120,7 +120,7 @@ def smb_sysvol_conn(server, lp, creds): + # Force signing for the connection + saved_signing_state = creds.get_smb_signing() + creds.set_smb_signing(SMB_SIGNING_REQUIRED) +- conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) ++ conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds) + # Reset signing state + creds.set_smb_signing(saved_signing_state) + return conn +diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py +index 0f2f6520fc3..bbaa0c17881 100644 +--- a/python/samba/netcmd/gpo.py ++++ b/python/samba/netcmd/gpo.py +@@ -392,7 +392,7 @@ def smb_connection(dc_hostname, service, lp, creds): + # the SMB bindings rely on having a s3 loadparm + s3_lp = s3param.get_context() + s3_lp.load(lp.configfile) +- conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) ++ conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds) + except Exception: + raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) + # Reset signing state +diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py +index d6f5de7440a..34785e2a2a7 100644 +--- a/python/samba/tests/dcerpc/raw_testcase.py ++++ b/python/samba/tests/dcerpc/raw_testcase.py +@@ -46,7 +46,7 @@ class smb_pipe_socket(object): + saved_signing_state = creds.get_smb_ipc_signing() + creds.set_smb_ipc_signing(SMB_SIGNING_REQUIRED) + self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, +- creds=creds, ipc=True, sign=True) ++ creds=creds, ipc=True) + creds.set_smb_ipc_signing(saved_signing_state) + self.smbfid = self.smbconn.create(pipename, + DesiredAccess=0x12019f, +diff --git a/source3/client/client.c b/source3/client/client.c +index f65293849d0..30287ffd253 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -6228,7 +6228,10 @@ static int do_message_op(struct user_auth_info *a_info) + + status = cli_connect_nb(desthost, have_ip ? &dest_ss : NULL, + port ? port : NBT_SMB_PORT, name_type, +- lp_netbios_name(), SMB_SIGNING_DEFAULT, 0, &cli); ++ lp_netbios_name(), ++ SMB_SIGNING_OFF, ++ 0, ++ &cli); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Connection to %s failed. Error %s\n", desthost, nt_errstr(status)); + return 1; +diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c +index 3579a040830..f8a4d56cf53 100644 +--- a/source3/libsmb/pylibsmb.c ++++ b/source3/libsmb/pylibsmb.c +@@ -440,9 +440,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + PyObject *py_lp = Py_None; + PyObject *py_multi_threaded = Py_False; + bool multi_threaded = false; +- PyObject *py_sign = Py_False; +- bool sign = false; +- int signing_state = SMB_SIGNING_DEFAULT; ++ enum smb_signing_setting signing_state = SMB_SIGNING_DEFAULT; + PyObject *py_force_smb1 = Py_False; + bool force_smb1 = false; + PyObject *py_ipc = Py_False; +@@ -453,7 +451,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + + static const char *kwlist[] = { + "host", "share", "lp", "creds", +- "multi_threaded", "sign", "force_smb1", ++ "multi_threaded", "force_smb1", + "ipc", + NULL + }; +@@ -465,11 +463,10 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + } + + ret = ParseTupleAndKeywords( +- args, kwds, "ssO|O!OOOO", kwlist, ++ args, kwds, "ssO|O!OOO", kwlist, + &host, &share, &py_lp, + py_type_Credentials, &creds, + &py_multi_threaded, +- &py_sign, + &py_force_smb1, + &py_ipc); + +@@ -480,13 +477,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + } + + multi_threaded = PyObject_IsTrue(py_multi_threaded); +- sign = PyObject_IsTrue(py_sign); + force_smb1 = PyObject_IsTrue(py_force_smb1); + +- if (sign) { +- signing_state = SMB_SIGNING_REQUIRED; +- } +- + if (force_smb1) { + /* + * As most of the cli_*_send() function +@@ -532,6 +524,12 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + cli_creds = PyCredentials_AsCliCredentials(creds); + } + ++ if (use_ipc) { ++ signing_state = cli_credentials_get_smb_ipc_signing(cli_creds); ++ } else { ++ signing_state = cli_credentials_get_smb_signing(cli_creds); ++ } ++ + req = cli_full_connection_creds_send( + NULL, self->ev, "myname", host, NULL, 0, share, "?????", + cli_creds, flags, signing_state); +-- +2.28.0 + + +From 639de1d5ddf200d03f51b0436789f5dde4cd083b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 18:20:02 +0200 +Subject: [PATCH 031/105] s3:libsmb: Remove signing_state from + cli_full_connection_creds_send() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/libsmb/cliconnect.c | 11 +++++++++-- + source3/libsmb/proto.h | 2 +- + source3/libsmb/pylibsmb.c | 9 +-------- + 3 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index bb20aa59385..0ff9c283e39 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -3361,10 +3361,11 @@ struct tevent_req *cli_full_connection_creds_send( + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, enum smb_signing_setting signing_state) ++ int flags) + { + struct tevent_req *req, *subreq; + struct cli_full_connection_creds_state *state; ++ enum smb_signing_setting signing_state; + + req = tevent_req_create(mem_ctx, &state, + struct cli_full_connection_creds_state); +@@ -3379,6 +3380,12 @@ struct tevent_req *cli_full_connection_creds_send( + state->creds = creds; + state->flags = flags; + ++ if (flags & CLI_FULL_CONNECTION_IPC) { ++ signing_state = cli_credentials_get_smb_ipc_signing(creds); ++ } else { ++ signing_state = cli_credentials_get_smb_signing(creds); ++ } ++ + subreq = cli_start_connection_send( + state, ev, my_name, dest_host, dest_ss, port, + signing_state, flags); +@@ -3532,7 +3539,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, + } + req = cli_full_connection_creds_send( + ev, ev, my_name, dest_host, dest_ss, port, service, +- service_type, creds, flags, signing_state); ++ service_type, creds, flags); + if (req == NULL) { + goto fail; + } +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index 995187e21b4..bef04d32638 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -100,7 +100,7 @@ struct tevent_req *cli_full_connection_creds_send( + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, enum smb_signing_setting signing_state); ++ int flags); + NTSTATUS cli_full_connection_creds_recv(struct tevent_req *req, + struct cli_state **output_cli); + NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, +diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c +index f8a4d56cf53..c7a2d73afcb 100644 +--- a/source3/libsmb/pylibsmb.c ++++ b/source3/libsmb/pylibsmb.c +@@ -440,7 +440,6 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + PyObject *py_lp = Py_None; + PyObject *py_multi_threaded = Py_False; + bool multi_threaded = false; +- enum smb_signing_setting signing_state = SMB_SIGNING_DEFAULT; + PyObject *py_force_smb1 = Py_False; + bool force_smb1 = false; + PyObject *py_ipc = Py_False; +@@ -524,15 +523,9 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + cli_creds = PyCredentials_AsCliCredentials(creds); + } + +- if (use_ipc) { +- signing_state = cli_credentials_get_smb_ipc_signing(cli_creds); +- } else { +- signing_state = cli_credentials_get_smb_signing(cli_creds); +- } +- + req = cli_full_connection_creds_send( + NULL, self->ev, "myname", host, NULL, 0, share, "?????", +- cli_creds, flags, signing_state); ++ cli_creds, flags); + if (!py_tevent_req_wait_exc(self, req)) { + return -1; + } +-- +2.28.0 + + +From 57336e07f2e23dade5fcd0b8f0d002202cda223d Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 4 Jun 2020 14:59:14 +0200 +Subject: [PATCH 032/105] s3:libsmb: Remove signing_state from + cli_full_connection_creds() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + examples/fuse/smb2mount.c | 3 +-- + examples/winexe/winexe.c | 4 +--- + source3/libnet/libnet_join.c | 9 +++------ + source3/libsmb/cliconnect.c | 6 ++---- + source3/libsmb/libsmb_server.c | 8 +------- + source3/libsmb/proto.h | 3 +-- + source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 +-- + source3/rpcclient/cmd_spoolss.c | 5 +---- + source3/rpcclient/rpcclient.c | 3 +-- + source3/torture/locktest2.c | 11 +++++++++-- + source3/torture/torture.c | 6 ++---- + source3/utils/mdfind.c | 3 +-- + source3/utils/net_ads.c | 3 +-- + source3/utils/net_util.c | 8 ++------ + source3/utils/netlookup.c | 3 +-- + source3/utils/smbcacls.c | 3 +-- + source3/utils/smbcquotas.c | 4 +--- + 17 files changed, 30 insertions(+), 55 deletions(-) + +diff --git a/examples/fuse/smb2mount.c b/examples/fuse/smb2mount.c +index ea1d9a11e0b..6206c3a9701 100644 +--- a/examples/fuse/smb2mount.c ++++ b/examples/fuse/smb2mount.c +@@ -37,8 +37,7 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, + NULL, port, + share, "?????", + get_cmdline_auth_info_creds(auth_info), +- flags, +- get_cmdline_auth_info_signing_state(auth_info)); ++ flags); + if (!NT_STATUS_IS_OK(nt_status)) { + DBG_ERR("cli_full_connection failed! (%s)\n", + nt_errstr(nt_status)); +diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c +index bb9c27e2e6d..03e7ec85198 100644 +--- a/examples/winexe/winexe.c ++++ b/examples/winexe/winexe.c +@@ -360,7 +360,6 @@ static NTSTATUS winexe_svc_upload( + "ADMIN$", + "?????", + credentials, +- 0, + 0); + if (!NT_STATUS_IS_OK(status)) { + DBG_WARNING("cli_full_connection_creds failed: %s\n", +@@ -1919,8 +1918,7 @@ int main(int argc, const char *argv[]) + "IPC$", + "?????", + options.credentials, +- CLI_FULL_CONNECTION_IPC, +- 0); ++ CLI_FULL_CONNECTION_IPC); + + if (!NT_STATUS_IS_OK(status)) { + DBG_WARNING("cli_full_connection_creds failed: %s\n", +diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c +index 392e3eff74f..f3bf27e6c00 100644 +--- a/source3/libnet/libnet_join.c ++++ b/source3/libnet/libnet_join.c +@@ -1095,8 +1095,7 @@ static NTSTATUS libnet_join_connect_dc_ipc(const char *dc, + NULL, 0, + "IPC$", "IPC", + creds, +- flags, +- SMB_SIGNING_IPC_DEFAULT); ++ flags); + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(frame); + return status; +@@ -1716,8 +1715,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, + NULL, 0, + "IPC$", "IPC", + cli_creds, +- flags, +- SMB_SIGNING_IPC_DEFAULT); ++ flags); + + if (!NT_STATUS_IS_OK(status)) { + struct cli_credentials *anon_creds = NULL; +@@ -1734,8 +1732,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, + NULL, 0, + "IPC$", "IPC", + anon_creds, +- flags, +- SMB_SIGNING_OFF); ++ flags); + } + + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index 0ff9c283e39..b24743d789b 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -3526,8 +3526,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, +- enum smb_signing_setting signing_state) ++ int flags) + { + struct tevent_context *ev; + struct tevent_req *req; +@@ -3684,8 +3683,7 @@ struct cli_state *get_ipc_connect(char *server, + + nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", + get_cmdline_auth_info_creds(user_info), +- flags, +- SMB_SIGNING_DEFAULT); ++ flags); + + if (NT_STATUS_IS_OK(nt_status)) { + return cli; +diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index 3d1cd602f6c..33dc8419deb 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -785,7 +785,6 @@ SMBC_attr_server(TALLOC_CTX *ctx, + pp_workgroup, pp_username, pp_password); + if (!ipc_srv) { + struct cli_credentials *creds = NULL; +- int signing_state = SMB_SIGNING_DEFAULT; + + /* We didn't find a cached connection. Get the password */ + if (!*pp_password || (*pp_password)[0] == '\0') { +@@ -812,16 +811,11 @@ SMBC_attr_server(TALLOC_CTX *ctx, + return NULL; + } + +- if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) { +- signing_state = SMB_SIGNING_REQUIRED; +- } +- + nt_status = cli_full_connection_creds(&ipc_cli, + lp_netbios_name(), server, + NULL, 0, "IPC$", "?????", + creds, +- flags, +- signing_state); ++ flags); + if (! NT_STATUS_IS_OK(nt_status)) { + TALLOC_FREE(creds); + DEBUG(1,("cli_full_connection failed! (%s)\n", +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index bef04d32638..850cf12c8a6 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -109,8 +109,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, +- enum smb_signing_setting signing_state); ++ int flags); + NTSTATUS cli_raw_tcon(struct cli_state *cli, + const char *service, const char *pass, const char *dev, + uint16_t *max_xmit, uint16_t *tid); +diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c +index 16e3ee485f0..e98401a4365 100644 +--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c ++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c +@@ -2482,8 +2482,7 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c + ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, + &rm_addr, 0, "IPC$", "IPC", + anon_creds, +- CLI_FULL_CONNECTION_IPC, +- SMB_SIGNING_OFF); ++ CLI_FULL_CONNECTION_IPC); + TALLOC_FREE(anon_creds); + if ( !NT_STATUS_IS_OK( ret ) ) { + DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n", +diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c +index 7198a451ab7..02889a0a666 100644 +--- a/source3/rpcclient/cmd_spoolss.c ++++ b/source3/rpcclient/cmd_spoolss.c +@@ -3537,10 +3537,7 @@ static WERROR cmd_spoolss_printercmp(struct rpc_pipe_client *cli, + "IPC$", "IPC", + get_cmdline_auth_info_creds( + popt_get_cmdline_auth_info()), +- CLI_FULL_CONNECTION_IPC, +- get_cmdline_auth_info_signing_state( +- popt_get_cmdline_auth_info())); +- ++ CLI_FULL_CONNECTION_IPC); + if ( !NT_STATUS_IS_OK(nt_status) ) + return WERR_GEN_FAILURE; + +diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c +index c86474d08f1..2ead6cc7ba5 100644 +--- a/source3/rpcclient/rpcclient.c ++++ b/source3/rpcclient/rpcclient.c +@@ -1206,8 +1206,7 @@ out_free: + "IPC$", "IPC", + get_cmdline_auth_info_creds( + popt_get_cmdline_auth_info()), +- flags, +- SMB_SIGNING_IPC_DEFAULT); ++ flags); + + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0,("Cannot connect to server. Error was %s\n", nt_errstr(nt_status))); +diff --git a/source3/torture/locktest2.c b/source3/torture/locktest2.c +index 84c335f959f..92ddb7629b9 100644 +--- a/source3/torture/locktest2.c ++++ b/source3/torture/locktest2.c +@@ -217,8 +217,15 @@ static struct cli_state *connect_one(char *share) + + slprintf(myname,sizeof(myname), "lock-%lu-%u", (unsigned long)getpid(), count++); + +- nt_status = cli_full_connection_creds(&c, myname, server_n, NULL, 0, share, "?????", +- creds, 0, SMB_SIGNING_DEFAULT); ++ nt_status = cli_full_connection_creds(&c, ++ myname, ++ server_n, ++ NULL, ++ 0, ++ share, ++ "?????", ++ creds, ++ 0); + TALLOC_FREE(creds); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("cli_full_connection failed with error %s\n", nt_errstr(nt_status))); +diff --git a/source3/torture/torture.c b/source3/torture/torture.c +index 2a3133373e9..a4edeefd628 100644 +--- a/source3/torture/torture.c ++++ b/source3/torture/torture.c +@@ -345,8 +345,7 @@ static bool torture_open_connection_share(struct cli_state **c, + sharename, + "?????", + torture_creds, +- flags, +- signing_state); ++ flags); + if (!NT_STATUS_IS_OK(status)) { + printf("failed to open share connection: //%s/%s port:%d - %s\n", + hostname, sharename, port_to_use, nt_errstr(status)); +@@ -1523,8 +1522,7 @@ static bool run_tcon_devtype_test(int dummy) + NULL, /* service */ + NULL, /* service_type */ + torture_creds, +- flags, +- signing_state); ++ flags); + + if (!NT_STATUS_IS_OK(status)) { + printf("could not open connection\n"); +diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c +index a3c879e75fb..2ac4fde7daf 100644 +--- a/source3/utils/mdfind.c ++++ b/source3/utils/mdfind.c +@@ -153,8 +153,7 @@ int main(int argc, char **argv) + "IPC$", + "IPC", + creds, +- flags, +- SMB_SIGNING_IPC_DEFAULT); ++ flags); + if (!NT_STATUS_IS_OK(status)) { + DBG_ERR("Cannot connect to server: %s\n", nt_errstr(status)); + goto fail; +diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c +index 28ef6dc9974..7f5b9c3a440 100644 +--- a/source3/utils/net_ads.c ++++ b/source3/utils/net_ads.c +@@ -2438,8 +2438,7 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * + &server_ss, 0, + "IPC$", "IPC", + creds, +- CLI_FULL_CONNECTION_IPC, +- SMB_SIGNING_IPC_DEFAULT); ++ CLI_FULL_CONNECTION_IPC); + + if (NT_STATUS_IS_ERR(nt_status)) { + d_fprintf(stderr, _("Unable to open a connection to %s to " +diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c +index d01b2d8c771..b139fb2d0da 100644 +--- a/source3/utils/net_util.c ++++ b/source3/utils/net_util.c +@@ -108,7 +108,6 @@ NTSTATUS connect_to_service(struct net_context *c, + const char *service_type) + { + NTSTATUS nt_status; +- enum smb_signing_setting signing_setting = SMB_SIGNING_DEFAULT; + struct cli_credentials *creds = NULL; + int flags = 0; + +@@ -119,7 +118,6 @@ NTSTATUS connect_to_service(struct net_context *c, + } + + if (strequal(service_type, "IPC")) { +- signing_setting = SMB_SIGNING_IPC_DEFAULT; + flags |= CLI_FULL_CONNECTION_IPC; + } + +@@ -127,8 +125,7 @@ NTSTATUS connect_to_service(struct net_context *c, + server_ss, c->opt_port, + service_name, service_type, + creds, +- flags, +- signing_setting); ++ flags); + if (!NT_STATUS_IS_OK(nt_status)) { + d_fprintf(stderr, _("Could not connect to server %s\n"), + server_name); +@@ -199,8 +196,7 @@ NTSTATUS connect_to_ipc_anonymous(struct net_context *c, + server_name, server_ss, c->opt_port, + "IPC$", "IPC", + anon_creds, +- CLI_FULL_CONNECTION_IPC, +- SMB_SIGNING_OFF); ++ CLI_FULL_CONNECTION_IPC); + + if (NT_STATUS_IS_OK(nt_status)) { + return nt_status; +diff --git a/source3/utils/netlookup.c b/source3/utils/netlookup.c +index 2241beb331f..aaf78b0977a 100644 +--- a/source3/utils/netlookup.c ++++ b/source3/utils/netlookup.c +@@ -99,8 +99,7 @@ static struct con_struct *create_cs(struct net_context *c, + &loopback_ss, 0, + "IPC$", "IPC", + anon_creds, +- CLI_FULL_CONNECTION_IPC, +- SMB_SIGNING_OFF); ++ CLI_FULL_CONNECTION_IPC); + + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); +diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c +index f3209c31877..5983ebbd0a5 100644 +--- a/source3/utils/smbcacls.c ++++ b/source3/utils/smbcacls.c +@@ -778,8 +778,7 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, + NULL, 0, + share, "?????", + get_cmdline_auth_info_creds(auth_info), +- flags, +- get_cmdline_auth_info_signing_state(auth_info)); ++ flags); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); + return NULL; +diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c +index 954d6eba804..fea066ce468 100644 +--- a/source3/utils/smbcquotas.c ++++ b/source3/utils/smbcquotas.c +@@ -527,9 +527,7 @@ static struct cli_state *connect_one(const char *share) + share, "?????", + get_cmdline_auth_info_creds( + popt_get_cmdline_auth_info()), +- flags, +- get_cmdline_auth_info_signing_state( +- popt_get_cmdline_auth_info())); ++ flags); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); + return NULL; +-- +2.28.0 + + +From 6752c123f20d46aa68725971e09548a47b7c7457 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 8 Jun 2020 08:04:24 +0200 +Subject: [PATCH 033/105] s3:libsmb: Add encryption support to + cli_full_connection_creds*() + +Pair-Programmed-With: Andreas Schneider + +Signed-off-by: Andreas Schneider +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andreas Schneider +--- + source3/libsmb/cliconnect.c | 166 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 166 insertions(+) + +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index b24743d789b..abfd18bfaf1 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -3352,6 +3352,10 @@ static int cli_full_connection_creds_state_destructor( + static void cli_full_connection_creds_conn_done(struct tevent_req *subreq); + static void cli_full_connection_creds_sess_start(struct tevent_req *req); + static void cli_full_connection_creds_sess_done(struct tevent_req *subreq); ++static void cli_full_connection_creds_enc_start(struct tevent_req *req); ++static void cli_full_connection_creds_enc_tcon(struct tevent_req *subreq); ++static void cli_full_connection_creds_enc_ver(struct tevent_req *subreq); ++static void cli_full_connection_creds_enc_done(struct tevent_req *subreq); + static void cli_full_connection_creds_tcon_start(struct tevent_req *req); + static void cli_full_connection_creds_tcon_done(struct tevent_req *subreq); + +@@ -3366,6 +3370,8 @@ struct tevent_req *cli_full_connection_creds_send( + struct tevent_req *req, *subreq; + struct cli_full_connection_creds_state *state; + enum smb_signing_setting signing_state; ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(creds); + + req = tevent_req_create(mem_ctx, &state, + struct cli_full_connection_creds_state); +@@ -3386,6 +3392,16 @@ struct tevent_req *cli_full_connection_creds_send( + signing_state = cli_credentials_get_smb_signing(creds); + } + ++ if (encryption_state == SMB_ENCRYPTION_REQUIRED) { ++ if (flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK) { ++ encryption_state = SMB_ENCRYPTION_DESIRED; ++ } ++ } ++ ++ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { ++ signing_state = SMB_SIGNING_REQUIRED; ++ } ++ + subreq = cli_start_connection_send( + state, ev, my_name, dest_host, dest_ss, port, + signing_state, flags); +@@ -3460,6 +3476,156 @@ static void cli_full_connection_creds_sess_done(struct tevent_req *subreq) + return; + } + ++ cli_full_connection_creds_enc_start(req); ++} ++ ++static void cli_full_connection_creds_enc_start(struct tevent_req *req) ++{ ++ struct cli_full_connection_creds_state *state = tevent_req_data( ++ req, struct cli_full_connection_creds_state); ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(state->creds); ++ struct tevent_req *subreq = NULL; ++ NTSTATUS status; ++ ++ if (encryption_state < SMB_ENCRYPTION_DESIRED) { ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ ++ if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) { ++ status = smb2cli_session_encryption_on(state->cli->smb2.session); ++ if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) { ++ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ d_printf("Encryption required and " ++ "server doesn't support " ++ "SMB3 encryption - failing connect\n"); ++ tevent_req_nterror(req, status); ++ return; ++ } else if (!NT_STATUS_IS_OK(status)) { ++ d_printf("Encryption required and " ++ "setup failed with error %s.\n", ++ nt_errstr(status)); ++ tevent_req_nterror(req, status); ++ return; ++ } ++ ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ ++ if (!SERVER_HAS_UNIX_CIFS(state->cli)) { ++ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ ++ status = NT_STATUS_NOT_SUPPORTED; ++ d_printf("Encryption required and " ++ "server doesn't support " ++ "SMB1 Unix Extensions - failing connect\n"); ++ tevent_req_nterror(req, status); ++ return; ++ } ++ ++ /* ++ * We do a tcon on IPC$ just to setup the encryption, ++ * the real tcon will be encrypted then. ++ */ ++ subreq = cli_tree_connect_send(state, state->ev, state->cli, ++ "IPC$", "IPC", NULL); ++ if (tevent_req_nomem(subreq, req)) { ++ return; ++ } ++ tevent_req_set_callback(subreq, cli_full_connection_creds_enc_tcon, req); ++} ++ ++static void cli_full_connection_creds_enc_tcon(struct tevent_req *subreq) ++{ ++ struct tevent_req *req = tevent_req_callback_data( ++ subreq, struct tevent_req); ++ struct cli_full_connection_creds_state *state = tevent_req_data( ++ req, struct cli_full_connection_creds_state); ++ NTSTATUS status; ++ ++ status = cli_tree_connect_recv(subreq); ++ TALLOC_FREE(subreq); ++ if (tevent_req_nterror(req, status)) { ++ return; ++ } ++ ++ subreq = cli_unix_extensions_version_send(state, state->ev, state->cli); ++ if (tevent_req_nomem(subreq, req)) { ++ return; ++ } ++ tevent_req_set_callback(subreq, cli_full_connection_creds_enc_ver, req); ++} ++ ++static void cli_full_connection_creds_enc_ver(struct tevent_req *subreq) ++{ ++ struct tevent_req *req = tevent_req_callback_data( ++ subreq, struct tevent_req); ++ struct cli_full_connection_creds_state *state = tevent_req_data( ++ req, struct cli_full_connection_creds_state); ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(state->creds); ++ uint16_t major, minor; ++ uint32_t caplow, caphigh; ++ NTSTATUS status; ++ ++ status = cli_unix_extensions_version_recv(subreq, ++ &major, &minor, ++ &caplow, ++ &caphigh); ++ TALLOC_FREE(subreq); ++ if (!NT_STATUS_IS_OK(status)) { ++ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ DEBUG(10, ("%s: cli_unix_extensions_version " ++ "returned %s\n", __func__, nt_errstr(status))); ++ tevent_req_nterror(req, NT_STATUS_UNKNOWN_REVISION); ++ return; ++ } ++ ++ if (!(caplow & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)) { ++ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ DEBUG(10, ("%s: CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP " ++ "not supported\n", __func__)); ++ tevent_req_nterror(req, NT_STATUS_UNSUPPORTED_COMPRESSION); ++ return; ++ } ++ ++ subreq = cli_smb1_setup_encryption_send(state, state->ev, ++ state->cli, ++ state->creds); ++ if (tevent_req_nomem(subreq, req)) { ++ return; ++ } ++ tevent_req_set_callback(subreq, ++ cli_full_connection_creds_enc_done, ++ req); ++} ++ ++static void cli_full_connection_creds_enc_done(struct tevent_req *subreq) ++{ ++ struct tevent_req *req = tevent_req_callback_data( ++ subreq, struct tevent_req); ++ NTSTATUS status; ++ ++ status = cli_smb1_setup_encryption_recv(subreq); ++ TALLOC_FREE(subreq); ++ if (tevent_req_nterror(req, status)) { ++ return; ++ } ++ + cli_full_connection_creds_tcon_start(req); + } + +-- +2.28.0 + + +From bdb894ebb29820b97dba3721a517a61d96fac152 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 11:26:00 +0200 +Subject: [PATCH 034/105] python: Add a test for SMB encryption + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/tests/libsmb.py | 37 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +diff --git a/python/samba/tests/libsmb.py b/python/samba/tests/libsmb.py +index e8f8e7fe94d..81d4e482644 100644 +--- a/python/samba/tests/libsmb.py ++++ b/python/samba/tests/libsmb.py +@@ -21,10 +21,12 @@ from samba.samba3 import libsmb_samba_internal as libsmb + from samba.dcerpc import security + from samba.samba3 import param as s3param + from samba import credentials ++from samba.credentials import SMB_ENCRYPTION_REQUIRED + import samba.tests + import threading + import sys + import os ++import random + + + class LibsmbTestCase(samba.tests.TestCase): +@@ -77,6 +79,41 @@ class LibsmbTestCase(samba.tests.TestCase): + if t.exc: + raise t.exc[0](t.exc[1]) + ++ def test_SMB3EncryptionRequired(self): ++ test_dir = 'testing_%d' % random.randint(0, 0xFFFF) ++ ++ lp = s3param.get_context() ++ lp.load(os.getenv("SMB_CONF_PATH")) ++ ++ creds = credentials.Credentials() ++ creds.guess(lp) ++ creds.set_username(os.getenv("USERNAME")) ++ creds.set_password(os.getenv("PASSWORD")) ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ c = libsmb.Conn(os.getenv("SERVER_IP"), "tmp", ++ lp, creds) ++ ++ c.mkdir(test_dir) ++ c.rmdir(test_dir) ++ ++ def test_SMB1EncryptionRequired(self): ++ test_dir = 'testing_%d' % random.randint(0, 0xFFFF) ++ ++ lp = s3param.get_context() ++ lp.load(os.getenv("SMB_CONF_PATH")) ++ ++ creds = credentials.Credentials() ++ creds.guess(lp) ++ creds.set_username(os.getenv("USERNAME")) ++ creds.set_password(os.getenv("PASSWORD")) ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ c = libsmb.Conn(os.getenv("SERVER_IP"), "tmp", ++ lp, creds, force_smb1=True) ++ ++ c.mkdir(test_dir) ++ c.rmdir(test_dir) + + if __name__ == "__main__": + import unittest +-- +2.28.0 + + +From d26afd8352435db71c542388220e951184adcdde Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:31:02 +0200 +Subject: [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/utils/net_util.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c +index b139fb2d0da..5829d891075 100644 +--- a/source3/utils/net_util.c ++++ b/source3/utils/net_util.c +@@ -148,16 +148,6 @@ NTSTATUS connect_to_service(struct net_context *c, + return nt_status; + } + +- if (c->smb_encrypt) { +- nt_status = cli_cm_force_encryption_creds(*cli_ctx, +- creds, +- service_name); +- if (!NT_STATUS_IS_OK(nt_status)) { +- cli_shutdown(*cli_ctx); +- *cli_ctx = NULL; +- } +- } +- + return nt_status; + } + +@@ -577,6 +567,12 @@ struct cli_credentials *net_context_creds(struct net_context *c, + CRED_SPECIFIED); + } + ++ if (c->smb_encrypt) { ++ cli_credentials_set_smb_encryption(creds, ++ SMB_ENCRYPTION_REQUIRED, ++ CRED_SPECIFIED); ++ } ++ + return creds; + } + +-- +2.28.0 + + +From c228933e88c6b615fa49402d2e826a5ec14b9f85 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:40:13 +0200 +Subject: [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() + +This also adds a SMBC_ENCRYPTLEVEL_DEFAULT to 'enum +smbc_smb_encrypt_level' in order to use the smb.conf default value. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/include/libsmbclient.h | 1 + + source3/libsmb/ABI/smbclient-0.7.0.sigs | 188 ++++++++++++++++++++++++ + source3/libsmb/libsmb_context.c | 4 +- + source3/libsmb/libsmb_server.c | 72 +++------ + source3/libsmb/wscript | 2 +- + 5 files changed, 216 insertions(+), 51 deletions(-) + create mode 100644 source3/libsmb/ABI/smbclient-0.7.0.sigs + +diff --git a/source3/include/libsmbclient.h b/source3/include/libsmbclient.h +index c47e7c2a872..84c98089251 100644 +--- a/source3/include/libsmbclient.h ++++ b/source3/include/libsmbclient.h +@@ -225,6 +225,7 @@ typedef enum smbc_share_mode + */ + typedef enum smbc_smb_encrypt_level + { ++ SMBC_ENCRYPTLEVEL_DEFAULT = -1, + SMBC_ENCRYPTLEVEL_NONE = 0, + SMBC_ENCRYPTLEVEL_REQUEST = 1, + SMBC_ENCRYPTLEVEL_REQUIRE = 2 +diff --git a/source3/libsmb/ABI/smbclient-0.7.0.sigs b/source3/libsmb/ABI/smbclient-0.7.0.sigs +new file mode 100644 +index 00000000000..ee758e21b50 +--- /dev/null ++++ b/source3/libsmb/ABI/smbclient-0.7.0.sigs +@@ -0,0 +1,188 @@ ++smbc_chmod: int (const char *, mode_t) ++smbc_close: int (int) ++smbc_closedir: int (int) ++smbc_creat: int (const char *, mode_t) ++smbc_fgetxattr: int (int, const char *, const void *, size_t) ++smbc_flistxattr: int (int, char *, size_t) ++smbc_free_context: int (SMBCCTX *, int) ++smbc_fremovexattr: int (int, const char *) ++smbc_fsetxattr: int (int, const char *, const void *, size_t, int) ++smbc_fstat: int (int, struct stat *) ++smbc_fstatvfs: int (int, struct statvfs *) ++smbc_ftruncate: int (int, off_t) ++smbc_getDebug: int (SMBCCTX *) ++smbc_getFunctionAddCachedServer: smbc_add_cached_srv_fn (SMBCCTX *) ++smbc_getFunctionAuthData: smbc_get_auth_data_fn (SMBCCTX *) ++smbc_getFunctionAuthDataWithContext: smbc_get_auth_data_with_context_fn (SMBCCTX *) ++smbc_getFunctionCheckServer: smbc_check_server_fn (SMBCCTX *) ++smbc_getFunctionChmod: smbc_chmod_fn (SMBCCTX *) ++smbc_getFunctionClose: smbc_close_fn (SMBCCTX *) ++smbc_getFunctionClosedir: smbc_closedir_fn (SMBCCTX *) ++smbc_getFunctionCreat: smbc_creat_fn (SMBCCTX *) ++smbc_getFunctionFstat: smbc_fstat_fn (SMBCCTX *) ++smbc_getFunctionFstatVFS: smbc_fstatvfs_fn (SMBCCTX *) ++smbc_getFunctionFstatdir: smbc_fstatdir_fn (SMBCCTX *) ++smbc_getFunctionFtruncate: smbc_ftruncate_fn (SMBCCTX *) ++smbc_getFunctionGetCachedServer: smbc_get_cached_srv_fn (SMBCCTX *) ++smbc_getFunctionGetdents: smbc_getdents_fn (SMBCCTX *) ++smbc_getFunctionGetxattr: smbc_getxattr_fn (SMBCCTX *) ++smbc_getFunctionListPrintJobs: smbc_list_print_jobs_fn (SMBCCTX *) ++smbc_getFunctionListxattr: smbc_listxattr_fn (SMBCCTX *) ++smbc_getFunctionLseek: smbc_lseek_fn (SMBCCTX *) ++smbc_getFunctionLseekdir: smbc_lseekdir_fn (SMBCCTX *) ++smbc_getFunctionMkdir: smbc_mkdir_fn (SMBCCTX *) ++smbc_getFunctionNotify: smbc_notify_fn (SMBCCTX *) ++smbc_getFunctionOpen: smbc_open_fn (SMBCCTX *) ++smbc_getFunctionOpenPrintJob: smbc_open_print_job_fn (SMBCCTX *) ++smbc_getFunctionOpendir: smbc_opendir_fn (SMBCCTX *) ++smbc_getFunctionPrintFile: smbc_print_file_fn (SMBCCTX *) ++smbc_getFunctionPurgeCachedServers: smbc_purge_cached_fn (SMBCCTX *) ++smbc_getFunctionRead: smbc_read_fn (SMBCCTX *) ++smbc_getFunctionReaddir: smbc_readdir_fn (SMBCCTX *) ++smbc_getFunctionReaddirPlus: smbc_readdirplus_fn (SMBCCTX *) ++smbc_getFunctionReaddirPlus2: smbc_readdirplus2_fn (SMBCCTX *) ++smbc_getFunctionRemoveCachedServer: smbc_remove_cached_srv_fn (SMBCCTX *) ++smbc_getFunctionRemoveUnusedServer: smbc_remove_unused_server_fn (SMBCCTX *) ++smbc_getFunctionRemovexattr: smbc_removexattr_fn (SMBCCTX *) ++smbc_getFunctionRename: smbc_rename_fn (SMBCCTX *) ++smbc_getFunctionRmdir: smbc_rmdir_fn (SMBCCTX *) ++smbc_getFunctionSetxattr: smbc_setxattr_fn (SMBCCTX *) ++smbc_getFunctionSplice: smbc_splice_fn (SMBCCTX *) ++smbc_getFunctionStat: smbc_stat_fn (SMBCCTX *) ++smbc_getFunctionStatVFS: smbc_statvfs_fn (SMBCCTX *) ++smbc_getFunctionTelldir: smbc_telldir_fn (SMBCCTX *) ++smbc_getFunctionUnlink: smbc_unlink_fn (SMBCCTX *) ++smbc_getFunctionUnlinkPrintJob: smbc_unlink_print_job_fn (SMBCCTX *) ++smbc_getFunctionUtimes: smbc_utimes_fn (SMBCCTX *) ++smbc_getFunctionWrite: smbc_write_fn (SMBCCTX *) ++smbc_getNetbiosName: const char *(SMBCCTX *) ++smbc_getOptionBrowseMaxLmbCount: int (SMBCCTX *) ++smbc_getOptionCaseSensitive: smbc_bool (SMBCCTX *) ++smbc_getOptionDebugToStderr: smbc_bool (SMBCCTX *) ++smbc_getOptionFallbackAfterKerberos: smbc_bool (SMBCCTX *) ++smbc_getOptionFullTimeNames: smbc_bool (SMBCCTX *) ++smbc_getOptionNoAutoAnonymousLogin: smbc_bool (SMBCCTX *) ++smbc_getOptionOneSharePerServer: smbc_bool (SMBCCTX *) ++smbc_getOptionOpenShareMode: smbc_share_mode (SMBCCTX *) ++smbc_getOptionSmbEncryptionLevel: smbc_smb_encrypt_level (SMBCCTX *) ++smbc_getOptionUrlEncodeReaddirEntries: smbc_bool (SMBCCTX *) ++smbc_getOptionUseCCache: smbc_bool (SMBCCTX *) ++smbc_getOptionUseKerberos: smbc_bool (SMBCCTX *) ++smbc_getOptionUseNTHash: smbc_bool (SMBCCTX *) ++smbc_getOptionUserData: void *(SMBCCTX *) ++smbc_getPort: uint16_t (SMBCCTX *) ++smbc_getServerCacheData: struct smbc_server_cache *(SMBCCTX *) ++smbc_getTimeout: int (SMBCCTX *) ++smbc_getUser: const char *(SMBCCTX *) ++smbc_getWorkgroup: const char *(SMBCCTX *) ++smbc_getdents: int (unsigned int, struct smbc_dirent *, int) ++smbc_getxattr: int (const char *, const char *, const void *, size_t) ++smbc_init: int (smbc_get_auth_data_fn, int) ++smbc_init_context: SMBCCTX *(SMBCCTX *) ++smbc_lgetxattr: int (const char *, const char *, const void *, size_t) ++smbc_list_print_jobs: int (const char *, smbc_list_print_job_fn) ++smbc_listxattr: int (const char *, char *, size_t) ++smbc_llistxattr: int (const char *, char *, size_t) ++smbc_lremovexattr: int (const char *, const char *) ++smbc_lseek: off_t (int, off_t, int) ++smbc_lseekdir: int (int, off_t) ++smbc_lsetxattr: int (const char *, const char *, const void *, size_t, int) ++smbc_mkdir: int (const char *, mode_t) ++smbc_new_context: SMBCCTX *(void) ++smbc_notify: int (int, smbc_bool, uint32_t, unsigned int, smbc_notify_callback_fn, void *) ++smbc_open: int (const char *, int, mode_t) ++smbc_open_print_job: int (const char *) ++smbc_opendir: int (const char *) ++smbc_option_get: void *(SMBCCTX *, char *) ++smbc_option_set: void (SMBCCTX *, char *, ...) ++smbc_print_file: int (const char *, const char *) ++smbc_read: ssize_t (int, void *, size_t) ++smbc_readdir: struct smbc_dirent *(unsigned int) ++smbc_readdirplus: const struct libsmb_file_info *(unsigned int) ++smbc_readdirplus2: const struct libsmb_file_info *(unsigned int, struct stat *) ++smbc_removexattr: int (const char *, const char *) ++smbc_rename: int (const char *, const char *) ++smbc_rmdir: int (const char *) ++smbc_setConfiguration: int (SMBCCTX *, const char *) ++smbc_setDebug: void (SMBCCTX *, int) ++smbc_setFunctionAddCachedServer: void (SMBCCTX *, smbc_add_cached_srv_fn) ++smbc_setFunctionAuthData: void (SMBCCTX *, smbc_get_auth_data_fn) ++smbc_setFunctionAuthDataWithContext: void (SMBCCTX *, smbc_get_auth_data_with_context_fn) ++smbc_setFunctionCheckServer: void (SMBCCTX *, smbc_check_server_fn) ++smbc_setFunctionChmod: void (SMBCCTX *, smbc_chmod_fn) ++smbc_setFunctionClose: void (SMBCCTX *, smbc_close_fn) ++smbc_setFunctionClosedir: void (SMBCCTX *, smbc_closedir_fn) ++smbc_setFunctionCreat: void (SMBCCTX *, smbc_creat_fn) ++smbc_setFunctionFstat: void (SMBCCTX *, smbc_fstat_fn) ++smbc_setFunctionFstatVFS: void (SMBCCTX *, smbc_fstatvfs_fn) ++smbc_setFunctionFstatdir: void (SMBCCTX *, smbc_fstatdir_fn) ++smbc_setFunctionFtruncate: void (SMBCCTX *, smbc_ftruncate_fn) ++smbc_setFunctionGetCachedServer: void (SMBCCTX *, smbc_get_cached_srv_fn) ++smbc_setFunctionGetdents: void (SMBCCTX *, smbc_getdents_fn) ++smbc_setFunctionGetxattr: void (SMBCCTX *, smbc_getxattr_fn) ++smbc_setFunctionListPrintJobs: void (SMBCCTX *, smbc_list_print_jobs_fn) ++smbc_setFunctionListxattr: void (SMBCCTX *, smbc_listxattr_fn) ++smbc_setFunctionLseek: void (SMBCCTX *, smbc_lseek_fn) ++smbc_setFunctionLseekdir: void (SMBCCTX *, smbc_lseekdir_fn) ++smbc_setFunctionMkdir: void (SMBCCTX *, smbc_mkdir_fn) ++smbc_setFunctionNotify: void (SMBCCTX *, smbc_notify_fn) ++smbc_setFunctionOpen: void (SMBCCTX *, smbc_open_fn) ++smbc_setFunctionOpenPrintJob: void (SMBCCTX *, smbc_open_print_job_fn) ++smbc_setFunctionOpendir: void (SMBCCTX *, smbc_opendir_fn) ++smbc_setFunctionPrintFile: void (SMBCCTX *, smbc_print_file_fn) ++smbc_setFunctionPurgeCachedServers: void (SMBCCTX *, smbc_purge_cached_fn) ++smbc_setFunctionRead: void (SMBCCTX *, smbc_read_fn) ++smbc_setFunctionReaddir: void (SMBCCTX *, smbc_readdir_fn) ++smbc_setFunctionReaddirPlus: void (SMBCCTX *, smbc_readdirplus_fn) ++smbc_setFunctionReaddirPlus2: void (SMBCCTX *, smbc_readdirplus2_fn) ++smbc_setFunctionRemoveCachedServer: void (SMBCCTX *, smbc_remove_cached_srv_fn) ++smbc_setFunctionRemoveUnusedServer: void (SMBCCTX *, smbc_remove_unused_server_fn) ++smbc_setFunctionRemovexattr: void (SMBCCTX *, smbc_removexattr_fn) ++smbc_setFunctionRename: void (SMBCCTX *, smbc_rename_fn) ++smbc_setFunctionRmdir: void (SMBCCTX *, smbc_rmdir_fn) ++smbc_setFunctionSetxattr: void (SMBCCTX *, smbc_setxattr_fn) ++smbc_setFunctionSplice: void (SMBCCTX *, smbc_splice_fn) ++smbc_setFunctionStat: void (SMBCCTX *, smbc_stat_fn) ++smbc_setFunctionStatVFS: void (SMBCCTX *, smbc_statvfs_fn) ++smbc_setFunctionTelldir: void (SMBCCTX *, smbc_telldir_fn) ++smbc_setFunctionUnlink: void (SMBCCTX *, smbc_unlink_fn) ++smbc_setFunctionUnlinkPrintJob: void (SMBCCTX *, smbc_unlink_print_job_fn) ++smbc_setFunctionUtimes: void (SMBCCTX *, smbc_utimes_fn) ++smbc_setFunctionWrite: void (SMBCCTX *, smbc_write_fn) ++smbc_setLogCallback: void (SMBCCTX *, void *, smbc_debug_callback_fn) ++smbc_setNetbiosName: void (SMBCCTX *, const char *) ++smbc_setOptionBrowseMaxLmbCount: void (SMBCCTX *, int) ++smbc_setOptionCaseSensitive: void (SMBCCTX *, smbc_bool) ++smbc_setOptionDebugToStderr: void (SMBCCTX *, smbc_bool) ++smbc_setOptionFallbackAfterKerberos: void (SMBCCTX *, smbc_bool) ++smbc_setOptionFullTimeNames: void (SMBCCTX *, smbc_bool) ++smbc_setOptionNoAutoAnonymousLogin: void (SMBCCTX *, smbc_bool) ++smbc_setOptionOneSharePerServer: void (SMBCCTX *, smbc_bool) ++smbc_setOptionOpenShareMode: void (SMBCCTX *, smbc_share_mode) ++smbc_setOptionProtocols: smbc_bool (SMBCCTX *, const char *, const char *) ++smbc_setOptionSmbEncryptionLevel: void (SMBCCTX *, smbc_smb_encrypt_level) ++smbc_setOptionUrlEncodeReaddirEntries: void (SMBCCTX *, smbc_bool) ++smbc_setOptionUseCCache: void (SMBCCTX *, smbc_bool) ++smbc_setOptionUseKerberos: void (SMBCCTX *, smbc_bool) ++smbc_setOptionUseNTHash: void (SMBCCTX *, smbc_bool) ++smbc_setOptionUserData: void (SMBCCTX *, void *) ++smbc_setPort: void (SMBCCTX *, uint16_t) ++smbc_setServerCacheData: void (SMBCCTX *, struct smbc_server_cache *) ++smbc_setTimeout: void (SMBCCTX *, int) ++smbc_setUser: void (SMBCCTX *, const char *) ++smbc_setWorkgroup: void (SMBCCTX *, const char *) ++smbc_set_context: SMBCCTX *(SMBCCTX *) ++smbc_set_credentials: void (const char *, const char *, const char *, smbc_bool, const char *) ++smbc_set_credentials_with_fallback: void (SMBCCTX *, const char *, const char *, const char *) ++smbc_setxattr: int (const char *, const char *, const void *, size_t, int) ++smbc_stat: int (const char *, struct stat *) ++smbc_statvfs: int (char *, struct statvfs *) ++smbc_telldir: off_t (int) ++smbc_unlink: int (const char *) ++smbc_unlink_print_job: int (const char *, int) ++smbc_urldecode: int (char *, char *, size_t) ++smbc_urlencode: int (char *, char *, int) ++smbc_utime: int (const char *, struct utimbuf *) ++smbc_utimes: int (const char *, struct timeval *) ++smbc_version: const char *(void) ++smbc_write: ssize_t (int, const void *, size_t) +diff --git a/source3/libsmb/libsmb_context.c b/source3/libsmb/libsmb_context.c +index eaa0cdeca93..ea741f41c7d 100644 +--- a/source3/libsmb/libsmb_context.c ++++ b/source3/libsmb/libsmb_context.c +@@ -171,7 +171,7 @@ smbc_new_context(void) + + smbc_setOptionFullTimeNames(context, False); + smbc_setOptionOpenShareMode(context, SMBC_SHAREMODE_DENY_NONE); +- smbc_setOptionSmbEncryptionLevel(context, SMBC_ENCRYPTLEVEL_NONE); ++ smbc_setOptionSmbEncryptionLevel(context, SMBC_ENCRYPTLEVEL_DEFAULT); + smbc_setOptionUseCCache(context, True); + smbc_setOptionCaseSensitive(context, False); + smbc_setOptionBrowseMaxLmbCount(context, 3); /* # LMBs to query */ +@@ -474,6 +474,8 @@ smbc_option_get(SMBCCTX *context, + } else if (strcmp(option_name, "smb_encrypt_level") == 0) { + switch(smbc_getOptionSmbEncryptionLevel(context)) + { ++ case SMBC_ENCRYPTLEVEL_DEFAULT: ++ return discard_const_p(void, "default"); + case 0: + return discard_const_p(void, "none"); + case 1: +diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index 33dc8419deb..eb58d7c6ac9 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -284,6 +284,29 @@ static struct cli_credentials *SMBC_auth_credentials(TALLOC_CTX *mem_ctx, + return NULL; + } + ++ switch (context->internal->smb_encryption_level) { ++ case SMBC_ENCRYPTLEVEL_DEFAULT: ++ /* Use the config option */ ++ break; ++ case SMBC_ENCRYPTLEVEL_NONE: ++ cli_credentials_set_smb_encryption(creds, ++ SMB_ENCRYPTION_OFF, ++ CRED_SPECIFIED); ++ break; ++ case SMBC_ENCRYPTLEVEL_REQUEST: ++ cli_credentials_set_smb_encryption(creds, ++ SMB_ENCRYPTION_DESIRED, ++ CRED_SPECIFIED); ++ break; ++ case SMBC_ENCRYPTLEVEL_REQUIRE: ++ default: ++ cli_credentials_set_smb_encryption(creds, ++ SMB_ENCRYPTION_REQUIRED, ++ CRED_SPECIFIED); ++ break; ++ } ++ ++ + return creds; + } + +@@ -625,30 +648,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, + smbXcli_tcon_set_fs_attributes(tcon, fs_attrs); + } + +- if (context->internal->smb_encryption_level) { +- /* Attempt encryption. */ +- status = cli_cm_force_encryption_creds(c, +- creds, +- share); +- if (!NT_STATUS_IS_OK(status)) { +- +- /* +- * context->smb_encryption_level == 1 +- * means don't fail if encryption can't be negotiated, +- * == 2 means fail if encryption can't be negotiated. +- */ +- +- DEBUG(4,(" SMB encrypt failed\n")); +- +- if (context->internal->smb_encryption_level == 2) { +- cli_shutdown(c); +- errno = EPERM; +- return NULL; +- } +- } +- DEBUG(4,(" SMB encrypt ok\n")); +- } +- + /* + * Ok, we have got a nice connection + * Let's allocate a server structure. +@@ -825,31 +824,6 @@ SMBC_attr_server(TALLOC_CTX *ctx, + } + talloc_steal(ipc_cli, creds); + +- if (context->internal->smb_encryption_level) { +- /* Attempt encryption. */ +- nt_status = cli_cm_force_encryption_creds(ipc_cli, +- creds, +- "IPC$"); +- if (!NT_STATUS_IS_OK(nt_status)) { +- +- /* +- * context->smb_encryption_level == +- * 1 means don't fail if encryption can't be +- * negotiated, == 2 means fail if encryption +- * can't be negotiated. +- */ +- +- DEBUG(4,(" SMB encrypt failed on IPC$\n")); +- +- if (context->internal->smb_encryption_level == 2) { +- cli_shutdown(ipc_cli); +- errno = EPERM; +- return NULL; +- } +- } +- DEBUG(4,(" SMB encrypt ok on IPC$\n")); +- } +- + ipc_srv = SMB_MALLOC_P(SMBCSRV); + if (!ipc_srv) { + errno = ENOMEM; +diff --git a/source3/libsmb/wscript b/source3/libsmb/wscript +index ec4a516b2ee..61503d0a98b 100644 +--- a/source3/libsmb/wscript ++++ b/source3/libsmb/wscript +@@ -26,5 +26,5 @@ def build(bld): + public_headers='../include/libsmbclient.h', + abi_directory='ABI', + abi_match='smbc_*', +- vnum='0.6.0', ++ vnum='0.7.0', + pc_files='smbclient.pc') +-- +2.28.0 + + +From 76dc706e6449161c27a5f117bc45922ab467dbfc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:43:33 +0200 +Subject: [PATCH 037/105] s3:client: Remove unused smb encryption code + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/client/smbspool.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c +index f56dc323b6e..16a8d44c069 100644 +--- a/source3/client/smbspool.c ++++ b/source3/client/smbspool.c +@@ -584,16 +584,6 @@ smb_complete_connection(struct cli_state **output_cli, + + return nt_status; + } +-#if 0 +- /* Need to work out how to specify this on the URL. */ +- if (smb_encrypt) { +- if (!cli_cm_force_encryption_creds(cli, creds, share)) { +- fprintf(stderr, "ERROR: encryption setup failed\n"); +- cli_shutdown(cli); +- return NULL; +- } +- } +-#endif + + *output_cli = cli; + return NT_STATUS_OK; +-- +2.28.0 + + +From a444688a6ed50c8443a778fbddb4dbd8a39d49d4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:47:05 +0200 +Subject: [PATCH 038/105] s3:utils: Remove obsolete force encryption from + smbacls + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/utils/smbcacls.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c +index 5983ebbd0a5..8fd9fcc5780 100644 +--- a/source3/utils/smbcacls.c ++++ b/source3/utils/smbcacls.c +@@ -784,16 +784,6 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, + return NULL; + } + +- if (get_cmdline_auth_info_smb_encrypt(auth_info)) { +- nt_status = cli_cm_force_encryption_creds(c, +- get_cmdline_auth_info_creds(auth_info), +- share); +- if (!NT_STATUS_IS_OK(nt_status)) { +- cli_shutdown(c); +- c = NULL; +- } +- } +- + return c; + } + +-- +2.28.0 + + +From 21b72b6107cd849b9da77e17520e658745fb897a Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:48:18 +0200 +Subject: [PATCH 039/105] s3:utils: Remove obsolete force encryption from + mdfind + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/utils/mdfind.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c +index 2ac4fde7daf..ef2657e4fa5 100644 +--- a/source3/utils/mdfind.c ++++ b/source3/utils/mdfind.c +@@ -159,13 +159,6 @@ int main(int argc, char **argv) + goto fail; + } + +- if (get_cmdline_auth_info_smb_encrypt(auth)) { +- status = cli_cm_force_encryption_creds(cli, creds, "IPC$"); +- if (!NT_STATUS_IS_OK(status)) { +- goto fail; +- } +- } +- + status = cli_rpc_pipe_open_noauth_transport(cli, + NCACN_NP, + &ndr_table_mdssvc, +-- +2.28.0 + + +From 842c3c1346cba54c92d6ba2d462818875403a394 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:49:28 +0200 +Subject: [PATCH 040/105] s3:utils: Remove obsolete force encryption from + smbcquotas + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/utils/smbcquotas.c | 11 ----------- + 1 file changed, 11 deletions(-) + +diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c +index fea066ce468..4ceac7b3ab0 100644 +--- a/source3/utils/smbcquotas.c ++++ b/source3/utils/smbcquotas.c +@@ -533,17 +533,6 @@ static struct cli_state *connect_one(const char *share) + return NULL; + } + +- if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) { +- nt_status = cli_cm_force_encryption_creds(c, +- get_cmdline_auth_info_creds( +- popt_get_cmdline_auth_info()), +- share); +- if (!NT_STATUS_IS_OK(nt_status)) { +- cli_shutdown(c); +- return NULL; +- } +- } +- + return c; + } + +-- +2.28.0 + + +From be36aec550d817bbcfdea88b433e31b44886ba19 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:51:18 +0200 +Subject: [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from + rpcclient + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/rpcclient/rpcclient.c | 11 ----------- + 1 file changed, 11 deletions(-) + +diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c +index 2ead6cc7ba5..575a42ebf70 100644 +--- a/source3/rpcclient/rpcclient.c ++++ b/source3/rpcclient/rpcclient.c +@@ -1214,17 +1214,6 @@ out_free: + goto done; + } + +- if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) { +- nt_status = cli_cm_force_encryption_creds(cli, +- get_cmdline_auth_info_creds( +- popt_get_cmdline_auth_info()), +- "IPC$"); +- if (!NT_STATUS_IS_OK(nt_status)) { +- result = 1; +- goto done; +- } +- } +- + #if 0 /* COMMENT OUT FOR TESTING */ + memset(cmdline_auth_info.password,'X',sizeof(cmdline_auth_info.password)); + #endif +-- +2.28.0 + + +From 8e2de7801238eb7f1090a9307dc4b05885b3dda2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 6 Jul 2020 10:58:36 +0200 +Subject: [PATCH 042/105] examples: Remove obsolete force encryption from + smb2mount + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + examples/fuse/smb2mount.c | 11 ----------- + 1 file changed, 11 deletions(-) + +diff --git a/examples/fuse/smb2mount.c b/examples/fuse/smb2mount.c +index 6206c3a9701..c64be573462 100644 +--- a/examples/fuse/smb2mount.c ++++ b/examples/fuse/smb2mount.c +@@ -44,17 +44,6 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, + return NULL; + } + +- if (get_cmdline_auth_info_smb_encrypt(auth_info)) { +- nt_status = cli_cm_force_encryption_creds( +- c, +- get_cmdline_auth_info_creds(auth_info), +- share); +- if (!NT_STATUS_IS_OK(nt_status)) { +- cli_shutdown(c); +- c = NULL; +- } +- } +- + return c; + } + +-- +2.28.0 + + +From 8c9a31cc180c674925919771ccdce1bb6895c1a3 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 6 Jul 2020 11:05:59 +0200 +Subject: [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() + static + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/libsmb/clidfs.c | 6 +++--- + source3/libsmb/proto.h | 3 --- + 2 files changed, 3 insertions(+), 6 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 4495a027830..aff998f6187 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -43,9 +43,9 @@ + Ensure a connection is encrypted. + ********************************************************************/ + +-NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, +- struct cli_credentials *creds, +- const char *sharename) ++static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, ++ struct cli_credentials *creds, ++ const char *sharename) + { + uint16_t major, minor; + uint32_t caplow, caphigh; +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index 850cf12c8a6..eeabcaa7463 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -123,9 +123,6 @@ struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx, + + /* The following definitions come from libsmb/clidfs.c */ + +-NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, +- struct cli_credentials *creds, +- const char *sharename); + NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + struct cli_state *referring_cli, + const char *server, +-- +2.28.0 + + +From 6e2a7196c424edd2c447cfd4377e38e5b51ee675 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 13 Aug 2020 16:16:55 +0200 +Subject: [PATCH 044/105] s4:libcli: Return NTSTATUS errors for + smb_composite_connect_send() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source4/libcli/smb_composite/connect.c | 40 +++++++++++++++++++------- + 1 file changed, 29 insertions(+), 11 deletions(-) + +diff --git a/source4/libcli/smb_composite/connect.c b/source4/libcli/smb_composite/connect.c +index 582d43ef173..ad50ae0ac81 100644 +--- a/source4/libcli/smb_composite/connect.c ++++ b/source4/libcli/smb_composite/connect.c +@@ -420,15 +420,25 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec + struct connect_state *state; + + c = talloc_zero(mem_ctx, struct composite_context); +- if (c == NULL) goto failed; +- +- c->event_ctx = event_ctx; +- if (c->event_ctx == NULL) goto failed; ++ if (c == NULL) { ++ goto nomem; ++ } + + state = talloc_zero(c, struct connect_state); +- if (state == NULL) goto failed; ++ if (state == NULL) { ++ goto nomem; ++ } ++ ++ c->event_ctx = event_ctx; ++ if (c->event_ctx == NULL) { ++ composite_error(c, NT_STATUS_INVALID_PARAMETER_MIX); ++ return c; ++ } + +- if (io->in.gensec_settings == NULL) goto failed; ++ if (io->in.gensec_settings == NULL) { ++ composite_error(c, NT_STATUS_INVALID_PARAMETER_MIX); ++ return c; ++ } + state->io = io; + + c->state = COMPOSITE_STATE_IN_PROGRESS; +@@ -449,12 +459,14 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec + &io->in.options, + &state->transport); + if (!NT_STATUS_IS_OK(status)) { +- goto failed; ++ composite_error(c, status); ++ return c; + } + + status = connect_send_session(c, io); + if (!NT_STATUS_IS_OK(status)) { +- goto failed; ++ composite_error(c, status); ++ return c; + } + + return c; +@@ -468,15 +480,18 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec + io->in.socket_options, + &state->calling, + &state->called); +- if (state->creq == NULL) goto failed; ++ if (state->creq == NULL) { ++ composite_error(c, NT_STATUS_NO_MEMORY); ++ return c; ++ } + + state->stage = CONNECT_SOCKET; + state->creq->async.private_data = c; + state->creq->async.fn = composite_handler; + + return c; +-failed: +- talloc_free(c); ++nomem: ++ TALLOC_FREE(c); + return NULL; + } + +@@ -506,5 +521,8 @@ NTSTATUS smb_composite_connect(struct smb_composite_connect *io, TALLOC_CTX *mem + struct tevent_context *ev) + { + struct composite_context *c = smb_composite_connect_send(io, mem_ctx, resolve_ctx, ev); ++ if (c == NULL) { ++ return NT_STATUS_NO_MEMORY; ++ } + return smb_composite_connect_recv(c, mem_ctx); + } +-- +2.28.0 + + +From cf89573a78556993d7ecb43257d347edc6c61151 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 7 Jul 2020 12:54:26 +0200 +Subject: [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source4/libcli/smb_composite/sesssetup.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c +index 6ee4929e8d7..51e121bdce6 100644 +--- a/source4/libcli/smb_composite/sesssetup.c ++++ b/source4/libcli/smb_composite/sesssetup.c +@@ -620,10 +620,17 @@ struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *se + struct composite_context *c; + struct sesssetup_state *state; + NTSTATUS status; ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(io->in.credentials); + + c = composite_create(session, session->transport->ev); + if (c == NULL) return NULL; + ++ if (encryption_state > SMB_ENCRYPTION_DESIRED) { ++ composite_error(c, NT_STATUS_PROTOCOL_NOT_SUPPORTED); ++ return c; ++ } ++ + state = talloc_zero(c, struct sesssetup_state); + if (composite_nomem(state, c)) return c; + c->private_data = state; +-- +2.28.0 + + +From 05914c4f85f71c7d1df884e33b8c0b8f5062ee3b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 7 Jul 2020 12:29:39 +0200 +Subject: [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source4/libcli/smb2/connect.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c +index 6fc3993a4e8..95ff05eac8f 100644 +--- a/source4/libcli/smb2/connect.c ++++ b/source4/libcli/smb2/connect.c +@@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req) + tevent_req_set_callback(subreq, smb2_connect_session_done, req); + } + ++static void smb2_connect_tcon_start(struct tevent_req *req); + static void smb2_connect_tcon_done(struct tevent_req *subreq); + + static void smb2_connect_session_done(struct tevent_req *subreq) +@@ -248,7 +249,6 @@ static void smb2_connect_session_done(struct tevent_req *subreq) + tevent_req_data(req, + struct smb2_connect_state); + NTSTATUS status; +- uint32_t timeout_msec; + + status = smb2_session_setup_spnego_recv(subreq); + TALLOC_FREE(subreq); +@@ -289,6 +289,17 @@ static void smb2_connect_session_done(struct tevent_req *subreq) + return; + } + ++ smb2_connect_tcon_start(req); ++} ++ ++static void smb2_connect_tcon_start(struct tevent_req *req) ++{ ++ struct smb2_connect_state *state = ++ tevent_req_data(req, ++ struct smb2_connect_state); ++ struct tevent_req *subreq = NULL; ++ uint32_t timeout_msec; ++ + timeout_msec = state->transport->options.request_timeout * 1000; + + subreq = smb2cli_tcon_send(state, state->ev, +-- +2.28.0 + + +From 63b0086d8ffdfca44134c09ff0db76d7a9ae8f6c Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 7 Jul 2020 12:44:26 +0200 +Subject: [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source4/libcli/smb2/connect.c | 38 +++++++++++++++++++++++++++++++++++ + 1 file changed, 38 insertions(+) + +diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c +index 95ff05eac8f..3a3ecdf20e8 100644 +--- a/source4/libcli/smb2/connect.c ++++ b/source4/libcli/smb2/connect.c +@@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req) + tevent_req_set_callback(subreq, smb2_connect_session_done, req); + } + ++static void smb2_connect_enc_start(struct tevent_req *req); + static void smb2_connect_tcon_start(struct tevent_req *req); + static void smb2_connect_tcon_done(struct tevent_req *subreq); + +@@ -289,6 +290,43 @@ static void smb2_connect_session_done(struct tevent_req *subreq) + return; + } + ++ smb2_connect_enc_start(req); ++} ++ ++static void smb2_connect_enc_start(struct tevent_req *req) ++{ ++ struct smb2_connect_state *state = ++ tevent_req_data(req, ++ struct smb2_connect_state); ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(state->credentials); ++ NTSTATUS status; ++ ++ if (encryption_state < SMB_ENCRYPTION_DESIRED) { ++ smb2_connect_tcon_start(req); ++ return; ++ } ++ ++ status = smb2cli_session_encryption_on(state->session->smbXcli); ++ if (!NT_STATUS_IS_OK(status)) { ++ if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) { ++ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { ++ smb2_connect_tcon_start(req); ++ return; ++ } ++ ++ DBG_ERR("Encryption required and server doesn't support " ++ "SMB3 encryption - failing connect\n"); ++ tevent_req_nterror(req, status); ++ return; ++ } ++ ++ DBG_ERR("Encryption required and setup failed with error %s.\n", ++ nt_errstr(status)); ++ tevent_req_nterror(req, NT_STATUS_PROTOCOL_NOT_SUPPORTED); ++ return; ++ } ++ + smb2_connect_tcon_start(req); + } + +-- +2.28.0 + + +From 8bc1b5f884d1e6a88e1ac403d9bc64c3b77e9428 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 24 Jul 2020 10:18:52 +0200 +Subject: [PATCH 048/105] s4:libcli: Require signing for SMB encryption + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source4/libcli/smb2/connect.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c +index 3a3ecdf20e8..9540704491e 100644 +--- a/source4/libcli/smb2/connect.c ++++ b/source4/libcli/smb2/connect.c +@@ -31,6 +31,7 @@ + #include "param/param.h" + #include "auth/credentials/credentials.h" + #include "../libcli/smb/smbXcli_base.h" ++#include "smb2_constants.h" + + struct smb2_connect_state { + struct tevent_context *ev; +@@ -76,6 +77,8 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, + struct smb2_connect_state *state; + struct composite_context *creq; + static const char *default_ports[] = { "445", "139", NULL }; ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(credentials); + + req = tevent_req_create(mem_ctx, &state, + struct smb2_connect_state); +@@ -99,6 +102,10 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, + state->ports = default_ports; + } + ++ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { ++ state->options.signing = SMB_SIGNING_REQUIRED; ++ } ++ + make_nbt_name_client(&state->calling, + cli_credentials_get_workstation(credentials)); + +@@ -116,7 +123,7 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, + + status = smb2_transport_raw_init(state, ev, + existing_conn, +- options, ++ &state->options, + &state->transport); + if (tevent_req_nterror(req, status)) { + return tevent_req_post(req, ev); +-- +2.28.0 + + +From 5cc8a0bc7381444804cde992afdc7aa0c0b70074 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 7 Jul 2020 14:27:07 +0200 +Subject: [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC + connection + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Wed Aug 19 17:46:28 UTC 2020 on sn-devel-184 +--- + python/samba/tests/dcerpc/binding.py | 82 ++++++++++++++++++++++++++++ + selftest/tests.py | 1 + + 2 files changed, 83 insertions(+) + create mode 100644 python/samba/tests/dcerpc/binding.py + +diff --git a/python/samba/tests/dcerpc/binding.py b/python/samba/tests/dcerpc/binding.py +new file mode 100644 +index 00000000000..8e0d6a5ef0a +--- /dev/null ++++ b/python/samba/tests/dcerpc/binding.py +@@ -0,0 +1,82 @@ ++# ++# Unix SMB/CIFS implementation. ++# Copyright (c) 2020 Andreas Schneider ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++"""Tests for samba.dcerpc., credentials and binding strings""" ++ ++import samba.tests ++from samba.tests import RpcInterfaceTestCase, TestCase ++from samba.dcerpc import lsa ++import samba.dcerpc.security as security ++from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED ++from samba import NTSTATUSError ++ ++class RpcBindingTests(RpcInterfaceTestCase): ++ def setUp(self): ++ super(RpcBindingTests, self).setUp() ++ ++ def get_user_creds(self): ++ c = Credentials() ++ c.guess() ++ domain = samba.tests.env_get_var_value('DOMAIN') ++ username = samba.tests.env_get_var_value('USERNAME') ++ password = samba.tests.env_get_var_value('PASSWORD') ++ c.set_domain(domain) ++ c.set_username(username) ++ c.set_password(password) ++ return c ++ ++ def test_smb3_dcerpc_encryption(self): ++ creds = self.get_user_creds() ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ lp = self.get_loadparm() ++ lp.set('client ipc max protocol', 'SMB3') ++ lp.set('client ipc min protocol', 'SMB3') ++ ++ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) ++ lsa_conn = lsa.lsarpc(binding_string, lp, creds) ++ ++ objectAttr = lsa.ObjectAttribute() ++ objectAttr.sec_qos = lsa.QosInfo() ++ ++ pol_handle = lsa_conn.OpenPolicy2('', ++ objectAttr, ++ security.SEC_FLAG_MAXIMUM_ALLOWED) ++ self.assertIsNotNone(pol_handle) ++ ++ def test_smb2_dcerpc_encryption(self): ++ creds = self.get_user_creds() ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ lp = self.get_loadparm() ++ lp.set('client ipc max protocol', 'SMB2') ++ lp.set('client ipc min protocol', 'SMB2') ++ ++ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) ++ self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds) ++ ++ def test_smb1_dcerpc_encryption(self): ++ creds = self.get_user_creds() ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ lp = self.get_loadparm() ++ lp.set('client ipc max protocol', 'NT1') ++ lp.set('client ipc min protocol', 'NT1') ++ ++ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) ++ self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds) +diff --git a/selftest/tests.py b/selftest/tests.py +index 20981754db4..adcb5b53189 100644 +--- a/selftest/tests.py ++++ b/selftest/tests.py +@@ -92,6 +92,7 @@ planpythontestsuite( + extra_path=[os.path.join(samba4srcdir, "..", "buildtools"), + os.path.join(samba4srcdir, "..", "third_party", "waf")]) + planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest") ++planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding") + + + def cmdline(script, *args): +-- +2.28.0 + + +From 546ecfae4f11e0625de86e47e90a98a7aafa0453 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 4 Sep 2020 10:47:54 +0200 +Subject: [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() + +Pair-Programmed-With: Andreas Schneider + +Signed-off-by: Andreas Schneider +Signed-off-by: Stefan Metzmacher +(cherry picked from commit b34e8dc8982b625d946e2ac8794ee41311bc41c2) +--- + auth/gensec/gensec.h | 2 + + auth/gensec/gensec_start.c | 87 ++++++++++++++++++++++++++++++++++++++ + 2 files changed, 89 insertions(+) + +diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h +index d424067d02c..fe26fff171a 100644 +--- a/auth/gensec/gensec.h ++++ b/auth/gensec/gensec.h +@@ -308,6 +308,8 @@ const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx + + NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, + const char *sasl_name); ++const char **gensec_security_sasl_names(struct gensec_security *gensec_security, ++ TALLOC_CTX *mem_ctx); + + int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value); + bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value); +diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c +index d2d62d6652e..4eb45643714 100644 +--- a/auth/gensec/gensec_start.c ++++ b/auth/gensec/gensec_start.c +@@ -299,6 +299,93 @@ const struct gensec_security_ops *gensec_security_by_name(struct gensec_security + return NULL; + } + ++static const char **gensec_security_sasl_names_from_ops( ++ struct gensec_security *gensec_security, ++ TALLOC_CTX *mem_ctx, ++ const struct gensec_security_ops * const *ops) ++{ ++ const char **sasl_names = NULL; ++ size_t i, sasl_names_count = 0; ++ ++ if (ops == NULL) { ++ return NULL; ++ } ++ ++ sasl_names = talloc_array(mem_ctx, const char *, 1); ++ if (sasl_names == NULL) { ++ return NULL; ++ } ++ ++ for (i = 0; ops[i] != NULL; i++) { ++ enum gensec_role role = GENSEC_SERVER; ++ const char **tmp = NULL; ++ ++ if (ops[i]->sasl_name == NULL) { ++ continue; ++ } ++ ++ if (gensec_security != NULL) { ++ if (!gensec_security_ops_enabled(ops[i], ++ gensec_security)) { ++ continue; ++ } ++ ++ role = gensec_security->gensec_role; ++ } ++ ++ switch (role) { ++ case GENSEC_CLIENT: ++ if (ops[i]->client_start == NULL) { ++ continue; ++ } ++ break; ++ case GENSEC_SERVER: ++ if (ops[i]->server_start == NULL) { ++ continue; ++ } ++ break; ++ } ++ ++ tmp = talloc_realloc(mem_ctx, ++ sasl_names, ++ const char *, ++ sasl_names_count + 2); ++ if (tmp == NULL) { ++ TALLOC_FREE(sasl_names); ++ return NULL; ++ } ++ sasl_names = tmp; ++ ++ sasl_names[sasl_names_count] = ops[i]->sasl_name; ++ sasl_names_count++; ++ } ++ sasl_names[sasl_names_count] = NULL; ++ ++ return sasl_names; ++} ++ ++/** ++ * @brief Get the sasl names from the gensec security context. ++ * ++ * @param[in] gensec_security The gensec security context. ++ * ++ * @param[in] mem_ctx The memory context to allocate memory on. ++ * ++ * @return An allocated array with sasl names, NULL on error. ++ */ ++_PUBLIC_ ++const char **gensec_security_sasl_names(struct gensec_security *gensec_security, ++ TALLOC_CTX *mem_ctx) ++{ ++ const struct gensec_security_ops **ops = NULL; ++ ++ ops = gensec_security_mechs(gensec_security, mem_ctx); ++ ++ return gensec_security_sasl_names_from_ops(gensec_security, ++ mem_ctx, ++ ops); ++} ++ + /** + * Return a unique list of security subsystems from those specified in + * the list of SASL names. +-- +2.28.0 + + +From ec079d88720a99a5bc5e6b5efd03f87342364f15 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 4 Sep 2020 10:48:27 +0200 +Subject: [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in + ldapsrv_backend_Init() + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andreas Schneider +(cherry picked from commit 5e3363e0b82193700f91a9bae5080aae0b744e5c) +--- + source4/dsdb/samdb/ldb_modules/rootdse.c | 4 +- + source4/ldap_server/ldap_backend.c | 49 +++++++++++------------- + 2 files changed, 25 insertions(+), 28 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/rootdse.c b/source4/dsdb/samdb/ldb_modules/rootdse.c +index 55340fa4f1e..4be9550747c 100644 +--- a/source4/dsdb/samdb/ldb_modules/rootdse.c ++++ b/source4/dsdb/samdb/ldb_modules/rootdse.c +@@ -230,7 +230,7 @@ static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *m + struct ldb_context *ldb; + struct rootdse_private_data *priv = talloc_get_type(ldb_module_get_private(ac->module), struct rootdse_private_data); + const char * const *attrs = ac->req->op.search.attrs; +- char **server_sasl; ++ const char **server_sasl = NULL; + const struct dsdb_schema *schema; + int *val; + struct ldb_control *edn_control; +@@ -341,7 +341,7 @@ static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *m + } + + server_sasl = talloc_get_type(ldb_get_opaque(ldb, "supportedSASLMechanisms"), +- char *); ++ const char *); + if (server_sasl && do_attribute(attrs, "supportedSASLMechanisms")) { + for (i = 0; server_sasl && server_sasl[i]; i++) { + char *sasl_name = talloc_strdup(msg, server_sasl[i]); +diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c +index 2839082daef..915d9b94f9b 100644 +--- a/source4/ldap_server/ldap_backend.c ++++ b/source4/ldap_server/ldap_backend.c +@@ -33,6 +33,7 @@ + #include "ldb_wrap.h" + #include "lib/tsocket/tsocket.h" + #include "libcli/ldap/ldap_proto.h" ++#include "source4/auth/auth.h" + + static int map_ldb_error(TALLOC_CTX *mem_ctx, int ldb_err, + const char *add_err_string, const char **errstring) +@@ -199,37 +200,33 @@ int ldapsrv_backend_Init(struct ldapsrv_connection *conn, + } + + if (conn->server_credentials) { +- char **sasl_mechs = NULL; +- const struct gensec_security_ops * const *backends = gensec_security_all(); +- const struct gensec_security_ops **ops +- = gensec_use_kerberos_mechs(conn, backends, conn->server_credentials); +- unsigned int i, j = 0; +- for (i = 0; ops && ops[i]; i++) { +- if (!lpcfg_parm_bool(conn->lp_ctx, NULL, "gensec", ops[i]->name, ops[i]->enabled)) +- continue; +- +- if (ops[i]->sasl_name && ops[i]->server_start) { +- char *sasl_name = talloc_strdup(conn, ops[i]->sasl_name); +- +- if (!sasl_name) { +- return LDB_ERR_OPERATIONS_ERROR; +- } +- sasl_mechs = talloc_realloc(conn, sasl_mechs, char *, j + 2); +- if (!sasl_mechs) { +- return LDB_ERR_OPERATIONS_ERROR; +- } +- sasl_mechs[j] = sasl_name; +- talloc_steal(sasl_mechs, sasl_name); +- sasl_mechs[j+1] = NULL; +- j++; +- } ++ struct gensec_security *gensec_security = NULL; ++ const char **sasl_mechs = NULL; ++ NTSTATUS status; ++ ++ status = samba_server_gensec_start(conn, ++ conn->connection->event.ctx, ++ conn->connection->msg_ctx, ++ conn->lp_ctx, ++ conn->server_credentials, ++ "ldap", ++ &gensec_security); ++ if (!NT_STATUS_IS_OK(status)) { ++ DBG_ERR("samba_server_gensec_start failed: %s\n", ++ nt_errstr(status)); ++ return LDB_ERR_OPERATIONS_ERROR; + } +- talloc_unlink(conn, ops); + + /* ldb can have a different lifetime to conn, so we + need to ensure that sasl_mechs lives as long as the + ldb does */ +- talloc_steal(conn->ldb, sasl_mechs); ++ sasl_mechs = gensec_security_sasl_names(gensec_security, ++ conn->ldb); ++ TALLOC_FREE(gensec_security); ++ if (sasl_mechs == NULL) { ++ DBG_ERR("Failed to get sasl mechs!\n"); ++ return LDB_ERR_OPERATIONS_ERROR; ++ } + + ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs); + } +-- +2.28.0 + + +From bc128ea1ea455a3a63e0ce3dc8777a7482c356f8 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 4 Sep 2020 14:39:15 +0200 +Subject: [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a + static function + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andreas Schneider +(cherry picked from commit 2186d4131ad4c7961d0c830bf9d48f3d06d27924) +--- + auth/gensec/gensec.h | 3 --- + auth/gensec/gensec_start.c | 7 ++++--- + 2 files changed, 4 insertions(+), 6 deletions(-) + +diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h +index fe26fff171a..8bece3c3458 100644 +--- a/auth/gensec/gensec.h ++++ b/auth/gensec/gensec.h +@@ -302,9 +302,6 @@ NTSTATUS gensec_wrap(struct gensec_security *gensec_security, + + const struct gensec_security_ops * const *gensec_security_all(void); + bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct gensec_security *security); +-const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, +- const struct gensec_security_ops * const *old_gensec_list, +- struct cli_credentials *creds); + + NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, + const char *sasl_name); +diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c +index 4eb45643714..ebcab76999a 100644 +--- a/auth/gensec/gensec_start.c ++++ b/auth/gensec/gensec_start.c +@@ -83,9 +83,10 @@ bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct g + * more compplex. + */ + +-_PUBLIC_ const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, +- const struct gensec_security_ops * const *old_gensec_list, +- struct cli_credentials *creds) ++static const struct gensec_security_ops **gensec_use_kerberos_mechs( ++ TALLOC_CTX *mem_ctx, ++ const struct gensec_security_ops * const *old_gensec_list, ++ struct cli_credentials *creds) + { + const struct gensec_security_ops **new_gensec_list; + int i, j, num_mechs_in; +-- +2.28.0 + + +From 37b7016fba1eae75fc4a87c9c5aebbbb47b7ff39 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 4 Sep 2020 14:41:43 +0200 +Subject: [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to + gensec_use_kerberos_mechs() + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andreas Schneider +(cherry picked from commit a33a40bbc848e5691869cf264009d23a03128f31) +--- + auth/gensec/gensec_start.c | 26 ++++++++++++++------------ + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c +index ebcab76999a..8d1b41fec74 100644 +--- a/auth/gensec/gensec_start.c ++++ b/auth/gensec/gensec_start.c +@@ -86,19 +86,11 @@ bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct g + static const struct gensec_security_ops **gensec_use_kerberos_mechs( + TALLOC_CTX *mem_ctx, + const struct gensec_security_ops * const *old_gensec_list, +- struct cli_credentials *creds) ++ enum credentials_use_kerberos use_kerberos, ++ bool keep_schannel) + { + const struct gensec_security_ops **new_gensec_list; + int i, j, num_mechs_in; +- enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; +- bool keep_schannel = false; +- +- if (creds) { +- use_kerberos = cli_credentials_get_kerberos_state(creds); +- if (cli_credentials_get_netlogon_creds(creds) != NULL) { +- keep_schannel = true; +- } +- } + + for (num_mechs_in=0; old_gensec_list && old_gensec_list[num_mechs_in]; num_mechs_in++) { + /* noop */ +@@ -163,18 +155,28 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( + struct gensec_security *gensec_security, + TALLOC_CTX *mem_ctx) + { +- struct cli_credentials *creds = NULL; + const struct gensec_security_ops * const *backends = gensec_security_all(); ++ enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; ++ bool keep_schannel = false; + + if (gensec_security != NULL) { ++ struct cli_credentials *creds = NULL; ++ + creds = gensec_get_credentials(gensec_security); ++ if (creds != NULL) { ++ use_kerberos = cli_credentials_get_kerberos_state(creds); ++ if (cli_credentials_get_netlogon_creds(creds) != NULL) { ++ keep_schannel = true; ++ } ++ } + + if (gensec_security->settings->backends) { + backends = gensec_security->settings->backends; + } + } + +- return gensec_use_kerberos_mechs(mem_ctx, backends, creds); ++ return gensec_use_kerberos_mechs(mem_ctx, backends, ++ use_kerberos, keep_schannel); + + } + +-- +2.28.0 + + +From 0579dbd6faa5a828cff42cd797f78c51316324b0 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 4 Sep 2020 17:00:45 +0200 +Subject: [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel + for machine account auth + +Signed-off-by: Stefan Metzmacher +Signed-off-by: Andreas Schneider +(cherry picked from commit 515cffb1f20eacb041ff7b3d43f8a122a82ddfbd) +--- + auth/gensec/gensec_start.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c +index 8d1b41fec74..3f42d611140 100644 +--- a/auth/gensec/gensec_start.c ++++ b/auth/gensec/gensec_start.c +@@ -168,6 +168,15 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( + if (cli_credentials_get_netlogon_creds(creds) != NULL) { + keep_schannel = true; + } ++ ++ /* ++ * Even if Kerberos is set to REQUIRED, keep the ++ * schannel auth mechanism that machine accounts are ++ * able to authenticate via netlogon. ++ */ ++ if (gensec_security->gensec_role == GENSEC_SERVER) { ++ keep_schannel = true; ++ } + } + + if (gensec_security->settings->backends) { +-- +2.28.0 + + +From 0f3676f4f84184b5bf83101e0b1eca0bb05a5079 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 4 Sep 2020 12:21:21 +0200 +Subject: [PATCH 055/105] auth:creds: Add cli_credentials_init_server() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 2c00bea2aefdcc69608dffdafa7ce581d31f9354) +--- + auth/credentials/credentials.c | 25 +++++++++++++++++++++++++ + auth/credentials/credentials.h | 2 ++ + 2 files changed, 27 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 9168b92d3ec..77c35dd104b 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -56,6 +56,31 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) + return cred; + } + ++_PUBLIC_ ++struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx, ++ struct loadparm_context *lp_ctx) ++{ ++ struct cli_credentials *server_creds = NULL; ++ NTSTATUS status; ++ ++ server_creds = cli_credentials_init(mem_ctx); ++ if (server_creds == NULL) { ++ return NULL; ++ } ++ ++ cli_credentials_set_conf(server_creds, lp_ctx); ++ ++ status = cli_credentials_set_machine_account(server_creds, lp_ctx); ++ if (!NT_STATUS_IS_OK(status)) { ++ DEBUG(1, ("Failed to obtain server credentials: %s\n", ++ nt_errstr(status))); ++ TALLOC_FREE(server_creds); ++ return NULL; ++ } ++ ++ return server_creds; ++} ++ + _PUBLIC_ void cli_credentials_set_callback_data(struct cli_credentials *cred, + void *callback_data) + { +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 7d0cf53194b..438bcdce232 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -76,6 +76,8 @@ bool cli_credentials_set_workstation(struct cli_credentials *cred, + enum credentials_obtained obtained); + bool cli_credentials_is_anonymous(struct cli_credentials *cred); + struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx); ++struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx, ++ struct loadparm_context *lp_ctx); + void cli_credentials_set_anonymous(struct cli_credentials *cred); + bool cli_credentials_wrong_password(struct cli_credentials *cred); + const char *cli_credentials_get_password(struct cli_credentials *cred); +-- +2.28.0 + + +From e1d566c2962ebd5596638df6f81fd120aaf32fcd Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 4 Sep 2020 12:21:36 +0200 +Subject: [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() + +Signed-off-by: Andreas Schneider +(cherry picked from commit 6c94ebf77fdb7383be2042f5e20ba2ef598cd4a4) +--- + source4/rpc_server/dcerpc_server.c | 17 +++-------------- + 1 file changed, 3 insertions(+), 14 deletions(-) + +diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c +index 084857a44bf..e64148ef788 100644 +--- a/source4/rpc_server/dcerpc_server.c ++++ b/source4/rpc_server/dcerpc_server.c +@@ -673,25 +673,14 @@ NTSTATUS dcesrv_gensec_prepare(TALLOC_CTX *mem_ctx, + struct cli_credentials *server_creds = NULL; + struct imessaging_context *imsg_ctx = + dcesrv_imessaging_context(call->conn); +- NTSTATUS status; + +- server_creds = cli_credentials_init(call->auth_state); +- if (!server_creds) { ++ server_creds = cli_credentials_init_server(call->auth_state, ++ call->conn->dce_ctx->lp_ctx); ++ if (server_creds == NULL) { + DEBUG(1, ("Failed to init server credentials\n")); + return NT_STATUS_NO_MEMORY; + } + +- cli_credentials_set_conf(server_creds, call->conn->dce_ctx->lp_ctx); +- +- status = cli_credentials_set_machine_account(server_creds, +- call->conn->dce_ctx->lp_ctx); +- if (!NT_STATUS_IS_OK(status)) { +- DEBUG(1, ("Failed to obtain server credentials: %s\n", +- nt_errstr(status))); +- talloc_free(server_creds); +- return status; +- } +- + return samba_server_gensec_start(mem_ctx, + call->event_ctx, + imsg_ctx, +-- +2.28.0 + + +From 694e1d1ca62372baba69818acf25a2eec8847115 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 7 Sep 2020 09:19:43 +0200 +Subject: [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for + negprot + +Signed-off-by: Andreas Schneider + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Mon Sep 7 13:22:26 UTC 2020 on sn-devel-184 + +(cherry picked from commit 0b742ec6a0558397d5cf01b99a401f8e2bc0e2e0) +--- + source4/smb_server/smb/negprot.c | 28 ++++++++++++++-------------- + source4/smb_server/smb2/negprot.c | 25 +++++++++++++------------ + 2 files changed, 27 insertions(+), 26 deletions(-) + +diff --git a/source4/smb_server/smb/negprot.c b/source4/smb_server/smb/negprot.c +index a6177a72019..04b69dd9883 100644 +--- a/source4/smb_server/smb/negprot.c ++++ b/source4/smb_server/smb/negprot.c +@@ -374,22 +374,22 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice) + DATA_BLOB blob = data_blob_null; + const char *oid; + NTSTATUS nt_status; +- +- server_credentials +- = cli_credentials_init(req); +- if (!server_credentials) { +- smbsrv_terminate_connection(req->smb_conn, "Failed to init server credentials\n"); +- return; +- } +- +- cli_credentials_set_conf(server_credentials, req->smb_conn->lp_ctx); +- nt_status = cli_credentials_set_machine_account(server_credentials, req->smb_conn->lp_ctx); +- if (!NT_STATUS_IS_OK(nt_status)) { +- DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status))); ++ ++ server_credentials = ++ cli_credentials_init_server(req, req->smb_conn->lp_ctx); ++ if (server_credentials == NULL) { ++ DBG_DEBUG("Failed to obtain server credentials, " ++ "perhaps a standalone server?\n"); + /* +- * We keep the server_credentials as anonymous +- * this is required for the spoolss.notify test ++ * Create anon server credentials for for the ++ * spoolss.notify test. + */ ++ server_credentials = cli_credentials_init_anon(req); ++ if (server_credentials == NULL) { ++ smbsrv_terminate_connection(req->smb_conn, ++ "Failed to init server credentials\n"); ++ return; ++ } + } + + nt_status = samba_server_gensec_start(req, +diff --git a/source4/smb_server/smb2/negprot.c b/source4/smb_server/smb2/negprot.c +index 4aaaf46793b..c433eb194bd 100644 +--- a/source4/smb_server/smb2/negprot.c ++++ b/source4/smb_server/smb2/negprot.c +@@ -39,20 +39,21 @@ static NTSTATUS smb2srv_negprot_secblob(struct smb2srv_request *req, DATA_BLOB * + NTSTATUS nt_status; + struct cli_credentials *server_credentials; + +- server_credentials = cli_credentials_init(req); +- if (!server_credentials) { +- smbsrv_terminate_connection(req->smb_conn, "Failed to init server credentials\n"); +- return NT_STATUS_NO_MEMORY; +- } +- +- cli_credentials_set_conf(server_credentials, req->smb_conn->lp_ctx); +- nt_status = cli_credentials_set_machine_account(server_credentials, req->smb_conn->lp_ctx); +- if (!NT_STATUS_IS_OK(nt_status)) { +- DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status))); ++ server_credentials = ++ cli_credentials_init_server(req, req->smb_conn->lp_ctx); ++ if (server_credentials == NULL) { ++ DBG_DEBUG("Failed to obtain server credentials, " ++ "perhaps a standalone server?\n"); + /* +- * We keep the server_credentials as anonymous +- * this is required for the spoolss.notify test ++ * Create anon server credentials for for the ++ * spoolss.notify test. + */ ++ server_credentials = cli_credentials_init_anon(req); ++ if (server_credentials == NULL) { ++ smbsrv_terminate_connection(req->smb_conn, ++ "Failed to init server credentials\n"); ++ return NT_STATUS_NO_MEMORY; ++ } + } + + req->smb_conn->negotiate.server_credentials = talloc_steal(req->smb_conn, server_credentials); +-- +2.28.0 + + +From c3b277172554d1d3155c3a1b4ad76685985273df Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 8 Sep 2020 10:15:22 +0200 +Subject: [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb + encrypt' + +This makes it more clear what we want. 'smb encrypt' is a synonym for +'server smb encrypt'. + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit c75e8ff47b4d79b37240f9461ddae10a4f03c892) +--- + selftest/target/Samba3.pm | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm +index 0a8cefa811d..a31165b372d 100755 +--- a/selftest/target/Samba3.pm ++++ b/selftest/target/Samba3.pm +@@ -1178,7 +1178,7 @@ sub setup_simpleserver + ntlm auth = yes + vfs objects = xattr_tdb streams_depot + change notify = no +- smb encrypt = off ++ server smb encrypt = off + + [vfs_aio_pthread] + path = $prefix_abs/share +@@ -1245,7 +1245,7 @@ sub setup_simpleserver + [enc_desired] + path = $prefix_abs/share + vfs objects = +- smb encrypt = desired ++ server smb encrypt = desired + + [hidenewfiles] + path = $prefix_abs/share +@@ -2340,7 +2340,7 @@ sub provision($$) + [tmpenc] + path = $shrdir + comment = encrypt smb username is [%U] +- smb encrypt = required ++ server smb encrypt = required + vfs objects = dirsort + [tmpguest] + path = $shrdir +-- +2.28.0 + + +From 355afa22953cf8838dc83210315bc2557e764082 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 8 Sep 2020 12:30:08 +0200 +Subject: [PATCH 059/105] selftest: Move enc_desired to provision to have it in + 'fileserver' too + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 1b67943f938ae774360dc3db73db940f9982243b) +--- + selftest/target/Samba3.pm | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm +index a31165b372d..eda2c428793 100755 +--- a/selftest/target/Samba3.pm ++++ b/selftest/target/Samba3.pm +@@ -1242,11 +1242,6 @@ sub setup_simpleserver + hide files = /hidefile/ + hide dot files = yes + +-[enc_desired] +- path = $prefix_abs/share +- vfs objects = +- server smb encrypt = desired +- + [hidenewfiles] + path = $prefix_abs/share + hide new files timeout = 5 +@@ -2822,7 +2817,13 @@ sub provision($$) + [delete_readonly] + path = $prefix_abs/share + delete readonly = yes ++ ++[enc_desired] ++ path = $prefix_abs/share ++ vfs objects = ++ server smb encrypt = desired + "; ++ + close(CONF); + + my $net = Samba::bindir_path($self, "net"); +-- +2.28.0 + + +From 2a8b98850f61219a1c97da9151e55d0e21a4265b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 8 Sep 2020 10:15:20 +0200 +Subject: [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb + encrypt' + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit e7577ab6cbc83b496ac091c3e425c7c7fea29cdb) +--- + selftest/knownfail.d/smbclient-encryption | 2 + + selftest/target/Samba3.pm | 5 ++ + .../script/tests/test_smbclient_encryption.sh | 72 +++++++++++++++++++ + source3/selftest/tests.py | 6 ++ + 4 files changed, 85 insertions(+) + create mode 100644 selftest/knownfail.d/smbclient-encryption + create mode 100755 source3/script/tests/test_smbclient_encryption.sh + +diff --git a/selftest/knownfail.d/smbclient-encryption b/selftest/knownfail.d/smbclient-encryption +new file mode 100644 +index 00000000000..972096bdc8b +--- /dev/null ++++ b/selftest/knownfail.d/smbclient-encryption +@@ -0,0 +1,2 @@ ++^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver ++^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver +diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm +index eda2c428793..9f86f2b59cf 100755 +--- a/selftest/target/Samba3.pm ++++ b/selftest/target/Samba3.pm +@@ -2822,6 +2822,11 @@ sub provision($$) + path = $prefix_abs/share + vfs objects = + server smb encrypt = desired ++ ++[enc_off] ++ path = $prefix_abs/share ++ vfs objects = ++ server smb encrypt = off + "; + + close(CONF); +diff --git a/source3/script/tests/test_smbclient_encryption.sh b/source3/script/tests/test_smbclient_encryption.sh +new file mode 100755 +index 00000000000..9a717cdac4f +--- /dev/null ++++ b/source3/script/tests/test_smbclient_encryption.sh +@@ -0,0 +1,72 @@ ++#!/bin/sh ++ ++if [ $# -lt 5 ]; then ++cat < +Date: Thu, 27 Aug 2020 15:19:27 +0200 +Subject: [PATCH 061/105] s3:client: Remove global smb_encrypt + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 1189b20cb7ea09cfed5c246cf977442a51ef72cb) +--- + source3/client/client.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 30287ffd253..e1128bf4a8c 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -98,9 +98,6 @@ static unsigned int put_total_time_ms = 0; + /* totals globals */ + static double dir_total; + +-/* encrypted state. */ +-static bool smb_encrypt; +- + /* root cli_state connection */ + + struct cli_state *cli; +@@ -2822,7 +2819,7 @@ static int cmd_posix_encrypt(void) + d_printf("posix_encrypt failed with error %s\n", nt_errstr(status)); + } else { + d_printf("encryption on\n"); +- smb_encrypt = true; ++ set_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info()); + } + + return 0; +@@ -5347,6 +5344,9 @@ int cmd_iosize(void) + TALLOC_CTX *ctx = talloc_tos(); + char *buf; + int iosize; ++ bool smb_encrypt = ++ get_cmdline_auth_info_smb_encrypt( ++ popt_get_cmdline_auth_info()); + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { + if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_SMB2_02) { +@@ -5610,6 +5610,9 @@ static int process_command_string(const char *cmd_in) + TALLOC_CTX *ctx = talloc_tos(); + char *cmd = talloc_strdup(ctx, cmd_in); + int rc = 0; ++ bool smb_encrypt = ++ get_cmdline_auth_info_smb_encrypt( ++ popt_get_cmdline_auth_info()); + + if (!cmd) { + return 1; +@@ -6063,6 +6066,9 @@ static int process(const char *base_directory) + { + int rc = 0; + NTSTATUS status; ++ bool smb_encrypt = ++ get_cmdline_auth_info_smb_encrypt( ++ popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + desthost, +@@ -6101,6 +6107,9 @@ static int process(const char *base_directory) + static int do_host_query(const char *query_host) + { + NTSTATUS status; ++ bool smb_encrypt = ++ get_cmdline_auth_info_smb_encrypt( ++ popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + query_host, +@@ -6178,6 +6187,9 @@ static int do_tar_op(const char *base_directory) + { + struct tar *tar_ctx = tar_get_ctx(); + int ret = 0; ++ bool smb_encrypt = ++ get_cmdline_auth_info_smb_encrypt( ++ popt_get_cmdline_auth_info()); + + /* do we already have a connection? */ + if (!cli) { +@@ -6523,9 +6535,6 @@ int main(int argc,char *argv[]) + case 'q': + quiet=true; + break; +- case 'e': +- smb_encrypt=true; +- break; + case 'B': + return(do_smb_browse()); + +@@ -6595,8 +6604,6 @@ int main(int argc,char *argv[]) + + /* Ensure we have a password (or equivalent). */ + popt_common_credentials_post(); +- smb_encrypt = get_cmdline_auth_info_smb_encrypt( +- popt_get_cmdline_auth_info()); + + max_protocol = lp_client_max_protocol(); + +-- +2.28.0 + + +From 088473e47bcb30fe3b179133265da9ea6b8ec684 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 15:24:27 +0200 +Subject: [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit a9fbc8dae878ddfa54153e91cc1128c307816b76) +--- + source3/client/client.c | 21 ++++----------------- + source3/lib/netapi/cm.c | 1 - + source3/libsmb/clidfs.c | 4 ++-- + source3/libsmb/proto.h | 1 - + 4 files changed, 6 insertions(+), 21 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index e1128bf4a8c..1f18024b798 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -5610,9 +5610,6 @@ static int process_command_string(const char *cmd_in) + TALLOC_CTX *ctx = talloc_tos(); + char *cmd = talloc_strdup(ctx, cmd_in); + int rc = 0; +- bool smb_encrypt = +- get_cmdline_auth_info_smb_encrypt( +- popt_get_cmdline_auth_info()); + + if (!cmd) { + return 1; +@@ -5625,7 +5622,6 @@ static int process_command_string(const char *cmd_in) + status = cli_cm_open(talloc_tos(), NULL, + desthost, + service, popt_get_cmdline_auth_info(), +- smb_encrypt, + max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, +@@ -6066,14 +6062,11 @@ static int process(const char *base_directory) + { + int rc = 0; + NTSTATUS status; +- bool smb_encrypt = +- get_cmdline_auth_info_smb_encrypt( +- popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + desthost, + service, popt_get_cmdline_auth_info(), +- smb_encrypt, max_protocol, ++ max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6107,14 +6100,11 @@ static int process(const char *base_directory) + static int do_host_query(const char *query_host) + { + NTSTATUS status; +- bool smb_encrypt = +- get_cmdline_auth_info_smb_encrypt( +- popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + query_host, + "IPC$", popt_get_cmdline_auth_info(), +- smb_encrypt, max_protocol, ++ max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6161,7 +6151,7 @@ static int do_host_query(const char *query_host) + status = cli_cm_open(talloc_tos(), NULL, + query_host, + "IPC$", popt_get_cmdline_auth_info(), +- smb_encrypt, max_proto, ++ max_proto, + have_ip ? &dest_ss : NULL, NBT_SMB_PORT, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6187,9 +6177,6 @@ static int do_tar_op(const char *base_directory) + { + struct tar *tar_ctx = tar_get_ctx(); + int ret = 0; +- bool smb_encrypt = +- get_cmdline_auth_info_smb_encrypt( +- popt_get_cmdline_auth_info()); + + /* do we already have a connection? */ + if (!cli) { +@@ -6198,7 +6185,7 @@ static int do_tar_op(const char *base_directory) + status = cli_cm_open(talloc_tos(), NULL, + desthost, + service, popt_get_cmdline_auth_info(), +- smb_encrypt, max_protocol, ++ max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c +index 1b8f2a4e97a..0fd31ef3d5a 100644 +--- a/source3/lib/netapi/cm.c ++++ b/source3/lib/netapi/cm.c +@@ -110,7 +110,6 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, + status = cli_cm_open(ctx, NULL, + server_name, "IPC$", + auth_info, +- false, + lp_client_ipc_max_protocol(), + NULL, 0, 0x20, &cli_ipc); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index aff998f6187..4825b8f3fae 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -383,7 +383,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + const char *server, + const char *share, + const struct user_auth_info *auth_info, +- bool force_encrypt, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +@@ -393,6 +392,8 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + /* Try to reuse an existing connection in this list. */ + struct cli_state *c = cli_cm_find(referring_cli, server, share); + NTSTATUS status; ++ bool force_encrypt = ++ get_cmdline_auth_info_smb_encrypt(auth_info); + + if (c) { + *pcli = c; +@@ -962,7 +963,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + smbXcli_conn_remote_name(rootcli->conn), + "IPC$", + dfs_auth_info, +- cli_state_is_encryption_on(rootcli), + smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss not needed, we reuse the transport */ + 0, +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index eeabcaa7463..bb3e9e6874e 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -128,7 +128,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + const char *server, + const char *share, + const struct user_auth_info *auth_info, +- bool force_encrypt, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +-- +2.28.0 + + +From 0291ff12056c914b3f9429a5bba48190897fe6c1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 15:26:39 +0200 +Subject: [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit d27e237cf37fb254646d94827935d9c302c379ff) +--- + source3/libsmb/clidfs.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 4825b8f3fae..b0032005398 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -287,7 +287,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + const char *server, + const char *share, + const struct user_auth_info *auth_info, +- bool force_encrypt, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +@@ -296,6 +295,8 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + { + struct cli_state *cli = NULL; + NTSTATUS status; ++ bool force_encrypt = ++ get_cmdline_auth_info_smb_encrypt(auth_info); + + status = do_connect(ctx, server, share, + auth_info, +@@ -392,8 +393,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + /* Try to reuse an existing connection in this list. */ + struct cli_state *c = cli_cm_find(referring_cli, server, share); + NTSTATUS status; +- bool force_encrypt = +- get_cmdline_auth_info_smb_encrypt(auth_info); + + if (c) { + *pcli = c; +@@ -414,7 +413,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + server, + share, + auth_info, +- force_encrypt, + max_protocol, + dest_ss, + port, +@@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + dfs_refs[count].server, + dfs_refs[count].share, + dfs_auth_info, +- cli_state_is_encryption_on(rootcli), + smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss */ + 0, /* port */ +-- +2.28.0 + + +From 32f7fd016ecbeb3b24ad93d593ba06e8292dd02f Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 15:28:28 +0200 +Subject: [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs + do_connect() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 615a9a68166bdeb0ab7dbacf395c6125ec70f288) +--- + source3/libsmb/clidfs.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index b0032005398..5503506de97 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + const char *server, + const char *share, + const struct user_auth_info *auth_info, +- bool force_encrypt, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +@@ -123,6 +122,8 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + enum protocol_types protocol = PROTOCOL_NONE; + int signing_state = get_cmdline_auth_info_signing_state(auth_info); + struct cli_credentials *creds = NULL; ++ bool force_encrypt = ++ get_cmdline_auth_info_smb_encrypt(auth_info); + + if (force_encrypt) { + signing_state = SMB_SIGNING_REQUIRED; +@@ -233,7 +234,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + cli_shutdown(c); + return do_connect(ctx, newserver, + newshare, auth_info, +- force_encrypt, max_protocol, ++ max_protocol, + NULL, port, name_type, pcli); + } + +@@ -295,12 +296,10 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + { + struct cli_state *cli = NULL; + NTSTATUS status; +- bool force_encrypt = +- get_cmdline_auth_info_smb_encrypt(auth_info); + + status = do_connect(ctx, server, share, + auth_info, +- force_encrypt, max_protocol, ++ max_protocol, + dest_ss, port, name_type, &cli); + + if (!NT_STATUS_IS_OK(status)) { +-- +2.28.0 + + +From 4afc92a55aa63557db2b4e2a9b0bbe5bc7d12c55 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 15:52:11 +0200 +Subject: [PATCH 065/105] s3:libsmb: Remove force_encrypt from + cli_check_msdfs_proxy() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 4ddec1ca257fff418847c5d1e83a3fb7cb5ade1a) +--- + source3/libsmb/clidfs.c | 17 ++++++++++++----- + source3/libsmb/libsmb_server.c | 4 ---- + source3/libsmb/proto.h | 1 - + 3 files changed, 12 insertions(+), 10 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 5503506de97..736c565a7a8 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -230,7 +230,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + if (smbXcli_conn_dfs_supported(c->conn) && + cli_check_msdfs_proxy(ctx, c, sharename, + &newserver, &newshare, +- force_encrypt, creds)) { ++ creds)) { + cli_shutdown(c); + return do_connect(ctx, newserver, + newshare, auth_info, +@@ -1176,7 +1176,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, + const char *sharename, + char **pp_newserver, + char **pp_newshare, +- bool force_encrypt, + struct cli_credentials *creds) + { + struct client_dfs_referral *refs = NULL; +@@ -1188,6 +1187,8 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, + char *newextrapath = NULL; + NTSTATUS status; + const char *remote_name; ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(creds); + + if (!cli || !sharename) { + return false; +@@ -1223,11 +1224,17 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, + return false; + } + +- if (force_encrypt) { ++ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { + status = cli_cm_force_encryption_creds(cli, creds, "IPC$"); + if (!NT_STATUS_IS_OK(status)) { +- cli_state_restore_tcon(cli, orig_tcon); +- return false; ++ switch (encryption_state) { ++ case SMB_ENCRYPTION_DESIRED: ++ break; ++ case SMB_ENCRYPTION_REQUIRED: ++ default: ++ cli_state_restore_tcon(cli, orig_tcon); ++ return false; ++ } + } + } + +diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index eb58d7c6ac9..5a1055ba773 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -587,10 +587,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, + if (smbXcli_conn_dfs_supported(c->conn) && + cli_check_msdfs_proxy(ctx, c, share, + &newserver, &newshare, +- /* FIXME: cli_check_msdfs_proxy() does +- not support smbc_smb_encrypt_level type */ +- context->internal->smb_encryption_level ? +- true : false, + creds)) { + cli_shutdown(c); + srv = SMBC_server_internal(ctx, context, connect_if_not_found, +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index bb3e9e6874e..f2b0a8c5ff8 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -161,7 +161,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, + const char *sharename, + char **pp_newserver, + char **pp_newshare, +- bool force_encrypt, + struct cli_credentials *creds); + + /* The following definitions come from libsmb/clientgen.c */ +-- +2.28.0 + + +From 2c50d0ba7eec6d37943b7afdf426b114c9e1f292 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 18 Aug 2020 17:15:09 +0200 +Subject: [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs + do_connect() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 276563de06f2071ec2ed9a8b73f92215ab621bba) +--- + selftest/knownfail.d/smbclient-encryption | 2 -- + source3/libsmb/clidfs.c | 34 +++++++++++++---------- + 2 files changed, 20 insertions(+), 16 deletions(-) + delete mode 100644 selftest/knownfail.d/smbclient-encryption + +diff --git a/selftest/knownfail.d/smbclient-encryption b/selftest/knownfail.d/smbclient-encryption +deleted file mode 100644 +index 972096bdc8b..00000000000 +--- a/selftest/knownfail.d/smbclient-encryption ++++ /dev/null +@@ -1,2 +0,0 @@ +-^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver +-^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 736c565a7a8..d536e0597af 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -106,7 +106,7 @@ static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, + static NTSTATUS do_connect(TALLOC_CTX *ctx, + const char *server, + const char *share, +- const struct user_auth_info *auth_info, ++ struct cli_credentials *creds, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +@@ -120,12 +120,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + NTSTATUS status; + int flags = 0; + enum protocol_types protocol = PROTOCOL_NONE; +- int signing_state = get_cmdline_auth_info_signing_state(auth_info); +- struct cli_credentials *creds = NULL; +- bool force_encrypt = +- get_cmdline_auth_info_smb_encrypt(auth_info); ++ enum smb_signing_setting signing_state = ++ cli_credentials_get_smb_signing(creds); ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(creds); + +- if (force_encrypt) { ++ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { + signing_state = SMB_SIGNING_REQUIRED; + } + +@@ -192,13 +192,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + smb2cli_conn_set_max_credits(c->conn, DEFAULT_SMB2_MAX_CREDITS); + } + +- creds = get_cmdline_auth_info_creds(auth_info); +- + status = cli_session_setup_creds(c, creds); + if (!NT_STATUS_IS_OK(status)) { + /* If a password was not supplied then + * try again with a null username. */ +- if (force_encrypt || smbXcli_conn_signing_mandatory(c->conn) || ++ if (encryption_state == SMB_ENCRYPTION_REQUIRED || ++ smbXcli_conn_signing_mandatory(c->conn) || + cli_credentials_authentication_requested(creds) || + cli_credentials_is_anonymous(creds) || + !NT_STATUS_IS_OK(status = cli_session_setup_anon(c))) +@@ -233,7 +232,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + creds)) { + cli_shutdown(c); + return do_connect(ctx, newserver, +- newshare, auth_info, ++ newshare, creds, + max_protocol, + NULL, port, name_type, pcli); + } +@@ -247,13 +246,19 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + return status; + } + +- if (force_encrypt) { ++ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { + status = cli_cm_force_encryption_creds(c, + creds, + sharename); + if (!NT_STATUS_IS_OK(status)) { +- cli_shutdown(c); +- return status; ++ switch (encryption_state) { ++ case SMB_ENCRYPTION_DESIRED: ++ break; ++ case SMB_ENCRYPTION_REQUIRED: ++ default: ++ cli_shutdown(c); ++ return status; ++ } + } + } + +@@ -295,10 +300,11 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + struct cli_state **pcli) + { + struct cli_state *cli = NULL; ++ struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); + NTSTATUS status; + + status = do_connect(ctx, server, share, +- auth_info, ++ creds, + max_protocol, + dest_ss, port, name_type, &cli); + +-- +2.28.0 + + +From 608c0b87761f75e539b2e1e7599ceb981770b647 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 18 Aug 2020 17:18:16 +0200 +Subject: [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit c8349111243fec81a2b95484e56a6d6bebaba80e) +--- + source3/libsmb/clidfs.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index d536e0597af..a2c6f5fe5ec 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -292,7 +292,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + struct cli_state *referring_cli, + const char *server, + const char *share, +- const struct user_auth_info *auth_info, ++ struct cli_credentials *creds, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +@@ -300,7 +300,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + struct cli_state **pcli) + { + struct cli_state *cli = NULL; +- struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); + NTSTATUS status; + + status = do_connect(ctx, server, share, +@@ -397,6 +396,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + { + /* Try to reuse an existing connection in this list. */ + struct cli_state *c = cli_cm_find(referring_cli, server, share); ++ struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); + NTSTATUS status; + + if (c) { +@@ -417,7 +417,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + referring_cli, + server, + share, +- auth_info, ++ creds, + max_protocol, + dest_ss, + port, +@@ -886,6 +886,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + struct smbXcli_tcon *root_tcon = NULL; + struct smbXcli_tcon *target_tcon = NULL; + struct cli_dfs_path_split *dfs_refs = NULL; ++ struct cli_credentials *creds = get_cmdline_auth_info_creds(dfs_auth_info); + + if ( !rootcli || !path || !targetcli ) { + return NT_STATUS_INVALID_PARAMETER; +@@ -1022,7 +1023,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + status = cli_cm_connect(ctx, rootcli, + dfs_refs[count].server, + dfs_refs[count].share, +- dfs_auth_info, ++ creds, + smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss */ + 0, /* port */ +-- +2.28.0 + + +From d6d5da0e28c3879280e1139f51bfe2ef03bc450e Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 18 Aug 2020 17:26:54 +0200 +Subject: [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit df1623abd7267916696e2e60c146ef8fa6c9dfc9) +--- + source3/client/client.c | 23 ++++++++++++++++++----- + source3/lib/netapi/cm.c | 4 +++- + source3/libsmb/clidfs.c | 25 ++++++++++++------------- + source3/libsmb/proto.h | 18 +++++++++--------- + 4 files changed, 42 insertions(+), 28 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 1f18024b798..35bc3a7c5c3 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -5610,6 +5610,8 @@ static int process_command_string(const char *cmd_in) + TALLOC_CTX *ctx = talloc_tos(); + char *cmd = talloc_strdup(ctx, cmd_in); + int rc = 0; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + + if (!cmd) { + return 1; +@@ -5621,7 +5623,8 @@ static int process_command_string(const char *cmd_in) + + status = cli_cm_open(talloc_tos(), NULL, + desthost, +- service, popt_get_cmdline_auth_info(), ++ service, ++ creds, + max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, +@@ -6062,10 +6065,13 @@ static int process(const char *base_directory) + { + int rc = 0; + NTSTATUS status; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + desthost, +- service, popt_get_cmdline_auth_info(), ++ service, ++ creds, + max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); +@@ -6100,10 +6106,13 @@ static int process(const char *base_directory) + static int do_host_query(const char *query_host) + { + NTSTATUS status; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + query_host, +- "IPC$", popt_get_cmdline_auth_info(), ++ "IPC$", ++ creds, + max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); +@@ -6150,7 +6159,8 @@ static int do_host_query(const char *query_host) + d_printf("Reconnecting with SMB1 for workgroup listing.\n"); + status = cli_cm_open(talloc_tos(), NULL, + query_host, +- "IPC$", popt_get_cmdline_auth_info(), ++ "IPC$", ++ creds, + max_proto, + have_ip ? &dest_ss : NULL, NBT_SMB_PORT, + name_type, &cli); +@@ -6177,6 +6187,8 @@ static int do_tar_op(const char *base_directory) + { + struct tar *tar_ctx = tar_get_ctx(); + int ret = 0; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + + /* do we already have a connection? */ + if (!cli) { +@@ -6184,7 +6196,8 @@ static int do_tar_op(const char *base_directory) + + status = cli_cm_open(talloc_tos(), NULL, + desthost, +- service, popt_get_cmdline_auth_info(), ++ service, ++ creds, + max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); +diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c +index 0fd31ef3d5a..943f7498e8c 100644 +--- a/source3/lib/netapi/cm.c ++++ b/source3/lib/netapi/cm.c +@@ -71,6 +71,7 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, + struct cli_state *cli_ipc = NULL; + struct client_ipc_connection *p; + NTSTATUS status; ++ struct cli_credentials *creds = NULL; + + if (!ctx || !pp || !server_name) { + return WERR_INVALID_PARAMETER; +@@ -106,10 +107,11 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, + if (ctx->use_ccache) { + set_cmdline_auth_info_use_ccache(auth_info, true); + } ++ creds = get_cmdline_auth_info_creds(auth_info); + + status = cli_cm_open(ctx, NULL, + server_name, "IPC$", +- auth_info, ++ creds, + lp_client_ipc_max_protocol(), + NULL, 0, 0x20, &cli_ipc); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index a2c6f5fe5ec..ef75fb36a45 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -384,19 +384,18 @@ static struct cli_state *cli_cm_find(struct cli_state *cli, + ****************************************************************************/ + + NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +- struct cli_state *referring_cli, +- const char *server, +- const char *share, +- const struct user_auth_info *auth_info, +- int max_protocol, +- const struct sockaddr_storage *dest_ss, +- int port, +- int name_type, +- struct cli_state **pcli) ++ struct cli_state *referring_cli, ++ const char *server, ++ const char *share, ++ struct cli_credentials *creds, ++ int max_protocol, ++ const struct sockaddr_storage *dest_ss, ++ int port, ++ int name_type, ++ struct cli_state **pcli) + { + /* Try to reuse an existing connection in this list. */ + struct cli_state *c = cli_cm_find(referring_cli, server, share); +- struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); + NTSTATUS status; + + if (c) { +@@ -404,11 +403,11 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + return NT_STATUS_OK; + } + +- if (auth_info == NULL) { ++ if (creds == NULL) { + /* Can't do a new connection + * without auth info. */ + d_printf("cli_cm_open() Unable to open connection [\\%s\\%s] " +- "without auth info\n", ++ "without client credentials\n", + server, share ); + return NT_STATUS_INVALID_PARAMETER; + } +@@ -966,7 +965,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + rootcli, + smbXcli_conn_remote_name(rootcli->conn), + "IPC$", +- dfs_auth_info, ++ creds, + smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss not needed, we reuse the transport */ + 0, +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index f2b0a8c5ff8..0b8cf2a6036 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -124,15 +124,15 @@ struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx, + /* The following definitions come from libsmb/clidfs.c */ + + NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +- struct cli_state *referring_cli, +- const char *server, +- const char *share, +- const struct user_auth_info *auth_info, +- int max_protocol, +- const struct sockaddr_storage *dest_ss, +- int port, +- int name_type, +- struct cli_state **pcli); ++ struct cli_state *referring_cli, ++ const char *server, ++ const char *share, ++ struct cli_credentials *creds, ++ int max_protocol, ++ const struct sockaddr_storage *dest_ss, ++ int port, ++ int name_type, ++ struct cli_state **pcli); + void cli_cm_display(struct cli_state *c); + struct client_dfs_referral; + NTSTATUS cli_dfs_get_referral_ex(TALLOC_CTX *ctx, +-- +2.28.0 + + +From 1c07abb4b9690b62b2ae7841134d7a71e4771bb9 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 18 Aug 2020 17:42:25 +0200 +Subject: [PATCH 069/105] s3:libsmb: Pass cli_credentials to + cli_resolve_path(), using helper variables. + +Signed-off-by: Andreas Schneider +Signed-off-by: Jeremy Allison +(cherry picked from commit 5245ab3c4dacc88d5cbe3bb1e3e339e4fb77a4db) +--- + source3/client/client.c | 148 +++++++++++++++++++++++++++------- + source3/libsmb/clidfs.c | 5 +- + source3/libsmb/libsmb_dir.c | 43 ++++++++-- + source3/libsmb/libsmb_file.c | 13 ++- + source3/libsmb/libsmb_stat.c | 6 +- + source3/libsmb/libsmb_xattr.c | 13 ++- + source3/libsmb/proto.h | 2 +- + source3/utils/smbcacls.c | 5 +- + 8 files changed, 188 insertions(+), 47 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 35bc3a7c5c3..23de5befee3 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -300,9 +300,14 @@ static int do_dskattr(void) + struct cli_state *targetcli = NULL; + char *targetpath = NULL; + TALLOC_CTX *ctx = talloc_tos(); ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), cli, ++ status = cli_resolve_path(ctx, ++ "", ++ creds, ++ cli, + client_get_cur_dir(), &targetcli, + &targetpath); + if (!NT_STATUS_IS_OK(status)) { +@@ -392,6 +397,8 @@ static int do_cd(const char *new_dir) + uint32_t attributes; + int ret = 1; + TALLOC_CTX *ctx = talloc_stackframe(); ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + newdir = talloc_strdup(ctx, new_dir); +@@ -434,7 +441,8 @@ static int do_cd(const char *new_dir) + new_cd = client_clean_name(ctx, new_cd); + client_set_cur_dir(new_cd); + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, new_cd, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("cd %s: %s\n", new_cd, nt_errstr(status)); +@@ -811,6 +819,8 @@ NTSTATUS do_list(const char *mask, + TALLOC_CTX *ctx = talloc_tos(); + struct cli_state *targetcli = NULL; + char *targetpath = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS ret_status = NT_STATUS_OK; + NTSTATUS status = NT_STATUS_OK; + +@@ -834,7 +844,7 @@ NTSTATUS do_list(const char *mask, + /* check for dfs */ + + status = cli_resolve_path(ctx, "", +- popt_get_cmdline_auth_info(), ++ creds, + cli, head, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("do_list: [%s] %s\n", head, +@@ -1044,6 +1054,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) + struct cli_state *targetcli = NULL; + char *targetname = NULL; + char *lname = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + lname = talloc_strdup(ctx, lname_in); +@@ -1058,7 +1070,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) + } + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, rname, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); +@@ -1477,9 +1490,12 @@ static bool do_mkdir(const char *name) + TALLOC_CTX *ctx = talloc_tos(); + struct cli_state *targetcli; + char *targetname = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, name, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("mkdir %s: %s\n", name, nt_errstr(status)); +@@ -1538,6 +1554,8 @@ static int cmd_mkdir(void) + TALLOC_CTX *ctx = talloc_tos(); + char *mask = NULL; + char *buf = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + mask = talloc_strdup(ctx, client_get_cur_dir()); +@@ -1574,7 +1592,8 @@ static int cmd_mkdir(void) + } + + status = cli_resolve_path(ctx, "", +- popt_get_cmdline_auth_info(), cli, mask, ++ creds, ++ cli, mask, + &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + return 1; +@@ -1888,9 +1907,12 @@ static int do_put(const char *rname, const char *lname, bool reput) + struct cli_state *targetcli; + char *targetname = NULL; + struct push_state state; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, rname, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); +@@ -2665,6 +2687,8 @@ static int cmd_wdel(void) + uint32_t attribute; + struct cli_state *targetcli; + char *targetname = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -2690,7 +2714,8 @@ static int cmd_wdel(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("cmd_wdel %s: %s\n", mask, nt_errstr(status)); +@@ -2716,6 +2741,8 @@ static int cmd_open(void) + char *targetname = NULL; + struct cli_state *targetcli; + uint16_t fnum = (uint16_t)-1; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -2735,7 +2762,8 @@ static int cmd_open(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("open %s: %s\n", mask, nt_errstr(status)); +@@ -2837,6 +2865,8 @@ static int cmd_posix_open(void) + struct cli_state *targetcli; + mode_t mode; + uint16_t fnum; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -2861,7 +2891,8 @@ static int cmd_posix_open(void) + } + mode = (mode_t)strtol(buf, (char **)NULL, 8); + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("posix_open %s: %s\n", mask, nt_errstr(status)); +@@ -2896,6 +2927,8 @@ static int cmd_posix_mkdir(void) + char *targetname = NULL; + struct cli_state *targetcli; + mode_t mode; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -2920,7 +2953,8 @@ static int cmd_posix_mkdir(void) + } + mode = (mode_t)strtol(buf, (char **)NULL, 8); + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("posix_mkdir %s: %s\n", mask, nt_errstr(status)); +@@ -2944,6 +2978,8 @@ static int cmd_posix_unlink(void) + char *buf = NULL; + char *targetname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -2962,7 +2998,8 @@ static int cmd_posix_unlink(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("posix_unlink %s: %s\n", mask, nt_errstr(status)); +@@ -2987,6 +3024,8 @@ static int cmd_posix_rmdir(void) + char *buf = NULL; + char *targetname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -3005,7 +3044,8 @@ static int cmd_posix_rmdir(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("posix_rmdir %s: %s\n", mask, nt_errstr(status)); +@@ -3294,6 +3334,8 @@ static int cmd_rmdir(void) + char *buf = NULL; + char *targetname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -3312,7 +3354,8 @@ static int cmd_rmdir(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("rmdir %s: %s\n", mask, nt_errstr(status)); +@@ -3341,6 +3384,8 @@ static int cmd_link(void) + char *buf2 = NULL; + char *targetname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -3371,7 +3416,8 @@ static int cmd_link(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, oldname, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("link %s: %s\n", oldname, nt_errstr(status)); +@@ -3404,6 +3450,8 @@ static int cmd_readlink(void) + char *targetname = NULL; + char *linkname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -3422,7 +3470,8 @@ static int cmd_readlink(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, name, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("readlink %s: %s\n", name, nt_errstr(status)); +@@ -3461,6 +3510,8 @@ static int cmd_symlink(void) + char *buf = NULL; + char *buf2 = NULL; + struct cli_state *newcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -3483,7 +3534,8 @@ static int cmd_symlink(void) + } + /* New name must be present in share namespace. */ + status = cli_resolve_path(ctx, "", +- popt_get_cmdline_auth_info(), cli, newname, ++ creds, ++ cli, newname, + &newcli, &newname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("link %s: %s\n", newname, +@@ -3519,6 +3571,8 @@ static int cmd_chmod(void) + char *targetname = NULL; + struct cli_state *targetcli; + mode_t mode; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -3540,7 +3594,8 @@ static int cmd_chmod(void) + + mode = (mode_t)strtol(buf, NULL, 8); + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("chmod %s: %s\n", src, nt_errstr(status)); +@@ -3684,6 +3739,8 @@ static int cmd_getfacl(void) + size_t num_dir_acls = 0; + size_t expected_buflen; + uint16_t i; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { +@@ -3702,7 +3759,8 @@ static int cmd_getfacl(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("stat %s: %s\n", src, nt_errstr(status)); +@@ -3867,6 +3925,8 @@ static int cmd_geteas(void) + NTSTATUS status; + size_t i, num_eas; + struct ea_struct *eas; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + + if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { + d_printf("geteas filename\n"); +@@ -3884,7 +3944,8 @@ static int cmd_geteas(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("stat %s: %s\n", src, nt_errstr(status)); +@@ -3923,6 +3984,8 @@ static int cmd_setea(void) + char *eavalue = NULL; + char *targetname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr, &name, NULL) +@@ -3945,7 +4008,8 @@ static int cmd_setea(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("stat %s: %s\n", src, nt_errstr(status)); +@@ -3977,6 +4041,8 @@ static int cmd_stat(void) + SMB_STRUCT_STAT sbuf; + struct tm *lt; + time_t tmp_time; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { +@@ -3995,7 +4061,8 @@ static int cmd_stat(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("stat %s: %s\n", src, nt_errstr(status)); +@@ -4084,6 +4151,8 @@ static int cmd_chown(void) + char *buf, *buf2, *buf3; + struct cli_state *targetcli; + char *targetname = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -4107,7 +4176,8 @@ static int cmd_chown(void) + if (src == NULL) { + return 1; + } +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("chown %s: %s\n", src, nt_errstr(status)); +@@ -4141,6 +4211,8 @@ static int cmd_rename(void) + struct cli_state *targetcli; + char *targetsrc; + char *targetdest; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + bool replace = false; + +@@ -4179,14 +4251,16 @@ static int cmd_rename(void) + replace = true; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetsrc); + if (!NT_STATUS_IS_OK(status)) { + d_printf("rename %s: %s\n", src, nt_errstr(status)); + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, dest, &targetcli, &targetdest); + if (!NT_STATUS_IS_OK(status)) { + d_printf("rename %s: %s\n", dest, nt_errstr(status)); +@@ -4243,6 +4317,8 @@ static int cmd_scopy(void) + off_t written = 0; + struct scopy_timing st; + int rc = 0; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -4275,14 +4351,16 @@ static int cmd_scopy(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetsrc); + if (!NT_STATUS_IS_OK(status)) { + d_printf("scopy %s: %s\n", src, nt_errstr(status)); + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, dest, &targetcli, &targetdest); + if (!NT_STATUS_IS_OK(status)) { + d_printf("scopy %s: %s\n", dest, nt_errstr(status)); +@@ -4381,6 +4459,8 @@ static int cmd_hardlink(void) + char *buf, *buf2; + struct cli_state *targetcli; + char *targetname; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -4413,7 +4493,8 @@ static int cmd_hardlink(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("hardlink %s: %s\n", src, nt_errstr(status)); +@@ -5087,9 +5168,13 @@ static int cmd_show_connect( void ) + TALLOC_CTX *ctx = talloc_tos(); + struct cli_state *targetcli; + char *targetpath; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), cli, ++ status = cli_resolve_path(ctx, "", ++ creds, ++ cli, + client_get_cur_dir(), &targetcli, + &targetpath); + if (!NT_STATUS_IS_OK(status)) { +@@ -5749,6 +5834,8 @@ static char **remote_completion(const char *text, int len) + struct cli_state *targetcli = NULL; + int i; + struct completion_remote info = { NULL, NULL, 1, 0, NULL, 0 }; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + /* can't have non-static initialisation on Sun CC, so do it +@@ -5809,7 +5896,8 @@ static char **remote_completion(const char *text, int len) + goto cleanup; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, dirmask, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + goto cleanup; +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index ef75fb36a45..e6695159a96 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -859,7 +859,7 @@ struct cli_dfs_path_split { + + NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + const char *mountpt, +- const struct user_auth_info *dfs_auth_info, ++ struct cli_credentials *creds, + struct cli_state *rootcli, + const char *path, + struct cli_state **targetcli, +@@ -885,7 +885,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + struct smbXcli_tcon *root_tcon = NULL; + struct smbXcli_tcon *target_tcon = NULL; + struct cli_dfs_path_split *dfs_refs = NULL; +- struct cli_credentials *creds = get_cmdline_auth_info_creds(dfs_auth_info); + + if ( !rootcli || !path || !targetcli ) { + return NT_STATUS_INVALID_PARAMETER; +@@ -1130,7 +1129,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + if (!strequal(*pp_targetpath, "\\") && !strequal(*pp_targetpath, "/")) { + status = cli_resolve_path(ctx, + newmount, +- dfs_auth_info, ++ creds, + *targetcli, + *pp_targetpath, + &newcli, +diff --git a/source3/libsmb/libsmb_dir.c b/source3/libsmb/libsmb_dir.c +index 12abb734c2d..0326f27125b 100644 +--- a/source3/libsmb/libsmb_dir.c ++++ b/source3/libsmb/libsmb_dir.c +@@ -911,6 +911,7 @@ SMBC_opendir_ctx(SMBCCTX *context, + */ + char *targetpath; + struct cli_state *targetcli; ++ struct cli_credentials *creds = NULL; + NTSTATUS status; + + /* We connect to the server and list the directory */ +@@ -943,8 +944,12 @@ SMBC_opendir_ctx(SMBCCTX *context, + return NULL; + } + ++ creds = get_cmdline_auth_info_creds( ++ context->internal->auth_info); ++ + status = cli_resolve_path( +- frame, "", context->internal->auth_info, ++ frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -1543,6 +1548,7 @@ SMBC_mkdir_ctx(SMBCCTX *context, + char *targetpath = NULL; + uint16_t port = 0; + struct cli_state *targetcli = NULL; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -1595,8 +1601,11 @@ SMBC_mkdir_ctx(SMBCCTX *context, + + } + ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ + /*d_printf(">>>mkdir: resolving %s\n", path);*/ +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ status = cli_resolve_path(frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -1654,6 +1663,7 @@ SMBC_rmdir_ctx(SMBCCTX *context, + char *targetpath = NULL; + uint16_t port = 0; + struct cli_state *targetcli = NULL; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -1706,8 +1716,11 @@ SMBC_rmdir_ctx(SMBCCTX *context, + + } + ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info), ++ + /*d_printf(">>>rmdir: resolving %s\n", path);*/ +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ status = cli_resolve_path(frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -1959,6 +1972,7 @@ SMBC_chmod_ctx(SMBCCTX *context, + char *path = NULL; + uint32_t attr; + uint16_t port = 0; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -2010,8 +2024,11 @@ SMBC_chmod_ctx(SMBCCTX *context, + return -1; /* errno set by SMBC_server */ + } + ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ + /*d_printf(">>>unlink: resolving %s\n", path);*/ +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ status = cli_resolve_path(frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -2152,6 +2169,7 @@ SMBC_unlink_ctx(SMBCCTX *context, + uint16_t port = 0; + struct cli_state *targetcli = NULL; + SMBCSRV *srv = NULL; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -2204,8 +2222,11 @@ SMBC_unlink_ctx(SMBCCTX *context, + + } + ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ + /*d_printf(">>>unlink: resolving %s\n", path);*/ +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ status = cli_resolve_path(frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -2282,6 +2303,8 @@ SMBC_rename_ctx(SMBCCTX *ocontext, + SMBCSRV *srv = NULL; + uint16_t port1 = 0; + uint16_t port2 = 0; ++ struct cli_credentials *ocreds = NULL; ++ struct cli_credentials *ncreds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -2375,7 +2398,10 @@ SMBC_rename_ctx(SMBCCTX *ocontext, + password1); + + /*d_printf(">>>rename: resolving %s\n", path1);*/ +- status = cli_resolve_path(frame, "", ocontext->internal->auth_info, ++ ocreds = get_cmdline_auth_info_creds(ocontext->internal->auth_info); ++ ++ status = cli_resolve_path(frame, "", ++ ocreds, + srv->cli, path1, &targetcli1, &targetpath1); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path1); +@@ -2392,7 +2418,10 @@ SMBC_rename_ctx(SMBCCTX *ocontext, + + /*d_printf(">>>rename: resolved path as %s\n", targetpath1);*/ + /*d_printf(">>>rename: resolving %s\n", path2);*/ +- status = cli_resolve_path(frame, "", ncontext->internal->auth_info, ++ ncreds = get_cmdline_auth_info_creds(ncontext->internal->auth_info); ++ ++ status = cli_resolve_path(frame, "", ++ ncreds, + srv->cli, path2, &targetcli2, &targetpath2); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path2); +diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c +index 0791df36690..a44925e0e0e 100644 +--- a/source3/libsmb/libsmb_file.c ++++ b/source3/libsmb/libsmb_file.c +@@ -103,6 +103,8 @@ SMBC_open_ctx(SMBCCTX *context, + if (strlen(path) > 0 && path[strlen(path) - 1] == '\\') { + status = NT_STATUS_OBJECT_PATH_INVALID; + } else { ++ struct cli_credentials *creds = NULL; ++ + file = SMB_MALLOC_P(SMBCFILE); + if (!file) { + errno = ENOMEM; +@@ -112,9 +114,12 @@ SMBC_open_ctx(SMBCCTX *context, + + ZERO_STRUCTP(file); + ++ creds = get_cmdline_auth_info_creds( ++ context->internal->auth_info); + /*d_printf(">>>open: resolving %s\n", path);*/ + status = cli_resolve_path( +- frame, "", context->internal->auth_info, ++ frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -461,6 +466,7 @@ SMBC_getatr(SMBCCTX * context, + struct timespec change_time_ts = {0}; + time_t write_time = 0; + SMB_INO_T ino = 0; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -490,7 +496,10 @@ SMBC_getatr(SMBCCTX * context, + } + DEBUG(4,("SMBC_getatr: sending qpathinfo\n")); + +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ ++ status = cli_resolve_path(frame, "", ++ creds, + srv->cli, fixedpath, + &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/libsmb/libsmb_stat.c b/source3/libsmb/libsmb_stat.c +index 790934bd565..1260928d0ff 100644 +--- a/source3/libsmb/libsmb_stat.c ++++ b/source3/libsmb/libsmb_stat.c +@@ -242,6 +242,7 @@ SMBC_fstat_ctx(SMBCCTX *context, + struct cli_state *targetcli = NULL; + SMB_INO_T ino = 0; + uint16_t port = 0; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -279,8 +280,11 @@ SMBC_fstat_ctx(SMBCCTX *context, + return -1; + } + ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ + /*d_printf(">>>fstat: resolving %s\n", path);*/ +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ status = cli_resolve_path(frame, "", ++ creds, + file->srv->cli, path, + &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/libsmb/libsmb_xattr.c b/source3/libsmb/libsmb_xattr.c +index d1b6548eb90..8b74d0a39e3 100644 +--- a/source3/libsmb/libsmb_xattr.c ++++ b/source3/libsmb/libsmb_xattr.c +@@ -860,13 +860,18 @@ cacl_get(SMBCCTX *context, + if (ipc_cli && (all || some_nt || all_nt_acls)) { + char *targetpath = NULL; + struct cli_state *targetcli = NULL; ++ struct cli_credentials *creds = NULL; + NTSTATUS status; + + /* Point to the portion after "system.nt_sec_desc." */ + name += 19; /* if (all) this will be invalid but unused */ + ++ creds = get_cmdline_auth_info_creds( ++ context->internal->auth_info); ++ + status = cli_resolve_path( +- ctx, "", context->internal->auth_info, ++ ctx, "", ++ creds, + cli, filename, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(5, ("cacl_get Could not resolve %s\n", +@@ -1511,6 +1516,7 @@ cacl_set(SMBCCTX *context, + bool numeric = True; + char *targetpath = NULL; + struct cli_state *targetcli = NULL; ++ struct cli_credentials *creds = NULL; + NTSTATUS status; + + /* the_acl will be null for REMOVE_ALL operations */ +@@ -1540,7 +1546,10 @@ cacl_set(SMBCCTX *context, + return -1; + } + +- status = cli_resolve_path(ctx, "", context->internal->auth_info, ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, filename, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(5,("cacl_set: Could not resolve %s\n", filename)); +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index 0b8cf2a6036..517738dbcd7 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -150,7 +150,7 @@ NTSTATUS cli_dfs_get_referral(TALLOC_CTX *ctx, + size_t *consumed); + NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + const char *mountpt, +- const struct user_auth_info *dfs_auth_info, ++ struct cli_credentials *creds, + struct cli_state *rootcli, + const char *path, + struct cli_state **targetcli, +diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c +index 8fd9fcc5780..4989ec633c3 100644 +--- a/source3/utils/smbcacls.c ++++ b/source3/utils/smbcacls.c +@@ -806,6 +806,7 @@ int main(int argc, char *argv[]) + than going via LSA calls to resolve them */ + int numeric = 0; + struct cli_state *targetcli = NULL; ++ struct cli_credentials *creds = NULL; + char *targetfile = NULL; + NTSTATUS status; + +@@ -1069,9 +1070,11 @@ int main(int argc, char *argv[]) + } + } + ++ creds = get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()), ++ + status = cli_resolve_path(frame, + "", +- popt_get_cmdline_auth_info(), ++ creds, + cli, + filename, + &targetcli, +-- +2.28.0 + + +From 100dad122572d927889f4c03b19f169a3bf61df4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 16:40:49 +0200 +Subject: [PATCH 070/105] s3:client: Remove global max_protocol + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit d07f28645f37c1f976017d5b89864791a18d1943) +--- + source3/client/client.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 23de5befee3..329463795e0 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -61,7 +61,6 @@ static int io_bufsize = 0; /* we use the default size */ + static int io_timeout = (CLIENT_TIMEOUT/1000); /* Per operation timeout (in seconds). */ + + static int name_type = 0x20; +-static int max_protocol = -1; + + static int process_tok(char *tok); + static int cmd_help(void); +@@ -5710,7 +5709,7 @@ static int process_command_string(const char *cmd_in) + desthost, + service, + creds, +- max_protocol, ++ lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, + &cli); +@@ -6160,7 +6159,7 @@ static int process(const char *base_directory) + desthost, + service, + creds, +- max_protocol, ++ lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6201,7 +6200,7 @@ static int do_host_query(const char *query_host) + query_host, + "IPC$", + creds, +- max_protocol, ++ lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6236,7 +6235,7 @@ static int do_host_query(const char *query_host) + if (port != NBT_SMB_PORT || + smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) + { +- int max_proto = MIN(max_protocol, PROTOCOL_NT1); ++ int max_proto = MIN(lp_client_max_protocol(), PROTOCOL_NT1); + + /* + * Workgroups simply don't make sense over anything +@@ -6286,7 +6285,7 @@ static int do_tar_op(const char *base_directory) + desthost, + service, + creds, +- max_protocol, ++ lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6693,8 +6692,6 @@ int main(int argc,char *argv[]) + /* Ensure we have a password (or equivalent). */ + popt_common_credentials_post(); + +- max_protocol = lp_client_max_protocol(); +- + if (tar_to_process(tar_ctx)) { + if (cmdstr) + process_command_string(cmdstr); +-- +2.28.0 + + +From fecf06bd00bc8ff23634bded86d649e432431957 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 16:43:46 +0200 +Subject: [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 4aac9daf095e7c2de6a27697a13385ee87a4b634) +--- + source3/client/client.c | 7 ------- + source3/lib/netapi/cm.c | 1 - + source3/libsmb/clidfs.c | 4 +--- + source3/libsmb/proto.h | 1 - + 4 files changed, 1 insertion(+), 12 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 329463795e0..e9e6cb1ac2c 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -5709,7 +5709,6 @@ static int process_command_string(const char *cmd_in) + desthost, + service, + creds, +- lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, + &cli); +@@ -6159,7 +6158,6 @@ static int process(const char *base_directory) + desthost, + service, + creds, +- lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6200,7 +6198,6 @@ static int do_host_query(const char *query_host) + query_host, + "IPC$", + creds, +- lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6235,8 +6232,6 @@ static int do_host_query(const char *query_host) + if (port != NBT_SMB_PORT || + smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) + { +- int max_proto = MIN(lp_client_max_protocol(), PROTOCOL_NT1); +- + /* + * Workgroups simply don't make sense over anything + * else but port 139 and SMB1. +@@ -6248,7 +6243,6 @@ static int do_host_query(const char *query_host) + query_host, + "IPC$", + creds, +- max_proto, + have_ip ? &dest_ss : NULL, NBT_SMB_PORT, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6285,7 +6279,6 @@ static int do_tar_op(const char *base_directory) + desthost, + service, + creds, +- lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c +index 943f7498e8c..3f4e188b396 100644 +--- a/source3/lib/netapi/cm.c ++++ b/source3/lib/netapi/cm.c +@@ -112,7 +112,6 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, + status = cli_cm_open(ctx, NULL, + server_name, "IPC$", + creds, +- lp_client_ipc_max_protocol(), + NULL, 0, 0x20, &cli_ipc); + if (!NT_STATUS_IS_OK(status)) { + cli_ipc = NULL; +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index e6695159a96..fb1a0c72e6d 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -388,7 +388,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + const char *server, + const char *share, + struct cli_credentials *creds, +- int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, + int name_type, +@@ -417,7 +416,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + server, + share, + creds, +- max_protocol, ++ lp_client_max_protocol(), + dest_ss, + port, + name_type, +@@ -965,7 +964,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + smbXcli_conn_remote_name(rootcli->conn), + "IPC$", + creds, +- smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss not needed, we reuse the transport */ + 0, + 0x20, +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index 517738dbcd7..8aaaff2cb1e 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -128,7 +128,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + const char *server, + const char *share, + struct cli_credentials *creds, +- int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, + int name_type, +-- +2.28.0 + + +From 2af136fd7c1ecae9cc06bc2cf26a7feac16cb279 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 16:45:12 +0200 +Subject: [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 2159582610ecc932047b85a77ec321b3d3ac806f) +--- + source3/libsmb/clidfs.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index fb1a0c72e6d..023dd4d2757 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -293,7 +293,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + const char *server, + const char *share, + struct cli_credentials *creds, +- int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, + int name_type, +@@ -304,7 +303,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + + status = do_connect(ctx, server, share, + creds, +- max_protocol, ++ lp_client_max_protocol(), + dest_ss, port, name_type, &cli); + + if (!NT_STATUS_IS_OK(status)) { +@@ -416,7 +415,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + server, + share, + creds, +- lp_client_max_protocol(), + dest_ss, + port, + name_type, +@@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + dfs_refs[count].server, + dfs_refs[count].share, + creds, +- smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss */ + 0, /* port */ + 0x20, +-- +2.28.0 + + +From dc8cfd9551afa10b0610c6663cb28bfb1ec5888a Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 16:46:29 +0200 +Subject: [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs + do_connect() + +The if check for max_protocol == 0 is part of lp_client_max_protocol(). + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 50b59b4c28bc816094a4ca97f64450860e2495b2) +--- + source3/libsmb/clidfs.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 023dd4d2757..ee5becf76a6 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + const char *server, + const char *share, + struct cli_credentials *creds, +- int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, + int name_type, +@@ -167,14 +166,11 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + return status; + } + +- if (max_protocol == 0) { +- max_protocol = PROTOCOL_LATEST; +- } + DEBUG(4,(" session request ok\n")); + + status = smbXcli_negprot(c->conn, c->timeout, + lp_client_min_protocol(), +- max_protocol); ++ lp_client_max_protocol()); + + if (!NT_STATUS_IS_OK(status)) { + d_printf("protocol negotiation failed: %s\n", +@@ -233,7 +229,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + cli_shutdown(c); + return do_connect(ctx, newserver, + newshare, creds, +- max_protocol, + NULL, port, name_type, pcli); + } + +@@ -303,7 +298,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + + status = do_connect(ctx, server, share, + creds, +- lp_client_max_protocol(), + dest_ss, port, name_type, &cli); + + if (!NT_STATUS_IS_OK(status)) { +-- +2.28.0 + + +From 3a99225868e079e108968552f43b937b5b9b702f Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 10 Aug 2020 15:47:35 +0200 +Subject: [PATCH 074/105] s3:include: Move loadparm prototypes to own header + file + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit d4d8218b9618dd289f54b41f13d7015f1b3994fd) +--- + source3/include/includes.h | 3 + + source3/include/proto.h | 167 ------------------------------- + source3/param/loadparm.h | 200 +++++++++++++++++++++++++++++++++++++ + 3 files changed, 203 insertions(+), 167 deletions(-) + create mode 100644 source3/param/loadparm.h + +diff --git a/source3/include/includes.h b/source3/include/includes.h +index 8fa65cc3122..c94f919ed59 100644 +--- a/source3/include/includes.h ++++ b/source3/include/includes.h +@@ -293,6 +293,9 @@ typedef char fstring[FSTRING_LEN]; + #endif + + #include "lib/param/loadparm.h" ++#include "source3/param/loadparm.h" ++/* Automatically generated by generate_param.py. */ ++#include "source3/param/param_proto.h" + + /* String routines */ + +diff --git a/source3/include/proto.h b/source3/include/proto.h +index 12aa392abae..b9a6cb7f116 100644 +--- a/source3/include/proto.h ++++ b/source3/include/proto.h +@@ -739,173 +739,6 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context, + const char *dcname, + bool force); + +-/* The following definitions come from param/loadparm.c */ +- +-const struct loadparm_substitution *loadparm_s3_global_substitution(void); +- +-char *lp_parm_substituted_string(TALLOC_CTX *mem_ctx, +- const struct loadparm_substitution *lp_sub, +- int snum, +- const char *type, +- const char *option, +- const char *def); +- +-#include "source3/param/param_proto.h" +- +-char *lp_servicename(TALLOC_CTX *ctx, const struct loadparm_substitution *, int); +-const char *lp_const_servicename(int); +-bool lp_autoloaded(int); +-const char *lp_dnsdomain(void); +-int lp_winbind_max_domain_connections(void); +-bool lp_idmap_range(const char *domain_name, uint32_t *low, uint32_t *high); +-bool lp_idmap_default_range(uint32_t *low, uint32_t *high); +-const char *lp_idmap_backend(const char *domain_name); +-const char *lp_idmap_default_backend (void); +-int lp_security(void); +-int lp_client_max_protocol(void); +-int lp_client_ipc_min_protocol(void); +-int lp_client_ipc_max_protocol(void); +-int lp_client_ipc_signing(void); +-int lp_smb2_max_credits(void); +-int lp_cups_encrypt(void); +-bool lp_widelinks(int ); +-int lp_rpc_low_port(void); +-int lp_rpc_high_port(void); +-bool lp_lanman_auth(void); +-enum samba_weak_crypto lp_weak_crypto(void); +- +-int lp_wi_scan_global_parametrics( +- const char *regex, size_t max_matches, +- bool (*cb)(const char *string, regmatch_t matches[], +- void *private_data), +- void *private_data); +- +-const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def); +-struct loadparm_service; +-const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type, +- const char *option, const char *def); +-const char **lp_parm_string_list(int snum, const char *type, const char *option, const char **def); +-int lp_parm_int(int snum, const char *type, const char *option, int def); +-unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsigned long def); +-unsigned long long lp_parm_ulonglong(int snum, const char *type, +- const char *option, +- unsigned long long def); +-bool lp_parm_bool(int snum, const char *type, const char *option, bool def); +-struct enum_list; +-int lp_parm_enum(int snum, const char *type, const char *option, +- const struct enum_list *_enum, int def); +-char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src); +-bool lp_add_home(const char *pszHomename, int iDefaultService, +- const char *user, const char *pszHomedir); +-int lp_add_service(const char *pszService, int iDefaultService); +-bool lp_add_printer(const char *pszPrintername, int iDefaultService); +-bool lp_parameter_is_valid(const char *pszParmName); +-bool lp_parameter_is_global(const char *pszParmName); +-bool lp_canonicalize_parameter(const char *parm_name, const char **canon_parm, +- bool *inverse); +-bool lp_canonicalize_parameter_with_value(const char *parm_name, +- const char *val, +- const char **canon_parm, +- const char **canon_val); +-void show_parameter_list(void); +-bool lp_invert_boolean(const char *str, const char **inverse_str); +-bool lp_canonicalize_boolean(const char *str, const char**canon_str); +-bool process_registry_service(const char *service_name); +-bool process_registry_shares(void); +-bool lp_config_backend_is_registry(void); +-bool lp_config_backend_is_file(void); +-bool lp_file_list_changed(void); +-const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx); +-const char *lp_ldap_user_suffix(TALLOC_CTX *ctx); +-const char *lp_ldap_group_suffix(TALLOC_CTX *ctx); +-const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx); +-struct parm_struct; +-/* Return a pointer to a service by name. */ +-struct loadparm_service *lp_service(const char *pszServiceName); +-struct loadparm_service *lp_servicebynum(int snum); +-struct loadparm_service *lp_default_loadparm_service(void); +-void *lp_parm_ptr(struct loadparm_service *service, struct parm_struct *parm); +-void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm); +-bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue); +-bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue); +-bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal); +-bool lp_snum_ok(int iService); +-void lp_add_one_printer(const char *name, const char *comment, +- const char *location, void *pdata); +-bool lp_loaded(void); +-void lp_killunused(struct smbd_server_connection *sconn, +- bool (*snumused) (struct smbd_server_connection *, int)); +-void lp_kill_all_services(void); +-void lp_killservice(int iServiceIn); +-const char* server_role_str(uint32_t role); +-enum usershare_err parse_usershare_file(TALLOC_CTX *ctx, +- SMB_STRUCT_STAT *psbuf, +- const char *servicename, +- int snum, +- char **lines, +- int numlines, +- char **pp_sharepath, +- char **pp_comment, +- char **pp_cp_share_name, +- struct security_descriptor **ppsd, +- bool *pallow_guest); +-int load_usershare_service(const char *servicename); +-int load_usershare_shares(struct smbd_server_connection *sconn, +- bool (*snumused) (struct smbd_server_connection *, int)); +-void gfree_loadparm(void); +-bool lp_load_initial_only(const char *pszFname); +-bool lp_load_global(const char *file_name); +-bool lp_load_with_shares(const char *file_name); +-bool lp_load_client(const char *file_name); +-bool lp_load_global_no_reinit(const char *file_name); +-bool lp_load_no_reinit(const char *file_name); +-bool lp_load_client_no_reinit(const char *file_name); +-bool lp_load_with_registry_shares(const char *pszFname); +-int lp_numservices(void); +-void lp_dump(FILE *f, bool show_defaults, int maxtoprint); +-void lp_dump_one(FILE * f, bool show_defaults, int snum); +-int lp_servicenumber(const char *pszServiceName); +-const char *volume_label(TALLOC_CTX *ctx, int snum); +-bool lp_domain_master(void); +-bool lp_preferred_master(void); +-void lp_remove_service(int snum); +-void lp_copy_service(int snum, const char *new_name); +-int lp_default_server_announce(void); +-const char *lp_printername(TALLOC_CTX *ctx, +- const struct loadparm_substitution *lp_sub, +- int snum); +-void lp_set_logfile(const char *name); +-int lp_maxprintjobs(int snum); +-const char *lp_printcapname(void); +-bool lp_disable_spoolss( void ); +-void lp_set_spoolss_state( uint32_t state ); +-uint32_t lp_get_spoolss_state( void ); +-struct smb_signing_state; +-void set_use_sendfile(int snum, bool val); +-void lp_set_mangling_method(const char *new_method); +-bool lp_posix_pathnames(void); +-void lp_set_posix_pathnames(void); +-enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp); +-void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val); +-int lp_min_receive_file_size(void); +-void widelinks_warning(int snum); +-const char *lp_ncalrpc_dir(void); +-void _lp_set_server_role(int server_role); +- +-/* The following definitions come from param/loadparm_ctx.c */ +- +-const struct loadparm_s3_helpers *loadparm_s3_helpers(void); +- +-/* The following definitions come from param/loadparm_server_role.c */ +- +-int lp_server_role(void); +-void set_server_role(void); +- +-/* The following definitions come from param/util.c */ +- +-uint32_t get_int_param( const char* param ); +-char* get_string_param( const char* param ); +- + /* The following definitions come from lib/server_contexts.c */ + struct tevent_context *global_event_context(void); + void global_event_context_free(void); +diff --git a/source3/param/loadparm.h b/source3/param/loadparm.h +new file mode 100644 +index 00000000000..7686877ccf1 +--- /dev/null ++++ b/source3/param/loadparm.h +@@ -0,0 +1,200 @@ ++/* ++ * ++ * Unix SMB/CIFS implementation. ++ * ++ * Type definitions for loadparm ++ * ++ * Copyright (c) 2020 Andreas Schneider ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#ifndef _S3_LOADPARM_H ++#define _S3_LOADPARM_H ++ ++#include ++#include ++ ++/* Forward declarations */ ++typedef struct stat_ex SMB_STRUCT_STAT; ++typedef struct files_struct files_struct; ++struct smbd_server_connection; ++struct security_descriptor; ++ ++/* The following definitions come from param/loadparm.c */ ++ ++const struct loadparm_substitution *loadparm_s3_global_substitution(void); ++ ++char *lp_parm_substituted_string(TALLOC_CTX *mem_ctx, ++ const struct loadparm_substitution *lp_sub, ++ int snum, ++ const char *type, ++ const char *option, ++ const char *def); ++ ++char *lp_servicename(TALLOC_CTX *ctx, const struct loadparm_substitution *, int); ++const char *lp_const_servicename(int); ++bool lp_autoloaded(int); ++const char *lp_dnsdomain(void); ++int lp_winbind_max_domain_connections(void); ++bool lp_idmap_range(const char *domain_name, uint32_t *low, uint32_t *high); ++bool lp_idmap_default_range(uint32_t *low, uint32_t *high); ++const char *lp_idmap_backend(const char *domain_name); ++const char *lp_idmap_default_backend (void); ++int lp_security(void); ++int lp_client_max_protocol(void); ++int lp_client_ipc_min_protocol(void); ++int lp_client_ipc_max_protocol(void); ++int lp_client_ipc_signing(void); ++int lp_smb2_max_credits(void); ++int lp_cups_encrypt(void); ++bool lp_widelinks(int ); ++int lp_rpc_low_port(void); ++int lp_rpc_high_port(void); ++bool lp_lanman_auth(void); ++enum samba_weak_crypto lp_weak_crypto(void); ++ ++int lp_wi_scan_global_parametrics( ++ const char *regex, size_t max_matches, ++ bool (*cb)(const char *string, regmatch_t matches[], ++ void *private_data), ++ void *private_data); ++ ++const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def); ++struct loadparm_service; ++const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type, ++ const char *option, const char *def); ++const char **lp_parm_string_list(int snum, const char *type, const char *option, const char **def); ++int lp_parm_int(int snum, const char *type, const char *option, int def); ++unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsigned long def); ++unsigned long long lp_parm_ulonglong(int snum, const char *type, ++ const char *option, ++ unsigned long long def); ++bool lp_parm_bool(int snum, const char *type, const char *option, bool def); ++struct enum_list; ++int lp_parm_enum(int snum, const char *type, const char *option, ++ const struct enum_list *_enum, int def); ++char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src); ++bool lp_add_home(const char *pszHomename, int iDefaultService, ++ const char *user, const char *pszHomedir); ++int lp_add_service(const char *pszService, int iDefaultService); ++bool lp_add_printer(const char *pszPrintername, int iDefaultService); ++bool lp_parameter_is_valid(const char *pszParmName); ++bool lp_parameter_is_global(const char *pszParmName); ++bool lp_canonicalize_parameter(const char *parm_name, const char **canon_parm, ++ bool *inverse); ++bool lp_canonicalize_parameter_with_value(const char *parm_name, ++ const char *val, ++ const char **canon_parm, ++ const char **canon_val); ++void show_parameter_list(void); ++bool lp_invert_boolean(const char *str, const char **inverse_str); ++bool lp_canonicalize_boolean(const char *str, const char**canon_str); ++bool process_registry_service(const char *service_name); ++bool process_registry_shares(void); ++bool lp_config_backend_is_registry(void); ++bool lp_config_backend_is_file(void); ++bool lp_file_list_changed(void); ++const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx); ++const char *lp_ldap_user_suffix(TALLOC_CTX *ctx); ++const char *lp_ldap_group_suffix(TALLOC_CTX *ctx); ++const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx); ++struct parm_struct; ++/* Return a pointer to a service by name. */ ++struct loadparm_service *lp_service(const char *pszServiceName); ++struct loadparm_service *lp_servicebynum(int snum); ++struct loadparm_service *lp_default_loadparm_service(void); ++void *lp_parm_ptr(struct loadparm_service *service, struct parm_struct *parm); ++void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm); ++bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue); ++bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue); ++bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal); ++bool lp_snum_ok(int iService); ++void lp_add_one_printer(const char *name, const char *comment, ++ const char *location, void *pdata); ++bool lp_loaded(void); ++void lp_killunused(struct smbd_server_connection *sconn, ++ bool (*snumused) (struct smbd_server_connection *, int)); ++void lp_kill_all_services(void); ++void lp_killservice(int iServiceIn); ++const char* server_role_str(uint32_t role); ++enum usershare_err parse_usershare_file(TALLOC_CTX *ctx, ++ SMB_STRUCT_STAT *psbuf, ++ const char *servicename, ++ int snum, ++ char **lines, ++ int numlines, ++ char **pp_sharepath, ++ char **pp_comment, ++ char **pp_cp_share_name, ++ struct security_descriptor **ppsd, ++ bool *pallow_guest); ++int load_usershare_service(const char *servicename); ++int load_usershare_shares(struct smbd_server_connection *sconn, ++ bool (*snumused) (struct smbd_server_connection *, int)); ++void gfree_loadparm(void); ++bool lp_load_initial_only(const char *pszFname); ++bool lp_load_global(const char *file_name); ++bool lp_load_with_shares(const char *file_name); ++bool lp_load_client(const char *file_name); ++bool lp_load_global_no_reinit(const char *file_name); ++bool lp_load_no_reinit(const char *file_name); ++bool lp_load_client_no_reinit(const char *file_name); ++bool lp_load_with_registry_shares(const char *pszFname); ++int lp_numservices(void); ++void lp_dump(FILE *f, bool show_defaults, int maxtoprint); ++void lp_dump_one(FILE * f, bool show_defaults, int snum); ++int lp_servicenumber(const char *pszServiceName); ++const char *volume_label(TALLOC_CTX *ctx, int snum); ++bool lp_domain_master(void); ++bool lp_preferred_master(void); ++void lp_remove_service(int snum); ++void lp_copy_service(int snum, const char *new_name); ++int lp_default_server_announce(void); ++const char *lp_printername(TALLOC_CTX *ctx, ++ const struct loadparm_substitution *lp_sub, ++ int snum); ++void lp_set_logfile(const char *name); ++int lp_maxprintjobs(int snum); ++const char *lp_printcapname(void); ++bool lp_disable_spoolss( void ); ++void lp_set_spoolss_state( uint32_t state ); ++uint32_t lp_get_spoolss_state( void ); ++struct smb_signing_state; ++void set_use_sendfile(int snum, bool val); ++void lp_set_mangling_method(const char *new_method); ++bool lp_posix_pathnames(void); ++void lp_set_posix_pathnames(void); ++enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp); ++void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val); ++int lp_min_receive_file_size(void); ++void widelinks_warning(int snum); ++const char *lp_ncalrpc_dir(void); ++void _lp_set_server_role(int server_role); ++uint32_t lp_get_async_dns_timeout(void); ++ ++/* The following definitions come from param/loadparm_ctx.c */ ++ ++const struct loadparm_s3_helpers *loadparm_s3_helpers(void); ++ ++/* The following definitions come from param/loadparm_server_role.c */ ++ ++int lp_server_role(void); ++void set_server_role(void); ++ ++/* The following definitions come from param/util.c */ ++ ++uint32_t get_int_param( const char* param ); ++char *get_string_param( const char* param ); ++ ++#endif /* _S3_LOADPARM_H */ +-- +2.28.0 + + +From 076e6929c3c8d1dc161e7dacfc7fb7aeceb588bd Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 11 Aug 2020 10:41:07 +0200 +Subject: [PATCH 075/105] s3:lib: Move interface prototypes to own header file + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison + +Autobuild-User(master): Jeremy Allison +Autobuild-Date(master): Fri Oct 9 20:36:13 UTC 2020 on sn-devel-184 + +(cherry picked from commit 925cc9aafbe17cb2cbd89f468fac70f96ae89475) +--- + source3/include/proto.h | 21 +------------------ + source3/lib/interface.h | 46 +++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 47 insertions(+), 20 deletions(-) + create mode 100644 source3/lib/interface.h + +diff --git a/source3/include/proto.h b/source3/include/proto.h +index b9a6cb7f116..1bbd8e9d526 100644 +--- a/source3/include/proto.h ++++ b/source3/include/proto.h +@@ -84,26 +84,7 @@ NTSTATUS vfs_at_fspcwd(TALLOC_CTX *mem_ctx, + struct connection_struct *conn, + struct files_struct **_fsp); + +-/* The following definitions come from lib/interface.c */ +- +-bool ismyaddr(const struct sockaddr *ip); +-bool ismyip_v4(struct in_addr ip); +-bool is_local_net(const struct sockaddr *from); +-void setup_linklocal_scope_id(struct sockaddr *pss); +-bool is_local_net_v4(struct in_addr from); +-int iface_count(void); +-int iface_count_v4_nl(void); +-const struct in_addr *first_ipv4_iface(void); +-struct interface *get_interface(int n); +-const struct sockaddr_storage *iface_n_sockaddr_storage(int n); +-const struct in_addr *iface_n_ip_v4(int n); +-const struct in_addr *iface_n_bcast_v4(int n); +-const struct sockaddr_storage *iface_n_bcast(int n); +-const struct sockaddr_storage *iface_ip(const struct sockaddr *ip); +-bool iface_local(const struct sockaddr *ip); +-void load_interfaces(void); +-void gfree_interfaces(void); +-bool interfaces_changed(void); ++#include "source3/lib/interface.h" + + /* The following definitions come from lib/ldap_debug_handler.c */ + +diff --git a/source3/lib/interface.h b/source3/lib/interface.h +new file mode 100644 +index 00000000000..f45435b4a81 +--- /dev/null ++++ b/source3/lib/interface.h +@@ -0,0 +1,46 @@ ++/* ++ * ++ * Unix SMB/CIFS implementation. ++ * ++ * Type definitions for interfaces ++ * ++ * Copyright (c) 2020 Andreas Schneider ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#ifndef _INTERFACE_H ++#define _INTERFACE_H ++ ++#include ++ ++bool ismyaddr(const struct sockaddr *ip); ++bool ismyip_v4(struct in_addr ip); ++bool is_local_net(const struct sockaddr *from); ++void setup_linklocal_scope_id(struct sockaddr *pss); ++bool is_local_net_v4(struct in_addr from); ++int iface_count(void); ++int iface_count_v4_nl(void); ++const struct in_addr *first_ipv4_iface(void); ++struct interface *get_interface(int n); ++const struct sockaddr_storage *iface_n_sockaddr_storage(int n); ++const struct in_addr *iface_n_ip_v4(int n); ++const struct in_addr *iface_n_bcast_v4(int n); ++const struct sockaddr_storage *iface_n_bcast(int n); ++const struct sockaddr_storage *iface_ip(const struct sockaddr *ip); ++bool iface_local(const struct sockaddr *ip); ++void load_interfaces(void); ++void gfree_interfaces(void); ++bool interfaces_changed(void); ++ ++#endif /* _INTERFACE_H */ +-- +2.28.0 + + +From b6d36e462fe41f7b88bbf120831c3765c40ef326 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 7 Feb 2020 16:48:16 +0100 +Subject: [PATCH 076/105] idl: Add SID_SAMBA_SMB3 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 56879ec5876625346df89110f62d52e3fd5b8934) +--- + librpc/idl/security.idl | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/librpc/idl/security.idl b/librpc/idl/security.idl +index a92e8f1518e..06bf7449a70 100644 +--- a/librpc/idl/security.idl ++++ b/librpc/idl/security.idl +@@ -282,6 +282,9 @@ interface security + const string SID_SAMBA_UNIX_USER_OWNER = "S-1-22-1"; + const string SID_SAMBA_UNIX_GROUP_OWNER = "S-1-22-2"; + ++ /* Information passing via security token */ ++ const string SID_SAMBA_SMB3 = "S-1-22-1397571891"; ++ + /* SECURITY_NT_SERVICE */ + const string NAME_NT_SERVICE = "NT SERVICE"; + +-- +2.28.0 + + +From 3128ed8c26c13ccc068b5e50ae52604f5ffc9241 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 7 Feb 2020 16:48:29 +0100 +Subject: [PATCH 077/105] s3:smbd: Add SMB3 connection information to session + info + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 905c2b9722a64ee57f3fbcff51e6bb591c6e3edc) +--- + source3/include/vfs.h | 1 + + source3/smbd/pipes.c | 82 +++++++++++++++++++++++++++++++++++++- + source3/smbd/smb2_server.c | 5 +++ + 3 files changed, 87 insertions(+), 1 deletion(-) + +diff --git a/source3/include/vfs.h b/source3/include/vfs.h +index d527f850628..c0d60636c31 100644 +--- a/source3/include/vfs.h ++++ b/source3/include/vfs.h +@@ -411,6 +411,7 @@ typedef struct files_struct { + bool use_ofd_locks : 1; + bool closing : 1; + bool lock_failure_seen : 1; ++ bool encryption_required : 1; + } fsp_flags; + + struct tevent_timer *update_write_time_event; +diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c +index 2dd38bb7ab3..d51a3de9497 100644 +--- a/source3/smbd/pipes.c ++++ b/source3/smbd/pipes.c +@@ -30,13 +30,16 @@ + #include "smbd/globals.h" + #include "libcli/security/security.h" + #include "rpc_server/srv_pipe_hnd.h" ++#include "auth/auth_util.h" + + NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, + struct files_struct **pfsp) + { ++ struct smbXsrv_connection *xconn = smb_req->xconn; + struct connection_struct *conn = smb_req->conn; + struct files_struct *fsp; + struct smb_filename *smb_fname = NULL; ++ struct auth_session_info *session_info = conn->session_info; + NTSTATUS status; + + status = file_new(smb_req, conn, &fsp); +@@ -68,10 +71,87 @@ NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, + return status; + } + ++ if (smb_req->smb2req != NULL && smb_req->smb2req->was_encrypted) { ++ struct security_token *security_token = NULL; ++ uint16_t dialect = xconn->smb2.server.dialect; ++ uint16_t srv_smb_encrypt = 0x0002; ++ uint16_t cipher = xconn->smb2.server.cipher; ++ char smb3_sid_str[SID_MAX_SIZE]; ++ struct dom_sid smb3_dom_sid; ++ struct dom_sid smb3_sid; ++ uint32_t i; ++ bool ok; ++ int rc; ++ ++ session_info = copy_session_info(fsp, conn->session_info); ++ if (session_info == NULL) { ++ DBG_ERR("Failed to copy session info\n"); ++ file_free(smb_req, fsp); ++ return NT_STATUS_NO_MEMORY; ++ } ++ security_token = session_info->security_token; ++ ++ ok = dom_sid_parse(SID_SAMBA_SMB3, &smb3_dom_sid); ++ if (!ok) { ++ file_free(smb_req, fsp); ++ return NT_STATUS_BUFFER_TOO_SMALL; ++ } ++ ++ /* ++ * Security check: ++ * ++ * Make sure we don't have a SMB3 SID in the security token! ++ */ ++ for (i = 0; i < security_token->num_sids; i++) { ++ int cmp; ++ ++ cmp = dom_sid_compare_domain(&security_token->sids[i], ++ &smb3_dom_sid); ++ if (cmp == 0) { ++ DBG_ERR("ERROR: An SMB3 SID has already been " ++ "detected in the security token!\n"); ++ file_free(smb_req, fsp); ++ return NT_STATUS_ACCESS_DENIED; ++ } ++ } ++ ++ rc = snprintf(smb3_sid_str, ++ sizeof(smb3_sid_str), ++ "%s-%u-%u-%u", ++ SID_SAMBA_SMB3, ++ dialect, ++ srv_smb_encrypt, ++ cipher); ++ if (rc < 0) { ++ DBG_ERR("Buffer too small\n"); ++ file_free(smb_req, fsp); ++ return NT_STATUS_BUFFER_TOO_SMALL; ++ } ++ ++ ok = dom_sid_parse(smb3_sid_str, &smb3_sid); ++ if (!ok) { ++ DBG_ERR("Failed to parse SMB3 SID\n"); ++ file_free(smb_req, fsp); ++ return NT_STATUS_INVALID_PARAMETER; ++ } ++ ++ status = add_sid_to_array_unique(security_token, ++ &smb3_sid, ++ &security_token->sids, ++ &security_token->num_sids); ++ if (!NT_STATUS_IS_OK(status)) { ++ DBG_ERR("Failed to add SMB3 SID to security token\n"); ++ file_free(smb_req, fsp); ++ return status; ++ } ++ ++ fsp->fsp_flags.encryption_required = true; ++ } ++ + status = np_open(fsp, name, + conn->sconn->remote_address, + conn->sconn->local_address, +- conn->session_info, ++ session_info, + conn->sconn->ev_ctx, + conn->sconn->msg_ctx, + conn->sconn->dce_ctx, +diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c +index cf9de185c1f..cd24b7d2ed5 100644 +--- a/source3/smbd/smb2_server.c ++++ b/source3/smbd/smb2_server.c +@@ -3232,6 +3232,11 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req) + return smbd_smb2_request_error(req, + NT_STATUS_FILE_CLOSED); + } ++ } else { ++ if (fsp->fsp_flags.encryption_required && !req->was_encrypted) { ++ return smbd_smb2_request_error(req, ++ NT_STATUS_ACCESS_DENIED); ++ } + } + } + +-- +2.28.0 + + +From 333ae30e7f8238c684d2a1aec2b0516369068a7e Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 12 Mar 2020 14:11:56 +0100 +Subject: [PATCH 078/105] librpc: Add dcerpc helper + dcerpc_is_transport_encrypted() + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 8bbe5c8c94aaf75d715f558c363e5b2de49f7bf9) +--- + librpc/rpc/dcerpc_helper.c | 137 +++++++++++++++++++++++++++++++++++++ + librpc/rpc/dcerpc_helper.h | 26 +++++++ + librpc/wscript_build | 9 +++ + 3 files changed, 172 insertions(+) + create mode 100644 librpc/rpc/dcerpc_helper.c + create mode 100644 librpc/rpc/dcerpc_helper.h + +diff --git a/librpc/rpc/dcerpc_helper.c b/librpc/rpc/dcerpc_helper.c +new file mode 100644 +index 00000000000..c5443764628 +--- /dev/null ++++ b/librpc/rpc/dcerpc_helper.c +@@ -0,0 +1,137 @@ ++/* ++ * Copyright (c) 2020 Andreas Schneider ++ * ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#include "includes.h" ++#include "librpc/gen_ndr/security.h" ++#include "librpc/gen_ndr/auth.h" ++#include "lib/crypto/gnutls_helpers.h" ++#include "libcli/security/dom_sid.h" ++#include "libcli/smb/smb2_constants.h" ++ ++#include "dcerpc_helper.h" ++ ++static bool smb3_sid_parse(const struct dom_sid *sid, ++ uint16_t *pdialect, ++ uint16_t *pencrypt, ++ uint16_t *pcipher) ++{ ++ uint16_t dialect; ++ uint16_t encrypt; ++ uint16_t cipher; ++ ++ if (sid->sub_auths[0] != 1397571891) { ++ return false; ++ } ++ ++ dialect = sid->sub_auths[1]; ++ if (dialect > 0x03ff) { ++ return false; ++ } ++ ++ encrypt = sid->sub_auths[2]; ++ if (encrypt > 0x0002) { ++ return false; ++ } ++ ++ cipher = sid->sub_auths[3]; ++ if (cipher > SMB2_ENCRYPTION_AES128_GCM) { ++ return false; ++ } ++ ++ if (pdialect != NULL) { ++ *pdialect = dialect; ++ } ++ ++ if (pencrypt != NULL) { ++ *pencrypt = encrypt; ++ } ++ ++ if (pcipher != NULL) { ++ *pcipher = cipher; ++ } ++ ++ return true; ++} ++ ++bool dcerpc_is_transport_encrypted(struct auth_session_info *session_info) ++{ ++ struct security_token *token = session_info->security_token; ++ struct dom_sid smb3_dom_sid; ++ const struct dom_sid *smb3_sid = NULL; ++ uint16_t dialect = 0; ++ uint16_t encrypt = 0; ++ uint16_t cipher = 0; ++ uint32_t i; ++ bool ok; ++ ++ ok = dom_sid_parse(SID_SAMBA_SMB3, &smb3_dom_sid); ++ if (!ok) { ++ return false; ++ } ++ ++ for (i = 0; i < token->num_sids; i++) { ++ int cmp; ++ ++ /* There is only one SMB3 SID allowed! */ ++ cmp = dom_sid_compare_domain(&token->sids[i], &smb3_dom_sid); ++ if (cmp == 0) { ++ if (smb3_sid == NULL) { ++ smb3_sid = &token->sids[i]; ++ } else { ++ DBG_ERR("ERROR: The SMB3 SID has been detected " ++ "multiple times\n"); ++ return false; ++ } ++ } ++ } ++ ++ if (smb3_sid == NULL) { ++ return false; ++ } ++ ++ ok = smb3_sid_parse(smb3_sid, &dialect, &encrypt, &cipher); ++ if (!ok) { ++ DBG_ERR("Failed to parse SMB3 SID!\n"); ++ return false; ++ } ++ ++ DBG_DEBUG("SMB SID - dialect: %#04x, encrypt: %#04x, cipher: %#04x\n", ++ dialect, ++ encrypt, ++ cipher); ++ ++ if (dialect < SMB3_DIALECT_REVISION_300) { ++ DBG_DEBUG("Invalid SMB3 dialect!\n"); ++ return false; ++ } ++ ++ if (encrypt != DCERPC_SMB_ENCRYPTION_REQUIRED) { ++ DBG_DEBUG("Invalid SMB3 encryption!\n"); ++ return false; ++ } ++ ++ switch (cipher) { ++ case SMB2_ENCRYPTION_AES128_CCM: ++ case SMB2_ENCRYPTION_AES128_GCM: ++ break; ++ default: ++ DBG_DEBUG("Invalid SMB3 cipher!\n"); ++ return false; ++ } ++ ++ return true; ++} +diff --git a/librpc/rpc/dcerpc_helper.h b/librpc/rpc/dcerpc_helper.h +new file mode 100644 +index 00000000000..c0f09ee494e +--- /dev/null ++++ b/librpc/rpc/dcerpc_helper.h +@@ -0,0 +1,26 @@ ++/* ++ * Copyright (c) 2020 Andreas Schneider ++ * ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#ifndef _DCERPC_HELPER_H ++#define _DCERPC_HELPER_H ++ ++#define DCERPC_SMB_ENCRYPTION_OFF 0x0000 ++#define DCERPC_SMB_ENCRYPTION_REQUIRED 0x0002 ++ ++bool dcerpc_is_transport_encrypted(struct auth_session_info *session_info); ++ ++#endif /* _DCERPC_HELPER_H */ +diff --git a/librpc/wscript_build b/librpc/wscript_build +index 27b180fa63d..109a1834841 100644 +--- a/librpc/wscript_build ++++ b/librpc/wscript_build +@@ -669,6 +669,15 @@ bld.SAMBA_LIBRARY('dcerpc-server-core', + autoproto='rpc/dcesrv_core_proto.h', + vnum='0.0.1') + ++bld.SAMBA_SUBSYSTEM('DCERPC_HELPER', ++ source='rpc/dcerpc_helper.c', ++ public_deps=''' ++ samba-hostconfig ++ samba-security ++ gnutls ++ GNUTLS_HELPERS ++ ''') ++ + bld.SAMBA_SUBSYSTEM('NDR_WINBIND', + source='gen_ndr/ndr_winbind.c', + public_deps='ndr NDR_LSA' +-- +2.28.0 + + +From 4a2e7909f3a40c6ab82c045a5a54f8604a6f1dd2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 28 Aug 2020 16:31:17 +0200 +Subject: [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 5f1a73be6311c68a21a550c0de5078baeb78f4ee) +--- + source3/smbd/pipes.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c +index d51a3de9497..785cbb23b5f 100644 +--- a/source3/smbd/pipes.c ++++ b/source3/smbd/pipes.c +@@ -31,6 +31,7 @@ + #include "libcli/security/security.h" + #include "rpc_server/srv_pipe_hnd.h" + #include "auth/auth_util.h" ++#include "librpc/rpc/dcerpc_helper.h" + + NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, + struct files_struct **pfsp) +@@ -74,7 +75,7 @@ NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, + if (smb_req->smb2req != NULL && smb_req->smb2req->was_encrypted) { + struct security_token *security_token = NULL; + uint16_t dialect = xconn->smb2.server.dialect; +- uint16_t srv_smb_encrypt = 0x0002; ++ uint16_t srv_smb_encrypt = DCERPC_SMB_ENCRYPTION_REQUIRED; + uint16_t cipher = xconn->smb2.server.cipher; + char smb3_sid_str[SID_MAX_SIZE]; + struct dom_sid smb3_dom_sid; +-- +2.28.0 + + +From 69b9e46fa29adcf5a478a240ea6980bf7d97ae4b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 12 Nov 2019 16:56:45 +0100 +Subject: [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit c6a21e1897985f267bcfc681179cea95165c3c57) +--- + source3/rpc_server/samr/srv_samr_chgpasswd.c | 3 + + source3/rpc_server/samr/srv_samr_nt.c | 78 +++++++++++++++++++- + source3/rpc_server/wscript_build | 2 +- + 3 files changed, 81 insertions(+), 2 deletions(-) + +diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c +index cb9837ecf01..e326745169e 100644 +--- a/source3/rpc_server/samr/srv_samr_chgpasswd.c ++++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c +@@ -769,11 +769,13 @@ static NTSTATUS check_oem_password(const char *user, + .size = 16, + }; + ++ GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &enc_key, + NULL); + if (rc < 0) { ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + } + +@@ -781,6 +783,7 @@ static NTSTATUS check_oem_password(const char *user, + password_encrypted, + 516); + gnutls_cipher_deinit(cipher_hnd); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + } +diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c +index 5ffc3331185..77cb18b6a88 100644 +--- a/source3/rpc_server/samr/srv_samr_nt.c ++++ b/source3/rpc_server/samr/srv_samr_nt.c +@@ -46,6 +46,8 @@ + #include "rpc_server/srv_access_check.h" + #include "../lib/tsocket/tsocket.h" + #include "lib/util/base64.h" ++#include "param/param.h" ++#include "librpc/rpc/dcerpc_helper.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -1887,6 +1889,7 @@ NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p, + char *user_name = NULL; + char *rhost; + const char *wks = NULL; ++ bool encrypted; + + DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__)); + +@@ -1915,6 +1918,12 @@ NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p, + return NT_STATUS_NO_MEMORY; + } + ++ encrypted = dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ return NT_STATUS_ACCESS_DENIED; ++ } ++ + /* + * UNIX username case mangling not required, pass_oem_change + * is case insensitive. +@@ -1948,6 +1957,7 @@ NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p, + char *user_name = NULL; + const char *wks = NULL; + char *rhost; ++ bool encrypted; + + DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__)); + +@@ -1985,6 +1995,12 @@ NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p, + return NT_STATUS_NO_MEMORY; + } + ++ encrypted = dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ return NT_STATUS_ACCESS_DENIED; ++ } ++ + status = pass_oem_change(user_name, + rhost, + r->in.password->data, +@@ -5200,8 +5216,13 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, + char *rhost; + DATA_BLOB session_key; + struct dom_sid_buf buf; ++ struct loadparm_context *lp_ctx = NULL; ++ bool encrypted; + +- DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__)); ++ lp_ctx = loadparm_init_s3(p->mem_ctx, loadparm_s3_helpers()); ++ if (lp_ctx == NULL) { ++ return NT_STATUS_NO_MEMORY; ++ } + + /* This is tricky. A WinXP domain join sets + (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES) +@@ -5390,13 +5411,27 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, + break; + + case 23: ++ encrypted = ++ dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ status = NT_STATUS_ACCESS_DENIED; ++ break; ++ } ++ + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); + if(!NT_STATUS_IS_OK(status)) { + break; + } ++ /* ++ * This can be allowed as it requires a session key ++ * which we only have if we have a SMB session. ++ */ ++ GNUTLS_FIPS140_SET_LAX_MODE(); + status = arc4_decrypt_data(session_key, + info->info23.password.data, + 516); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if(!NT_STATUS_IS_OK(status)) { + break; + } +@@ -5412,14 +5447,27 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, + break; + + case 24: ++ encrypted = ++ dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ status = NT_STATUS_ACCESS_DENIED; ++ break; ++ } + + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); + if(!NT_STATUS_IS_OK(status)) { + break; + } ++ /* ++ * This can be allowed as it requires a session key ++ * which we only have if we have a SMB session. ++ */ ++ GNUTLS_FIPS140_SET_LAX_MODE(); + status = arc4_decrypt_data(session_key, + info->info24.password.data, + 516); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if(!NT_STATUS_IS_OK(status)) { + break; + } +@@ -5434,12 +5482,26 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, + break; + + case 25: ++ encrypted = ++ dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ status = NT_STATUS_ACCESS_DENIED; ++ break; ++ } ++ + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); + if(!NT_STATUS_IS_OK(status)) { + break; + } ++ /* ++ * This can be allowed as it requires a session key ++ * which we only have if we have a SMB session. ++ */ ++ GNUTLS_FIPS140_SET_LAX_MODE(); + status = decode_rc4_passwd_buffer(&session_key, + &info->info25.password); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (!NT_STATUS_IS_OK(status)) { + break; + } +@@ -5454,12 +5516,26 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, + break; + + case 26: ++ encrypted = ++ dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ status = NT_STATUS_ACCESS_DENIED; ++ break; ++ } ++ + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); + if(!NT_STATUS_IS_OK(status)) { + break; + } ++ /* ++ * This can be allowed as it requires a session key ++ * which we only have if we have a SMB session. ++ */ ++ GNUTLS_FIPS140_SET_LAX_MODE(); + status = decode_rc4_passwd_buffer(&session_key, + &info->info26.password); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (!NT_STATUS_IS_OK(status)) { + break; + } +diff --git a/source3/rpc_server/wscript_build b/source3/rpc_server/wscript_build +index 2af02ad6fa8..eb91ac09384 100644 +--- a/source3/rpc_server/wscript_build ++++ b/source3/rpc_server/wscript_build +@@ -85,7 +85,7 @@ bld.SAMBA3_SUBSYSTEM('RPC_SAMR', + source='''samr/srv_samr_nt.c + samr/srv_samr_util.c + samr/srv_samr_chgpasswd.c''', +- deps='PLAINTEXT_AUTH SRV_ACCESS_CHECK') ++ deps='PLAINTEXT_AUTH SRV_ACCESS_CHECK DCERPC_HELPER') + + bld.SAMBA3_SUBSYSTEM('RPC_SPOOLSS', + source='''spoolss/srv_spoolss_nt.c +-- +2.28.0 + + +From 110323b646715aabd4468d70773c2d94968f2e99 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 15 Nov 2019 13:49:40 +0100 +Subject: [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit a9c532c6d3e85fbe49b7040254cfc66ab54074bc) +--- + source4/rpc_server/samr/samr_password.c | 30 +++++++++++++++++++++++++ + source4/rpc_server/wscript_build | 2 +- + 2 files changed, 31 insertions(+), 1 deletion(-) + +diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c +index 52a644176e2..83b104fbd0e 100644 +--- a/source4/rpc_server/samr/samr_password.c ++++ b/source4/rpc_server/samr/samr_password.c +@@ -31,6 +31,8 @@ + #include "../lib/util/util_ldb.h" + #include "rpc_server/samr/proto.h" + #include "auth/auth_sam.h" ++#include "lib/param/loadparm.h" ++#include "librpc/rpc/dcerpc_helper.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -129,6 +131,8 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + struct dom_sid *user_objectSid = NULL; + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t lm_session_key; ++ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; ++ bool encrypted; + int rc; + + if (pwbuf == NULL) { +@@ -144,6 +148,12 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + return NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER; + } + ++ encrypted = dcerpc_is_transport_encrypted(session_info); ++ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ return NT_STATUS_ACCESS_DENIED; ++ } ++ + /* Connect to a SAMDB with system privileges for fetching the old pw + * hashes. */ + sam_ctx = samdb_connect(mem_ctx, +@@ -188,11 +198,13 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + .size = sizeof(lm_pwd->hash), + }; + ++ GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &lm_session_key, + NULL); + if (rc < 0) { ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto failed; + } +@@ -201,6 +213,7 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + pwbuf->data, + 516); + gnutls_cipher_deinit(cipher_hnd); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto failed; +@@ -607,7 +620,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, + DATA_BLOB session_key = data_blob(NULL, 0); + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t _session_key; ++ struct auth_session_info *session_info = ++ dcesrv_call_session_info(dce_call); ++ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; + int rc; ++ bool encrypted; ++ ++ encrypted = dcerpc_is_transport_encrypted(session_info); ++ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ return NT_STATUS_ACCESS_DENIED; ++ } + + nt_status = dcesrv_transport_session_key(dce_call, &session_key); + if (!NT_STATUS_IS_OK(nt_status)) { +@@ -621,11 +644,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, + .size = session_key.length, + }; + ++ /* ++ * This is safe to support as we only have a session key ++ * over a SMB connection which we force to be encrypted. ++ */ ++ GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &_session_key, + NULL); + if (rc < 0) { ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } +@@ -634,6 +663,7 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, + pwbuf->data, + 516); + gnutls_cipher_deinit(cipher_hnd); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; +diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build +index de55ad6239a..c9c1978f223 100644 +--- a/source4/rpc_server/wscript_build ++++ b/source4/rpc_server/wscript_build +@@ -87,7 +87,7 @@ bld.SAMBA_MODULE('dcesrv_samr', + autoproto='samr/proto.h', + subsystem='dcerpc_server', + init_function='dcerpc_server_samr_init', +- deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS' ++ deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS DCERPC_HELPER' + ) + + +-- +2.28.0 + + +From 6353a991bc6d35b9468867c0e809e752b060da9b Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:45:49 +0200 +Subject: [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips + mode + +Signed-off-by: Isaac Boukris +Reviewed-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 32d4c75d6cbf9153068a0487347097707afb356a) +--- + lib/crypto/py_crypto.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c +index 32b946eee8f..ad18d3ada0f 100644 +--- a/lib/crypto/py_crypto.c ++++ b/lib/crypto/py_crypto.c +@@ -24,6 +24,7 @@ + + #include + #include ++#include "lib/crypto/gnutls_helpers.h" + + static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args) + { +@@ -85,12 +86,27 @@ static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args) + return result; + } + ++static PyObject *py_crypto_set_relax_mode(PyObject *module) ++{ ++ GNUTLS_FIPS140_SET_LAX_MODE(); ++ ++ Py_RETURN_NONE; ++} ++ ++static PyObject *py_crypto_set_strict_mode(PyObject *module) ++{ ++ GNUTLS_FIPS140_SET_STRICT_MODE(); ++ ++ Py_RETURN_NONE; ++} + + static const char py_crypto_arcfour_crypt_blob_doc[] = "arcfour_crypt_blob(data, key)\n" + "Encrypt the data with RC4 algorithm using the key"; + + static PyMethodDef py_crypto_methods[] = { + { "arcfour_crypt_blob", (PyCFunction)py_crypto_arcfour_crypt_blob, METH_VARARGS, py_crypto_arcfour_crypt_blob_doc }, ++ { "set_relax_mode", (PyCFunction)py_crypto_set_relax_mode, METH_NOARGS, "Set fips to relax mode" }, ++ { "set_strict_mode", (PyCFunction)py_crypto_set_strict_mode, METH_NOARGS, "Set fips to strict mode" }, + {0}, + }; + +-- +2.28.0 + + +From 525072939b9292a1744f929803a9597b5f725f9a Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 28 Oct 2020 17:05:36 +0100 +Subject: [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 7d54e4b49c235dc571f47d15e6b0a6fa63340773) +--- + source4/param/pyparam.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/source4/param/pyparam.c b/source4/param/pyparam.c +index 4023fac4dd6..e15592b5743 100644 +--- a/source4/param/pyparam.c ++++ b/source4/param/pyparam.c +@@ -463,6 +463,23 @@ static PyObject *py_lp_ctx_config_file(PyObject *self, void *closure) + return PyUnicode_FromString(configfile); + } + ++static PyObject *py_lp_ctx_weak_crypto(PyObject *self, void *closure) ++{ ++ enum samba_weak_crypto weak_crypto = ++ lpcfg_weak_crypto(PyLoadparmContext_AsLoadparmContext(self)); ++ ++ switch(weak_crypto) { ++ case SAMBA_WEAK_CRYPTO_UNKNOWN: ++ Py_RETURN_NONE; ++ case SAMBA_WEAK_CRYPTO_ALLOWED: ++ return PyUnicode_FromString("allowed"); ++ case SAMBA_WEAK_CRYPTO_DISALLOWED: ++ return PyUnicode_FromString("disallowed"); ++ } ++ ++ Py_RETURN_NONE; ++} ++ + static PyGetSetDef py_lp_ctx_getset[] = { + { + .name = discard_const_p(char, "default_service"), +@@ -473,6 +490,11 @@ static PyGetSetDef py_lp_ctx_getset[] = { + .get = (getter)py_lp_ctx_config_file, + .doc = discard_const_p(char, "Name of last config file that was loaded.") + }, ++ { ++ .name = discard_const_p(char, "weak_crypto"), ++ .get = (getter)py_lp_ctx_weak_crypto, ++ .doc = discard_const_p(char, "If weak crypto is allowed.") ++ }, + { .name = NULL } + }; + +-- +2.28.0 + + +From c7dfaf75a8f8bdb18c42325c470bdee8e600d930 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 21 Oct 2020 10:09:22 +0200 +Subject: [PATCH 084/105] python:tests: Add SAMR password change tests for fips + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 9a3ba502d8193b25799ef92917efafd52de2e8c2) +--- + .../tests/dcerpc/samr_change_password.py | 188 ++++++++++++++++++ + selftest/tests.py | 2 + + 2 files changed, 190 insertions(+) + create mode 100644 python/samba/tests/dcerpc/samr_change_password.py + +diff --git a/python/samba/tests/dcerpc/samr_change_password.py b/python/samba/tests/dcerpc/samr_change_password.py +new file mode 100644 +index 00000000000..109eeea98cc +--- /dev/null ++++ b/python/samba/tests/dcerpc/samr_change_password.py +@@ -0,0 +1,188 @@ ++# Unix SMB/CIFS implementation. ++# ++# Copyright © 2020 Andreas Schneider ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++"""Tests for samba.dcerpc.samr.password""" ++ ++import os ++import ctypes ++import samba.tests ++ ++from samba import crypto, generate_random_password, generate_random_bytes, ntstatus ++from samba.auth import system_session ++from samba.credentials import Credentials ++from samba.credentials import SMB_ENCRYPTION_REQUIRED ++from samba.dcerpc import samr, security, lsa ++from samba.samdb import SamDB ++from samba.tests import RpcInterfaceTestCase ++ ++ ++class SamrPasswordTests(RpcInterfaceTestCase): ++ def setUp(self): ++ super(SamrPasswordTests, self).setUp() ++ self.open_samdb() ++ ++ self.create_user_account(10000) ++ ++ self.remote_server = samba.tests.env_get_var_value('SERVER') ++ self.remote_domain = samba.tests.env_get_var_value('DOMAIN') ++ self.remote_user = samba.tests.env_get_var_value('USERNAME') ++ self.remote_password = samba.tests.env_get_var_value('PASSWORD') ++ self.remote_binding_string = "ncacn_np:%s[krb5]" % (self.remote_server) ++ ++ self.remote_creds = Credentials() ++ self.remote_creds.guess(self.lp) ++ self.remote_creds.set_username(self.remote_user) ++ self.remote_creds.set_password(self.remote_password) ++ ++ def tearDown(self): ++ super(SamrPasswordTests, self).tearDown() ++ ++ samr.Close(self.user_handle) ++ samr.Close(self.domain_handle) ++ samr.Close(self.handle) ++ ++ samba.tests.delete_force(self.samdb, self.user_dn) ++ ++ # ++ # Open the samba database ++ # ++ def open_samdb(self): ++ self.lp = samba.tests.env_loadparm() ++ ++ self.local_creds = Credentials() ++ self.local_creds.guess(self.lp) ++ self.session = system_session() ++ self.samdb = SamDB(session_info=self.session, ++ credentials=self.local_creds, ++ lp=self.lp) ++ ++ # ++ # Open a SAMR Domain handle ++ # ++ def open_domain_handle(self): ++ self.handle = self.conn.Connect2(None, ++ security.SEC_FLAG_MAXIMUM_ALLOWED) ++ ++ self.domain_sid = self.conn.LookupDomain(self.handle, ++ lsa.String(self.remote_domain)) ++ ++ self.domain_handle = self.conn.OpenDomain(self.handle, ++ security.SEC_FLAG_MAXIMUM_ALLOWED, ++ self.domain_sid) ++ ++ def open_user_handle(self): ++ name = lsa.String(self.user_name) ++ ++ rids = self.conn.LookupNames(self.domain_handle, [name]) ++ ++ self.user_handle = self.conn.OpenUser(self.domain_handle, ++ security.SEC_FLAG_MAXIMUM_ALLOWED, ++ rids[0].ids[0]) ++ # ++ # Create a test user account ++ # ++ def create_user_account(self, user_id): ++ self.user_name = ("SAMR_USER_%d" % user_id) ++ self.user_pass = generate_random_password(32, 32) ++ self.user_dn = "cn=%s,cn=users,%s" % (self.user_name, self.samdb.domain_dn()) ++ ++ samba.tests.delete_force(self.samdb, self.user_dn) ++ ++ self.samdb.newuser(self.user_name, ++ self.user_pass, ++ description="Password for " + self.user_name + " is " + self.user_pass, ++ givenname=self.user_name, ++ surname=self.user_name) ++ ++ ++ def init_samr_CryptPassword(self, password, session_key): ++ ++ def encode_pw_buffer(password): ++ data = bytearray([0] * 516) ++ ++ p = samba.string_to_byte_array(password.encode('utf-16-le')) ++ plen = len(p) ++ ++ b = generate_random_bytes(512 - plen) ++ ++ i = 512 - plen ++ data[0:i] = b ++ data[i:i+plen] = p ++ data[512:516] = plen.to_bytes(4, byteorder='little') ++ ++ return bytes(data) ++ ++ # This is a test, so always allow to encrypt using RC4 ++ try: ++ crypto.set_relax_mode() ++ encrypted_blob = samba.arcfour_encrypt(session_key, encode_pw_buffer(password)) ++ finally: ++ crypto.set_strict_mode() ++ ++ out_blob = samr.CryptPassword() ++ out_blob.data = list(encrypted_blob) ++ ++ return out_blob ++ ++ ++ def test_setUserInfo2_Password(self, password='P@ssw0rd'): ++ self.conn = samr.samr(self.remote_binding_string, ++ self.get_loadparm(), ++ self.remote_creds) ++ self.open_domain_handle() ++ self.open_user_handle() ++ ++ password='P@ssw0rd' ++ ++ level = 24 ++ info = samr.UserInfo24() ++ ++ info.password_expired = 0 ++ info.password = self.init_samr_CryptPassword(password, self.conn.session_key) ++ ++ # If the server is in FIPS mode, it should reject the password change! ++ try: ++ self.conn.SetUserInfo2(self.user_handle, level, info) ++ except samba.NTSTATUSError as e: ++ code = ctypes.c_uint32(e.args[0]).value ++ print(code) ++ if ((code == ntstatus.NT_STATUS_ACCESS_DENIED) and ++ (self.lp.weak_crypto == 'disallowed')): ++ pass ++ else: ++ raise ++ ++ ++ def test_setUserInfo2_Password_Encrypted(self, password='P@ssw0rd'): ++ self.remote_creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ self.conn = samr.samr(self.remote_binding_string, ++ self.get_loadparm(), ++ self.remote_creds) ++ self.open_domain_handle() ++ self.open_user_handle() ++ ++ password='P@ssw0rd' ++ ++ level = 24 ++ info = samr.UserInfo24() ++ ++ info.password_expired = 0 ++ info.password = self.init_samr_CryptPassword(password, self.conn.session_key) ++ ++ self.conn.SetUserInfo2(self.user_handle, level, info) +diff --git a/selftest/tests.py b/selftest/tests.py +index adcb5b53189..86cab3f8046 100644 +--- a/selftest/tests.py ++++ b/selftest/tests.py +@@ -93,6 +93,8 @@ planpythontestsuite( + os.path.join(samba4srcdir, "..", "third_party", "waf")]) + planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest") + planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding") ++for env in [ 'ad_dc:local', 'ad_dc_fips:local' ]: ++ planpythontestsuite(env, "samba.tests.dcerpc.samr_change_password") + + + def cmdline(script, *args): +-- +2.28.0 + + +From 9dfef9d7129babedfdc0fddd60f76859f44fe7c1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 21 Oct 2020 10:09:22 +0200 +Subject: [PATCH 085/105] python:tests: Add SAMR password change tests for fips + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Thu Oct 29 15:41:37 UTC 2020 on sn-devel-184 + +(cherry picked from commit ebd687335b9accfdbae7dbc65c9882ab4d5c0986) +--- + selftest/target/Samba4.pm | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm +index 649e923ff9a..1ebdf2a5484 100755 +--- a/selftest/target/Samba4.pm ++++ b/selftest/target/Samba4.pm +@@ -1040,7 +1040,7 @@ servicePrincipalName: http/testupnspn.$ctx->{dnsname} + $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; + $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" "; + $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool") +- . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'"; ++ . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account' -d10"; + unless (system($samba_tool_cmd) == 0) { + warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n"); + return undef; +-- +2.28.0 + + +From 8e8b9d33f25c7ef89fdf4af90821ea4de77525e1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 20 Aug 2020 09:40:41 +0200 +Subject: [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 1298280a22ef7494fb85a6a5953bae15d22fa204) +--- + auth/credentials/credentials.c | 8 +++++--- + auth/credentials/credentials.h | 9 ++++++--- + auth/credentials/credentials_krb5.c | 4 ++-- + auth/credentials/credentials_ntlm.c | 2 +- + auth/credentials/credentials_secrets.c | 5 +++-- + auth/credentials/pycredentials.c | 6 +++--- + auth/credentials/tests/simple.c | 2 +- + auth/credentials/wscript_build | 2 +- + auth/gensec/gensec_start.c | 8 ++++---- + examples/winexe/winexe.c | 4 ++-- + source3/auth/auth_generic.c | 4 ++-- + source3/lib/util_cmdline.c | 18 +++++++++--------- + source3/libads/sasl.c | 8 ++++---- + source3/libnet/libnet_join.c | 2 +- + source3/libsmb/cliconnect.c | 16 ++++++++-------- + source3/passdb/passdb.c | 6 +++--- + source3/passdb/pdb_samba_dsdb.c | 4 ++-- + source3/rpc_client/cli_pipe.c | 2 +- + source3/rpcclient/rpcclient.c | 8 ++++---- + source3/utils/net_ads.c | 2 +- + source3/utils/net_util.c | 6 +++--- + source3/utils/ntlm_auth.c | 4 ++-- + source3/winbindd/winbindd_cm.c | 2 +- + source4/auth/gensec/gensec_gssapi.c | 2 +- + source4/auth/session.c | 2 +- + source4/lib/cmdline/popt_credentials.c | 4 ++-- + source4/torture/ldap/session_expiry.c | 2 +- + source4/torture/raw/session.c | 4 ++-- + source4/torture/rpc/schannel.c | 4 ++-- + source4/torture/smb2/session.c | 12 ++++++------ + 30 files changed, 84 insertions(+), 78 deletions(-) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 77c35dd104b..1bdd6f15a09 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -44,6 +44,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) + + cred->winbind_separator = '\\'; + ++ cred->use_kerberos = CRED_USE_KERBEROS_DESIRED; ++ + cred->signing_state = SMB_SIGNING_DEFAULT; + + /* +@@ -360,7 +362,7 @@ _PUBLIC_ bool cli_credentials_authentication_requested(struct cli_credentials *c + return true; + } + +- if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) { ++ if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) { + return true; + } + +@@ -1018,7 +1020,7 @@ _PUBLIC_ void cli_credentials_guess(struct cli_credentials *cred, + } + + if (lp_ctx != NULL && +- cli_credentials_get_kerberos_state(cred) != CRED_DONT_USE_KERBEROS) { ++ cli_credentials_get_kerberos_state(cred) != CRED_USE_KERBEROS_DISABLED) { + cli_credentials_set_ccache(cred, lp_ctx, NULL, CRED_GUESS_FILE, + &error_string); + } +@@ -1097,7 +1099,7 @@ _PUBLIC_ void cli_credentials_set_anonymous(struct cli_credentials *cred) + cli_credentials_set_principal(cred, NULL, CRED_SPECIFIED); + cli_credentials_set_realm(cred, NULL, CRED_SPECIFIED); + cli_credentials_set_workstation(cred, "", CRED_UNINITIALISED); +- cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_DISABLED); + } + + /** +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 438bcdce232..f468b8558dd 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -53,9 +53,12 @@ enum credentials_obtained { + }; + + enum credentials_use_kerberos { +- CRED_AUTO_USE_KERBEROS = 0, /* Default, we try kerberos if available */ +- CRED_DONT_USE_KERBEROS, /* Sometimes trying kerberos just does 'bad things', so don't */ +- CRED_MUST_USE_KERBEROS /* Sometimes administrators are parinoid, so always do kerberos */ ++ /** Sometimes trying kerberos just does 'bad things', so don't */ ++ CRED_USE_KERBEROS_DISABLED = 0, ++ /** Default, we try kerberos if available */ ++ CRED_USE_KERBEROS_DESIRED, ++ /** Sometimes administrators are paranoid, so always do kerberos */ ++ CRED_USE_KERBEROS_REQUIRED, + }; + + enum credentials_krb_forwardable { +diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c +index 259b35b73b0..36f6b59a72b 100644 +--- a/auth/credentials/credentials_krb5.c ++++ b/auth/credentials/credentials_krb5.c +@@ -871,7 +871,7 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred, + ret = cli_credentials_get_ccache(cred, event_ctx, lp_ctx, + &ccache, error_string); + if (ret) { +- if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) { ++ if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) { + DEBUG(1, ("Failed to get kerberos credentials (kerberos required): %s\n", *error_string)); + } else { + DEBUG(4, ("Failed to get kerberos credentials: %s\n", *error_string)); +@@ -1431,7 +1431,7 @@ _PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials * + cred->impersonate_principal = talloc_strdup(cred, principal); + talloc_free(cred->self_service); + cred->self_service = talloc_strdup(cred, self_service); +- cli_credentials_set_kerberos_state(cred, CRED_MUST_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_REQUIRED); + } + + /* +diff --git a/auth/credentials/credentials_ntlm.c b/auth/credentials/credentials_ntlm.c +index f1b22a6c9e2..1bec60e5dce 100644 +--- a/auth/credentials/credentials_ntlm.c ++++ b/auth/credentials/credentials_ntlm.c +@@ -53,7 +53,7 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred + const struct samr_Password *nt_hash = NULL; + int rc; + +- if (cred->use_kerberos == CRED_MUST_USE_KERBEROS) { ++ if (cred->use_kerberos == CRED_USE_KERBEROS_REQUIRED) { + TALLOC_FREE(frame); + return NT_STATUS_INVALID_PARAMETER_MIX; + } +diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c +index 52a89d4d5b4..58067a5bece 100644 +--- a/auth/credentials/credentials_secrets.c ++++ b/auth/credentials/credentials_secrets.c +@@ -370,7 +370,8 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti + } + + if (secrets_tdb_password_more_recent) { +- enum credentials_use_kerberos use_kerberos = CRED_DONT_USE_KERBEROS; ++ enum credentials_use_kerberos use_kerberos = ++ CRED_USE_KERBEROS_DISABLED; + char *machine_account = talloc_asprintf(tmp_ctx, "%s$", lpcfg_netbios_name(lp_ctx)); + cli_credentials_set_password(cred, secrets_tdb_password, CRED_SPECIFIED); + cli_credentials_set_old_password(cred, secrets_tdb_old_password, CRED_SPECIFIED); +@@ -386,7 +387,7 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti + + FALL_THROUGH; + case ROLE_ACTIVE_DIRECTORY_DC: +- use_kerberos = CRED_AUTO_USE_KERBEROS; ++ use_kerberos = CRED_USE_KERBEROS_DESIRED; + break; + } + } +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index 17c90573f09..95dde276ef7 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -1492,9 +1492,9 @@ MODULE_INIT_FUNC(credentials) + PyModule_AddObject(m, "CALLBACK_RESULT", PyLong_FromLong(CRED_CALLBACK_RESULT)); + PyModule_AddObject(m, "SPECIFIED", PyLong_FromLong(CRED_SPECIFIED)); + +- PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyLong_FromLong(CRED_AUTO_USE_KERBEROS)); +- PyModule_AddObject(m, "DONT_USE_KERBEROS", PyLong_FromLong(CRED_DONT_USE_KERBEROS)); +- PyModule_AddObject(m, "MUST_USE_KERBEROS", PyLong_FromLong(CRED_MUST_USE_KERBEROS)); ++ PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_DESIRED)); ++ PyModule_AddObject(m, "DONT_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_DISABLED)); ++ PyModule_AddObject(m, "MUST_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_REQUIRED)); + + PyModule_AddObject(m, "AUTO_KRB_FORWARDABLE", PyLong_FromLong(CRED_AUTO_KRB_FORWARDABLE)); + PyModule_AddObject(m, "NO_KRB_FORWARDABLE", PyLong_FromLong(CRED_NO_KRB_FORWARDABLE)); +diff --git a/auth/credentials/tests/simple.c b/auth/credentials/tests/simple.c +index 7f122bed3bc..b39d7a2251b 100644 +--- a/auth/credentials/tests/simple.c ++++ b/auth/credentials/tests/simple.c +@@ -73,7 +73,7 @@ static bool test_guess(struct torture_context *tctx) + const char *passwd_fd = getenv("PASSWD_FD"); + const char *passwd_file = getenv("PASSWD_FILE"); + +- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); + + unsetenv("USER"); + unsetenv("PASSWD_FD"); +diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build +index 1e3302e3e48..ad16b7d8008 100644 +--- a/auth/credentials/wscript_build ++++ b/auth/credentials/wscript_build +@@ -5,7 +5,7 @@ bld.SAMBA_LIBRARY('samba-credentials', + public_headers='credentials.h', + pc_files='samba-credentials.pc', + deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', +- vnum='0.1.0' ++ vnum='1.0.0' + ) + + bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', +diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c +index 3f42d611140..56306efed13 100644 +--- a/auth/gensec/gensec_start.c ++++ b/auth/gensec/gensec_start.c +@@ -117,18 +117,18 @@ static const struct gensec_security_ops **gensec_use_kerberos_mechs( + } + + switch (use_kerberos) { +- case CRED_AUTO_USE_KERBEROS: ++ case CRED_USE_KERBEROS_DESIRED: + keep = true; + break; + +- case CRED_DONT_USE_KERBEROS: ++ case CRED_USE_KERBEROS_DISABLED: + if (old_gensec_list[i]->kerberos == false) { + keep = true; + } + + break; + +- case CRED_MUST_USE_KERBEROS: ++ case CRED_USE_KERBEROS_REQUIRED: + if (old_gensec_list[i]->kerberos == true) { + keep = true; + } +@@ -156,7 +156,7 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( + TALLOC_CTX *mem_ctx) + { + const struct gensec_security_ops * const *backends = gensec_security_all(); +- enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; ++ enum credentials_use_kerberos use_kerberos = CRED_USE_KERBEROS_DESIRED; + bool keep_schannel = false; + + if (gensec_security != NULL) { +diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c +index 03e7ec85198..95386211c0a 100644 +--- a/examples/winexe/winexe.c ++++ b/examples/winexe/winexe.c +@@ -283,8 +283,8 @@ static void parse_args(int argc, const char *argv[], + if (opt_kerberos) { + cli_credentials_set_kerberos_state(cred, + strcmp(opt_kerberos, "yes") +- ? CRED_MUST_USE_KERBEROS +- : CRED_DONT_USE_KERBEROS); ++ ? CRED_USE_KERBEROS_REQUIRED ++ : CRED_USE_KERBEROS_DISABLED); + } + + if (options->runas == NULL && options->runas_file != NULL) { +diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c +index 0e9500ac08d..f314acd9559 100644 +--- a/source3/auth/auth_generic.c ++++ b/source3/auth/auth_generic.c +@@ -356,9 +356,9 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx, + cli_credentials_set_conf(server_credentials, lp_ctx); + + if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { +- cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED); + } else { +- cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED); + } + + nt_status = gensec_server_start(tmp_ctx, gensec_settings, +diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c +index 9c9e2f0ac0f..d2af34ee19b 100644 +--- a/source3/lib/util_cmdline.c ++++ b/source3/lib/util_cmdline.c +@@ -307,9 +307,9 @@ void set_cmdline_auth_info_use_kerberos(struct user_auth_info *auth_info, + enum credentials_use_kerberos krb5_state; + + if (b) { +- krb5_state = CRED_MUST_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_REQUIRED; + } else { +- krb5_state = CRED_DONT_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_DISABLED; + } + + cli_credentials_set_kerberos_state(auth_info->creds, krb5_state); +@@ -321,7 +321,7 @@ bool get_cmdline_auth_info_use_kerberos(const struct user_auth_info *auth_info) + + krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); + +- if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + return true; + } + +@@ -336,17 +336,17 @@ void set_cmdline_auth_info_fallback_after_kerberos(struct user_auth_info *auth_i + krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); + + switch (krb5_state) { +- case CRED_MUST_USE_KERBEROS: ++ case CRED_USE_KERBEROS_REQUIRED: + if (b) { +- krb5_state = CRED_AUTO_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_DESIRED; + } + break; +- case CRED_AUTO_USE_KERBEROS: ++ case CRED_USE_KERBEROS_DESIRED: + if (!b) { +- krb5_state = CRED_MUST_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_REQUIRED; + } + break; +- case CRED_DONT_USE_KERBEROS: ++ case CRED_USE_KERBEROS_DISABLED: + /* nothing to do */ + break; + } +@@ -360,7 +360,7 @@ bool get_cmdline_auth_info_fallback_after_kerberos(const struct user_auth_info * + + krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); + +- if (krb5_state == CRED_AUTO_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_DESIRED) { + return true; + } + +diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c +index 87beeafe3ed..90ffa040ec0 100644 +--- a/source3/libads/sasl.c ++++ b/source3/libads/sasl.c +@@ -158,7 +158,7 @@ static ADS_STATUS ads_sasl_spnego_gensec_bind(ADS_STRUCT *ads, + use_spnego_principal = false; + } + +- if (krb5_state == CRED_DONT_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_DISABLED) { + use_spnego_principal = false; + } + +@@ -565,7 +565,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) + { + + status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", +- CRED_MUST_USE_KERBEROS, ++ CRED_USE_KERBEROS_REQUIRED, + p.service, p.hostname, + blob); + if (ADS_ERR_OK(status)) { +@@ -581,7 +581,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) + + if (ADS_ERR_OK(status)) { + status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", +- CRED_MUST_USE_KERBEROS, ++ CRED_USE_KERBEROS_REQUIRED, + p.service, p.hostname, + blob); + if (!ADS_ERR_OK(status)) { +@@ -616,7 +616,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) + library for HMAC_MD4 encryption */ + mech = "NTLMSSP"; + status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", +- CRED_DONT_USE_KERBEROS, ++ CRED_USE_KERBEROS_DISABLED, + p.service, p.hostname, + data_blob_null); + done: +diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c +index f3bf27e6c00..bd3aeec9434 100644 +--- a/source3/libnet/libnet_join.c ++++ b/source3/libnet/libnet_join.c +@@ -1707,7 +1707,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, + + if (use_kerberos) { + cli_credentials_set_kerberos_state(cli_creds, +- CRED_MUST_USE_KERBEROS); ++ CRED_USE_KERBEROS_REQUIRED); + } + + status = cli_full_connection_creds(&cli, NULL, +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index abfd18bfaf1..f7b4741de89 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -124,13 +124,13 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx, + + if (use_kerberos && fallback_after_kerberos) { + cli_credentials_set_kerberos_state(creds, +- CRED_AUTO_USE_KERBEROS); ++ CRED_USE_KERBEROS_DESIRED); + } else if (use_kerberos) { + cli_credentials_set_kerberos_state(creds, +- CRED_MUST_USE_KERBEROS); ++ CRED_USE_KERBEROS_REQUIRED); + } else { + cli_credentials_set_kerberos_state(creds, +- CRED_DONT_USE_KERBEROS); ++ CRED_USE_KERBEROS_DISABLED); + } + + if (use_ccache) { +@@ -255,7 +255,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, + + krb5_state = cli_credentials_get_kerberos_state(creds); + +- if (krb5_state != CRED_DONT_USE_KERBEROS) { ++ if (krb5_state != CRED_USE_KERBEROS_DISABLED) { + try_kerberos = true; + } + +@@ -275,7 +275,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, + try_kerberos = false; + } + +- if (krb5_state == CRED_MUST_USE_KERBEROS && !try_kerberos) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED && !try_kerberos) { + DEBUG(0, ("Kerberos auth with '%s' (%s\\%s) to access " + "'%s' not possible\n", + user_principal, user_domain, user_account, +@@ -286,7 +286,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, + + if (pass == NULL || strlen(pass) == 0) { + need_kinit = false; +- } else if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ } else if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + need_kinit = try_kerberos; + } else { + need_kinit = try_kerberos; +@@ -321,14 +321,14 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, + if (ret != 0) { + int dbglvl = DBGLVL_NOTICE; + +- if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + dbglvl = DBGLVL_ERR; + } + + DEBUG(dbglvl, ("Kinit for %s to access %s failed: %s\n", + user_principal, target_hostname, + error_message(ret))); +- if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + TALLOC_FREE(frame); + return krb5_to_nt_status(ret); + } +diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c +index 8ed1bafcea3..b12c845d9d2 100644 +--- a/source3/passdb/passdb.c ++++ b/source3/passdb/passdb.c +@@ -2630,7 +2630,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, + /* + * It's not possible to use NTLMSSP with a domain trust account. + */ +- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); + } else { + /* + * We can't use kerberos against an NT4 domain. +@@ -2638,7 +2638,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, + * We should have a mode that also disallows NTLMSSP here, + * as only NETLOGON SCHANNEL is possible. + */ +- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); + } + + ok = cli_credentials_set_username(creds, account_name, CRED_SPECIFIED); +@@ -2656,7 +2656,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, + /* + * We currently can't do kerberos just with an NTHASH. + */ +- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); + goto done; + } + +diff --git a/source3/passdb/pdb_samba_dsdb.c b/source3/passdb/pdb_samba_dsdb.c +index 276bda88efc..93e8f5bebe6 100644 +--- a/source3/passdb/pdb_samba_dsdb.c ++++ b/source3/passdb/pdb_samba_dsdb.c +@@ -2599,13 +2599,13 @@ static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m, + * Force kerberos if this is an active directory domain + */ + cli_credentials_set_kerberos_state(creds, +- CRED_MUST_USE_KERBEROS); ++ CRED_USE_KERBEROS_REQUIRED); + } else { + /* + * TODO: we should allow krb5 with the raw nt hash. + */ + cli_credentials_set_kerberos_state(creds, +- CRED_DONT_USE_KERBEROS); ++ CRED_USE_KERBEROS_DISABLED); + } + + *_creds = talloc_move(mem_ctx, &creds); +diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c +index 8227ef0b0bd..ba6c86cc227 100644 +--- a/source3/rpc_client/cli_pipe.c ++++ b/source3/rpc_client/cli_pipe.c +@@ -2637,7 +2637,7 @@ NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx, + NAME_NT_AUTHORITY, /* domain */ + "SYSTEM", + NULL, /* password */ +- CRED_DONT_USE_KERBEROS, ++ CRED_USE_KERBEROS_DISABLED, + NULL, /* netlogon_creds_CredentialState */ + presult); + } +diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c +index 575a42ebf70..a38f69f5592 100644 +--- a/source3/rpcclient/rpcclient.c ++++ b/source3/rpcclient/rpcclient.c +@@ -810,19 +810,19 @@ static NTSTATUS do_cmd(struct cli_state *cli, + case DCERPC_AUTH_TYPE_SPNEGO: + switch (pipe_default_auth_spnego_type) { + case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP: +- krb5_state = CRED_DONT_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_DISABLED; + break; + case PIPE_AUTH_TYPE_SPNEGO_KRB5: +- krb5_state = CRED_MUST_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_REQUIRED; + break; + case PIPE_AUTH_TYPE_SPNEGO_NONE: +- krb5_state = CRED_AUTO_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_DESIRED; + break; + } + FALL_THROUGH; + case DCERPC_AUTH_TYPE_NTLMSSP: + case DCERPC_AUTH_TYPE_KRB5: +- if (krb5_state != CRED_AUTO_USE_KERBEROS) { ++ if (krb5_state != CRED_USE_KERBEROS_DESIRED) { + cli_credentials_set_kerberos_state(creds, + krb5_state); + } +diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c +index 7f5b9c3a440..1a0e8a5c9dd 100644 +--- a/source3/utils/net_ads.c ++++ b/source3/utils/net_ads.c +@@ -2432,7 +2432,7 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * + talloc_destroy(mem_ctx); + return -1; + } +- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); + + nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername, + &server_ss, 0, +diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c +index 5829d891075..6c5321db0fd 100644 +--- a/source3/utils/net_util.c ++++ b/source3/utils/net_util.c +@@ -493,13 +493,13 @@ struct cli_credentials *net_context_creds(struct net_context *c, + + if (c->opt_kerberos && c->opt_user_specified) { + cli_credentials_set_kerberos_state(creds, +- CRED_AUTO_USE_KERBEROS); ++ CRED_USE_KERBEROS_DESIRED); + } else if (c->opt_kerberos) { + cli_credentials_set_kerberos_state(creds, +- CRED_MUST_USE_KERBEROS); ++ CRED_USE_KERBEROS_REQUIRED); + } else { + cli_credentials_set_kerberos_state(creds, +- CRED_DONT_USE_KERBEROS); ++ CRED_USE_KERBEROS_DISABLED); + } + + if (c->opt_ccache) { +diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c +index 7f8d2688978..bfaeff5188d 100644 +--- a/source3/utils/ntlm_auth.c ++++ b/source3/utils/ntlm_auth.c +@@ -1364,9 +1364,9 @@ static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx, + cli_credentials_set_conf(server_credentials, lp_ctx); + + if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC || lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { +- cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED); + } else { +- cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED); + } + + nt_status = gensec_server_start(tmp_ctx, gensec_settings, +diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c +index 5fb22d7e9c8..466a0095ef2 100644 +--- a/source3/winbindd/winbindd_cm.c ++++ b/source3/winbindd/winbindd_cm.c +@@ -706,7 +706,7 @@ static NTSTATUS cm_get_ipc_credentials(TALLOC_CTX *mem_ctx, + } + + cli_credentials_set_conf(creds, lp_ctx); +- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); + + ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED); + if (!ok) { +diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c +index d66abf32a7f..b668d4ed258 100644 +--- a/source4/auth/gensec/gensec_gssapi.c ++++ b/source4/auth/gensec/gensec_gssapi.c +@@ -1556,7 +1556,7 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi + } + + /* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */ +- cli_credentials_set_kerberos_state(session_info->credentials, CRED_MUST_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(session_info->credentials, CRED_USE_KERBEROS_REQUIRED); + + /* It has been taken from this place... */ + gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL; +diff --git a/source4/auth/session.c b/source4/auth/session.c +index c5fc226a7d7..8e44dcd24f1 100644 +--- a/source4/auth/session.c ++++ b/source4/auth/session.c +@@ -295,7 +295,7 @@ struct auth_session_info *auth_session_info_from_transport(TALLOC_CTX *mem_ctx, + /* This credential handle isn't useful for password + * authentication, so ensure nobody tries to do that */ + cli_credentials_set_kerberos_state(creds, +- CRED_MUST_USE_KERBEROS); ++ CRED_USE_KERBEROS_REQUIRED); + + } + #endif +diff --git a/source4/lib/cmdline/popt_credentials.c b/source4/lib/cmdline/popt_credentials.c +index 5dd61f6339c..7d8963da99e 100644 +--- a/source4/lib/cmdline/popt_credentials.c ++++ b/source4/lib/cmdline/popt_credentials.c +@@ -120,8 +120,8 @@ static void popt_common_credentials_callback(poptContext con, + cli_credentials_set_kerberos_state( + popt_get_cmdline_credentials(), + use_kerberos +- ? CRED_MUST_USE_KERBEROS +- : CRED_DONT_USE_KERBEROS); ++ ? CRED_USE_KERBEROS_REQUIRED ++ : CRED_USE_KERBEROS_DISABLED); + break; + } + +diff --git a/source4/torture/ldap/session_expiry.c b/source4/torture/ldap/session_expiry.c +index 35dda439b17..e5e38450745 100644 +--- a/source4/torture/ldap/session_expiry.c ++++ b/source4/torture/ldap/session_expiry.c +@@ -55,7 +55,7 @@ bool torture_ldap_session_expiry(struct torture_context *torture) + torture, url!=NULL, ret, fail, "talloc_asprintf failed"); + + cli_credentials_set_kerberos_state( +- credentials, CRED_MUST_USE_KERBEROS); ++ credentials, CRED_USE_KERBEROS_REQUIRED); + + ok = lpcfg_set_option( + torture->lp_ctx, "gensec_gssapi:requested_life_time=4"); +diff --git a/source4/torture/raw/session.c b/source4/torture/raw/session.c +index 0c460ae3069..e246d25e9fb 100644 +--- a/source4/torture/raw/session.c ++++ b/source4/torture/raw/session.c +@@ -245,12 +245,12 @@ static bool test_session_expire1(struct torture_context *tctx) + + use_kerberos = cli_credentials_get_kerberos_state( + popt_get_cmdline_credentials()); +- if (use_kerberos != CRED_MUST_USE_KERBEROS) { ++ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { + torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); + torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); + } + +- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, ++ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, + "please use -k yes"); + + lpcfg_set_option(tctx->lp_ctx, "gensec_gssapi:requested_life_time=4"); +diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c +index fff0b1aacbd..a5755041040 100644 +--- a/source4/torture/rpc/schannel.c ++++ b/source4/torture/rpc/schannel.c +@@ -965,8 +965,8 @@ bool torture_rpc_schannel_bench1(struct torture_context *torture) + torture_assert(torture, s->join_ctx2 != NULL, + "Failed to join domain with acct_flags=ACB_WSTRUST"); + +- cli_credentials_set_kerberos_state(s->wks_creds1, CRED_DONT_USE_KERBEROS); +- cli_credentials_set_kerberos_state(s->wks_creds2, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(s->wks_creds1, CRED_USE_KERBEROS_DISABLED); ++ cli_credentials_set_kerberos_state(s->wks_creds2, CRED_USE_KERBEROS_DISABLED); + + for (i=0; i < s->nprocs; i++) { + struct cli_credentials *wks = s->wks_creds1; +diff --git a/source4/torture/smb2/session.c b/source4/torture/smb2/session.c +index 07c6faebb15..701dfc10a07 100644 +--- a/source4/torture/smb2/session.c ++++ b/source4/torture/smb2/session.c +@@ -956,7 +956,7 @@ bool test_session_reauth6(struct torture_context *tctx, struct smb2_tree *tree) + + krb_state = cli_credentials_get_kerberos_state( + popt_get_cmdline_credentials()); +- if (krb_state == CRED_MUST_USE_KERBEROS) { ++ if (krb_state == CRED_USE_KERBEROS_REQUIRED) { + torture_skip(tctx, + "Can't test failing session setup with kerberos."); + } +@@ -1064,12 +1064,12 @@ static bool test_session_expire1i(struct torture_context *tctx, + size_t i; + + use_kerberos = cli_credentials_get_kerberos_state(credentials); +- if (use_kerberos != CRED_MUST_USE_KERBEROS) { ++ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { + torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); + torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); + } + +- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, ++ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, + "please use -k yes"); + + cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED); +@@ -1250,12 +1250,12 @@ static bool test_session_expire2i(struct torture_context *tctx, + struct smb2_notify ntf2; + + use_kerberos = cli_credentials_get_kerberos_state(credentials); +- if (use_kerberos != CRED_MUST_USE_KERBEROS) { ++ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { + torture_warning(tctx, "smb2.session.expire2 requires -k yes!"); + torture_skip(tctx, "smb2.session.expire2 requires -k yes!"); + } + +- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, ++ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, + "please use -k yes"); + + cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED); +@@ -1612,7 +1612,7 @@ static bool test_session_expire_disconnect(struct torture_context *tctx) + bool connected; + + use_kerberos = cli_credentials_get_kerberos_state(credentials); +- if (use_kerberos != CRED_MUST_USE_KERBEROS) { ++ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { + torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); + torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); + } +-- +2.28.0 + + +From 6a356a6e79fa76de18a4ca0760ac4f053d70137f Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 1 Sep 2020 12:32:28 +0200 +Subject: [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 1a92994a9513f5e73d30604a1dc217ddeb1ac8d5) +--- + auth/credentials/tests/test_creds.c | 221 ++++++++++++++++++++++++++++ + auth/credentials/wscript_build | 6 + + selftest/tests.py | 2 + + source4/torture/local/local.c | 1 - + source4/torture/local/wscript_build | 2 +- + 5 files changed, 230 insertions(+), 2 deletions(-) + create mode 100644 auth/credentials/tests/test_creds.c + +diff --git a/auth/credentials/tests/test_creds.c b/auth/credentials/tests/test_creds.c +new file mode 100644 +index 00000000000..d2d3d30d73d +--- /dev/null ++++ b/auth/credentials/tests/test_creds.c +@@ -0,0 +1,221 @@ ++/* ++ * Unix SMB/CIFS implementation. ++ * ++ * Copyright (C) 2018-2019 Andreas Schneider ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include "lib/replace/replace.h" ++#include "auth/credentials/credentials.c" ++ ++static int setup_talloc_context(void **state) ++{ ++ TALLOC_CTX *frame = talloc_stackframe(); ++ ++ *state = frame; ++ return 0; ++} ++ ++static int teardown_talloc_context(void **state) ++{ ++ TALLOC_CTX *frame = *state; ++ TALLOC_FREE(frame); ++ return 0; ++} ++ ++static void torture_creds_init(void **state) ++{ ++ TALLOC_CTX *mem_ctx = *state; ++ struct cli_credentials *creds = NULL; ++ const char *username = NULL; ++ const char *domain = NULL; ++ const char *password = NULL; ++ bool ok; ++ ++ creds = cli_credentials_init(mem_ctx); ++ assert_non_null(creds); ++ assert_null(creds->username); ++ assert_int_equal(creds->username_obtained, CRED_UNINITIALISED); ++ ++ domain = cli_credentials_get_domain(creds); ++ assert_null(domain); ++ ok = cli_credentials_set_domain(creds, "WURST", CRED_SPECIFIED); ++ assert_true(ok); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ domain = cli_credentials_get_domain(creds); ++ assert_string_equal(domain, "WURST"); ++ ++ username = cli_credentials_get_username(creds); ++ assert_null(username); ++ ok = cli_credentials_set_username(creds, "brot", CRED_SPECIFIED); ++ assert_true(ok); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ username = cli_credentials_get_username(creds); ++ assert_string_equal(username, "brot"); ++ ++ password = cli_credentials_get_password(creds); ++ assert_null(password); ++ ok = cli_credentials_set_password(creds, "SECRET", CRED_SPECIFIED); ++ assert_true(ok); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++ password = cli_credentials_get_password(creds); ++ assert_string_equal(password, "SECRET"); ++} ++ ++static void torture_creds_init_anonymous(void **state) ++{ ++ TALLOC_CTX *mem_ctx = *state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = cli_credentials_init_anon(mem_ctx); ++ assert_non_null(creds); ++ ++ assert_string_equal(creds->domain, ""); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->username, ""); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_null(creds->password); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++} ++ ++static void torture_creds_guess(void **state) ++{ ++ TALLOC_CTX *mem_ctx = *state; ++ struct cli_credentials *creds = NULL; ++ const char *env_user = getenv("USER"); ++ ++ creds = cli_credentials_init(mem_ctx); ++ assert_non_null(creds); ++ ++ setenv("PASSWD", "SECRET", 1); ++ cli_credentials_guess(creds, NULL); ++ ++ assert_string_equal(creds->username, env_user); ++ assert_int_equal(creds->username_obtained, CRED_GUESS_ENV); ++ ++ assert_string_equal(creds->password, "SECRET"); ++ assert_int_equal(creds->password_obtained, CRED_GUESS_ENV); ++ unsetenv("PASSWD"); ++} ++ ++static void torture_creds_anon_guess(void **state) ++{ ++ TALLOC_CTX *mem_ctx = *state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = cli_credentials_init_anon(mem_ctx); ++ assert_non_null(creds); ++ ++ setenv("PASSWD", "SECRET", 1); ++ cli_credentials_guess(creds, NULL); ++ ++ assert_string_equal(creds->username, ""); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_null(creds->password); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++ unsetenv("PASSWD"); ++} ++ ++static void torture_creds_parse_string(void **state) ++{ ++ TALLOC_CTX *mem_ctx = *state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = cli_credentials_init(mem_ctx); ++ assert_non_null(creds); ++ ++ /* Anonymous */ ++ cli_credentials_parse_string(creds, "%", CRED_SPECIFIED); ++ ++ assert_string_equal(creds->domain, ""); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->username, ""); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_null(creds->password); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++ ++ /* Username + password */ ++ cli_credentials_parse_string(creds, "wurst%BROT", CRED_SPECIFIED); ++ ++ assert_string_equal(creds->domain, ""); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->username, "wurst"); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->password, "BROT"); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++ ++ /* Domain + username + password */ ++ cli_credentials_parse_string(creds, "XXL\\wurst%BROT", CRED_SPECIFIED); ++ ++ assert_string_equal(creds->domain, "XXL"); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->username, "wurst"); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->password, "BROT"); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++ ++ /* Principal */ ++ cli_credentials_parse_string(creds, "wurst@brot.realm", CRED_SPECIFIED); ++ ++ assert_string_equal(creds->domain, ""); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->username, "wurst@brot.realm"); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->principal, "wurst@brot.realm"); ++ assert_int_equal(creds->principal_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->password, "BROT"); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++} ++ ++int main(int argc, char *argv[]) ++{ ++ int rc; ++ const struct CMUnitTest tests[] = { ++ cmocka_unit_test(torture_creds_init), ++ cmocka_unit_test(torture_creds_init_anonymous), ++ cmocka_unit_test(torture_creds_guess), ++ cmocka_unit_test(torture_creds_anon_guess), ++ cmocka_unit_test(torture_creds_parse_string), ++ }; ++ ++ if (argc == 2) { ++ cmocka_set_test_filter(argv[1]); ++ } ++ cmocka_set_message_output(CM_OUTPUT_SUBUNIT); ++ ++ rc = cmocka_run_group_tests(tests, ++ setup_talloc_context, ++ teardown_talloc_context); ++ ++ return rc; ++} +diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build +index ad16b7d8008..46111164b36 100644 +--- a/auth/credentials/wscript_build ++++ b/auth/credentials/wscript_build +@@ -31,3 +31,9 @@ bld.SAMBA_PYTHON('pycredentials', + public_deps='samba-credentials cmdline-credentials %s %s CREDENTIALS_KRB5 CREDENTIALS_SECRETS' % (pytalloc_util, pyparam_util), + realname='samba/credentials.so' + ) ++ ++bld.SAMBA_BINARY('test_creds', ++ source='tests/test_creds.c', ++ deps='cmocka samba-credentials', ++ local_include=False, ++ for_selftest=True) +diff --git a/selftest/tests.py b/selftest/tests.py +index 86cab3f8046..4a968cdbe8a 100644 +--- a/selftest/tests.py ++++ b/selftest/tests.py +@@ -418,3 +418,5 @@ plantestsuite("samba.unittests.test_oLschema2ldif", "none", + if with_elasticsearch_backend: + plantestsuite("samba.unittests.mdsparser_es", "none", + [os.path.join(bindir(), "default/source3/test_mdsparser_es")] + [configuration]) ++plantestsuite("samba.unittests.credentials", "none", ++ [os.path.join(bindir(), "default/auth/credentials/test_creds")]) +diff --git a/source4/torture/local/local.c b/source4/torture/local/local.c +index a3186788524..d19b55e9502 100644 +--- a/source4/torture/local/local.c ++++ b/source4/torture/local/local.c +@@ -70,7 +70,6 @@ + torture_local_tevent_req, + torture_local_torture, + torture_local_dbspeed, +- torture_local_credentials, + torture_ldb, + torture_dsdb_dn, + torture_dsdb_syntax, +diff --git a/source4/torture/local/wscript_build b/source4/torture/local/wscript_build +index 38b6c8f4b6e..f0ab0357986 100644 +--- a/source4/torture/local/wscript_build ++++ b/source4/torture/local/wscript_build +@@ -16,7 +16,7 @@ TORTURE_LOCAL_SOURCE = '''../../../lib/util/charset/tests/iconv.c + ../../libcli/security/tests/sddl.c ../../../lib/tdr/testsuite.c + ../../../lib/tevent/testsuite.c ../../param/tests/share.c + ../../../lib/tevent/test_req.c +- ../../param/tests/loadparm.c ../../../auth/credentials/tests/simple.c local.c ++ ../../param/tests/loadparm.c local.c + dbspeed.c torture.c ../ldb/ldb.c ../../dsdb/common/tests/dsdb_dn.c + ../../dsdb/schema/tests/schema_syntax.c + ../../../lib/util/tests/anonymous_shared.c +-- +2.28.0 + + +From f6a4f70007e5c5ad1df3ddb018bde8568fc63f57 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Deschner?= +Date: Mon, 2 Nov 2020 16:10:44 +0100 +Subject: [PATCH 088/105] s3-vfs_glusterfs: always disable write-behind + translator + +The "pass-through" option has now been merged upstream as of: +https://github.com/gluster/glusterfs/pull/1640 + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 + +Guenther + +Signed-off-by: Guenther Deschner +Pair-Programmed-With: Anoop C S +Pair-Programmed-With: Sachin Prabhu +Reviewed-by: Jeremy Allison + +Autobuild-User(master): Jeremy Allison +Autobuild-Date(master): Wed Nov 4 22:53:49 UTC 2020 on sn-devel-184 + +(cherry picked from commit a51cda69ec6a017ad04b5690a3ae67a5478deee9) + +Autobuild-User(v4-13-test): Karolin Seeger +Autobuild-Date(v4-13-test): Thu Nov 5 13:54:25 UTC 2020 on sn-devel-184 +--- + source3/modules/vfs_glusterfs.c | 20 +++++++++++++++++--- + source3/wscript | 3 +++ + 2 files changed, 20 insertions(+), 3 deletions(-) + +diff --git a/source3/modules/vfs_glusterfs.c b/source3/modules/vfs_glusterfs.c +index 3cbb1ab6cb6..bdfe35ced82 100644 +--- a/source3/modules/vfs_glusterfs.c ++++ b/source3/modules/vfs_glusterfs.c +@@ -363,6 +363,7 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, + glfs_t *fs = NULL; + TALLOC_CTX *tmp_ctx; + int ret = 0; ++ bool write_behind_pass_through_set = false; + + tmp_ctx = talloc_new(NULL); + if (tmp_ctx == NULL) { +@@ -435,6 +436,17 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, + goto done; + } + ++#ifdef HAVE_GFAPI_VER_7_9 ++ ret = glfs_set_xlator_option(fs, "*-write-behind", "pass-through", ++ "true"); ++ if (ret < 0) { ++ DBG_ERR("%s: Failed to set xlator option: pass-through\n", ++ volume); ++ goto done; ++ } ++ write_behind_pass_through_set = true; ++#endif ++ + ret = glfs_set_logging(fs, logfile, loglevel); + if (ret < 0) { + DEBUG(0, ("%s: Failed to set logfile %s loglevel %d\n", +@@ -449,9 +461,11 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, + goto done; + } + +- ret = check_for_write_behind_translator(tmp_ctx, fs, volume); +- if (ret < 0) { +- goto done; ++ if (!write_behind_pass_through_set) { ++ ret = check_for_write_behind_translator(tmp_ctx, fs, volume); ++ if (ret < 0) { ++ goto done; ++ } + } + + ret = glfs_set_preopened(volume, handle->conn->connectpath, fs); +diff --git a/source3/wscript b/source3/wscript +index 335cfd797f1..9920432a360 100644 +--- a/source3/wscript ++++ b/source3/wscript +@@ -1766,6 +1766,9 @@ main() { + conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.6" --cflags --libs', + msg='Checking for glusterfs-api >= 7.6', + uselib_store="GFAPI_VER_7_6") ++ conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.9" --cflags --libs', ++ msg='Checking for glusterfs-api >= 7.9', ++ uselib_store="GFAPI_VER_7_9") + else: + conf.SET_TARGET_TYPE('gfapi', 'EMPTY') + conf.undefine('HAVE_GLUSTERFS') +-- +2.28.0 + + +From 0d6268ff0a055e8fb418da761eeb820a8e11e2ad Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:09:05 +0200 +Subject: [PATCH 089/105] Add smb2cli_session_get_encryption_cipher() + +When 'session->smb2->should_encrypt' is true, the client MUST encrypt +all transport messages (see also MS-SMB2 3.2.4.1.8). + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit f0f8de9d4a4e05445e427f00bb10eb34e1110a97) +--- + libcli/smb/smbXcli_base.c | 13 +++++++++++++ + libcli/smb/smbXcli_base.h | 1 + + 2 files changed, 14 insertions(+) + +diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c +index 7d2da4b9ebc..471319a32f1 100644 +--- a/libcli/smb/smbXcli_base.c ++++ b/libcli/smb/smbXcli_base.c +@@ -6436,6 +6436,19 @@ NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session) + return NT_STATUS_OK; + } + ++uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session) ++{ ++ if (session->conn->protocol < PROTOCOL_SMB2_24) { ++ return 0; ++ } ++ ++ if (!session->smb2->should_encrypt) { ++ return 0; ++ } ++ ++ return session->conn->smb2.server.cipher; ++} ++ + struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx) + { + struct smbXcli_tcon *tcon; +diff --git a/libcli/smb/smbXcli_base.h b/libcli/smb/smbXcli_base.h +index 2afc7165cd9..db5f5d58799 100644 +--- a/libcli/smb/smbXcli_base.h ++++ b/libcli/smb/smbXcli_base.h +@@ -518,6 +518,7 @@ NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session, + const DATA_BLOB channel_key, + const struct iovec *recv_iov); + NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session); ++uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session); + + struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx); + struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx, +-- +2.28.0 + + +From 3f77e6cb6220d50b75ceb197e26813e9e5244cc0 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:18:21 +0200 +Subject: [PATCH 090/105] Add dcerpc_transport_encrypted() + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 339bfcd67af2675d10287946d8f5dabba1022d57) +--- + source4/librpc/rpc/dcerpc.h | 2 ++ + source4/librpc/rpc/dcerpc_smb.c | 11 +++++++++++ + source4/librpc/rpc/dcerpc_util.c | 13 +++++++++++++ + 3 files changed, 26 insertions(+) + +diff --git a/source4/librpc/rpc/dcerpc.h b/source4/librpc/rpc/dcerpc.h +index 6b0b841d64d..57124f10778 100644 +--- a/source4/librpc/rpc/dcerpc.h ++++ b/source4/librpc/rpc/dcerpc.h +@@ -87,6 +87,7 @@ struct dcecli_connection { + struct dcerpc_transport { + enum dcerpc_transport_t transport; + void *private_data; ++ bool encrypted; + + struct tstream_context *stream; + /** to serialize write events */ +@@ -181,6 +182,7 @@ NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p, + const struct ndr_interface_table *table); + NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p, + DATA_BLOB *session_key); ++bool dcerpc_transport_encrypted(struct dcerpc_pipe *p); + struct composite_context; + NTSTATUS dcerpc_secondary_connection_recv(struct composite_context *c, + struct dcerpc_pipe **p2); +diff --git a/source4/librpc/rpc/dcerpc_smb.c b/source4/librpc/rpc/dcerpc_smb.c +index b20b154a1cb..101ed64f0cd 100644 +--- a/source4/librpc/rpc/dcerpc_smb.c ++++ b/source4/librpc/rpc/dcerpc_smb.c +@@ -145,6 +145,7 @@ static void dcerpc_pipe_open_smb_done(struct tevent_req *subreq) + struct dcerpc_pipe_open_smb_state); + struct composite_context *ctx = state->ctx; + struct dcecli_connection *c = state->c; ++ uint16_t enc_cipher; + + ctx->status = tstream_smbXcli_np_open_recv(subreq, + state->smb, +@@ -173,6 +174,16 @@ static void dcerpc_pipe_open_smb_done(struct tevent_req *subreq) + /* Over-ride the default session key with the SMB session key */ + c->security_state.session_key = smb_session_key; + ++ enc_cipher = smb2cli_session_get_encryption_cipher(state->smb->session); ++ switch (enc_cipher) { ++ case SMB2_ENCRYPTION_AES128_CCM: ++ case SMB2_ENCRYPTION_AES128_GCM: ++ c->transport.encrypted = true; ++ break; ++ default: ++ c->transport.encrypted = false; ++ } ++ + c->transport.private_data = talloc_move(c, &state->smb); + + composite_done(ctx); +diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c +index bd79a072bc8..6ea27a8d9a3 100644 +--- a/source4/librpc/rpc/dcerpc_util.c ++++ b/source4/librpc/rpc/dcerpc_util.c +@@ -743,6 +743,19 @@ _PUBLIC_ NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p, + return NT_STATUS_OK; + } + ++_PUBLIC_ bool dcerpc_transport_encrypted(struct dcerpc_pipe *p) ++{ ++ if (p == NULL) { ++ return false; ++ } ++ ++ if (p->conn == NULL) { ++ return false; ++ } ++ ++ return p->conn->transport.encrypted; ++} ++ + /* + create a secondary context from a primary connection + +-- +2.28.0 + + +From 4045c677a3ea3c44e5509025c1c7d03936ba9d82 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:35:01 +0200 +Subject: [PATCH 091/105] Add py binding for dcerpc_transport_encrypted + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit eba91f0dfa8e3267689b4076302e257f4cecd63b) +--- + source4/librpc/rpc/pyrpc.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/source4/librpc/rpc/pyrpc.c b/source4/librpc/rpc/pyrpc.c +index be914ed5f14..309a6d72e26 100644 +--- a/source4/librpc/rpc/pyrpc.c ++++ b/source4/librpc/rpc/pyrpc.c +@@ -293,11 +293,25 @@ static PyObject *py_iface_request(PyObject *self, PyObject *args, PyObject *kwar + return ret; + } + ++static PyObject *py_iface_transport_encrypted(PyObject *self) ++{ ++ dcerpc_InterfaceObject *iface = (dcerpc_InterfaceObject *)self; ++ ++ if (dcerpc_transport_encrypted(iface->pipe)) { ++ Py_RETURN_TRUE; ++ } ++ ++ Py_RETURN_FALSE; ++} ++ + static PyMethodDef dcerpc_interface_methods[] = { + { "request", PY_DISCARD_FUNC_SIG(PyCFunction, py_iface_request), + METH_VARARGS|METH_KEYWORDS, + "S.request(opnum, data, object=None) -> data\n" + "Make a raw request" }, ++ { "transport_encrypted", PY_DISCARD_FUNC_SIG(PyCFunction, py_iface_transport_encrypted), ++ METH_NOARGS, ++ "Check if the DCE transport is encrypted" }, + { NULL, NULL, 0, NULL }, + }; + +-- +2.28.0 + + +From 07a87eaff7e2e18c2d462f4caff95cace92a0130 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:44:08 +0200 +Subject: [PATCH 092/105] selftest: add a test for py dce transport_encrypted + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit a77551bea969ce73a3dc27384d94b4126bef04f7) +--- + python/samba/tests/dcerpc/binding.py | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/python/samba/tests/dcerpc/binding.py b/python/samba/tests/dcerpc/binding.py +index 8e0d6a5ef0a..24e4ac77d89 100644 +--- a/python/samba/tests/dcerpc/binding.py ++++ b/python/samba/tests/dcerpc/binding.py +@@ -22,7 +22,7 @@ import samba.tests + from samba.tests import RpcInterfaceTestCase, TestCase + from samba.dcerpc import lsa + import samba.dcerpc.security as security +-from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED ++from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED, SMB_ENCRYPTION_OFF + from samba import NTSTATUSError + + class RpcBindingTests(RpcInterfaceTestCase): +@@ -40,6 +40,26 @@ class RpcBindingTests(RpcInterfaceTestCase): + c.set_password(password) + return c + ++ def test_smb3_dcerpc_no_encryption(self): ++ creds = self.get_user_creds() ++ creds.set_smb_encryption(SMB_ENCRYPTION_OFF) ++ ++ lp = self.get_loadparm() ++ lp.set('client ipc max protocol', 'SMB3') ++ lp.set('client ipc min protocol', 'SMB3') ++ ++ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) ++ lsa_conn = lsa.lsarpc(binding_string, lp, creds) ++ self.assertFalse(lsa_conn.transport_encrypted()) ++ ++ objectAttr = lsa.ObjectAttribute() ++ objectAttr.sec_qos = lsa.QosInfo() ++ ++ pol_handle = lsa_conn.OpenPolicy2('', ++ objectAttr, ++ security.SEC_FLAG_MAXIMUM_ALLOWED) ++ self.assertIsNotNone(pol_handle) ++ + def test_smb3_dcerpc_encryption(self): + creds = self.get_user_creds() + creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) +@@ -50,6 +70,7 @@ class RpcBindingTests(RpcInterfaceTestCase): + + binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) + lsa_conn = lsa.lsarpc(binding_string, lp, creds) ++ self.assertTrue(lsa_conn.transport_encrypted()) + + objectAttr = lsa.ObjectAttribute() + objectAttr.sec_qos = lsa.QosInfo() +-- +2.28.0 + + +From 1c74d87e4dfe78d6e884c9bb4e57ec383d632a88 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:47:12 +0200 +Subject: [PATCH 093/105] Add CreateTrustedDomainRelax wrapper for fips mode + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit c2644032b49b4160517a7c73634cebc54a76f827) +--- + python/samba/trust_utils.py | 62 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 62 insertions(+) + create mode 100644 python/samba/trust_utils.py + +diff --git a/python/samba/trust_utils.py b/python/samba/trust_utils.py +new file mode 100644 +index 00000000000..b4df0fa5bb8 +--- /dev/null ++++ b/python/samba/trust_utils.py +@@ -0,0 +1,62 @@ ++# trust utils ++# ++# Copyright Isaac Boukris 2020 ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++ ++ ++from samba.dcerpc import lsa, drsblobs ++from samba.ndr import ndr_pack ++from samba import arcfour_encrypt, string_to_byte_array ++import random ++from samba import crypto ++ ++def CreateTrustedDomainRelax(lsaconn, policy, trust_info, mask, in_blob, out_blob): ++ ++ def generate_AuthInfoInternal(session_key, incoming=None, outgoing=None): ++ confounder = [0] * 512 ++ for i in range(len(confounder)): ++ confounder[i] = random.randint(0, 255) ++ ++ trustpass = drsblobs.trustDomainPasswords() ++ ++ trustpass.confounder = confounder ++ trustpass.outgoing = outgoing ++ trustpass.incoming = incoming ++ ++ trustpass_blob = ndr_pack(trustpass) ++ ++ encrypted_trustpass = arcfour_encrypt(session_key, trustpass_blob) ++ ++ auth_blob = lsa.DATA_BUF2() ++ auth_blob.size = len(encrypted_trustpass) ++ auth_blob.data = string_to_byte_array(encrypted_trustpass) ++ ++ auth_info = lsa.TrustDomainInfoAuthInfoInternal() ++ auth_info.auth_blob = auth_blob ++ ++ return auth_info ++ ++ session_key = lsaconn.session_key ++ ++ try: ++ if lsaconn.transport_encrypted(): ++ crypto.set_relax_mode() ++ auth_info = generate_AuthInfoInternal(session_key, ++ incoming=in_blob, ++ outgoing=out_blob) ++ finally: ++ crypto.set_strict_mode() ++ ++ return lsaconn.CreateTrustedDomainEx2(policy, trust_info, auth_info, mask) +-- +2.28.0 + + +From 067c8d73800b928b02bcb1095c13083d9e0e368d Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:49:17 +0200 +Subject: [PATCH 094/105] Use the new CreateTrustedDomainRelax() + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit baf4e2930ee13b47c23c63c7e945fdc4444f0c69) +--- + python/samba/netcmd/domain.py | 57 ++++++++--------------------------- + 1 file changed, 13 insertions(+), 44 deletions(-) + +diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py +index 1d12c362911..93a3258d28d 100644 +--- a/python/samba/netcmd/domain.py ++++ b/python/samba/netcmd/domain.py +@@ -102,6 +102,7 @@ from samba.netcmd.domain_backup import cmd_domain_backup + + from samba.compat import binary_type + from samba.compat import get_string ++from samba.trust_utils import CreateTrustedDomainRelax + + string_version_to_constant = { + "2008_R2": DS_DOMAIN_FUNCTION_2008_R2, +@@ -2528,54 +2529,20 @@ class cmd_domain_trust_create(DomainTrustCommand): + + return blob + +- def generate_AuthInfoInternal(session_key, incoming=None, outgoing=None): +- confounder = [0] * 512 +- for i in range(len(confounder)): +- confounder[i] = random.randint(0, 255) +- +- trustpass = drsblobs.trustDomainPasswords() +- +- trustpass.confounder = confounder +- trustpass.outgoing = outgoing +- trustpass.incoming = incoming +- +- trustpass_blob = ndr_pack(trustpass) +- +- encrypted_trustpass = arcfour_encrypt(session_key, trustpass_blob) +- +- auth_blob = lsa.DATA_BUF2() +- auth_blob.size = len(encrypted_trustpass) +- auth_blob.data = string_to_byte_array(encrypted_trustpass) +- +- auth_info = lsa.TrustDomainInfoAuthInfoInternal() +- auth_info.auth_blob = auth_blob +- +- return auth_info +- + update_time = samba.current_unix_time() + incoming_blob = generate_AuthInOutBlob(incoming_secret, update_time) + outgoing_blob = generate_AuthInOutBlob(outgoing_secret, update_time) + +- local_tdo_handle = None +- remote_tdo_handle = None +- +- local_auth_info = generate_AuthInfoInternal(local_lsa.session_key, +- incoming=incoming_blob, +- outgoing=outgoing_blob) +- if remote_trust_info: +- remote_auth_info = generate_AuthInfoInternal(remote_lsa.session_key, +- incoming=outgoing_blob, +- outgoing=incoming_blob) +- + try: + if remote_trust_info: + self.outf.write("Creating remote TDO.\n") + current_request = {"location": "remote", "name": "CreateTrustedDomainEx2"} +- remote_tdo_handle = \ +- remote_lsa.CreateTrustedDomainEx2(remote_policy, +- remote_trust_info, +- remote_auth_info, +- lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS) ++ remote_tdo_handle = CreateTrustedDomainRelax(remote_lsa, ++ remote_policy, ++ remote_trust_info, ++ lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS, ++ outgoing_blob, ++ incoming_blob) + self.outf.write("Remote TDO created.\n") + if enc_types: + self.outf.write("Setting supported encryption types on remote TDO.\n") +@@ -2586,10 +2553,12 @@ class cmd_domain_trust_create(DomainTrustCommand): + + self.outf.write("Creating local TDO.\n") + current_request = {"location": "local", "name": "CreateTrustedDomainEx2"} +- local_tdo_handle = local_lsa.CreateTrustedDomainEx2(local_policy, +- local_trust_info, +- local_auth_info, +- lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS) ++ local_tdo_handle = CreateTrustedDomainRelax(local_lsa, ++ local_policy, ++ local_trust_info, ++ lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS, ++ incoming_blob, ++ outgoing_blob) + self.outf.write("Local TDO created\n") + if enc_types: + self.outf.write("Setting supported encryption types on local TDO.\n") +-- +2.28.0 + + +From 72dfcc923d0cf8054cb0f011e8405fa96b9ec6e0 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Tue, 1 Sep 2020 20:14:29 +0300 +Subject: [PATCH 095/105] selftest: add a test for the CreateTrustedDomainRelax + wrapper + +Originally copied from 'source4/scripting/devel/createtrust' +(had to drop the TRUST_AUTH_TYPE_VERSION part though, as it +fails against samba DC). + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit cfaad16ff632df83a881fe5d8ec498bab102c9c9) +--- + python/samba/tests/dcerpc/createtrustrelax.py | 131 ++++++++++++++++++ + selftest/knownfail.d/createtrustrelax_server | 1 + + source4/selftest/tests.py | 4 + + 3 files changed, 136 insertions(+) + create mode 100644 python/samba/tests/dcerpc/createtrustrelax.py + create mode 100644 selftest/knownfail.d/createtrustrelax_server + +diff --git a/python/samba/tests/dcerpc/createtrustrelax.py b/python/samba/tests/dcerpc/createtrustrelax.py +new file mode 100644 +index 00000000000..48beb0f9680 +--- /dev/null ++++ b/python/samba/tests/dcerpc/createtrustrelax.py +@@ -0,0 +1,131 @@ ++# Unix SMB/CIFS implementation. ++# ++# Copyright (C) Andrew Bartlett 2011 ++# Copyright (C) Isaac Boukris 2020 ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++"""Tests for the CreateTrustedDomainRelax wrapper""" ++ ++import os ++import samba ++from samba.tests import TestCase ++from samba.dcerpc import lsa, security, drsblobs ++from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED, SMB_ENCRYPTION_OFF ++from samba.trust_utils import CreateTrustedDomainRelax ++ ++class CreateTrustedDomainRelaxTest(TestCase): ++ def setUp(self): ++ super(CreateTrustedDomainRelaxTest, self).setUp() ++ ++ def get_user_creds(self): ++ c = Credentials() ++ c.guess() ++ domain = samba.tests.env_get_var_value('DOMAIN') ++ username = samba.tests.env_get_var_value('USERNAME') ++ password = samba.tests.env_get_var_value('PASSWORD') ++ c.set_domain(domain) ++ c.set_username(username) ++ c.set_password(password) ++ return c ++ ++ def _create_trust_relax(self, smbencrypt=True): ++ creds = self.get_user_creds() ++ ++ if smbencrypt: ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ else: ++ creds.set_smb_encryption(SMB_ENCRYPTION_OFF) ++ ++ lp = self.get_loadparm() ++ ++ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) ++ lsa_conn = lsa.lsarpc(binding_string, lp, creds) ++ ++ if smbencrypt: ++ self.assertTrue(lsa_conn.transport_encrypted()) ++ else: ++ self.assertFalse(lsa_conn.transport_encrypted()) ++ ++ objectAttr = lsa.ObjectAttribute() ++ objectAttr.sec_qos = lsa.QosInfo() ++ ++ pol_handle = lsa_conn.OpenPolicy2('', ++ objectAttr, ++ security.SEC_FLAG_MAXIMUM_ALLOWED) ++ self.assertIsNotNone(pol_handle) ++ ++ name = lsa.String() ++ name.string = "tests.samba.example.com" ++ try: ++ info = lsa_conn.QueryTrustedDomainInfoByName(pol_handle, name, ++ lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO) ++ ++ lsa_conn.DeleteTrustedDomain(pol_handle, info.info_ex.sid) ++ except RuntimeError: ++ pass ++ ++ info = lsa.TrustDomainInfoInfoEx() ++ info.domain_name.string = name.string ++ info.netbios_name.string = "createtrustrelax" ++ info.sid = security.dom_sid("S-1-5-21-538490383-3740119673-95748416") ++ info.trust_direction = lsa.LSA_TRUST_DIRECTION_INBOUND | lsa.LSA_TRUST_DIRECTION_OUTBOUND ++ info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL ++ info.trust_attributes = lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE ++ ++ password_blob = samba.string_to_byte_array("password".encode('utf-16-le')) ++ ++ clear_value = drsblobs.AuthInfoClear() ++ clear_value.size = len(password_blob) ++ clear_value.password = password_blob ++ ++ clear_authentication_information = drsblobs.AuthenticationInformation() ++ clear_authentication_information.LastUpdateTime = 0 ++ clear_authentication_information.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR ++ clear_authentication_information.AuthInfo = clear_value ++ ++ authentication_information_array = drsblobs.AuthenticationInformationArray() ++ authentication_information_array.count = 1 ++ authentication_information_array.array = [clear_authentication_information] ++ ++ outgoing = drsblobs.trustAuthInOutBlob() ++ outgoing.count = 1 ++ outgoing.current = authentication_information_array ++ ++ trustdom_handle = None ++ try: ++ trustdom_handle = CreateTrustedDomainRelax(lsa_conn, ++ pol_handle, ++ info, ++ security.SEC_STD_DELETE, ++ outgoing, ++ outgoing) ++ except samba.NTSTATUSError as nt: ++ raise AssertionError(nt) ++ except OSError as e: ++ if smbencrypt: ++ raise AssertionError(e) ++ ++ if smbencrypt: ++ self.assertIsNotNone(trustdom_handle) ++ lsa_conn.DeleteTrustedDomain(pol_handle, info.sid) ++ else: ++ self.assertIsNone(trustdom_handle) ++ ++ def test_create_trust_relax_encrypt(self): ++ self._create_trust_relax(True) ++ ++ def test_create_trust_relax_no_enc(self): ++ self._create_trust_relax(False) +diff --git a/selftest/knownfail.d/createtrustrelax_server b/selftest/knownfail.d/createtrustrelax_server +new file mode 100644 +index 00000000000..80effda8343 +--- /dev/null ++++ b/selftest/knownfail.d/createtrustrelax_server +@@ -0,0 +1 @@ ++^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) +diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py +index 3a903a7eee0..96f51b68cfc 100755 +--- a/source4/selftest/tests.py ++++ b/source4/selftest/tests.py +@@ -704,6 +704,10 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex + name = module + plantestsuite_loadlist(name, env, args) + ++if have_gnutls_crypto_policies: ++ planoldpythontestsuite("ad_dc", "samba.tests.dcerpc.createtrustrelax", environ={'GNUTLS_FORCE_FIPS_MODE':'1'}) ++ planoldpythontestsuite("ad_dc_fips", "samba.tests.dcerpc.createtrustrelax", environ={'GNUTLS_FORCE_FIPS_MODE':'1'}) ++ + # Run complex search expressions test once for each database backend. + # Right now ad_dc has mdb and ad_dc_ntvfs has tdb + mdb_testenv = "ad_dc" +-- +2.28.0 + + +From 341cc046bf816ad5818932c6c5d170a2a9a38783 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 5 Nov 2020 15:38:19 +0200 +Subject: [PATCH 096/105] Remove source4/scripting/devel/createtrust script + +We now have the 'samba-tool domain trust' command. + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Isaac Boukris +Autobuild-Date(master): Fri Nov 6 11:25:02 UTC 2020 on sn-devel-184 + +(cherry picked from commit 604153525afc892f57a1df710c41ffca275b0dd3) +--- + source4/scripting/devel/createtrust | 125 ---------------------------- + 1 file changed, 125 deletions(-) + delete mode 100755 source4/scripting/devel/createtrust + +diff --git a/source4/scripting/devel/createtrust b/source4/scripting/devel/createtrust +deleted file mode 100755 +index 26b0d0dcb68..00000000000 +--- a/source4/scripting/devel/createtrust ++++ /dev/null +@@ -1,125 +0,0 @@ +-#!/usr/bin/env python3 +- +-# create a domain trust +- +-import sys +-from optparse import OptionParser +- +-sys.path.insert(0, "bin/python") +- +-import samba +-import samba.getopt as options +-from samba.dcerpc import lsa, security, drsblobs +-from samba.ndr import ndr_pack +-from samba import arcfour_encrypt, string_to_byte_array +-import random +- +-########### main code ########### +-if __name__ == "__main__": +- parser = OptionParser("createtrust [options] server") +- sambaopts = options.SambaOptions(parser) +- credopts = options.CredentialsOptionsDouble(parser) +- parser.add_option_group(credopts) +- +- (opts, args) = parser.parse_args() +- +- lp = sambaopts.get_loadparm() +- creds = credopts.get_credentials(lp) +- +- if len(args) != 1: +- parser.error("You must supply a server") +- +- if not creds.authentication_requested(): +- parser.error("You must supply credentials") +- +- server = args[0] +- +- binding_str = "ncacn_np:%s[print]" % server +- +- lsaconn = lsa.lsarpc(binding_str, lp, creds) +- +- objectAttr = lsa.ObjectAttribute() +- objectAttr.sec_qos = lsa.QosInfo() +- +- pol_handle = lsaconn.OpenPolicy2(''.decode('utf-8'), +- objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED) +- +- name = lsa.String() +- name.string = "sub2.win2k3.obed.home.abartlet.net" +- try: +- info = lsaconn.QueryTrustedDomainInfoByName(pol_handle, name, lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO) +- +- lsaconn.DeleteTrustedDomain(pol_handle, info.info_ex.sid) +- except RuntimeError: +- pass +- +- info = lsa.TrustDomainInfoInfoEx() +- info.domain_name.string = "sub2.win2k3.obed.home.abartlet.net" +- info.netbios_name.string = "sub2" +- info.sid = security.dom_sid("S-1-5-21-538090388-3760119675-95745416") +- info.trust_direction = lsa.LSA_TRUST_DIRECTION_INBOUND | lsa.LSA_TRUST_DIRECTION_OUTBOUND +- info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL +- info.trust_attributes = lsa.LSA_TRUST_ATTRIBUTE_WITHIN_FOREST +- +- password_blob = string_to_byte_array("password".encode('utf-16-le')) +- +- clear_value = drsblobs.AuthInfoClear() +- clear_value.size = len(password_blob) +- clear_value.password = password_blob +- +- clear_authentication_information = drsblobs.AuthenticationInformation() +- clear_authentication_information.LastUpdateTime = 0 +- clear_authentication_information.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR +- clear_authentication_information.AuthInfo = clear_value +- +- version_value = drsblobs.AuthInfoVersion() +- version_value.version = 1 +- +- version = drsblobs.AuthenticationInformation() +- version.LastUpdateTime = 0 +- version.AuthType = lsa.TRUST_AUTH_TYPE_VERSION +- version.AuthInfo = version_value +- +- authentication_information_array = drsblobs.AuthenticationInformationArray() +- authentication_information_array.count = 2 +- authentication_information_array.array = [clear_authentication_information, version] +- +- outgoing = drsblobs.trustAuthInOutBlob() +- outgoing.count = 1 +- outgoing.current = authentication_information_array +- +- trustpass = drsblobs.trustDomainPasswords() +- confounder = [3] * 512 +- +- for i in range(512): +- confounder[i] = random.randint(0, 255) +- +- trustpass.confounder = confounder +- +-# print "confounder: ", trustpass.confounder +- +- trustpass.outgoing = outgoing +- trustpass.incoming = outgoing +- +- trustpass_blob = ndr_pack(trustpass) +- +-# print "trustpass_blob: ", list(trustpass_blob) +- +- encrypted_trustpass = arcfour_encrypt(lsaconn.session_key, trustpass_blob) +- +-# print "encrypted_trustpass: ", list(encrypted_trustpass) +- +- auth_blob = lsa.DATA_BUF2() +- auth_blob.size = len(encrypted_trustpass) +- auth_blob.data = string_to_byte_array(encrypted_trustpass) +- +- auth_info = lsa.TrustDomainInfoAuthInfoInternal() +- auth_info.auth_blob = auth_blob +- +- +-# print "auth_info.auth_blob.data: ", auth_info.auth_blob.data +- +- trustdom_handle = lsaconn.CreateTrustedDomainEx2(pol_handle, +- info, +- auth_info, +- security.SEC_STD_DELETE) +-- +2.28.0 + + +From f51b23a9b8ad22d4cd4d7dea3ed8f0150974a209 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 6 Nov 2020 14:30:26 +0100 +Subject: [PATCH 097/105] s3:rpc_server: Use gnutls_cipher_decrypt() in + get_trustdom_auth_blob() + +It doesn't matter for RC4, but just to be correct. + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 6c11e5f42ba3248c97d85c989d422b256d2465a9) +--- + source3/rpc_server/lsa/srv_lsa_nt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index 198387424e6..e749caf2551 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -1726,7 +1726,7 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, + goto out; + } + +- rc = gnutls_cipher_encrypt(cipher_hnd, ++ rc = gnutls_cipher_decrypt(cipher_hnd, + auth_blob->data, + auth_blob->length); + gnutls_cipher_deinit(cipher_hnd); +-- +2.28.0 + + +From 7b24fdcb4a797b1daa97750f8a2c4f2c603115f3 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 6 Nov 2020 14:33:38 +0100 +Subject: [PATCH 098/105] s4:rpc_server: Use gnutls_cipher_decrypt() in + get_trustdom_auth_blob() + +It doesn't matter for RC4, but just to be correct. + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit c93ccebdfedd60c1d19f1b1436ac30062259952a) +--- + source4/rpc_server/lsa/dcesrv_lsa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c +index 8333cb149b6..4bb8aaa9592 100644 +--- a/source4/rpc_server/lsa/dcesrv_lsa.c ++++ b/source4/rpc_server/lsa/dcesrv_lsa.c +@@ -889,7 +889,7 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, + goto out; + } + +- rc = gnutls_cipher_encrypt(cipher_hnd, ++ rc = gnutls_cipher_decrypt(cipher_hnd, + auth_blob->data, + auth_blob->length); + gnutls_cipher_deinit(cipher_hnd); +-- +2.28.0 + + +From acbb59f45cb2b4c35df678ba774425180e9cf8c6 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 20 Aug 2020 13:40:21 +0200 +Subject: [PATCH 099/105] s3:rpc_server: Allow to use RC4 for creating trusts + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 4425f2c113a4dc33a8dc609d84a92018d61b4d2e) +--- + source3/rpc_server/lsa/srv_lsa_nt.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index e749caf2551..d6d606ddeca 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -51,6 +51,8 @@ + #include "../libcli/lsarpc/util_lsarpc.h" + #include "lsa.h" + #include "librpc/rpc/dcesrv_core.h" ++#include "librpc/rpc/dcerpc_helper.h" ++#include "lib/param/loadparm.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -1706,6 +1708,14 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, + gnutls_datum_t my_session_key; + NTSTATUS status; + int rc; ++ bool encrypted; ++ ++ encrypted = ++ dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ return NT_STATUS_ACCESS_DENIED; ++ } + + status = session_extract_session_key(p->session_info, &lsession_key, KEY_USE_16BYTES); + if (!NT_STATUS_IS_OK(status)) { +@@ -1717,11 +1727,13 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, + .size = lsession_key.length, + }; + ++ GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &my_session_key, + NULL); + if (rc < 0) { ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } +@@ -1730,6 +1742,7 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, + auth_blob->data, + auth_blob->length); + gnutls_cipher_deinit(cipher_hnd); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; +-- +2.28.0 + + +From a4d0e69eb7a429a13e456cff7f96870e87791694 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 20 Aug 2020 13:51:39 +0200 +Subject: [PATCH 100/105] s4:rpc_server: Allow to use RC4 for creating trusts + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +Reviewed-by: Stefan Metzmacher +(cherry picked from commit c75dd1ea178325b8f65343cb5c35bb93f43a49a3) +--- + source4/rpc_server/lsa/dcesrv_lsa.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c +index 4bb8aaa9592..5b3ef71d458 100644 +--- a/source4/rpc_server/lsa/dcesrv_lsa.c ++++ b/source4/rpc_server/lsa/dcesrv_lsa.c +@@ -33,6 +33,8 @@ + #include "libcli/lsarpc/util_lsarpc.h" + #include "lib/messaging/irpc.h" + #include "libds/common/roles.h" ++#include "lib/param/loadparm.h" ++#include "librpc/rpc/dcerpc_helper.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -869,6 +871,19 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t _session_key; + int rc; ++ struct auth_session_info *session_info = ++ dcesrv_call_session_info(dce_call); ++ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; ++ bool encrypted; ++ ++ encrypted = ++ dcerpc_is_transport_encrypted(session_info); ++ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ DBG_ERR("Transport isn't encrypted and weak crypto disallowed!\n"); ++ return NT_STATUS_ACCESS_DENIED; ++ } ++ + + nt_status = dcesrv_transport_session_key(dce_call, &session_key); + if (!NT_STATUS_IS_OK(nt_status)) { +@@ -880,11 +895,13 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, + .size = session_key.length, + }; + ++ GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &_session_key, + NULL); + if (rc < 0) { ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } +@@ -893,6 +910,7 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, + auth_blob->data, + auth_blob->length); + gnutls_cipher_deinit(cipher_hnd); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; +-- +2.28.0 + + +From f327133ced90a52d1ff9e104b1722876b21b7a78 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 6 Nov 2020 10:13:48 +0100 +Subject: [PATCH 101/105] sefltest: Enable the dcerpc.createtrustrelax test + against ad_dc_fips + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Mon Nov 9 10:22:51 UTC 2020 on sn-devel-184 + +(cherry picked from commit b89134013041e772418c2c8bcfffe8a9ade6db91) +--- + selftest/knownfail.d/createtrustrelax_server | 1 - + 1 file changed, 1 deletion(-) + delete mode 100644 selftest/knownfail.d/createtrustrelax_server + +diff --git a/selftest/knownfail.d/createtrustrelax_server b/selftest/knownfail.d/createtrustrelax_server +deleted file mode 100644 +index 80effda8343..00000000000 +--- a/selftest/knownfail.d/createtrustrelax_server ++++ /dev/null +@@ -1 +0,0 @@ +-^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) +-- +2.28.0 + + +From 721f97817de2d1e14d99459f9e6af9fccf11b621 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 5 Nov 2020 15:48:08 -0800 +Subject: [PATCH 102/105] s3: spoolss: Make parameters in call to + user_ok_token() match all other uses. + +We already have p->session_info->unix_info->unix_name, we don't +need to go through a legacy call to uidtoname(p->session_info->unix_token->uid). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14568 + +Signed-off-by: Jeremy Allison +Reviewed-by: Andrew Bartlett + +Autobuild-User(master): Andrew Bartlett +Autobuild-Date(master): Mon Nov 9 04:10:45 UTC 2020 on sn-devel-184 + +(cherry picked from commit e5e1759057a767f517bf480a2172a36623df2799) +--- + source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c +index e98401a4365..906fab2adb5 100644 +--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c ++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c +@@ -1880,7 +1880,8 @@ WERROR _spoolss_OpenPrinterEx(struct pipes_struct *p, + return WERR_ACCESS_DENIED; + } + +- if (!user_ok_token(uidtoname(p->session_info->unix_token->uid), NULL, ++ if (!user_ok_token(p->session_info->unix_info->unix_name, ++ p->session_info->info->domain_name, + p->session_info->security_token, snum) || + !W_ERROR_IS_OK(print_access_check(p->session_info, + p->msg_ctx, +-- +2.28.0 + + +From a078205ce3816c175cd16dc22875dc147a5da645 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 11 Nov 2020 13:42:06 +0100 +Subject: [PATCH 103/105] s3:smbd: Fix possible null pointer dereference in + token_contains_name() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14572 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Alexander Bokovoy +Autobuild-Date(master): Thu Nov 12 15:13:47 UTC 2020 on sn-devel-184 + +(cherry picked from commit 8036bf9717f83e83c3e4a9cf00fded42e9a5de15) +--- + source3/smbd/share_access.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c +index 57754a0f766..694c0c290e8 100644 +--- a/source3/smbd/share_access.c ++++ b/source3/smbd/share_access.c +@@ -79,7 +79,7 @@ static bool token_contains_name(TALLOC_CTX *mem_ctx, + enum lsa_SidType type; + + if (username != NULL) { +- size_t domain_len = strlen(domain); ++ size_t domain_len = domain != NULL ? strlen(domain) : 0; + + /* Check if username starts with domain name */ + if (domain_len > 0) { +-- +2.28.0 + + +From 5654101584b7742e684d12e6aea43e5004142dcb Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 10 Nov 2020 17:35:24 +0200 +Subject: [PATCH 104/105] lookup_name: allow lookup names prefixed with DNS + forest root for FreeIPA DC + +In FreeIPA deployment with active Global Catalog service, when a two-way +trust to Active Directory forest is established, Windows systems can +look up FreeIPA users and groups. When using a security tab in Windows +Explorer on AD side, a lookup over a trusted forest might come as +realm\name instead of NetBIOS domain name: + +-------------------------------------------------------------------- +[2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) + lsa_LookupNames3: struct lsa_LookupNames3 + in: struct lsa_LookupNames3 + handle : * + handle: struct policy_handle + handle_type : 0x00000000 (0) + uuid : 0000000e-0000-0000-1c5e-a750e5810000 + num_names : 0x00000001 (1) + names: ARRAY(1) + names: struct lsa_String + length : 0x001e (30) + size : 0x0020 (32) + string : * + string : 'ipa.test\admins' + sids : * + sids: struct lsa_TransSidArray3 + count : 0x00000000 (0) + sids : NULL + level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) + count : * + count : 0x00000000 (0) + lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) + client_revision : LSA_CLIENT_REVISION_2 (2) +-------------------------------------------------------------------- + +If we are running as a DC and PASSDB supports returning domain info +(pdb_get_domain_info() returns a valid structure), check domain of the +name in lookup_name() against DNS forest name and allow the request to +be done against the primary domain. This corresponds to FreeIPA's use of +Samba as a DC. For normal domain members a realm-based lookup falls back +to a lookup over to its own domain controller with the help of winbindd. + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Alexander Bokovoy +Autobuild-Date(master): Wed Nov 11 10:59:01 UTC 2020 on sn-devel-184 + +(cherry picked from commit 31c703766fd2b89737826fb7e9a707f0622bb8cd) +--- + source3/passdb/lookup_sid.c | 37 ++++++++++++++++++++++++++++--------- + 1 file changed, 28 insertions(+), 9 deletions(-) + +diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c +index 82c47b3145b..864246da56e 100644 +--- a/source3/passdb/lookup_sid.c ++++ b/source3/passdb/lookup_sid.c +@@ -113,17 +113,36 @@ bool lookup_name(TALLOC_CTX *mem_ctx, + full_name, domain, name)); + DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); + +- if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && +- strequal(domain, get_global_sam_name())) +- { ++ if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) { ++ bool check_global_sam = false; ++ ++ check_global_sam = strequal(domain, get_global_sam_name()); ++ ++ /* If we are running on a DC that has PASSDB module with domain ++ * information, check if DNS forest name is matching the domain ++ * name. This is the case of FreeIPA domain controller when ++ * trusted AD DC looks up users found in a Global Catalog of ++ * the forest root domain. */ ++ if (!check_global_sam && (IS_DC)) { ++ struct pdb_domain_info *dom_info = NULL; ++ dom_info = pdb_get_domain_info(tmp_ctx); ++ ++ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { ++ check_global_sam = strequal(domain, dom_info->dns_forest); ++ } + +- /* It's our own domain, lookup the name in passdb */ +- if (lookup_global_sam_name(name, flags, &rid, &type)) { +- sid_compose(&sid, get_global_sam_sid(), rid); +- goto ok; ++ TALLOC_FREE(dom_info); ++ } ++ ++ if (check_global_sam) { ++ /* It's our own domain, lookup the name in passdb */ ++ if (lookup_global_sam_name(name, flags, &rid, &type)) { ++ sid_compose(&sid, get_global_sam_sid(), rid); ++ goto ok; ++ } ++ TALLOC_FREE(tmp_ctx); ++ return false; + } +- TALLOC_FREE(tmp_ctx); +- return false; + } + + if ((flags & LOOKUP_NAME_BUILTIN) && +-- +2.28.0 + + +From efa59aa4b2455ea3bc4d0fd0358b160858626585 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 11 Nov 2020 14:42:55 +0200 +Subject: [PATCH 105/105] auth_sam: use pdb_get_domain_info to look up DNS + forest information + +When Samba is used as a part of FreeIPA domain controller, Windows +clients for a trusted AD forest may try to authenticate (perform logon +operation) as a REALM\name user account. + +Fix auth_sam plugins to accept DNS forest name if we are running on a DC +with PASSDB module providing domain information (e.g. pdb_get_domain_info() +returning non-NULL structure). Right now, only FreeIPA or Samba AD DC +PASSDB backends return this information but Samba AD DC configuration is +explicitly ignored by the two auth_sam (strict and netlogon3) modules. + +Detailed logs below: + +[2020/11/11 09:23:53.281296, 1, pid=42677, effective(65534, 65534), real(65534, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:482(ndr_print_function_debug) + netr_LogonSamLogonWithFlags: struct netr_LogonSamLogonWithFlags + in: struct netr_LogonSamLogonWithFlags + server_name : * + server_name : '\\master.ipa.test' + computer_name : * + computer_name : 'AD1' + credential : * + credential: struct netr_Authenticator + cred: struct netr_Credential + data : 529f4b087c5f6546 + timestamp : Wed Nov 11 09:23:55 AM 2020 UTC + return_authenticator : * + return_authenticator: struct netr_Authenticator + cred: struct netr_Credential + data : 204f28f622010000 + timestamp : Fri May 2 06:37:50 AM 1986 UTC + logon_level : NetlogonNetworkTransitiveInformation (6) + logon : * + logon : union netr_LogonLevel(case 6) + network : * + network: struct netr_NetworkInfo + identity_info: struct netr_IdentityInfo + domain_name: struct lsa_String + length : 0x0010 (16) + size : 0x01fe (510) + string : * + string : 'IPA.TEST' + parameter_control : 0x00002ae0 (10976) + 0: MSV1_0_CLEARTEXT_PASSWORD_ALLOWED + 0: MSV1_0_UPDATE_LOGON_STATISTICS + 0: MSV1_0_RETURN_USER_PARAMETERS + 0: MSV1_0_DONT_TRY_GUEST_ACCOUNT + 1: MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT + 1: MSV1_0_RETURN_PASSWORD_EXPIRY + 1: MSV1_0_USE_CLIENT_CHALLENGE + 0: MSV1_0_TRY_GUEST_ACCOUNT_ONLY + 1: MSV1_0_RETURN_PROFILE_PATH + 0: MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY + 1: MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT + 0: MSV1_0_DISABLE_PERSONAL_FALLBACK + 1: MSV1_0_ALLOW_FORCE_GUEST + 0: MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED + 0: MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY + 0: MSV1_0_ALLOW_MSVCHAPV2 + 0: MSV1_0_S4U2SELF + 0: MSV1_0_CHECK_LOGONHOURS_FOR_S4U + 0: MSV1_0_SUBAUTHENTICATION_DLL_EX + logon_id : 0x0000000000884ef2 (8933106) + account_name: struct lsa_String + length : 0x000e (14) + size : 0x000e (14) + string : * + string : 'idmuser' + workstation: struct lsa_String + length : 0x0000 (0) + size : 0x0000 (0) + string : * + string : '' + challenge : 417207867bd33c74 + nt: struct netr_ChallengeResponse + length : 0x00c0 (192) + size : 0x00c0 (192) + data : * + data: ARRAY(192) + [0000] A5 24 62 6E 31 DF 69 66 9E DC 54 D6 63 4C D6 2F .$bn1.if ..T.cL./ + [0010] 01 01 00 00 00 00 00 00 50 37 D7 60 0C B8 D6 01 ........ P7.`.... + [0020] 15 1B 38 4F 47 95 4D 62 00 00 00 00 02 00 0E 00 ..8OG.Mb ........ + [0030] 57 00 49 00 4E 00 32 00 30 00 31 00 36 00 01 00 W.I.N.2. 0.1.6... + [0040] 06 00 41 00 44 00 31 00 04 00 18 00 77 00 69 00 ..A.D.1. ....w.i. + [0050] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e. + [0060] 73 00 74 00 03 00 20 00 61 00 64 00 31 00 2E 00 s.t... . a.d.1... + [0070] 77 00 69 00 6E 00 32 00 30 00 31 00 36 00 2E 00 w.i.n.2. 0.1.6... + [0080] 74 00 65 00 73 00 74 00 05 00 18 00 77 00 69 00 t.e.s.t. ....w.i. + [0090] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e. + [00A0] 73 00 74 00 07 00 08 00 50 37 D7 60 0C B8 D6 01 s.t..... P7.`.... + [00B0] 06 00 04 00 02 00 00 00 00 00 00 00 00 00 00 00 ........ ........ + lm: struct netr_ChallengeResponse + length : 0x0018 (24) + size : 0x0018 (24) + data : * + data : 000000000000000000000000000000000000000000000000 + validation_level : 0x0006 (6) + flags : * + flags : 0x00000000 (0) + 0: NETLOGON_SAMLOGON_FLAG_PASS_TO_FOREST_ROOT + 0: NETLOGON_SAMLOGON_FLAG_PASS_CROSS_FOREST_HOP + 0: NETLOGON_SAMLOGON_FLAG_RODC_TO_OTHER_DOMAIN + 0: NETLOGON_SAMLOGON_FLAG_RODC_NTLM_REQUEST + +In such case checks for a workgroup name will not match the DNS forest +name used in the username specification: + +[2020/11/11 09:23:53.283055, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:200(auth_check_ntlm_password) + check_ntlm_password: Checking password for unmapped user [IPA.TEST]\[idmuser]@[] with the new password interface +[2020/11/11 09:23:53.283073, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:203(auth_check_ntlm_password) + check_ntlm_password: mapped user is: [IPA.TEST]\[idmuser]@[] +[2020/11/11 09:23:53.283082, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:213(auth_check_ntlm_password) + check_ntlm_password: auth_context challenge created by fixed +[2020/11/11 09:23:53.283091, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:216(auth_check_ntlm_password) + challenge is: +[2020/11/11 09:23:53.283099, 5, pid=42677, effective(65534, 65534), real(65534, 0)] ../../lib/util/util.c:678(dump_data) + [0000] 41 72 07 86 7B D3 3C 74 Ar..{. +Reviewed-by: Andreas Schneider +(cherry picked from commit 2a8b672652dcbcf55ec59be537773d76f0f14d0a) +--- + source3/auth/auth_sam.c | 45 +++++++++++++++++++++++++++++++++++++---- + 1 file changed, 41 insertions(+), 4 deletions(-) + +diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c +index 3c12f959faf..e8e0d543f8c 100644 +--- a/source3/auth/auth_sam.c ++++ b/source3/auth/auth_sam.c +@@ -22,6 +22,7 @@ + + #include "includes.h" + #include "auth.h" ++#include "passdb.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_AUTH +@@ -142,10 +143,28 @@ static NTSTATUS auth_samstrict_auth(const struct auth_context *auth_context, + break; + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: +- if ( !is_local_name && !is_my_domain ) { +- DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n", +- effective_domain)); +- return NT_STATUS_NOT_IMPLEMENTED; ++ if (!is_local_name && !is_my_domain) { ++ /* If we are running on a DC that has PASSDB module with domain ++ * information, check if DNS forest name is matching the domain ++ * name. This is the case of FreeIPA domain controller when ++ * trusted AD DCs attempt to authenticate FreeIPA users using ++ * the forest root domain (which is the only domain in FreeIPA). ++ */ ++ struct pdb_domain_info *dom_info = NULL; ++ ++ dom_info = pdb_get_domain_info(mem_ctx); ++ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { ++ is_my_domain = strequal(user_info->mapped.domain_name, ++ dom_info->dns_forest); ++ } ++ ++ TALLOC_FREE(dom_info); ++ if (!is_my_domain) { ++ DEBUG(6,("check_samstrict_security: %s is not one " ++ "of my local names or domain name (DC)\n", ++ effective_domain)); ++ return NT_STATUS_NOT_IMPLEMENTED; ++ } + } + + break; +@@ -230,6 +249,24 @@ static NTSTATUS auth_sam_netlogon3_auth(const struct auth_context *auth_context, + } + + is_my_domain = strequal(user_info->mapped.domain_name, lp_workgroup()); ++ if (!is_my_domain) { ++ /* If we are running on a DC that has PASSDB module with domain ++ * information, check if DNS forest name is matching the domain ++ * name. This is the case of FreeIPA domain controller when ++ * trusted AD DCs attempt to authenticate FreeIPA users using ++ * the forest root domain (which is the only domain in FreeIPA). ++ */ ++ struct pdb_domain_info *dom_info = NULL; ++ dom_info = pdb_get_domain_info(mem_ctx); ++ ++ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { ++ is_my_domain = strequal(user_info->mapped.domain_name, ++ dom_info->dns_forest); ++ } ++ ++ TALLOC_FREE(dom_info); ++ } ++ + if (!is_my_domain) { + DBG_INFO("%s is not our domain name (DC for %s)\n", + effective_domain, lp_workgroup()); +-- +2.28.0 + diff --git a/samba.spec b/samba.spec index b7972be..f76af7a 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 2 %define samba_version 4.13.2 %define talloc_version 2.3.1 @@ -131,7 +131,7 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch -Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch +Patch2: samba-4.13-redhat.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3616,6 +3616,11 @@ fi %endif %changelog +* Wed Nov 25 2020 Alexander Bokovoy - 4.13.2-2 +- Merge RHEL 8.4 patches: + - FIPS-related enhancements + - FreeIPA Global Catalog patches + * Tue Nov 03 2020 Andreas Schneider - 4.13.2-1 - Create a python3-samba-devel package to avoid unnessary dependencies From ab926fdf1e91a79e51855a0d58ea1ed802e4d235 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 25 Nov 2020 13:49:53 +0200 Subject: [PATCH 10/30] Fix smbclient mget crashes - Upstream bug #14517 - rhbz#1892745, rhbz#1900232 --- samba-smbclient-mget-bug-14517.patch | 430 +++++++++++++++++++++++++++ samba.spec | 2 + 2 files changed, 432 insertions(+) create mode 100644 samba-smbclient-mget-bug-14517.patch diff --git a/samba-smbclient-mget-bug-14517.patch b/samba-smbclient-mget-bug-14517.patch new file mode 100644 index 0000000..8f21623 --- /dev/null +++ b/samba-smbclient-mget-bug-14517.patch @@ -0,0 +1,430 @@ +From 52ddfacead1ba50da0fc706b54e90e7a0cadb8e9 Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Mon, 28 Sep 2020 14:11:13 +0200 +Subject: [PATCH 1/4] smbclient: Remove the "abort_mget" variable + +This was never set to true anywhere in the code + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 +Signed-off-by: Volker Lendecke +Reviewed-by: Jeremy Allison +(cherry picked from commit 8fa451d2b052223a11b24ffc2a956b80d03aaa7c) +--- + source3/client/client.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index f65293849d0..5bed37fc2a2 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -87,8 +87,6 @@ static char dest_ss_str[INET6_ADDRSTRLEN]; + + #define SEPARATORS " \t\n\r" + +-static bool abort_mget = true; +- + /* timing globals */ + uint64_t get_total_size = 0; + unsigned int get_total_time_ms = 0; +@@ -1217,11 +1215,6 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + if (strequal(finfo->name,".") || strequal(finfo->name,"..")) + return NT_STATUS_OK; + +- if (abort_mget) { +- d_printf("mget aborted\n"); +- return NT_STATUS_UNSUCCESSFUL; +- } +- + if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { + if (asprintf(&quest, + "Get directory %s? ",finfo->name) < 0) { +@@ -1419,8 +1412,6 @@ static int cmd_mget(void) + attribute |= FILE_ATTRIBUTE_DIRECTORY; + } + +- abort_mget = false; +- + while (next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { + + mget_mask = talloc_strdup(ctx, client_get_cur_dir()); +-- +2.20.1 + + +From 159a03a9067f7aeddb29080dc34e37b567a02479 Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Mon, 28 Sep 2020 14:21:24 +0200 +Subject: [PATCH 2/4] smbclient: Slightly simplify do_mget() + +Put the prompt query into a separate if-statement, move the "quest" +variable closer to its use + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 +Signed-off-by: Volker Lendecke +Reviewed-by: Jeremy Allison +(cherry picked from commit 71bc4d4b8d94458ac2e40d659f06110d434fd5c9) +--- + source3/client/client.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 5bed37fc2a2..5901419f427 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -1203,7 +1203,6 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + TALLOC_CTX *ctx = talloc_tos(); + NTSTATUS status = NT_STATUS_OK; + char *rname = NULL; +- char *quest = NULL; + char *saved_curdir = NULL; + char *mget_mask = NULL; + char *new_cd = NULL; +@@ -1215,23 +1214,24 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + if (strequal(finfo->name,".") || strequal(finfo->name,"..")) + return NT_STATUS_OK; + +- if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { +- if (asprintf(&quest, +- "Get directory %s? ",finfo->name) < 0) { +- return NT_STATUS_NO_MEMORY; +- } +- } else { +- if (asprintf(&quest, +- "Get file %s? ",finfo->name) < 0) { ++ if (prompt) { ++ const char *object = (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) ? ++ "directory" : "file"; ++ char *quest = NULL; ++ bool ok; ++ ++ quest = talloc_asprintf( ++ ctx, "Get %s %s? ", object, finfo->name); ++ if (quest == NULL) { + return NT_STATUS_NO_MEMORY; + } +- } + +- if (prompt && !yesno(quest)) { +- SAFE_FREE(quest); +- return NT_STATUS_OK; ++ ok = yesno(quest); ++ TALLOC_FREE(quest); ++ if (!ok) { ++ return NT_STATUS_OK; ++ } + } +- SAFE_FREE(quest); + + if (!(finfo->attr & FILE_ATTRIBUTE_DIRECTORY)) { + rname = talloc_asprintf(ctx, +-- +2.20.1 + + +From 523ccc98d2c6a9ddc0714084b5e19cee2a80bf27 Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Mon, 28 Sep 2020 16:29:27 +0200 +Subject: [PATCH 3/4] test3: Add a test showing that smbclient recursive mget + is broken + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 +Signed-off-by: Volker Lendecke +Reviewed-by: Jeremy Allison +(cherry picked from commit 254a5b034e5a081c9d3f28717a4b54d2af0180fc) +--- + selftest/knownfail.d/smbclient_mget | 1 + + source3/script/tests/test_smbclient_mget.sh | 39 +++++++++++++++++++++ + source3/selftest/tests.py | 10 ++++++ + 3 files changed, 50 insertions(+) + create mode 100644 selftest/knownfail.d/smbclient_mget + create mode 100755 source3/script/tests/test_smbclient_mget.sh + +diff --git a/selftest/knownfail.d/smbclient_mget b/selftest/knownfail.d/smbclient_mget +new file mode 100644 +index 00000000000..64407a8c5d4 +--- /dev/null ++++ b/selftest/knownfail.d/smbclient_mget +@@ -0,0 +1 @@ ++^samba3.blackbox.smbclient-mget.smbclient\ mget\(fileserver\) +\ No newline at end of file +diff --git a/source3/script/tests/test_smbclient_mget.sh b/source3/script/tests/test_smbclient_mget.sh +new file mode 100755 +index 00000000000..45f62f15d4d +--- /dev/null ++++ b/source3/script/tests/test_smbclient_mget.sh +@@ -0,0 +1,39 @@ ++#!/bin/sh ++ ++if [ $# -lt 6 ]; then ++cat < +Date: Mon, 28 Sep 2020 15:03:41 +0200 +Subject: [PATCH 4/4] smbclient: Fix recursive mget + +Make do_mget rely on do_list() already doing the recursion in a +breadth-first manner. The previous code called do_list() from within +its callback. Unfortunately the recent simplifications of do_list() +broke this, leading to recursive mget to segfault. Instead of figuring +out how this worked before the simplifications in do_list() (I did +spend a few hours on this) and fixing it, I chose to restructure +do_mget() to not recursively call do_list() anymore but instead rely +on do_list() to do the recursion. Saves quite a few lines of code and +complexity. + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 +Signed-off-by: Volker Lendecke +Reviewed-by: Jeremy Allison + +Autobuild-User(master): Jeremy Allison +Autobuild-Date(master): Wed Sep 30 17:23:45 UTC 2020 on sn-devel-184 + +(cherry picked from commit 9f24b5098f796f364a3f403ad4e9ae28b3c0935a) +--- + selftest/knownfail.d/smbclient_mget | 1 - + source3/client/client.c | 121 ++++++++-------------------- + 2 files changed, 33 insertions(+), 89 deletions(-) + delete mode 100644 selftest/knownfail.d/smbclient_mget + +diff --git a/selftest/knownfail.d/smbclient_mget b/selftest/knownfail.d/smbclient_mget +deleted file mode 100644 +index 64407a8c5d4..00000000000 +--- a/selftest/knownfail.d/smbclient_mget ++++ /dev/null +@@ -1 +0,0 @@ +-^samba3.blackbox.smbclient-mget.smbclient\ mget\(fileserver\) +\ No newline at end of file +diff --git a/source3/client/client.c b/source3/client/client.c +index 5901419f427..8c7ceb644aa 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -1201,11 +1201,10 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + const char *dir) + { + TALLOC_CTX *ctx = talloc_tos(); +- NTSTATUS status = NT_STATUS_OK; +- char *rname = NULL; +- char *saved_curdir = NULL; +- char *mget_mask = NULL; +- char *new_cd = NULL; ++ const char *client_cwd = NULL; ++ size_t client_cwd_len; ++ char *path = NULL; ++ char *local_path = NULL; + + if (!finfo->name) { + return NT_STATUS_OK; +@@ -1214,6 +1213,10 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + if (strequal(finfo->name,".") || strequal(finfo->name,"..")) + return NT_STATUS_OK; + ++ if ((finfo->attr & FILE_ATTRIBUTE_DIRECTORY) && !recurse) { ++ return NT_STATUS_OK; ++ } ++ + if (prompt) { + const char *object = (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) ? + "directory" : "file"; +@@ -1233,98 +1236,40 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + } + } + +- if (!(finfo->attr & FILE_ATTRIBUTE_DIRECTORY)) { +- rname = talloc_asprintf(ctx, +- "%s%s", +- client_get_cur_dir(), +- finfo->name); +- if (!rname) { +- return NT_STATUS_NO_MEMORY; +- } +- rname = client_clean_name(ctx, rname); +- if (rname == NULL) { +- return NT_STATUS_NO_MEMORY; +- } +- do_get(rname, finfo->name, false); +- TALLOC_FREE(rname); +- return NT_STATUS_OK; +- } +- +- /* handle directories */ +- saved_curdir = talloc_strdup(ctx, client_get_cur_dir()); +- if (!saved_curdir) { ++ path = talloc_asprintf( ++ ctx, "%s%c%s", dir, CLI_DIRSEP_CHAR, finfo->name); ++ if (path == NULL) { + return NT_STATUS_NO_MEMORY; + } +- +- new_cd = talloc_asprintf(ctx, +- "%s%s%s", +- client_get_cur_dir(), +- finfo->name, +- CLI_DIRSEP_STR); +- if (!new_cd) { +- return NT_STATUS_NO_MEMORY; +- } +- new_cd = client_clean_name(ctx, new_cd); +- if (new_cd == NULL) { ++ path = client_clean_name(ctx, path); ++ if (path == NULL) { + return NT_STATUS_NO_MEMORY; + } +- client_set_cur_dir(new_cd); +- +- string_replace(finfo->name,'\\','/'); +- if (lowercase) { +- if (!strlower_m(finfo->name)) { +- return NT_STATUS_INVALID_PARAMETER; +- } +- } +- +- if (!directory_exist(finfo->name) && +- mkdir(finfo->name,0777) != 0) { +- d_printf("failed to create directory %s\n",finfo->name); +- client_set_cur_dir(saved_curdir); +- return map_nt_error_from_unix(errno); +- } +- +- if (chdir(finfo->name) != 0) { +- d_printf("failed to chdir to directory %s\n",finfo->name); +- client_set_cur_dir(saved_curdir); +- return map_nt_error_from_unix(errno); +- } + +- mget_mask = talloc_asprintf(ctx, +- "%s*", +- client_get_cur_dir()); ++ /* ++ * Skip the path prefix if we've done a remote "cd" when ++ * creating the local path ++ */ ++ client_cwd = client_get_cur_dir(); ++ client_cwd_len = strlen(client_cwd); + +- if (!mget_mask) { ++ local_path = talloc_strdup(ctx, path + client_cwd_len); ++ if (local_path == NULL) { ++ TALLOC_FREE(path); + return NT_STATUS_NO_MEMORY; + } ++ string_replace(local_path, CLI_DIRSEP_CHAR, '/'); + +- mget_mask = client_clean_name(ctx, mget_mask); +- if (mget_mask == NULL) { +- return NT_STATUS_NO_MEMORY; +- } +- status = do_list(mget_mask, +- (FILE_ATTRIBUTE_SYSTEM +- | FILE_ATTRIBUTE_HIDDEN +- | FILE_ATTRIBUTE_DIRECTORY), +- do_mget, false, true); +- if (!NT_STATUS_IS_OK(status) +- && !NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) { +- /* +- * Ignore access denied errors to ensure all permitted files are +- * pulled down. +- */ +- return status; +- } ++ if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { ++ int ret = mkdir(local_path, 0777); + +- if (chdir("..") == -1) { +- d_printf("do_mget: failed to chdir to .. (error %s)\n", +- strerror(errno) ); +- return map_nt_error_from_unix(errno); ++ if ((ret == -1) && (errno != EEXIST)) { ++ return map_nt_error_from_unix(errno); ++ } ++ } else { ++ do_get(path, local_path, false); + } +- client_set_cur_dir(saved_curdir); +- TALLOC_FREE(mget_mask); +- TALLOC_FREE(saved_curdir); +- TALLOC_FREE(new_cd); ++ + return NT_STATUS_OK; + } + +@@ -1431,7 +1376,7 @@ static int cmd_mget(void) + if (mget_mask == NULL) { + return 1; + } +- status = do_list(mget_mask, attribute, do_mget, false, true); ++ status = do_list(mget_mask, attribute, do_mget, recurse, true); + if (!NT_STATUS_IS_OK(status)) { + return 1; + } +@@ -1453,7 +1398,7 @@ static int cmd_mget(void) + if (mget_mask == NULL) { + return 1; + } +- status = do_list(mget_mask, attribute, do_mget, false, true); ++ status = do_list(mget_mask, attribute, do_mget, recurse, true); + if (!NT_STATUS_IS_OK(status)) { + return 1; + } +-- +2.20.1 + diff --git a/samba.spec b/samba.spec index f76af7a..b8593e5 100644 --- a/samba.spec +++ b/samba.spec @@ -132,6 +132,7 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch Patch2: samba-4.13-redhat.patch +Patch3: samba-smbclient-mget-bug-14517.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3617,6 +3618,7 @@ fi %changelog * Wed Nov 25 2020 Alexander Bokovoy - 4.13.2-2 +- rhbz#1892745, rhbz#1900232: smbclient mget crashes (upstream bug 14517) - Merge RHEL 8.4 patches: - FIPS-related enhancements - FreeIPA Global Catalog patches From 9962ff5e4576726d23c05afab66169b758d7a813 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 25 Nov 2020 13:52:50 +0200 Subject: [PATCH 11/30] Add new unpackaged Python modules --- samba.spec | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/samba.spec b/samba.spec index b8593e5..f6d4aae 100644 --- a/samba.spec +++ b/samba.spec @@ -131,6 +131,10 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch +# Backport bug fixes to https://gitlab.com/samba-redhat/samba/-/tree/v4-13-redhat +# This will give us CI and makes it easy to generate patchsets. +# +# Generate the patchset using: git format-patch -l1 --stdout -N > samba-4.13-redhat.patch Patch2: samba-4.13-redhat.patch Patch3: samba-smbclient-mget-bug-14517.patch @@ -2429,6 +2433,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc @@ -2439,12 +2444,14 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/rpc_talloc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/rpcecho.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/sam.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/samr_change_password.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/srvsvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/string_tests.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/testrpc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/unix.*.pyc %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py +%{python3_sitearch}/samba/tests/dcerpc/binding.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py @@ -2455,6 +2462,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/rpc_talloc.py %{python3_sitearch}/samba/tests/dcerpc/rpcecho.py %{python3_sitearch}/samba/tests/dcerpc/sam.py +%{python3_sitearch}/samba/tests/dcerpc/samr_change_password.py %{python3_sitearch}/samba/tests/dcerpc/srvsvc.py %{python3_sitearch}/samba/tests/dcerpc/string_tests.py %{python3_sitearch}/samba/tests/dcerpc/testrpc.py From 0db49376b0b55d4923f2f7c0ca41f33d003b2522 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 25 Nov 2020 17:05:49 +0200 Subject: [PATCH 12/30] More missing Python modules --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index f6d4aae..aca9fa5 100644 --- a/samba.spec +++ b/samba.spec @@ -2009,6 +2009,7 @@ fi %{python3_sitearch}/samba/__pycache__/sites.*.pyc %{python3_sitearch}/samba/__pycache__/subnets.*.pyc %{python3_sitearch}/samba/__pycache__/tdb_util.*.pyc +%{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc %{python3_sitearch}/samba/__pycache__/xattr.*.pyc @@ -2199,6 +2200,7 @@ fi %{python3_sitearch}/samba/third_party/__init__.py %dir %{python3_sitearch}/samba/third_party/__pycache__ %{python3_sitearch}/samba/third_party/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/trust_utils.py %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py %{python3_sitearch}/samba/werror.*.so @@ -2433,6 +2435,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/createtrustrelax.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc @@ -2452,6 +2455,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py +%{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py From e2885c339abcfc311254534b1ddf63234402556b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 15 Dec 2020 12:09:29 +0100 Subject: [PATCH 13/30] Update to Samba 4.13.3 Guenther --- samba-4.13-redhat.patch | 1028 ++++++++++++-------------- samba-smbclient-mget-bug-14517.patch | 430 ----------- samba.spec | 8 +- 3 files changed, 474 insertions(+), 992 deletions(-) delete mode 100644 samba-smbclient-mget-bug-14517.patch diff --git a/samba-4.13-redhat.patch b/samba-4.13-redhat.patch index 33b84bd..e085e74 100644 --- a/samba-4.13-redhat.patch +++ b/samba-4.13-redhat.patch @@ -1,7 +1,7 @@ -From 77a771be72a6084216ea848f2d851eb7192ae9b9 Mon Sep 17 00:00:00 2001 +From 4e5d178f9367f4e51b387b7d4df1e8407b15fafc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 16:15:03 +0200 -Subject: [PATCH 001/105] libcli:smb2: Do not leak ptext on error +Subject: [PATCH 001/104] libcli:smb2: Do not leak ptext on error Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -10,10 +10,10 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 1 insertion(+) diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c -index 623fc23fb18..bba80817018 100644 +index cc03607d789..4d430f56df5 100644 --- a/libcli/smb/smb2_signing.c +++ b/libcli/smb/smb2_signing.c -@@ -522,6 +522,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, +@@ -520,6 +520,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, ctext = talloc_size(talloc_tos(), ctext_size); if (ctext == NULL) { @@ -22,13 +22,13 @@ index 623fc23fb18..bba80817018 100644 goto out; } -- -2.28.0 +2.29.2 -From eb5fbbd3090cbdea95b14e9ac167253fafe633f8 Mon Sep 17 00:00:00 2001 +From 1310c58c3b8b9c7fcb0c811a9ef24b3bbe8c16f1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 17:23:37 +0200 -Subject: [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have +Subject: [PATCH 002/104] libcli:smb2: Use talloc NULL context if we don't have a stackframe If we execute this code from python we don't have a talloc stackframe @@ -44,10 +44,10 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c -index bba80817018..7669b219bbe 100644 +index 4d430f56df5..6ece5f2e4d3 100644 --- a/libcli/smb/smb2_signing.c +++ b/libcli/smb/smb2_signing.c -@@ -513,14 +513,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, +@@ -511,14 +511,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, uint8_t *ctext = NULL; size_t len = 0; int i; @@ -75,7 +75,7 @@ index bba80817018..7669b219bbe 100644 if (ctext == NULL) { TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; -@@ -713,16 +724,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, +@@ -710,16 +721,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, uint8_t *ptext = NULL; size_t len = 0; int i; @@ -106,13 +106,13 @@ index bba80817018..7669b219bbe 100644 TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; -- -2.28.0 +2.29.2 -From 66ee204aee9a4919d94003a9a3263a44c2d5b436 Mon Sep 17 00:00:00 2001 +From ff15d93d1009a23428b9c11090836624255924cd Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 6 Nov 2019 17:37:45 +0100 -Subject: [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF +Subject: [PATCH 003/104] auth:creds: Introduce CRED_SMB_CONF We have several places where we check '> CRED_UNINITIALISED', so we better don't use CRED_UNINITIALISED for values from @@ -202,13 +202,13 @@ index d2a81506de3..6454ac9ff7c 100644 self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) self.assertEqual(creds.get_realm(), realm.upper()) -- -2.28.0 +2.29.2 -From 8d2d8cdc90d0455429c9d461ebd65d21a0b29b8d Mon Sep 17 00:00:00 2001 +From cc5e70efc8b9f45054d7e57002f59ac38c4c687f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 10 Oct 2019 14:18:23 +0200 -Subject: [PATCH 004/105] param: Add 'server smb encrypt' parameter +Subject: [PATCH 004/104] param: Add 'server smb encrypt' parameter And this also makes 'smb encrypt' a synonym of that. @@ -727,7 +727,7 @@ index 32a22cb58f5..798e616b765 100644 default diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index 6674485738a..82be31e8437 100644 +index a3abaa2ec67..c0070b716a5 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = @@ -821,13 +821,13 @@ index 7acde285a90..b745e0906b1 100644 req, NT_STATUS_NOT_SUPPORTED); -- -2.28.0 +2.29.2 -From 71b97ba1fd9260efd29e3ab3456b82d2a4f6dcc8 Mon Sep 17 00:00:00 2001 +From d78374a9e26428a48b3c6a2aa1d4280751620fb9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 10:04:19 +0200 -Subject: [PATCH 005/105] param: Create and use enum_smb_encryption_vals +Subject: [PATCH 005/104] param: Create and use enum_smb_encryption_vals Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -919,13 +919,13 @@ index b424b13cde4..2fb1fd7189e 100644 #define SMB_DATA_BLOCK 0x1 #define SMB_ASCII4 0x4 -- -2.28.0 +2.29.2 -From ca1e10a901af67327d25765bfed404e2d1c756a5 Mon Sep 17 00:00:00 2001 +From e2e0decfb117a8d6bb1428509f770315849e972b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:34:54 +0200 -Subject: [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values +Subject: [PATCH 006/104] s3:smbd: Use 'enum smb_encryption_setting' values Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -939,7 +939,7 @@ Reviewed-by: Stefan Metzmacher 6 files changed, 12 insertions(+), 11 deletions(-) diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index 82be31e8437..b305e34b252 100644 +index c0070b716a5..4ad541301b3 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = @@ -1043,13 +1043,13 @@ index b745e0906b1..2f2fdcb7260 100644 req, NT_STATUS_NOT_SUPPORTED); -- -2.28.0 +2.29.2 -From a5630bb933393fe69ff9b7f072221b9085d6277c Mon Sep 17 00:00:00 2001 +From a461b9e0348f2f082cc59b601271ca5b3283df09 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Apr 2020 10:38:41 +0200 -Subject: [PATCH 007/105] docs-xml: Add 'client smb encrypt' +Subject: [PATCH 007/104] docs-xml: Add 'client smb encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1193,7 +1193,7 @@ index 00000000000..05df152e734 +default + diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c -index e041f4fb01b..e167903dbd9 100644 +index 006caabc092..67f5709b213 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -3079,6 +3079,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) @@ -1208,7 +1208,7 @@ index e041f4fb01b..e167903dbd9 100644 if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { lp_ctx->flags[i] |= FLAG_DEFAULT; diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index b305e34b252..9a2a309b781 100644 +index 4ad541301b3..6418a42b6eb 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -960,6 +960,8 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) @@ -1221,13 +1221,13 @@ index b305e34b252..9a2a309b781 100644 apply_lp_set_cmdline(); } -- -2.28.0 +2.29.2 -From 3d826b1efb4a0e1f77875c7cbad2fcd16c3ac17b Mon Sep 17 00:00:00 2001 +From d55143fc3090b43390fdf14ff45d9c2971fc43d2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jul 2020 17:48:25 +0200 -Subject: [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() +Subject: [PATCH 008/104] lib:param: Add lpcfg_parse_enum_vals() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1237,10 +1237,10 @@ Reviewed-by: Stefan Metzmacher 2 files changed, 32 insertions(+) diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c -index e167903dbd9..952d2b49811 100644 +index 67f5709b213..b1410791c60 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c -@@ -3674,3 +3674,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx, +@@ -3675,3 +3675,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx, raw_value, lp_sub->private_data); } @@ -1288,13 +1288,13 @@ index 323fcf84523..e66ce2324b4 100644 struct loadparm_substitution; #ifdef LOADPARM_SUBSTITUTION_INTERNALS -- -2.28.0 +2.29.2 -From 2f74f9d6a5d38e6eb2ca3d32f61d5d9b1c55f3c1 Mon Sep 17 00:00:00 2001 +From d01ae8111553a71b80988eeb737e8b80bc765b20 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:38:08 +0200 -Subject: [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() +Subject: [PATCH 009/104] libcli:smb: Add smb_signing_setting_translate() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1461,13 +1461,13 @@ index 6918e1306c3..20981754db4 100644 plantestsuite("samba.unittests.talloc_keep_secret", "none", [os.path.join(bindir(), "default/lib/util/test_talloc_keep_secret")]) -- -2.28.0 +2.29.2 -From 912ec83bf4ec6a965ee10ace1d74036c5c6a4c92 Mon Sep 17 00:00:00 2001 +From 4cef2825a3363a38fbfbff5f172053145f62f100 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 08:39:34 +0200 -Subject: [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() +Subject: [PATCH 010/104] libcli:smb: Add smb_encryption_setting_translate() Add encryption enum and function to avoid confusion when reading the code. @@ -1555,13 +1555,13 @@ index da0e4db2bf3..ac2887ee5c4 100644 + return encryption_state; +} -- -2.28.0 +2.29.2 -From 7d2c3a519805549f577b54cf72a5d95b4ae744f3 Mon Sep 17 00:00:00 2001 +From a0cb6b810b655298ce5b87d8e36d1089460feca7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:47:59 +0200 -Subject: [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline +Subject: [PATCH 011/104] s3:lib: Use smb_signing_setting_translate for cmdline parsing The function will be removed soon. @@ -1622,13 +1622,13 @@ index 5a07eddac44..6a08afe4a25 100644 bld.SAMBA3_LIBRARY('cmdline_contexts', -- -2.28.0 +2.29.2 -From d488762aa9468bd54890a2fe3dba3fd52582b556 Mon Sep 17 00:00:00 2001 +From ef521e6b44710fb3ed567d36fa56687b677fe58a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 07:47:18 +0200 -Subject: [PATCH 012/105] auth:creds: Remove unused credentials autoproto +Subject: [PATCH 012/104] auth:creds: Remove unused credentials autoproto header Signed-off-by: Andreas Schneider @@ -1702,13 +1702,13 @@ index 7711eac2afa..d9be3562adb 100644 #include "auth/kerberos/kerberos_credentials.h" #include "auth/kerberos/kerberos_util.h" -- -2.28.0 +2.29.2 -From 696d2230503dada1e4369500c7c632bd7d3e5527 Mon Sep 17 00:00:00 2001 +From 6fafcebb8bd6311a736d995af6641e68e43e03a1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:32:44 +0200 -Subject: [PATCH 013/105] auth:creds: Add +Subject: [PATCH 013/104] auth:creds: Add cli_credentials_(get|set)_smb_signing() Signed-off-by: Andreas Schneider @@ -1844,13 +1844,13 @@ index 68f1f25dce1..9cde0000b5f 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.28.0 +2.29.2 -From 0176a9d55aed4bdb49ac6f703dcae778b2f4ac5c Mon Sep 17 00:00:00 2001 +From 64e2c99501677bfe52212c9ea99ec3512cf62f6e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 11:56:01 +0200 -Subject: [PATCH 014/105] auth:creds: Add python bindings for +Subject: [PATCH 014/104] auth:creds: Add python bindings for (get|set)_smb_signing Signed-off-by: Andreas Schneider @@ -1970,13 +1970,13 @@ index 6454ac9ff7c..e5f8122fa21 100644 + creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) -- -2.28.0 +2.29.2 -From 96c4ce197bb62772778d822f0e5956d5a3ffe28d Mon Sep 17 00:00:00 2001 +From 1280505f1396925851db5a29f2465d9c31d45f88 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:31:35 +0200 -Subject: [PATCH 015/105] auth:creds: Add +Subject: [PATCH 015/104] auth:creds: Add cli_credentials_(get|set)_smb_ipc_signing() Signed-off-by: Andreas Schneider @@ -2102,13 +2102,13 @@ index 9cde0000b5f..54e8271471f 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.28.0 +2.29.2 -From 301adf15736a4cb10f9dca267a906efb8f885354 Mon Sep 17 00:00:00 2001 +From 32209d254bb7bd3bd6ad3af14f219cee306a19a3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:32:46 +0200 -Subject: [PATCH 016/105] auth:creds: Add python bindings for +Subject: [PATCH 016/104] auth:creds: Add python bindings for (get|set)_smb_ipc_signing Signed-off-by: Andreas Schneider @@ -2207,13 +2207,13 @@ index e5f8122fa21..8edf13ce6ff 100644 + creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) -- -2.28.0 +2.29.2 -From cf2cafb38dd319c01ff539a73d40dac8813f03a0 Mon Sep 17 00:00:00 2001 +From d0a1bf1a75426c1d334349a6a4f8e44c80c1915b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:10:52 +0200 -Subject: [PATCH 017/105] auth:creds: Add +Subject: [PATCH 017/104] auth:creds: Add cli_credentials_(get|set)_smb_encryption() Signed-off-by: Andreas Schneider @@ -2341,13 +2341,13 @@ index 54e8271471f..3b86b742448 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.28.0 +2.29.2 -From a25732f42cf7418789c2102f093dc0b3062543fd Mon Sep 17 00:00:00 2001 +From 36ab2aa54102aa9cce92ac8ebf250db4d460324e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:38:30 +0200 -Subject: [PATCH 018/105] auth:creds: Add python bindings for +Subject: [PATCH 018/104] auth:creds: Add python bindings for (get|set)_smb_encryption Signed-off-by: Andreas Schneider @@ -2459,13 +2459,13 @@ index 8edf13ce6ff..e0a6248d37a 100644 + creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) -- -2.28.0 +2.29.2 -From 1a1809bd260ceff97dd4ff697f78b97a63f60b48 Mon Sep 17 00:00:00 2001 +From f866d9e80964e16307a8376ed448d0ca3a987538 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 11:19:53 +0200 -Subject: [PATCH 019/105] auth:creds: Add python bindings for +Subject: [PATCH 019/104] auth:creds: Add python bindings for cli_credentials_set_conf() Signed-off-by: Andreas Schneider @@ -2587,13 +2587,13 @@ index e0a6248d37a..6187bded0b6 100644 + creds.set_conf(lp) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) -- -2.28.0 +2.29.2 -From 72b31403174eb23fe4fdf75ad918e845a740db6f Mon Sep 17 00:00:00 2001 +From 3f55ee05f024eacdd43fbbfb941703f8555df7c7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 08:14:23 +0200 -Subject: [PATCH 020/105] auth:creds: Bump library version +Subject: [PATCH 020/104] auth:creds: Bump library version We added new functions so bump the version. @@ -2617,13 +2617,13 @@ index 564a04fe8dd..1e3302e3e48 100644 bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', -- -2.28.0 +2.29.2 -From 918b87437b9c36981049ca4e3cf0220ad56ec7c2 Mon Sep 17 00:00:00 2001 +From 492030e0e6179bdc0311e8d03b89b1cb01de1a3e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 May 2020 11:10:30 +0200 -Subject: [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() +Subject: [PATCH 021/104] s3:lib: Use cli_credential_(get|set)_smb_signing() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2688,13 +2688,13 @@ index bc1f1c3ed25..6038ec11515 100644 void set_cmdline_auth_info_use_ccache(struct user_auth_info *auth_info, bool b) -- -2.28.0 +2.29.2 -From 22efb02d818946e4f03ebfb72ea345e9106deca8 Mon Sep 17 00:00:00 2001 +From 6164c45feff5daf0e751526d1f7bd599c61b2a0e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:45:34 +0200 -Subject: [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API +Subject: [PATCH 022/104] s3:lib: Set smb encryption also via cli creds API Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2717,13 +2717,13 @@ index 6038ec11515..9c9e2f0ac0f 100644 } -- -2.28.0 +2.29.2 -From 9abae48706106793f8952524ad2325bdd6a5101c Mon Sep 17 00:00:00 2001 +From ddb7926bba603afbc1a588d1b6da9f9a625881ac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 10:40:23 +0200 -Subject: [PATCH 023/105] python: Remove unused sign argument from +Subject: [PATCH 023/104] python: Remove unused sign argument from smb_connection() Signed-off-by: Andreas Schneider @@ -2772,13 +2772,13 @@ index 1e2c2918ebe..ad60cda0690 100644 smb_dir = '\\'.join([self.lp.get('realm').lower(), 'Policies', 'PolicyDefinitions']) -- -2.28.0 +2.29.2 -From e2f0f56ea6ec4f9696affdee08de89c0bdffa719 Mon Sep 17 00:00:00 2001 +From 8683eacfb9c053115a84be025bbd64471c55d1c8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 14:02:37 +0200 -Subject: [PATCH 024/105] python: Set smb signing via the creds API +Subject: [PATCH 024/104] python: Set smb signing via the creds API Pair-Programmed-With: Stefan Metzmacher @@ -2876,13 +2876,13 @@ index ad60cda0690..0f2f6520fc3 100644 -- -2.28.0 +2.29.2 -From 53b2d53349b8f453cd0144f01b833deca52e3626 Mon Sep 17 00:00:00 2001 +From 86212ac5fb8d5f0710f23dde362dc35d908e3047 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:22:12 +0200 -Subject: [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC +Subject: [PATCH 025/104] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2977,10 +2977,10 @@ index 1fb1f0127b9..f20146378e3 100644 nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", get_cmdline_auth_info_creds(user_info), diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index 8b6a803a910..16e3ee485f0 100644 +index 10c1b1d54f2..f578f1c4131 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -2481,7 +2481,9 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c +@@ -2482,7 +2482,9 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c /* setup the connection */ ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, &rm_addr, 0, "IPC$", "IPC", @@ -3099,13 +3099,13 @@ index 6cea2ee306c..2241beb331f 100644 if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); -- -2.28.0 +2.29.2 -From 975383e368a3891e92fb071ab20f2b5208167500 Mon Sep 17 00:00:00 2001 +From 834dae6a34aaef7dccfb84821ec3fa7013b07d15 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:29:25 +0200 -Subject: [PATCH 026/105] s3:pylibsmb: Add ipc=True support for +Subject: [PATCH 026/104] s3:pylibsmb: Add ipc=True support for CLI_FULL_CONNECTION_IPC Signed-off-by: Andreas Schneider @@ -3164,13 +3164,13 @@ index 3fcc3424a57..3579a040830 100644 #ifdef HAVE_PTHREAD ret = py_cli_state_setup_mt_ev(self); -- -2.28.0 +2.29.2 -From 59831141a17195b9308d75257123134b0217489c Mon Sep 17 00:00:00 2001 +From 072dfd83ee6513658e0ec818fb548f70648d6a41 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 09:47:11 +0200 -Subject: [PATCH 027/105] python:tests: Mark libsmb connection as an IPC +Subject: [PATCH 027/104] python:tests: Mark libsmb connection as an IPC connection Signed-off-by: Andreas Schneider @@ -3193,13 +3193,13 @@ index ba7440df13b..2c028d381db 100644 DesiredAccess=0x12019f, ShareAccess=0x7, -- -2.28.0 +2.29.2 -From b9df53c20a753bf31b8684776f2b6aaaf1583abe Mon Sep 17 00:00:00 2001 +From ceb25f6cb4fd07cd736085030a02aefbcb012e34 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 17 Aug 2020 12:52:39 +0200 -Subject: [PATCH 028/105] python:tests: Set smb ipc signing via the creds API +Subject: [PATCH 028/104] python:tests: Set smb ipc signing via the creds API Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -3231,13 +3231,13 @@ index 2c028d381db..d6f5de7440a 100644 DesiredAccess=0x12019f, ShareAccess=0x7, -- -2.28.0 +2.29.2 -From c9e88d833db2b472099e5751b7731e337342d2c4 Mon Sep 17 00:00:00 2001 +From d3fe919fa5b952d075353f0d5c5366cabd5ef976 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:59:19 +0200 -Subject: [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in +Subject: [PATCH 029/104] s3:libsmb: Use 'enum smb_signing_setting' in cliconnect.c Signed-off-by: Andreas Schneider @@ -3361,13 +3361,13 @@ index d214cdabca4..995187e21b4 100644 void cli_nt_pipes_close(struct cli_state *cli); void cli_shutdown(struct cli_state *cli); -- -2.28.0 +2.29.2 -From 40c201c4d1b4621e823485e3082d0ca5799a6237 Mon Sep 17 00:00:00 2001 +From 0ec1b432bf807efe37fdedf346724e787742e3aa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:11:31 +0200 -Subject: [PATCH 030/105] s3:client: Turn off smb signing for message op +Subject: [PATCH 030/104] s3:client: Turn off smb signing for message op Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -3433,10 +3433,10 @@ index d6f5de7440a..34785e2a2a7 100644 self.smbfid = self.smbconn.create(pipename, DesiredAccess=0x12019f, diff --git a/source3/client/client.c b/source3/client/client.c -index f65293849d0..30287ffd253 100644 +index 8c7ceb644aa..56309efcea7 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -6228,7 +6228,10 @@ static int do_message_op(struct user_auth_info *a_info) +@@ -6164,7 +6164,10 @@ static int do_message_op(struct user_auth_info *a_info) status = cli_connect_nb(desthost, have_ip ? &dest_ss : NULL, port ? port : NBT_SMB_PORT, name_type, @@ -3513,13 +3513,13 @@ index 3579a040830..f8a4d56cf53 100644 NULL, self->ev, "myname", host, NULL, 0, share, "?????", cli_creds, flags, signing_state); -- -2.28.0 +2.29.2 -From 639de1d5ddf200d03f51b0436789f5dde4cd083b Mon Sep 17 00:00:00 2001 +From dd6a89dd02e675e1b836042e4a4dec31667ac58c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:20:02 +0200 -Subject: [PATCH 031/105] s3:libsmb: Remove signing_state from +Subject: [PATCH 031/104] s3:libsmb: Remove signing_state from cli_full_connection_creds_send() Signed-off-by: Andreas Schneider @@ -3612,13 +3612,13 @@ index f8a4d56cf53..c7a2d73afcb 100644 return -1; } -- -2.28.0 +2.29.2 -From 57336e07f2e23dade5fcd0b8f0d002202cda223d Mon Sep 17 00:00:00 2001 +From b31e224159fe25e8cf84e7d2ef8bc53934ddd209 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 14:59:14 +0200 -Subject: [PATCH 032/105] s3:libsmb: Remove signing_state from +Subject: [PATCH 032/104] s3:libsmb: Remove signing_state from cli_full_connection_creds() Signed-off-by: Andreas Schneider @@ -3782,10 +3782,10 @@ index bef04d32638..850cf12c8a6 100644 const char *service, const char *pass, const char *dev, uint16_t *max_xmit, uint16_t *tid); diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index 16e3ee485f0..e98401a4365 100644 +index f578f1c4131..906fab2adb5 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -2482,8 +2482,7 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c +@@ -2483,8 +2483,7 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, &rm_addr, 0, "IPC$", "IPC", anon_creds, @@ -3983,13 +3983,13 @@ index 954d6eba804..fea066ce468 100644 DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); return NULL; -- -2.28.0 +2.29.2 -From 6752c123f20d46aa68725971e09548a47b7c7457 Mon Sep 17 00:00:00 2001 +From 49430d65ac0e11cdfec07c55b72f030c959f576f Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 8 Jun 2020 08:04:24 +0200 -Subject: [PATCH 033/105] s3:libsmb: Add encryption support to +Subject: [PATCH 033/104] s3:libsmb: Add encryption support to cli_full_connection_creds*() Pair-Programmed-With: Andreas Schneider @@ -4200,13 +4200,13 @@ index b24743d789b..abfd18bfaf1 100644 } -- -2.28.0 +2.29.2 -From bdb894ebb29820b97dba3721a517a61d96fac152 Mon Sep 17 00:00:00 2001 +From cc6eca3fe233c16d879f9a76aae022320e7044d7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 11:26:00 +0200 -Subject: [PATCH 034/105] python: Add a test for SMB encryption +Subject: [PATCH 034/104] python: Add a test for SMB encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4274,13 +4274,13 @@ index e8f8e7fe94d..81d4e482644 100644 if __name__ == "__main__": import unittest -- -2.28.0 +2.29.2 -From d26afd8352435db71c542388220e951184adcdde Mon Sep 17 00:00:00 2001 +From 3bb0f6be56244767f78e8d0e085f2f7555585225 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:31:02 +0200 -Subject: [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() +Subject: [PATCH 035/104] s3:net: Use cli_credentials_set_smb_encryption() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4323,13 +4323,13 @@ index b139fb2d0da..5829d891075 100644 } -- -2.28.0 +2.29.2 -From c228933e88c6b615fa49402d2e826a5ec14b9f85 Mon Sep 17 00:00:00 2001 +From 16aaa2f7395d235f72582a5190c9bf5d90578b9d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:40:13 +0200 -Subject: [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() +Subject: [PATCH 036/104] s3:libsmb: Use cli_credentials_set_smb_encryption() This also adds a SMBC_ENCRYPTLEVEL_DEFAULT to 'enum smbc_smb_encrypt_level' in order to use the smb.conf default value. @@ -4682,13 +4682,13 @@ index ec4a516b2ee..61503d0a98b 100644 + vnum='0.7.0', pc_files='smbclient.pc') -- -2.28.0 +2.29.2 -From 76dc706e6449161c27a5f117bc45922ab467dbfc Mon Sep 17 00:00:00 2001 +From eaa0bdc5931b82f9adbb65070252208be26a9d28 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:43:33 +0200 -Subject: [PATCH 037/105] s3:client: Remove unused smb encryption code +Subject: [PATCH 037/104] s3:client: Remove unused smb encryption code Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4718,13 +4718,13 @@ index f56dc323b6e..16a8d44c069 100644 *output_cli = cli; return NT_STATUS_OK; -- -2.28.0 +2.29.2 -From a444688a6ed50c8443a778fbddb4dbd8a39d49d4 Mon Sep 17 00:00:00 2001 +From 63179da4a51fefc5d938339360d579f725875389 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:47:05 +0200 -Subject: [PATCH 038/105] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 038/104] s3:utils: Remove obsolete force encryption from smbacls Signed-off-by: Andreas Schneider @@ -4755,13 +4755,13 @@ index 5983ebbd0a5..8fd9fcc5780 100644 } -- -2.28.0 +2.29.2 -From 21b72b6107cd849b9da77e17520e658745fb897a Mon Sep 17 00:00:00 2001 +From f113666b62c0fbe960f9ac22aea63241b56ffc61 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:48:18 +0200 -Subject: [PATCH 039/105] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 039/104] s3:utils: Remove obsolete force encryption from mdfind Signed-off-by: Andreas Schneider @@ -4789,13 +4789,13 @@ index 2ac4fde7daf..ef2657e4fa5 100644 NCACN_NP, &ndr_table_mdssvc, -- -2.28.0 +2.29.2 -From 842c3c1346cba54c92d6ba2d462818875403a394 Mon Sep 17 00:00:00 2001 +From 4f3770237e1a3d41c725560d9e5c14786b98d2f9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:49:28 +0200 -Subject: [PATCH 040/105] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 040/104] s3:utils: Remove obsolete force encryption from smbcquotas Signed-off-by: Andreas Schneider @@ -4827,13 +4827,13 @@ index fea066ce468..4ceac7b3ab0 100644 } -- -2.28.0 +2.29.2 -From be36aec550d817bbcfdea88b433e31b44886ba19 Mon Sep 17 00:00:00 2001 +From b897f3360dae5737d646dbce9f7571b1cfb070b0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:51:18 +0200 -Subject: [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from +Subject: [PATCH 041/104] s3:rpcclient: Remove obsolete force encryption from rpcclient Signed-off-by: Andreas Schneider @@ -4865,13 +4865,13 @@ index 2ead6cc7ba5..575a42ebf70 100644 memset(cmdline_auth_info.password,'X',sizeof(cmdline_auth_info.password)); #endif -- -2.28.0 +2.29.2 -From 8e2de7801238eb7f1090a9307dc4b05885b3dda2 Mon Sep 17 00:00:00 2001 +From b01458095b5e815c09eb71fb597598e9f34ee342 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 10:58:36 +0200 -Subject: [PATCH 042/105] examples: Remove obsolete force encryption from +Subject: [PATCH 042/104] examples: Remove obsolete force encryption from smb2mount Signed-off-by: Andreas Schneider @@ -4903,13 +4903,13 @@ index 6206c3a9701..c64be573462 100644 } -- -2.28.0 +2.29.2 -From 8c9a31cc180c674925919771ccdce1bb6895c1a3 Mon Sep 17 00:00:00 2001 +From 66eb5d32234f2e7700a43504158507a6f828c50b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 11:05:59 +0200 -Subject: [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() +Subject: [PATCH 043/104] s3:libsmb: Make cli_cm_force_encryption_creds() static Signed-off-by: Andreas Schneider @@ -4951,13 +4951,13 @@ index 850cf12c8a6..eeabcaa7463 100644 struct cli_state *referring_cli, const char *server, -- -2.28.0 +2.29.2 -From 6e2a7196c424edd2c447cfd4377e38e5b51ee675 Mon Sep 17 00:00:00 2001 +From 3b8e9646f0a79e2cbb977b8c1d0fc5f28a9b7490 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 16:16:55 +0200 -Subject: [PATCH 044/105] s4:libcli: Return NTSTATUS errors for +Subject: [PATCH 044/104] s4:libcli: Return NTSTATUS errors for smb_composite_connect_send() Signed-off-by: Andreas Schneider @@ -5051,13 +5051,13 @@ index 582d43ef173..ad50ae0ac81 100644 return smb_composite_connect_recv(c, mem_ctx); } -- -2.28.0 +2.29.2 -From cf89573a78556993d7ecb43257d347edc6c61151 Mon Sep 17 00:00:00 2001 +From cecd31a2451e20046c0202837269fb533e3118a7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:54:26 +0200 -Subject: [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 +Subject: [PATCH 045/104] s4:libcli: Return if encryption is requested for SMB1 Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5088,13 +5088,13 @@ index 6ee4929e8d7..51e121bdce6 100644 if (composite_nomem(state, c)) return c; c->private_data = state; -- -2.28.0 +2.29.2 -From 05914c4f85f71c7d1df884e33b8c0b8f5062ee3b Mon Sep 17 00:00:00 2001 +From ed5b2f36fec30ae7b277620cb82f01a07f027e0e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:29:39 +0200 -Subject: [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() +Subject: [PATCH 046/104] s3:libcli: Split out smb2_connect_tcon_start() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5141,13 +5141,13 @@ index 6fc3993a4e8..95ff05eac8f 100644 subreq = smb2cli_tcon_send(state, state->ev, -- -2.28.0 +2.29.2 -From 63b0086d8ffdfca44134c09ff0db76d7a9ae8f6c Mon Sep 17 00:00:00 2001 +From 7eb81b6448064d8beee3972471723b90ea9307ec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:44:26 +0200 -Subject: [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() +Subject: [PATCH 047/104] s4:libcli: Add smb2_connect_enc_start() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5212,13 +5212,13 @@ index 95ff05eac8f..3a3ecdf20e8 100644 } -- -2.28.0 +2.29.2 -From 8bc1b5f884d1e6a88e1ac403d9bc64c3b77e9428 Mon Sep 17 00:00:00 2001 +From b5b0c28d597d8ef98b632e4616d2d2cdaaad37a9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 10:18:52 +0200 -Subject: [PATCH 048/105] s4:libcli: Require signing for SMB encryption +Subject: [PATCH 048/104] s4:libcli: Require signing for SMB encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5268,13 +5268,13 @@ index 3a3ecdf20e8..9540704491e 100644 if (tevent_req_nterror(req, status)) { return tevent_req_post(req, ev); -- -2.28.0 +2.29.2 -From 5cc8a0bc7381444804cde992afdc7aa0c0b70074 Mon Sep 17 00:00:00 2001 +From ee95e01cdc3917fc371b3145dcbe6d23ffc054b1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 14:27:07 +0200 -Subject: [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC +Subject: [PATCH 049/104] python:tests: Add test for SMB encrypted DCERPC connection Signed-off-by: Andreas Schneider @@ -5389,13 +5389,13 @@ index 20981754db4..adcb5b53189 100644 def cmdline(script, *args): -- -2.28.0 +2.29.2 -From 546ecfae4f11e0625de86e47e90a98a7aafa0453 Mon Sep 17 00:00:00 2001 +From fefa1d0236c67b2a93328eb9e0eac21da22235b2 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:47:54 +0200 -Subject: [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() +Subject: [PATCH 050/104] auth:gensec: Add gensec_security_sasl_names() Pair-Programmed-With: Andreas Schneider @@ -5519,13 +5519,13 @@ index d2d62d6652e..4eb45643714 100644 * Return a unique list of security subsystems from those specified in * the list of SASL names. -- -2.28.0 +2.29.2 -From ec079d88720a99a5bc5e6b5efd03f87342364f15 Mon Sep 17 00:00:00 2001 +From adf58a175cea99c0b0147d3b3275563c7155edfa Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:48:27 +0200 -Subject: [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in +Subject: [PATCH 051/104] s4:ldap_server: Use samba_server_gensec_start() in ldapsrv_backend_Init() Signed-off-by: Stefan Metzmacher @@ -5631,13 +5631,13 @@ index 2839082daef..915d9b94f9b 100644 ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs); } -- -2.28.0 +2.29.2 -From bc128ea1ea455a3a63e0ce3dc8777a7482c356f8 Mon Sep 17 00:00:00 2001 +From e887d94b47aca3609fd158efe0f4654101c5e02b Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:39:15 +0200 -Subject: [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a +Subject: [PATCH 052/104] auth:gensec: Make gensec_use_kerberos_mechs() a static function Signed-off-by: Stefan Metzmacher @@ -5681,13 +5681,13 @@ index 4eb45643714..ebcab76999a 100644 const struct gensec_security_ops **new_gensec_list; int i, j, num_mechs_in; -- -2.28.0 +2.29.2 -From 37b7016fba1eae75fc4a87c9c5aebbbb47b7ff39 Mon Sep 17 00:00:00 2001 +From 08dc4775dbf72a1e8068d392360be158d8305bfa Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:41:43 +0200 -Subject: [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to +Subject: [PATCH 053/104] auth:gensec: Pass use_kerberos and keep_schannel to gensec_use_kerberos_mechs() Signed-off-by: Stefan Metzmacher @@ -5755,13 +5755,13 @@ index ebcab76999a..8d1b41fec74 100644 } -- -2.28.0 +2.29.2 -From 0579dbd6faa5a828cff42cd797f78c51316324b0 Mon Sep 17 00:00:00 2001 +From bc505a449449267085778ec51c5362e256837edb Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 17:00:45 +0200 -Subject: [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel +Subject: [PATCH 054/104] auth:gensec: If Kerberos is required, keep schannel for machine account auth Signed-off-by: Stefan Metzmacher @@ -5792,13 +5792,13 @@ index 8d1b41fec74..3f42d611140 100644 if (gensec_security->settings->backends) { -- -2.28.0 +2.29.2 -From 0f3676f4f84184b5bf83101e0b1eca0bb05a5079 Mon Sep 17 00:00:00 2001 +From 9b7a189e038e3f783a2b23302f0ee4657ef18057 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:21 +0200 -Subject: [PATCH 055/105] auth:creds: Add cli_credentials_init_server() +Subject: [PATCH 055/104] auth:creds: Add cli_credentials_init_server() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5858,13 +5858,13 @@ index 7d0cf53194b..438bcdce232 100644 bool cli_credentials_wrong_password(struct cli_credentials *cred); const char *cli_credentials_get_password(struct cli_credentials *cred); -- -2.28.0 +2.29.2 -From e1d566c2962ebd5596638df6f81fd120aaf32fcd Mon Sep 17 00:00:00 2001 +From 013d5eb87f3ddcda6df5c76796bede7a85c42207 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:36 +0200 -Subject: [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() +Subject: [PATCH 056/104] s4:rpc_server: Use cli_credentials_init_server() Signed-off-by: Andreas Schneider (cherry picked from commit 6c94ebf77fdb7383be2042f5e20ba2ef598cd4a4) @@ -5906,13 +5906,13 @@ index 084857a44bf..e64148ef788 100644 call->event_ctx, imsg_ctx, -- -2.28.0 +2.29.2 -From 694e1d1ca62372baba69818acf25a2eec8847115 Mon Sep 17 00:00:00 2001 +From 6e6030dca006e829150e6b64db0485e3c9895485 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 7 Sep 2020 09:19:43 +0200 -Subject: [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for +Subject: [PATCH 057/104] s4:smb_server: Use cli_credentials_init_server() for negprot Signed-off-by: Andreas Schneider @@ -6006,13 +6006,13 @@ index 4aaaf46793b..c433eb194bd 100644 req->smb_conn->negotiate.server_credentials = talloc_steal(req->smb_conn, server_credentials); -- -2.28.0 +2.29.2 -From c3b277172554d1d3155c3a1b4ad76685985273df Mon Sep 17 00:00:00 2001 +From f9f25b7690c2e234ea2e631f05c1fb0180776842 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:22 +0200 -Subject: [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb +Subject: [PATCH 058/104] selftest: Rename 'smb encrypt' to 'server smb encrypt' This makes it more clear what we want. 'smb encrypt' is a synonym for @@ -6026,7 +6026,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index 0a8cefa811d..a31165b372d 100755 +index e141f102ef1..c070086ca49 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -1178,7 +1178,7 @@ sub setup_simpleserver @@ -6047,7 +6047,7 @@ index 0a8cefa811d..a31165b372d 100755 [hidenewfiles] path = $prefix_abs/share -@@ -2340,7 +2340,7 @@ sub provision($$) +@@ -2351,7 +2351,7 @@ sub provision($$) [tmpenc] path = $shrdir comment = encrypt smb username is [%U] @@ -6057,13 +6057,13 @@ index 0a8cefa811d..a31165b372d 100755 [tmpguest] path = $shrdir -- -2.28.0 +2.29.2 -From 355afa22953cf8838dc83210315bc2557e764082 Mon Sep 17 00:00:00 2001 +From 2fc16a8d11f48424fc2fff0380fb623f552ece5f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 12:30:08 +0200 -Subject: [PATCH 059/105] selftest: Move enc_desired to provision to have it in +Subject: [PATCH 059/104] selftest: Move enc_desired to provision to have it in 'fileserver' too Signed-off-by: Andreas Schneider @@ -6074,7 +6074,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index a31165b372d..eda2c428793 100755 +index c070086ca49..fa3ca8962a5 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -1242,11 +1242,6 @@ sub setup_simpleserver @@ -6089,7 +6089,7 @@ index a31165b372d..eda2c428793 100755 [hidenewfiles] path = $prefix_abs/share hide new files timeout = 5 -@@ -2822,7 +2817,13 @@ sub provision($$) +@@ -2833,7 +2828,13 @@ sub provision($$) [delete_readonly] path = $prefix_abs/share delete readonly = yes @@ -6104,13 +6104,13 @@ index a31165b372d..eda2c428793 100755 my $net = Samba::bindir_path($self, "net"); -- -2.28.0 +2.29.2 -From 2a8b98850f61219a1c97da9151e55d0e21a4265b Mon Sep 17 00:00:00 2001 +From 299d7d6868e9590693e465cbc0c10abe8b7fc5a0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:20 +0200 -Subject: [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb +Subject: [PATCH 060/104] s3:tests: Add smbclient tests for 'client smb encrypt' Signed-off-by: Andreas Schneider @@ -6134,10 +6134,10 @@ index 00000000000..972096bdc8b +^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver +^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index eda2c428793..9f86f2b59cf 100755 +index fa3ca8962a5..ffc19c7d5a2 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm -@@ -2822,6 +2822,11 @@ sub provision($$) +@@ -2833,6 +2833,11 @@ sub provision($$) path = $prefix_abs/share vfs objects = server smb encrypt = desired @@ -6228,7 +6228,7 @@ index 00000000000..9a717cdac4f + +testok $0 $failed diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py -index d05de6bd08c..ec967caea2e 100755 +index 27dc7587b17..46bf274227c 100755 --- a/source3/selftest/tests.py +++ b/source3/selftest/tests.py @@ -1040,6 +1040,12 @@ plantestsuite("samba3.blackbox.smbclient.encryption_off", "simpleserver", @@ -6245,13 +6245,13 @@ index d05de6bd08c..ec967caea2e 100755 [os.path.join(samba3srcdir, "script/tests/test_rpcclient_netsessenum.sh"), -- -2.28.0 +2.29.2 -From 45ebf91c66a23488c0835ba038eca345db984106 Mon Sep 17 00:00:00 2001 +From d996ccf7dc53046f92827ddab72aac6e92dd3a77 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:19:27 +0200 -Subject: [PATCH 061/105] s3:client: Remove global smb_encrypt +Subject: [PATCH 061/104] s3:client: Remove global smb_encrypt Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6261,10 +6261,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index 30287ffd253..e1128bf4a8c 100644 +index 56309efcea7..60d4fb3c5ee 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -98,9 +98,6 @@ static unsigned int put_total_time_ms = 0; +@@ -96,9 +96,6 @@ static unsigned int put_total_time_ms = 0; /* totals globals */ static double dir_total; @@ -6274,7 +6274,7 @@ index 30287ffd253..e1128bf4a8c 100644 /* root cli_state connection */ struct cli_state *cli; -@@ -2822,7 +2819,7 @@ static int cmd_posix_encrypt(void) +@@ -2758,7 +2755,7 @@ static int cmd_posix_encrypt(void) d_printf("posix_encrypt failed with error %s\n", nt_errstr(status)); } else { d_printf("encryption on\n"); @@ -6283,7 +6283,7 @@ index 30287ffd253..e1128bf4a8c 100644 } return 0; -@@ -5347,6 +5344,9 @@ int cmd_iosize(void) +@@ -5283,6 +5280,9 @@ int cmd_iosize(void) TALLOC_CTX *ctx = talloc_tos(); char *buf; int iosize; @@ -6293,7 +6293,7 @@ index 30287ffd253..e1128bf4a8c 100644 if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_SMB2_02) { -@@ -5610,6 +5610,9 @@ static int process_command_string(const char *cmd_in) +@@ -5546,6 +5546,9 @@ static int process_command_string(const char *cmd_in) TALLOC_CTX *ctx = talloc_tos(); char *cmd = talloc_strdup(ctx, cmd_in); int rc = 0; @@ -6303,7 +6303,7 @@ index 30287ffd253..e1128bf4a8c 100644 if (!cmd) { return 1; -@@ -6063,6 +6066,9 @@ static int process(const char *base_directory) +@@ -5999,6 +6002,9 @@ static int process(const char *base_directory) { int rc = 0; NTSTATUS status; @@ -6313,7 +6313,7 @@ index 30287ffd253..e1128bf4a8c 100644 status = cli_cm_open(talloc_tos(), NULL, desthost, -@@ -6101,6 +6107,9 @@ static int process(const char *base_directory) +@@ -6037,6 +6043,9 @@ static int process(const char *base_directory) static int do_host_query(const char *query_host) { NTSTATUS status; @@ -6323,7 +6323,7 @@ index 30287ffd253..e1128bf4a8c 100644 status = cli_cm_open(talloc_tos(), NULL, query_host, -@@ -6178,6 +6187,9 @@ static int do_tar_op(const char *base_directory) +@@ -6114,6 +6123,9 @@ static int do_tar_op(const char *base_directory) { struct tar *tar_ctx = tar_get_ctx(); int ret = 0; @@ -6333,7 +6333,7 @@ index 30287ffd253..e1128bf4a8c 100644 /* do we already have a connection? */ if (!cli) { -@@ -6523,9 +6535,6 @@ int main(int argc,char *argv[]) +@@ -6459,9 +6471,6 @@ int main(int argc,char *argv[]) case 'q': quiet=true; break; @@ -6343,7 +6343,7 @@ index 30287ffd253..e1128bf4a8c 100644 case 'B': return(do_smb_browse()); -@@ -6595,8 +6604,6 @@ int main(int argc,char *argv[]) +@@ -6531,8 +6540,6 @@ int main(int argc,char *argv[]) /* Ensure we have a password (or equivalent). */ popt_common_credentials_post(); @@ -6353,13 +6353,13 @@ index 30287ffd253..e1128bf4a8c 100644 max_protocol = lp_client_max_protocol(); -- -2.28.0 +2.29.2 -From 088473e47bcb30fe3b179133265da9ea6b8ec684 Mon Sep 17 00:00:00 2001 +From b923ea7625de03e23a999a3cb844d81dcd25316f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:24:27 +0200 -Subject: [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() +Subject: [PATCH 062/104] s3:libsmb: Remove force_encrypt from cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6372,10 +6372,10 @@ Reviewed-by: Jeremy Allison 4 files changed, 6 insertions(+), 21 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index e1128bf4a8c..1f18024b798 100644 +index 60d4fb3c5ee..3a610086511 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -5610,9 +5610,6 @@ static int process_command_string(const char *cmd_in) +@@ -5546,9 +5546,6 @@ static int process_command_string(const char *cmd_in) TALLOC_CTX *ctx = talloc_tos(); char *cmd = talloc_strdup(ctx, cmd_in); int rc = 0; @@ -6385,7 +6385,7 @@ index e1128bf4a8c..1f18024b798 100644 if (!cmd) { return 1; -@@ -5625,7 +5622,6 @@ static int process_command_string(const char *cmd_in) +@@ -5561,7 +5558,6 @@ static int process_command_string(const char *cmd_in) status = cli_cm_open(talloc_tos(), NULL, desthost, service, popt_get_cmdline_auth_info(), @@ -6393,7 +6393,7 @@ index e1128bf4a8c..1f18024b798 100644 max_protocol, have_ip ? &dest_ss : NULL, port, name_type, -@@ -6066,14 +6062,11 @@ static int process(const char *base_directory) +@@ -6002,14 +5998,11 @@ static int process(const char *base_directory) { int rc = 0; NTSTATUS status; @@ -6409,7 +6409,7 @@ index e1128bf4a8c..1f18024b798 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6107,14 +6100,11 @@ static int process(const char *base_directory) +@@ -6043,14 +6036,11 @@ static int process(const char *base_directory) static int do_host_query(const char *query_host) { NTSTATUS status; @@ -6425,7 +6425,7 @@ index e1128bf4a8c..1f18024b798 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6161,7 +6151,7 @@ static int do_host_query(const char *query_host) +@@ -6097,7 +6087,7 @@ static int do_host_query(const char *query_host) status = cli_cm_open(talloc_tos(), NULL, query_host, "IPC$", popt_get_cmdline_auth_info(), @@ -6434,7 +6434,7 @@ index e1128bf4a8c..1f18024b798 100644 have_ip ? &dest_ss : NULL, NBT_SMB_PORT, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6187,9 +6177,6 @@ static int do_tar_op(const char *base_directory) +@@ -6123,9 +6113,6 @@ static int do_tar_op(const char *base_directory) { struct tar *tar_ctx = tar_get_ctx(); int ret = 0; @@ -6444,7 +6444,7 @@ index e1128bf4a8c..1f18024b798 100644 /* do we already have a connection? */ if (!cli) { -@@ -6198,7 +6185,7 @@ static int do_tar_op(const char *base_directory) +@@ -6134,7 +6121,7 @@ static int do_tar_op(const char *base_directory) status = cli_cm_open(talloc_tos(), NULL, desthost, service, popt_get_cmdline_auth_info(), @@ -6507,13 +6507,13 @@ index eeabcaa7463..bb3e9e6874e 100644 const struct sockaddr_storage *dest_ss, int port, -- -2.28.0 +2.29.2 -From 0291ff12056c914b3f9429a5bba48190897fe6c1 Mon Sep 17 00:00:00 2001 +From 2fd26f4c208556cd2f28f0c54fe11cea044c7881 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:26:39 +0200 -Subject: [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() +Subject: [PATCH 063/104] s3:libsmb: Remove force_encrypt from cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6569,13 +6569,13 @@ index 4825b8f3fae..b0032005398 100644 NULL, /* dest_ss */ 0, /* port */ -- -2.28.0 +2.29.2 -From 32f7fd016ecbeb3b24ad93d593ba06e8292dd02f Mon Sep 17 00:00:00 2001 +From 3db1056dc42765aa3043b6ea0fd0389a34a41145 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:28:28 +0200 -Subject: [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs +Subject: [PATCH 064/104] s3:libsmb: Remove force_encrypt from clidfs do_connect() Signed-off-by: Andreas Schneider @@ -6630,13 +6630,13 @@ index b0032005398..5503506de97 100644 if (!NT_STATUS_IS_OK(status)) { -- -2.28.0 +2.29.2 -From 4afc92a55aa63557db2b4e2a9b0bbe5bc7d12c55 Mon Sep 17 00:00:00 2001 +From 8b234932ec76052258078d08071c33fefd5f3a0e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:52:11 +0200 -Subject: [PATCH 065/105] s3:libsmb: Remove force_encrypt from +Subject: [PATCH 065/104] s3:libsmb: Remove force_encrypt from cli_check_msdfs_proxy() Signed-off-by: Andreas Schneider @@ -6727,13 +6727,13 @@ index bb3e9e6874e..f2b0a8c5ff8 100644 /* The following definitions come from libsmb/clientgen.c */ -- -2.28.0 +2.29.2 -From 2c50d0ba7eec6d37943b7afdf426b114c9e1f292 Mon Sep 17 00:00:00 2001 +From b1324ba3361e66ca4bdf5b0cb0e1d8c8084955d4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:15:09 +0200 -Subject: [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs +Subject: [PATCH 066/104] s3:libsmb: Pass cli_credentials to clidfs do_connect() Signed-off-by: Andreas Schneider @@ -6846,13 +6846,13 @@ index 736c565a7a8..d536e0597af 100644 dest_ss, port, name_type, &cli); -- -2.28.0 +2.29.2 -From 608c0b87761f75e539b2e1e7599ceb981770b647 Mon Sep 17 00:00:00 2001 +From 5997be2fc0d9b25c7a81d1d21e3cc1cd3f55e66f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:18:16 +0200 -Subject: [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() +Subject: [PATCH 067/104] s3:libsmb: Pass cli_credentials to cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6917,13 +6917,13 @@ index d536e0597af..a2c6f5fe5ec 100644 NULL, /* dest_ss */ 0, /* port */ -- -2.28.0 +2.29.2 -From d6d5da0e28c3879280e1139f51bfe2ef03bc450e Mon Sep 17 00:00:00 2001 +From 62109132050092a5b4ac81d80cb358e563da605c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:26:54 +0200 -Subject: [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() +Subject: [PATCH 068/104] s3:libsmb: Pass cli_credentials to cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6936,10 +6936,10 @@ Reviewed-by: Jeremy Allison 4 files changed, 42 insertions(+), 28 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index 1f18024b798..35bc3a7c5c3 100644 +index 3a610086511..c54b5065b44 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -5610,6 +5610,8 @@ static int process_command_string(const char *cmd_in) +@@ -5546,6 +5546,8 @@ static int process_command_string(const char *cmd_in) TALLOC_CTX *ctx = talloc_tos(); char *cmd = talloc_strdup(ctx, cmd_in); int rc = 0; @@ -6948,7 +6948,7 @@ index 1f18024b798..35bc3a7c5c3 100644 if (!cmd) { return 1; -@@ -5621,7 +5623,8 @@ static int process_command_string(const char *cmd_in) +@@ -5557,7 +5559,8 @@ static int process_command_string(const char *cmd_in) status = cli_cm_open(talloc_tos(), NULL, desthost, @@ -6958,7 +6958,7 @@ index 1f18024b798..35bc3a7c5c3 100644 max_protocol, have_ip ? &dest_ss : NULL, port, name_type, -@@ -6062,10 +6065,13 @@ static int process(const char *base_directory) +@@ -5998,10 +6001,13 @@ static int process(const char *base_directory) { int rc = 0; NTSTATUS status; @@ -6973,7 +6973,7 @@ index 1f18024b798..35bc3a7c5c3 100644 max_protocol, have_ip ? &dest_ss : NULL, port, name_type, &cli); -@@ -6100,10 +6106,13 @@ static int process(const char *base_directory) +@@ -6036,10 +6042,13 @@ static int process(const char *base_directory) static int do_host_query(const char *query_host) { NTSTATUS status; @@ -6988,7 +6988,7 @@ index 1f18024b798..35bc3a7c5c3 100644 max_protocol, have_ip ? &dest_ss : NULL, port, name_type, &cli); -@@ -6150,7 +6159,8 @@ static int do_host_query(const char *query_host) +@@ -6086,7 +6095,8 @@ static int do_host_query(const char *query_host) d_printf("Reconnecting with SMB1 for workgroup listing.\n"); status = cli_cm_open(talloc_tos(), NULL, query_host, @@ -6998,7 +6998,7 @@ index 1f18024b798..35bc3a7c5c3 100644 max_proto, have_ip ? &dest_ss : NULL, NBT_SMB_PORT, name_type, &cli); -@@ -6177,6 +6187,8 @@ static int do_tar_op(const char *base_directory) +@@ -6113,6 +6123,8 @@ static int do_tar_op(const char *base_directory) { struct tar *tar_ctx = tar_get_ctx(); int ret = 0; @@ -7007,7 +7007,7 @@ index 1f18024b798..35bc3a7c5c3 100644 /* do we already have a connection? */ if (!cli) { -@@ -6184,7 +6196,8 @@ static int do_tar_op(const char *base_directory) +@@ -6120,7 +6132,8 @@ static int do_tar_op(const char *base_directory) status = cli_cm_open(talloc_tos(), NULL, desthost, @@ -7128,13 +7128,13 @@ index f2b0a8c5ff8..0b8cf2a6036 100644 struct client_dfs_referral; NTSTATUS cli_dfs_get_referral_ex(TALLOC_CTX *ctx, -- -2.28.0 +2.29.2 -From 1c07abb4b9690b62b2ae7841134d7a71e4771bb9 Mon Sep 17 00:00:00 2001 +From 9500031d977b874b32085df3ff7f5b0ae28514c6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:42:25 +0200 -Subject: [PATCH 069/105] s3:libsmb: Pass cli_credentials to +Subject: [PATCH 069/104] s3:libsmb: Pass cli_credentials to cli_resolve_path(), using helper variables. Signed-off-by: Andreas Schneider @@ -7152,10 +7152,10 @@ Signed-off-by: Jeremy Allison 8 files changed, 188 insertions(+), 47 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index 35bc3a7c5c3..23de5befee3 100644 +index c54b5065b44..13e48f80a01 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -300,9 +300,14 @@ static int do_dskattr(void) +@@ -298,9 +298,14 @@ static int do_dskattr(void) struct cli_state *targetcli = NULL; char *targetpath = NULL; TALLOC_CTX *ctx = talloc_tos(); @@ -7171,7 +7171,7 @@ index 35bc3a7c5c3..23de5befee3 100644 client_get_cur_dir(), &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { -@@ -392,6 +397,8 @@ static int do_cd(const char *new_dir) +@@ -390,6 +395,8 @@ static int do_cd(const char *new_dir) uint32_t attributes; int ret = 1; TALLOC_CTX *ctx = talloc_stackframe(); @@ -7180,7 +7180,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; newdir = talloc_strdup(ctx, new_dir); -@@ -434,7 +441,8 @@ static int do_cd(const char *new_dir) +@@ -432,7 +439,8 @@ static int do_cd(const char *new_dir) new_cd = client_clean_name(ctx, new_cd); client_set_cur_dir(new_cd); @@ -7190,7 +7190,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, new_cd, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("cd %s: %s\n", new_cd, nt_errstr(status)); -@@ -811,6 +819,8 @@ NTSTATUS do_list(const char *mask, +@@ -809,6 +817,8 @@ NTSTATUS do_list(const char *mask, TALLOC_CTX *ctx = talloc_tos(); struct cli_state *targetcli = NULL; char *targetpath = NULL; @@ -7199,7 +7199,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS ret_status = NT_STATUS_OK; NTSTATUS status = NT_STATUS_OK; -@@ -834,7 +844,7 @@ NTSTATUS do_list(const char *mask, +@@ -832,7 +842,7 @@ NTSTATUS do_list(const char *mask, /* check for dfs */ status = cli_resolve_path(ctx, "", @@ -7208,7 +7208,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, head, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("do_list: [%s] %s\n", head, -@@ -1044,6 +1054,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) +@@ -1042,6 +1052,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) struct cli_state *targetcli = NULL; char *targetname = NULL; char *lname = NULL; @@ -7217,7 +7217,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; lname = talloc_strdup(ctx, lname_in); -@@ -1058,7 +1070,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) +@@ -1056,7 +1068,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) } } @@ -7227,7 +7227,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, rname, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); -@@ -1477,9 +1490,12 @@ static bool do_mkdir(const char *name) +@@ -1413,9 +1426,12 @@ static bool do_mkdir(const char *name) TALLOC_CTX *ctx = talloc_tos(); struct cli_state *targetcli; char *targetname = NULL; @@ -7241,7 +7241,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, name, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("mkdir %s: %s\n", name, nt_errstr(status)); -@@ -1538,6 +1554,8 @@ static int cmd_mkdir(void) +@@ -1474,6 +1490,8 @@ static int cmd_mkdir(void) TALLOC_CTX *ctx = talloc_tos(); char *mask = NULL; char *buf = NULL; @@ -7250,7 +7250,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; mask = talloc_strdup(ctx, client_get_cur_dir()); -@@ -1574,7 +1592,8 @@ static int cmd_mkdir(void) +@@ -1510,7 +1528,8 @@ static int cmd_mkdir(void) } status = cli_resolve_path(ctx, "", @@ -7260,7 +7260,7 @@ index 35bc3a7c5c3..23de5befee3 100644 &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { return 1; -@@ -1888,9 +1907,12 @@ static int do_put(const char *rname, const char *lname, bool reput) +@@ -1824,9 +1843,12 @@ static int do_put(const char *rname, const char *lname, bool reput) struct cli_state *targetcli; char *targetname = NULL; struct push_state state; @@ -7274,7 +7274,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, rname, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); -@@ -2665,6 +2687,8 @@ static int cmd_wdel(void) +@@ -2601,6 +2623,8 @@ static int cmd_wdel(void) uint32_t attribute; struct cli_state *targetcli; char *targetname = NULL; @@ -7283,7 +7283,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2690,7 +2714,8 @@ static int cmd_wdel(void) +@@ -2626,7 +2650,8 @@ static int cmd_wdel(void) return 1; } @@ -7293,7 +7293,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("cmd_wdel %s: %s\n", mask, nt_errstr(status)); -@@ -2716,6 +2741,8 @@ static int cmd_open(void) +@@ -2652,6 +2677,8 @@ static int cmd_open(void) char *targetname = NULL; struct cli_state *targetcli; uint16_t fnum = (uint16_t)-1; @@ -7302,7 +7302,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2735,7 +2762,8 @@ static int cmd_open(void) +@@ -2671,7 +2698,8 @@ static int cmd_open(void) return 1; } @@ -7312,7 +7312,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("open %s: %s\n", mask, nt_errstr(status)); -@@ -2837,6 +2865,8 @@ static int cmd_posix_open(void) +@@ -2773,6 +2801,8 @@ static int cmd_posix_open(void) struct cli_state *targetcli; mode_t mode; uint16_t fnum; @@ -7321,7 +7321,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2861,7 +2891,8 @@ static int cmd_posix_open(void) +@@ -2797,7 +2827,8 @@ static int cmd_posix_open(void) } mode = (mode_t)strtol(buf, (char **)NULL, 8); @@ -7331,7 +7331,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_open %s: %s\n", mask, nt_errstr(status)); -@@ -2896,6 +2927,8 @@ static int cmd_posix_mkdir(void) +@@ -2832,6 +2863,8 @@ static int cmd_posix_mkdir(void) char *targetname = NULL; struct cli_state *targetcli; mode_t mode; @@ -7340,7 +7340,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2920,7 +2953,8 @@ static int cmd_posix_mkdir(void) +@@ -2856,7 +2889,8 @@ static int cmd_posix_mkdir(void) } mode = (mode_t)strtol(buf, (char **)NULL, 8); @@ -7350,7 +7350,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_mkdir %s: %s\n", mask, nt_errstr(status)); -@@ -2944,6 +2978,8 @@ static int cmd_posix_unlink(void) +@@ -2880,6 +2914,8 @@ static int cmd_posix_unlink(void) char *buf = NULL; char *targetname = NULL; struct cli_state *targetcli; @@ -7359,7 +7359,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2962,7 +2998,8 @@ static int cmd_posix_unlink(void) +@@ -2898,7 +2934,8 @@ static int cmd_posix_unlink(void) return 1; } @@ -7369,7 +7369,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_unlink %s: %s\n", mask, nt_errstr(status)); -@@ -2987,6 +3024,8 @@ static int cmd_posix_rmdir(void) +@@ -2923,6 +2960,8 @@ static int cmd_posix_rmdir(void) char *buf = NULL; char *targetname = NULL; struct cli_state *targetcli; @@ -7378,7 +7378,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -3005,7 +3044,8 @@ static int cmd_posix_rmdir(void) +@@ -2941,7 +2980,8 @@ static int cmd_posix_rmdir(void) return 1; } @@ -7388,7 +7388,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_rmdir %s: %s\n", mask, nt_errstr(status)); -@@ -3294,6 +3334,8 @@ static int cmd_rmdir(void) +@@ -3230,6 +3270,8 @@ static int cmd_rmdir(void) char *buf = NULL; char *targetname = NULL; struct cli_state *targetcli; @@ -7397,7 +7397,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -3312,7 +3354,8 @@ static int cmd_rmdir(void) +@@ -3248,7 +3290,8 @@ static int cmd_rmdir(void) return 1; } @@ -7407,7 +7407,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("rmdir %s: %s\n", mask, nt_errstr(status)); -@@ -3341,6 +3384,8 @@ static int cmd_link(void) +@@ -3277,6 +3320,8 @@ static int cmd_link(void) char *buf2 = NULL; char *targetname = NULL; struct cli_state *targetcli; @@ -7416,7 +7416,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -3371,7 +3416,8 @@ static int cmd_link(void) +@@ -3307,7 +3352,8 @@ static int cmd_link(void) return 1; } @@ -7426,7 +7426,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, oldname, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("link %s: %s\n", oldname, nt_errstr(status)); -@@ -3404,6 +3450,8 @@ static int cmd_readlink(void) +@@ -3340,6 +3386,8 @@ static int cmd_readlink(void) char *targetname = NULL; char *linkname = NULL; struct cli_state *targetcli; @@ -7435,7 +7435,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -3422,7 +3470,8 @@ static int cmd_readlink(void) +@@ -3358,7 +3406,8 @@ static int cmd_readlink(void) return 1; } @@ -7445,7 +7445,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, name, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("readlink %s: %s\n", name, nt_errstr(status)); -@@ -3461,6 +3510,8 @@ static int cmd_symlink(void) +@@ -3397,6 +3446,8 @@ static int cmd_symlink(void) char *buf = NULL; char *buf2 = NULL; struct cli_state *newcli; @@ -7454,7 +7454,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -3483,7 +3534,8 @@ static int cmd_symlink(void) +@@ -3419,7 +3470,8 @@ static int cmd_symlink(void) } /* New name must be present in share namespace. */ status = cli_resolve_path(ctx, "", @@ -7464,7 +7464,7 @@ index 35bc3a7c5c3..23de5befee3 100644 &newcli, &newname); if (!NT_STATUS_IS_OK(status)) { d_printf("link %s: %s\n", newname, -@@ -3519,6 +3571,8 @@ static int cmd_chmod(void) +@@ -3455,6 +3507,8 @@ static int cmd_chmod(void) char *targetname = NULL; struct cli_state *targetcli; mode_t mode; @@ -7473,7 +7473,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -3540,7 +3594,8 @@ static int cmd_chmod(void) +@@ -3476,7 +3530,8 @@ static int cmd_chmod(void) mode = (mode_t)strtol(buf, NULL, 8); @@ -7483,7 +7483,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("chmod %s: %s\n", src, nt_errstr(status)); -@@ -3684,6 +3739,8 @@ static int cmd_getfacl(void) +@@ -3620,6 +3675,8 @@ static int cmd_getfacl(void) size_t num_dir_acls = 0; size_t expected_buflen; uint16_t i; @@ -7492,7 +7492,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { -@@ -3702,7 +3759,8 @@ static int cmd_getfacl(void) +@@ -3638,7 +3695,8 @@ static int cmd_getfacl(void) return 1; } @@ -7502,7 +7502,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -3867,6 +3925,8 @@ static int cmd_geteas(void) +@@ -3803,6 +3861,8 @@ static int cmd_geteas(void) NTSTATUS status; size_t i, num_eas; struct ea_struct *eas; @@ -7511,7 +7511,7 @@ index 35bc3a7c5c3..23de5befee3 100644 if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { d_printf("geteas filename\n"); -@@ -3884,7 +3944,8 @@ static int cmd_geteas(void) +@@ -3820,7 +3880,8 @@ static int cmd_geteas(void) return 1; } @@ -7521,7 +7521,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -3923,6 +3984,8 @@ static int cmd_setea(void) +@@ -3859,6 +3920,8 @@ static int cmd_setea(void) char *eavalue = NULL; char *targetname = NULL; struct cli_state *targetcli; @@ -7530,7 +7530,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr, &name, NULL) -@@ -3945,7 +4008,8 @@ static int cmd_setea(void) +@@ -3881,7 +3944,8 @@ static int cmd_setea(void) return 1; } @@ -7540,7 +7540,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -3977,6 +4041,8 @@ static int cmd_stat(void) +@@ -3913,6 +3977,8 @@ static int cmd_stat(void) SMB_STRUCT_STAT sbuf; struct tm *lt; time_t tmp_time; @@ -7549,7 +7549,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { -@@ -3995,7 +4061,8 @@ static int cmd_stat(void) +@@ -3931,7 +3997,8 @@ static int cmd_stat(void) return 1; } @@ -7559,7 +7559,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -4084,6 +4151,8 @@ static int cmd_chown(void) +@@ -4020,6 +4087,8 @@ static int cmd_chown(void) char *buf, *buf2, *buf3; struct cli_state *targetcli; char *targetname = NULL; @@ -7568,7 +7568,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -4107,7 +4176,8 @@ static int cmd_chown(void) +@@ -4043,7 +4112,8 @@ static int cmd_chown(void) if (src == NULL) { return 1; } @@ -7578,7 +7578,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("chown %s: %s\n", src, nt_errstr(status)); -@@ -4141,6 +4211,8 @@ static int cmd_rename(void) +@@ -4077,6 +4147,8 @@ static int cmd_rename(void) struct cli_state *targetcli; char *targetsrc; char *targetdest; @@ -7587,7 +7587,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; bool replace = false; -@@ -4179,14 +4251,16 @@ static int cmd_rename(void) +@@ -4115,14 +4187,16 @@ static int cmd_rename(void) replace = true; } @@ -7606,7 +7606,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, dest, &targetcli, &targetdest); if (!NT_STATUS_IS_OK(status)) { d_printf("rename %s: %s\n", dest, nt_errstr(status)); -@@ -4243,6 +4317,8 @@ static int cmd_scopy(void) +@@ -4179,6 +4253,8 @@ static int cmd_scopy(void) off_t written = 0; struct scopy_timing st; int rc = 0; @@ -7615,7 +7615,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -4275,14 +4351,16 @@ static int cmd_scopy(void) +@@ -4211,14 +4287,16 @@ static int cmd_scopy(void) return 1; } @@ -7634,7 +7634,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, dest, &targetcli, &targetdest); if (!NT_STATUS_IS_OK(status)) { d_printf("scopy %s: %s\n", dest, nt_errstr(status)); -@@ -4381,6 +4459,8 @@ static int cmd_hardlink(void) +@@ -4317,6 +4395,8 @@ static int cmd_hardlink(void) char *buf, *buf2; struct cli_state *targetcli; char *targetname; @@ -7643,7 +7643,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -4413,7 +4493,8 @@ static int cmd_hardlink(void) +@@ -4349,7 +4429,8 @@ static int cmd_hardlink(void) return 1; } @@ -7653,7 +7653,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("hardlink %s: %s\n", src, nt_errstr(status)); -@@ -5087,9 +5168,13 @@ static int cmd_show_connect( void ) +@@ -5023,9 +5104,13 @@ static int cmd_show_connect( void ) TALLOC_CTX *ctx = talloc_tos(); struct cli_state *targetcli; char *targetpath; @@ -7668,7 +7668,7 @@ index 35bc3a7c5c3..23de5befee3 100644 client_get_cur_dir(), &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { -@@ -5749,6 +5834,8 @@ static char **remote_completion(const char *text, int len) +@@ -5685,6 +5770,8 @@ static char **remote_completion(const char *text, int len) struct cli_state *targetcli = NULL; int i; struct completion_remote info = { NULL, NULL, 1, 0, NULL, 0 }; @@ -7677,7 +7677,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; /* can't have non-static initialisation on Sun CC, so do it -@@ -5809,7 +5896,8 @@ static char **remote_completion(const char *text, int len) +@@ -5745,7 +5832,8 @@ static char **remote_completion(const char *text, int len) goto cleanup; } @@ -8015,13 +8015,13 @@ index 8fd9fcc5780..4989ec633c3 100644 filename, &targetcli, -- -2.28.0 +2.29.2 -From 100dad122572d927889f4c03b19f169a3bf61df4 Mon Sep 17 00:00:00 2001 +From e3ce5ba85266a08bd201c851e8fd59b71322d03e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:40:49 +0200 -Subject: [PATCH 070/105] s3:client: Remove global max_protocol +Subject: [PATCH 070/104] s3:client: Remove global max_protocol Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8031,7 +8031,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index 23de5befee3..329463795e0 100644 +index 13e48f80a01..902cdec8b64 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -61,7 +61,6 @@ static int io_bufsize = 0; /* we use the default size */ @@ -8042,7 +8042,7 @@ index 23de5befee3..329463795e0 100644 static int process_tok(char *tok); static int cmd_help(void); -@@ -5710,7 +5709,7 @@ static int process_command_string(const char *cmd_in) +@@ -5646,7 +5645,7 @@ static int process_command_string(const char *cmd_in) desthost, service, creds, @@ -8051,7 +8051,7 @@ index 23de5befee3..329463795e0 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); -@@ -6160,7 +6159,7 @@ static int process(const char *base_directory) +@@ -6096,7 +6095,7 @@ static int process(const char *base_directory) desthost, service, creds, @@ -8060,7 +8060,7 @@ index 23de5befee3..329463795e0 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6201,7 +6200,7 @@ static int do_host_query(const char *query_host) +@@ -6137,7 +6136,7 @@ static int do_host_query(const char *query_host) query_host, "IPC$", creds, @@ -8069,7 +8069,7 @@ index 23de5befee3..329463795e0 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6236,7 +6235,7 @@ static int do_host_query(const char *query_host) +@@ -6172,7 +6171,7 @@ static int do_host_query(const char *query_host) if (port != NBT_SMB_PORT || smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) { @@ -8078,7 +8078,7 @@ index 23de5befee3..329463795e0 100644 /* * Workgroups simply don't make sense over anything -@@ -6286,7 +6285,7 @@ static int do_tar_op(const char *base_directory) +@@ -6222,7 +6221,7 @@ static int do_tar_op(const char *base_directory) desthost, service, creds, @@ -8087,7 +8087,7 @@ index 23de5befee3..329463795e0 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6693,8 +6692,6 @@ int main(int argc,char *argv[]) +@@ -6629,8 +6628,6 @@ int main(int argc,char *argv[]) /* Ensure we have a password (or equivalent). */ popt_common_credentials_post(); @@ -8097,13 +8097,13 @@ index 23de5befee3..329463795e0 100644 if (cmdstr) process_command_string(cmdstr); -- -2.28.0 +2.29.2 -From fecf06bd00bc8ff23634bded86d649e432431957 Mon Sep 17 00:00:00 2001 +From 156a763a247480a88ab79f8822a2f34670a0c63b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:43:46 +0200 -Subject: [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() +Subject: [PATCH 071/104] s3:libsmb: Remove max_protocol from cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8116,10 +8116,10 @@ Reviewed-by: Jeremy Allison 4 files changed, 1 insertion(+), 12 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index 329463795e0..e9e6cb1ac2c 100644 +index 902cdec8b64..82764c5ca16 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -5709,7 +5709,6 @@ static int process_command_string(const char *cmd_in) +@@ -5645,7 +5645,6 @@ static int process_command_string(const char *cmd_in) desthost, service, creds, @@ -8127,7 +8127,7 @@ index 329463795e0..e9e6cb1ac2c 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); -@@ -6159,7 +6158,6 @@ static int process(const char *base_directory) +@@ -6095,7 +6094,6 @@ static int process(const char *base_directory) desthost, service, creds, @@ -8135,7 +8135,7 @@ index 329463795e0..e9e6cb1ac2c 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6200,7 +6198,6 @@ static int do_host_query(const char *query_host) +@@ -6136,7 +6134,6 @@ static int do_host_query(const char *query_host) query_host, "IPC$", creds, @@ -8143,7 +8143,7 @@ index 329463795e0..e9e6cb1ac2c 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6235,8 +6232,6 @@ static int do_host_query(const char *query_host) +@@ -6171,8 +6168,6 @@ static int do_host_query(const char *query_host) if (port != NBT_SMB_PORT || smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) { @@ -8152,7 +8152,7 @@ index 329463795e0..e9e6cb1ac2c 100644 /* * Workgroups simply don't make sense over anything * else but port 139 and SMB1. -@@ -6248,7 +6243,6 @@ static int do_host_query(const char *query_host) +@@ -6184,7 +6179,6 @@ static int do_host_query(const char *query_host) query_host, "IPC$", creds, @@ -8160,7 +8160,7 @@ index 329463795e0..e9e6cb1ac2c 100644 have_ip ? &dest_ss : NULL, NBT_SMB_PORT, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6285,7 +6279,6 @@ static int do_tar_op(const char *base_directory) +@@ -6221,7 +6215,6 @@ static int do_tar_op(const char *base_directory) desthost, service, creds, @@ -8222,13 +8222,13 @@ index 517738dbcd7..8aaaff2cb1e 100644 int port, int name_type, -- -2.28.0 +2.29.2 -From 2af136fd7c1ecae9cc06bc2cf26a7feac16cb279 Mon Sep 17 00:00:00 2001 +From 2ad30b082df42e010ca88e7a84471629476e00b9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:45:12 +0200 -Subject: [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() +Subject: [PATCH 072/104] s3:libcmb: Remove max_protocol from cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8275,13 +8275,13 @@ index fb1a0c72e6d..023dd4d2757 100644 0, /* port */ 0x20, -- -2.28.0 +2.29.2 -From dc8cfd9551afa10b0610c6663cb28bfb1ec5888a Mon Sep 17 00:00:00 2001 +From 4cc3243a8cf7c18129ad41ea52abc325aef55f06 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:46:29 +0200 -Subject: [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs +Subject: [PATCH 073/104] s3:libsmb: Remove max_protocol from clidfs do_connect() The if check for max_protocol == 0 is part of lp_client_max_protocol(). @@ -8338,13 +8338,13 @@ index 023dd4d2757..ee5becf76a6 100644 if (!NT_STATUS_IS_OK(status)) { -- -2.28.0 +2.29.2 -From 3a99225868e079e108968552f43b937b5b9b702f Mon Sep 17 00:00:00 2001 +From bfd80fa8f7a476b2fb37bd435697700ad032cc70 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Aug 2020 15:47:35 +0200 -Subject: [PATCH 074/105] s3:include: Move loadparm prototypes to own header +Subject: [PATCH 074/104] s3:include: Move loadparm prototypes to own header file Signed-off-by: Andreas Schneider @@ -8756,13 +8756,13 @@ index 00000000000..7686877ccf1 + +#endif /* _S3_LOADPARM_H */ -- -2.28.0 +2.29.2 -From 076e6929c3c8d1dc161e7dacfc7fb7aeceb588bd Mon Sep 17 00:00:00 2001 +From ad73140f7e08472179ac7598cfea780a207f0570 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 11 Aug 2020 10:41:07 +0200 -Subject: [PATCH 075/105] s3:lib: Move interface prototypes to own header file +Subject: [PATCH 075/104] s3:lib: Move interface prototypes to own header file Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8862,13 +8862,13 @@ index 00000000000..f45435b4a81 + +#endif /* _INTERFACE_H */ -- -2.28.0 +2.29.2 -From b6d36e462fe41f7b88bbf120831c3765c40ef326 Mon Sep 17 00:00:00 2001 +From bd958477d69c820766a30f818163cda9f9d171a3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:16 +0100 -Subject: [PATCH 076/105] idl: Add SID_SAMBA_SMB3 +Subject: [PATCH 076/104] idl: Add SID_SAMBA_SMB3 Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -8892,13 +8892,13 @@ index a92e8f1518e..06bf7449a70 100644 const string NAME_NT_SERVICE = "NT SERVICE"; -- -2.28.0 +2.29.2 -From 3128ed8c26c13ccc068b5e50ae52604f5ffc9241 Mon Sep 17 00:00:00 2001 +From 6b4e237ea0900e2ac7f46b889fd95d1d04db5bff Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:29 +0100 -Subject: [PATCH 077/105] s3:smbd: Add SMB3 connection information to session +Subject: [PATCH 077/104] s3:smbd: Add SMB3 connection information to session info Signed-off-by: Andreas Schneider @@ -9049,13 +9049,13 @@ index cf9de185c1f..cd24b7d2ed5 100644 } -- -2.28.0 +2.29.2 -From 333ae30e7f8238c684d2a1aec2b0516369068a7e Mon Sep 17 00:00:00 2001 +From 466c2d98005e1e0a3c3aa7b17779031b426b5da6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Mar 2020 14:11:56 +0100 -Subject: [PATCH 078/105] librpc: Add dcerpc helper +Subject: [PATCH 078/104] librpc: Add dcerpc helper dcerpc_is_transport_encrypted() Signed-off-by: Andreas Schneider @@ -9265,13 +9265,13 @@ index 27b180fa63d..109a1834841 100644 source='gen_ndr/ndr_winbind.c', public_deps='ndr NDR_LSA' -- -2.28.0 +2.29.2 -From 4a2e7909f3a40c6ab82c045a5a54f8604a6f1dd2 Mon Sep 17 00:00:00 2001 +From cc8a5479152c6131362e9ca9cfe6e5bab2a71af3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 28 Aug 2020 16:31:17 +0200 -Subject: [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' +Subject: [PATCH 079/104] s3:smbd: Use defines to set 'srv_smb_encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9302,13 +9302,13 @@ index d51a3de9497..785cbb23b5f 100644 char smb3_sid_str[SID_MAX_SIZE]; struct dom_sid smb3_dom_sid; -- -2.28.0 +2.29.2 -From 69b9e46fa29adcf5a478a240ea6980bf7d97ae4b Mon Sep 17 00:00:00 2001 +From dad6dc0e5a202d48a930504768394343823d5c42 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 12 Nov 2019 16:56:45 +0100 -Subject: [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords +Subject: [PATCH 080/104] s3:rpc_server: Allow to use RC4 for setting passwords Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9539,13 +9539,13 @@ index 2af02ad6fa8..eb91ac09384 100644 bld.SAMBA3_SUBSYSTEM('RPC_SPOOLSS', source='''spoolss/srv_spoolss_nt.c -- -2.28.0 +2.29.2 -From 110323b646715aabd4468d70773c2d94968f2e99 Mon Sep 17 00:00:00 2001 +From 2932bdeff6ad18a36b2b64ab59d72ff1040acd09 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 15 Nov 2019 13:49:40 +0100 -Subject: [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords +Subject: [PATCH 081/104] s4:rpc_server: Allow to use RC4 for setting passwords Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9670,13 +9670,13 @@ index de55ad6239a..c9c1978f223 100644 -- -2.28.0 +2.29.2 -From 6353a991bc6d35b9468867c0e809e752b060da9b Mon Sep 17 00:00:00 2001 +From 959978865400d20fe1b2f9b5343fbec7c0b1109a Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:45:49 +0200 -Subject: [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips +Subject: [PATCH 082/104] lib:crypto: Add py binding for set_relax/strict fips mode Signed-off-by: Isaac Boukris @@ -9728,13 +9728,13 @@ index 32b946eee8f..ad18d3ada0f 100644 }; -- -2.28.0 +2.29.2 -From 525072939b9292a1744f929803a9597b5f725f9a Mon Sep 17 00:00:00 2001 +From e3059d24a83175efb4f9eb3844c2e02d2af7775a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 28 Oct 2020 17:05:36 +0100 -Subject: [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam +Subject: [PATCH 083/104] s4:param: Add 'weak crypto' getter to pyparam Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9784,13 +9784,13 @@ index 4023fac4dd6..e15592b5743 100644 }; -- -2.28.0 +2.29.2 -From c7dfaf75a8f8bdb18c42325c470bdee8e600d930 Mon Sep 17 00:00:00 2001 +From 2c10e3c1bbd7527f8563dca42700310c86ec04d4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 -Subject: [PATCH 084/105] python:tests: Add SAMR password change tests for fips +Subject: [PATCH 084/104] python:tests: Add SAMR password change tests for fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -10009,13 +10009,13 @@ index adcb5b53189..86cab3f8046 100644 def cmdline(script, *args): -- -2.28.0 +2.29.2 -From 9dfef9d7129babedfdc0fddd60f76859f44fe7c1 Mon Sep 17 00:00:00 2001 +From 65f6aef76ebc4b432f2743fb36cec64d7e06e71d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 -Subject: [PATCH 085/105] python:tests: Add SAMR password change tests for fips +Subject: [PATCH 085/104] python:tests: Add SAMR password change tests for fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -10042,13 +10042,13 @@ index 649e923ff9a..1ebdf2a5484 100755 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n"); return undef; -- -2.28.0 +2.29.2 -From 8e8b9d33f25c7ef89fdf4af90821ea4de77525e1 Mon Sep 17 00:00:00 2001 +From 114ce58de5ac14035c095e12aeb31931c7859d89 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 09:40:41 +0200 -Subject: [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values +Subject: [PATCH 086/104] auth:creds: Rename CRED_USE_KERBEROS values Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -10784,13 +10784,13 @@ index 07c6faebb15..701dfc10a07 100644 torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); } -- -2.28.0 +2.29.2 -From 6a356a6e79fa76de18a4ca0760ac4f053d70137f Mon Sep 17 00:00:00 2001 +From dd116a6a1b334431981b786c103503d9e2998247 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Sep 2020 12:32:28 +0200 -Subject: [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test +Subject: [PATCH 087/104] auth:creds:tests: Migrate test to a cmocka unit test Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -11081,106 +11081,13 @@ index 38b6c8f4b6e..f0ab0357986 100644 ../../dsdb/schema/tests/schema_syntax.c ../../../lib/util/tests/anonymous_shared.c -- -2.28.0 +2.29.2 -From f6a4f70007e5c5ad1df3ddb018bde8568fc63f57 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Mon, 2 Nov 2020 16:10:44 +0100 -Subject: [PATCH 088/105] s3-vfs_glusterfs: always disable write-behind - translator - -The "pass-through" option has now been merged upstream as of: -https://github.com/gluster/glusterfs/pull/1640 - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 - -Guenther - -Signed-off-by: Guenther Deschner -Pair-Programmed-With: Anoop C S -Pair-Programmed-With: Sachin Prabhu -Reviewed-by: Jeremy Allison - -Autobuild-User(master): Jeremy Allison -Autobuild-Date(master): Wed Nov 4 22:53:49 UTC 2020 on sn-devel-184 - -(cherry picked from commit a51cda69ec6a017ad04b5690a3ae67a5478deee9) - -Autobuild-User(v4-13-test): Karolin Seeger -Autobuild-Date(v4-13-test): Thu Nov 5 13:54:25 UTC 2020 on sn-devel-184 ---- - source3/modules/vfs_glusterfs.c | 20 +++++++++++++++++--- - source3/wscript | 3 +++ - 2 files changed, 20 insertions(+), 3 deletions(-) - -diff --git a/source3/modules/vfs_glusterfs.c b/source3/modules/vfs_glusterfs.c -index 3cbb1ab6cb6..bdfe35ced82 100644 ---- a/source3/modules/vfs_glusterfs.c -+++ b/source3/modules/vfs_glusterfs.c -@@ -363,6 +363,7 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, - glfs_t *fs = NULL; - TALLOC_CTX *tmp_ctx; - int ret = 0; -+ bool write_behind_pass_through_set = false; - - tmp_ctx = talloc_new(NULL); - if (tmp_ctx == NULL) { -@@ -435,6 +436,17 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, - goto done; - } - -+#ifdef HAVE_GFAPI_VER_7_9 -+ ret = glfs_set_xlator_option(fs, "*-write-behind", "pass-through", -+ "true"); -+ if (ret < 0) { -+ DBG_ERR("%s: Failed to set xlator option: pass-through\n", -+ volume); -+ goto done; -+ } -+ write_behind_pass_through_set = true; -+#endif -+ - ret = glfs_set_logging(fs, logfile, loglevel); - if (ret < 0) { - DEBUG(0, ("%s: Failed to set logfile %s loglevel %d\n", -@@ -449,9 +461,11 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, - goto done; - } - -- ret = check_for_write_behind_translator(tmp_ctx, fs, volume); -- if (ret < 0) { -- goto done; -+ if (!write_behind_pass_through_set) { -+ ret = check_for_write_behind_translator(tmp_ctx, fs, volume); -+ if (ret < 0) { -+ goto done; -+ } - } - - ret = glfs_set_preopened(volume, handle->conn->connectpath, fs); -diff --git a/source3/wscript b/source3/wscript -index 335cfd797f1..9920432a360 100644 ---- a/source3/wscript -+++ b/source3/wscript -@@ -1766,6 +1766,9 @@ main() { - conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.6" --cflags --libs', - msg='Checking for glusterfs-api >= 7.6', - uselib_store="GFAPI_VER_7_6") -+ conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.9" --cflags --libs', -+ msg='Checking for glusterfs-api >= 7.9', -+ uselib_store="GFAPI_VER_7_9") - else: - conf.SET_TARGET_TYPE('gfapi', 'EMPTY') - conf.undefine('HAVE_GLUSTERFS') --- -2.28.0 - - -From 0d6268ff0a055e8fb418da761eeb820a8e11e2ad Mon Sep 17 00:00:00 2001 +From 48c31546ad4c2a072497e3ce9eff37ef37bc81c8 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:09:05 +0200 -Subject: [PATCH 089/105] Add smb2cli_session_get_encryption_cipher() +Subject: [PATCH 088/104] Add smb2cli_session_get_encryption_cipher() When 'session->smb2->should_encrypt' is true, the client MUST encrypt all transport messages (see also MS-SMB2 3.2.4.1.8). @@ -11231,13 +11138,13 @@ index 2afc7165cd9..db5f5d58799 100644 struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx); struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx, -- -2.28.0 +2.29.2 -From 3f77e6cb6220d50b75ceb197e26813e9e5244cc0 Mon Sep 17 00:00:00 2001 +From 25a7d3534f7e3798cdf2432de62ed62f9e11547b Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:18:21 +0200 -Subject: [PATCH 090/105] Add dcerpc_transport_encrypted() +Subject: [PATCH 089/104] Add dcerpc_transport_encrypted() Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11323,13 +11230,13 @@ index bd79a072bc8..6ea27a8d9a3 100644 create a secondary context from a primary connection -- -2.28.0 +2.29.2 -From 4045c677a3ea3c44e5509025c1c7d03936ba9d82 Mon Sep 17 00:00:00 2001 +From a0b8ea04d7030d2cb97d6ccea9d28072d6e3dbda Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:35:01 +0200 -Subject: [PATCH 091/105] Add py binding for dcerpc_transport_encrypted +Subject: [PATCH 090/104] Add py binding for dcerpc_transport_encrypted Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11370,13 +11277,13 @@ index be914ed5f14..309a6d72e26 100644 }; -- -2.28.0 +2.29.2 -From 07a87eaff7e2e18c2d462f4caff95cace92a0130 Mon Sep 17 00:00:00 2001 +From ff38da1d43f7ec3312a90fb8c53f977c9466e199 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:44:08 +0200 -Subject: [PATCH 092/105] selftest: add a test for py dce transport_encrypted +Subject: [PATCH 091/104] selftest: add a test for py dce transport_encrypted Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11435,13 +11342,13 @@ index 8e0d6a5ef0a..24e4ac77d89 100644 objectAttr = lsa.ObjectAttribute() objectAttr.sec_qos = lsa.QosInfo() -- -2.28.0 +2.29.2 -From 1c74d87e4dfe78d6e884c9bb4e57ec383d632a88 Mon Sep 17 00:00:00 2001 +From 5ffb0a0d9093bba2c4630d89512f623a35122f8e Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:47:12 +0200 -Subject: [PATCH 093/105] Add CreateTrustedDomainRelax wrapper for fips mode +Subject: [PATCH 092/104] Add CreateTrustedDomainRelax wrapper for fips mode Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11521,13 +11428,13 @@ index 00000000000..b4df0fa5bb8 + + return lsaconn.CreateTrustedDomainEx2(policy, trust_info, auth_info, mask) -- -2.28.0 +2.29.2 -From 067c8d73800b928b02bcb1095c13083d9e0e368d Mon Sep 17 00:00:00 2001 +From d980bb1444e318825457ead9bdbce1c9353ccc66 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:49:17 +0200 -Subject: [PATCH 094/105] Use the new CreateTrustedDomainRelax() +Subject: [PATCH 093/104] Use the new CreateTrustedDomainRelax() Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11628,13 +11535,13 @@ index 1d12c362911..93a3258d28d 100644 if enc_types: self.outf.write("Setting supported encryption types on local TDO.\n") -- -2.28.0 +2.29.2 -From 72dfcc923d0cf8054cb0f011e8405fa96b9ec6e0 Mon Sep 17 00:00:00 2001 +From e06d01fe3370501ab45d01c5511aa0b5de9d854e Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 1 Sep 2020 20:14:29 +0300 -Subject: [PATCH 095/105] selftest: add a test for the CreateTrustedDomainRelax +Subject: [PATCH 094/104] selftest: add a test for the CreateTrustedDomainRelax wrapper Originally copied from 'source4/scripting/devel/createtrust' @@ -11813,13 +11720,13 @@ index 3a903a7eee0..96f51b68cfc 100755 # Right now ad_dc has mdb and ad_dc_ntvfs has tdb mdb_testenv = "ad_dc" -- -2.28.0 +2.29.2 -From 341cc046bf816ad5818932c6c5d170a2a9a38783 Mon Sep 17 00:00:00 2001 +From 93b792d5d0dcf96833e32958aeb3877f74125f07 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 5 Nov 2020 15:38:19 +0200 -Subject: [PATCH 096/105] Remove source4/scripting/devel/createtrust script +Subject: [PATCH 095/104] Remove source4/scripting/devel/createtrust script We now have the 'samba-tool domain trust' command. @@ -11968,13 +11875,13 @@ index 26b0d0dcb68..00000000000 - auth_info, - security.SEC_STD_DELETE) -- -2.28.0 +2.29.2 -From f51b23a9b8ad22d4cd4d7dea3ed8f0150974a209 Mon Sep 17 00:00:00 2001 +From 4577786be36993e958b745e4953f582e3de301a1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:30:26 +0100 -Subject: [PATCH 097/105] s3:rpc_server: Use gnutls_cipher_decrypt() in +Subject: [PATCH 096/104] s3:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob() It doesn't matter for RC4, but just to be correct. @@ -12000,13 +11907,13 @@ index 198387424e6..e749caf2551 100644 auth_blob->length); gnutls_cipher_deinit(cipher_hnd); -- -2.28.0 +2.29.2 -From 7b24fdcb4a797b1daa97750f8a2c4f2c603115f3 Mon Sep 17 00:00:00 2001 +From ad9c90d18c2efdee16535ade97d4b151e4a64c5e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:33:38 +0100 -Subject: [PATCH 098/105] s4:rpc_server: Use gnutls_cipher_decrypt() in +Subject: [PATCH 097/104] s4:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob() It doesn't matter for RC4, but just to be correct. @@ -12032,13 +11939,13 @@ index 8333cb149b6..4bb8aaa9592 100644 auth_blob->length); gnutls_cipher_deinit(cipher_hnd); -- -2.28.0 +2.29.2 -From acbb59f45cb2b4c35df678ba774425180e9cf8c6 Mon Sep 17 00:00:00 2001 +From 6c73bf8553c48e28abd09ff225cbfb8278528d0d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:40:21 +0200 -Subject: [PATCH 099/105] s3:rpc_server: Allow to use RC4 for creating trusts +Subject: [PATCH 098/104] s3:rpc_server: Allow to use RC4 for creating trusts Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -12099,13 +12006,13 @@ index e749caf2551..d6d606ddeca 100644 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; -- -2.28.0 +2.29.2 -From a4d0e69eb7a429a13e456cff7f96870e87791694 Mon Sep 17 00:00:00 2001 +From 20f0e078f2dd5681513253788216313851df428d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:51:39 +0200 -Subject: [PATCH 100/105] s4:rpc_server: Allow to use RC4 for creating trusts +Subject: [PATCH 099/104] s4:rpc_server: Allow to use RC4 for creating trusts Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -12171,13 +12078,13 @@ index 4bb8aaa9592..5b3ef71d458 100644 nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; -- -2.28.0 +2.29.2 -From f327133ced90a52d1ff9e104b1722876b21b7a78 Mon Sep 17 00:00:00 2001 +From 8c7a60700f7c7925749ccfd0f3ccb17ca47df7da Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 10:13:48 +0100 -Subject: [PATCH 101/105] sefltest: Enable the dcerpc.createtrustrelax test +Subject: [PATCH 100/104] sefltest: Enable the dcerpc.createtrustrelax test against ad_dc_fips Signed-off-by: Andreas Schneider @@ -12201,53 +12108,13 @@ index 80effda8343..00000000000 @@ -1 +0,0 @@ -^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) -- -2.28.0 +2.29.2 -From 721f97817de2d1e14d99459f9e6af9fccf11b621 Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 5 Nov 2020 15:48:08 -0800 -Subject: [PATCH 102/105] s3: spoolss: Make parameters in call to - user_ok_token() match all other uses. - -We already have p->session_info->unix_info->unix_name, we don't -need to go through a legacy call to uidtoname(p->session_info->unix_token->uid). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14568 - -Signed-off-by: Jeremy Allison -Reviewed-by: Andrew Bartlett - -Autobuild-User(master): Andrew Bartlett -Autobuild-Date(master): Mon Nov 9 04:10:45 UTC 2020 on sn-devel-184 - -(cherry picked from commit e5e1759057a767f517bf480a2172a36623df2799) ---- - source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index e98401a4365..906fab2adb5 100644 ---- a/source3/rpc_server/spoolss/srv_spoolss_nt.c -+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -1880,7 +1880,8 @@ WERROR _spoolss_OpenPrinterEx(struct pipes_struct *p, - return WERR_ACCESS_DENIED; - } - -- if (!user_ok_token(uidtoname(p->session_info->unix_token->uid), NULL, -+ if (!user_ok_token(p->session_info->unix_info->unix_name, -+ p->session_info->info->domain_name, - p->session_info->security_token, snum) || - !W_ERROR_IS_OK(print_access_check(p->session_info, - p->msg_ctx, --- -2.28.0 - - -From a078205ce3816c175cd16dc22875dc147a5da645 Mon Sep 17 00:00:00 2001 +From 9db0e9602ea96849a6f854415f4cd988576cccf2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 11 Nov 2020 13:42:06 +0100 -Subject: [PATCH 103/105] s3:smbd: Fix possible null pointer dereference in +Subject: [PATCH 101/104] s3:smbd: Fix possible null pointer dereference in token_contains_name() BUG: https://bugzilla.samba.org/show_bug.cgi?id=14572 @@ -12277,13 +12144,13 @@ index 57754a0f766..694c0c290e8 100644 /* Check if username starts with domain name */ if (domain_len > 0) { -- -2.28.0 +2.29.2 -From 5654101584b7742e684d12e6aea43e5004142dcb Mon Sep 17 00:00:00 2001 +From b92cbd97865ea6ef49892df75c59f37e9917ddb3 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 10 Nov 2020 17:35:24 +0200 -Subject: [PATCH 104/105] lookup_name: allow lookup names prefixed with DNS +Subject: [PATCH 102/104] lookup_name: allow lookup names prefixed with DNS forest root for FreeIPA DC In FreeIPA deployment with active Global Catalog service, when a two-way @@ -12387,13 +12254,13 @@ index 82c47b3145b..864246da56e 100644 if ((flags & LOOKUP_NAME_BUILTIN) && -- -2.28.0 +2.29.2 -From efa59aa4b2455ea3bc4d0fd0358b160858626585 Mon Sep 17 00:00:00 2001 +From 5bf01d45325bcc6819f807620267e35841f826a3 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 11 Nov 2020 14:42:55 +0200 -Subject: [PATCH 105/105] auth_sam: use pdb_get_domain_info to look up DNS +Subject: [PATCH 103/104] auth_sam: use pdb_get_domain_info to look up DNS forest information When Samba is used as a part of FreeIPA domain controller, Windows @@ -12610,5 +12477,48 @@ index 3c12f959faf..e8e0d543f8c 100644 DBG_INFO("%s is not our domain name (DC for %s)\n", effective_domain, lp_workgroup()); -- -2.28.0 +2.29.2 + + +From edd405a3918b5d52e7eeff2f8425478a0a1867ed Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 27 Nov 2020 11:22:15 +0100 +Subject: [PATCH 104/104] docs-xml: Add a section about weak crypto in testparm + manpage + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14583 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Fri Nov 27 13:48:20 UTC 2020 on sn-devel-184 + +(cherry picked from commit 5c27740aeff273bcd5f027d36874e56170234146) +--- + docs-xml/manpages/testparm.1.xml | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/docs-xml/manpages/testparm.1.xml b/docs-xml/manpages/testparm.1.xml +index 9099cda010f..7c7abf50e8b 100644 +--- a/docs-xml/manpages/testparm.1.xml ++++ b/docs-xml/manpages/testparm.1.xml +@@ -171,6 +171,15 @@ + errors and warnings if the file did not load. If the file was + loaded OK, the program then dumps all known service details + to stdout. ++ ++ For certain use cases, SMB protocol requires use of ++ cryptographic algorithms which are known to be weak and already ++ broken. DES and ARCFOUR (RC4) ciphers and the SHA1 and MD5 hash ++ algorithms are considered weak but they are required for backward ++ compatibility. The testparm utility shows whether the Samba tools ++ will fall back to these weak crypto algorithms if it is not possible ++ to use strong cryptography by default. ++ In FIPS mode weak crypto cannot be enabled. + + + +-- +2.29.2 diff --git a/samba-smbclient-mget-bug-14517.patch b/samba-smbclient-mget-bug-14517.patch deleted file mode 100644 index 8f21623..0000000 --- a/samba-smbclient-mget-bug-14517.patch +++ /dev/null @@ -1,430 +0,0 @@ -From 52ddfacead1ba50da0fc706b54e90e7a0cadb8e9 Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Mon, 28 Sep 2020 14:11:13 +0200 -Subject: [PATCH 1/4] smbclient: Remove the "abort_mget" variable - -This was never set to true anywhere in the code - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 -Signed-off-by: Volker Lendecke -Reviewed-by: Jeremy Allison -(cherry picked from commit 8fa451d2b052223a11b24ffc2a956b80d03aaa7c) ---- - source3/client/client.c | 9 --------- - 1 file changed, 9 deletions(-) - -diff --git a/source3/client/client.c b/source3/client/client.c -index f65293849d0..5bed37fc2a2 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -87,8 +87,6 @@ static char dest_ss_str[INET6_ADDRSTRLEN]; - - #define SEPARATORS " \t\n\r" - --static bool abort_mget = true; -- - /* timing globals */ - uint64_t get_total_size = 0; - unsigned int get_total_time_ms = 0; -@@ -1217,11 +1215,6 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - if (strequal(finfo->name,".") || strequal(finfo->name,"..")) - return NT_STATUS_OK; - -- if (abort_mget) { -- d_printf("mget aborted\n"); -- return NT_STATUS_UNSUCCESSFUL; -- } -- - if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { - if (asprintf(&quest, - "Get directory %s? ",finfo->name) < 0) { -@@ -1419,8 +1412,6 @@ static int cmd_mget(void) - attribute |= FILE_ATTRIBUTE_DIRECTORY; - } - -- abort_mget = false; -- - while (next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { - - mget_mask = talloc_strdup(ctx, client_get_cur_dir()); --- -2.20.1 - - -From 159a03a9067f7aeddb29080dc34e37b567a02479 Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Mon, 28 Sep 2020 14:21:24 +0200 -Subject: [PATCH 2/4] smbclient: Slightly simplify do_mget() - -Put the prompt query into a separate if-statement, move the "quest" -variable closer to its use - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 -Signed-off-by: Volker Lendecke -Reviewed-by: Jeremy Allison -(cherry picked from commit 71bc4d4b8d94458ac2e40d659f06110d434fd5c9) ---- - source3/client/client.c | 28 ++++++++++++++-------------- - 1 file changed, 14 insertions(+), 14 deletions(-) - -diff --git a/source3/client/client.c b/source3/client/client.c -index 5bed37fc2a2..5901419f427 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -1203,7 +1203,6 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - TALLOC_CTX *ctx = talloc_tos(); - NTSTATUS status = NT_STATUS_OK; - char *rname = NULL; -- char *quest = NULL; - char *saved_curdir = NULL; - char *mget_mask = NULL; - char *new_cd = NULL; -@@ -1215,23 +1214,24 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - if (strequal(finfo->name,".") || strequal(finfo->name,"..")) - return NT_STATUS_OK; - -- if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { -- if (asprintf(&quest, -- "Get directory %s? ",finfo->name) < 0) { -- return NT_STATUS_NO_MEMORY; -- } -- } else { -- if (asprintf(&quest, -- "Get file %s? ",finfo->name) < 0) { -+ if (prompt) { -+ const char *object = (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) ? -+ "directory" : "file"; -+ char *quest = NULL; -+ bool ok; -+ -+ quest = talloc_asprintf( -+ ctx, "Get %s %s? ", object, finfo->name); -+ if (quest == NULL) { - return NT_STATUS_NO_MEMORY; - } -- } - -- if (prompt && !yesno(quest)) { -- SAFE_FREE(quest); -- return NT_STATUS_OK; -+ ok = yesno(quest); -+ TALLOC_FREE(quest); -+ if (!ok) { -+ return NT_STATUS_OK; -+ } - } -- SAFE_FREE(quest); - - if (!(finfo->attr & FILE_ATTRIBUTE_DIRECTORY)) { - rname = talloc_asprintf(ctx, --- -2.20.1 - - -From 523ccc98d2c6a9ddc0714084b5e19cee2a80bf27 Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Mon, 28 Sep 2020 16:29:27 +0200 -Subject: [PATCH 3/4] test3: Add a test showing that smbclient recursive mget - is broken - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 -Signed-off-by: Volker Lendecke -Reviewed-by: Jeremy Allison -(cherry picked from commit 254a5b034e5a081c9d3f28717a4b54d2af0180fc) ---- - selftest/knownfail.d/smbclient_mget | 1 + - source3/script/tests/test_smbclient_mget.sh | 39 +++++++++++++++++++++ - source3/selftest/tests.py | 10 ++++++ - 3 files changed, 50 insertions(+) - create mode 100644 selftest/knownfail.d/smbclient_mget - create mode 100755 source3/script/tests/test_smbclient_mget.sh - -diff --git a/selftest/knownfail.d/smbclient_mget b/selftest/knownfail.d/smbclient_mget -new file mode 100644 -index 00000000000..64407a8c5d4 ---- /dev/null -+++ b/selftest/knownfail.d/smbclient_mget -@@ -0,0 +1 @@ -+^samba3.blackbox.smbclient-mget.smbclient\ mget\(fileserver\) -\ No newline at end of file -diff --git a/source3/script/tests/test_smbclient_mget.sh b/source3/script/tests/test_smbclient_mget.sh -new file mode 100755 -index 00000000000..45f62f15d4d ---- /dev/null -+++ b/source3/script/tests/test_smbclient_mget.sh -@@ -0,0 +1,39 @@ -+#!/bin/sh -+ -+if [ $# -lt 6 ]; then -+cat < -Date: Mon, 28 Sep 2020 15:03:41 +0200 -Subject: [PATCH 4/4] smbclient: Fix recursive mget - -Make do_mget rely on do_list() already doing the recursion in a -breadth-first manner. The previous code called do_list() from within -its callback. Unfortunately the recent simplifications of do_list() -broke this, leading to recursive mget to segfault. Instead of figuring -out how this worked before the simplifications in do_list() (I did -spend a few hours on this) and fixing it, I chose to restructure -do_mget() to not recursively call do_list() anymore but instead rely -on do_list() to do the recursion. Saves quite a few lines of code and -complexity. - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 -Signed-off-by: Volker Lendecke -Reviewed-by: Jeremy Allison - -Autobuild-User(master): Jeremy Allison -Autobuild-Date(master): Wed Sep 30 17:23:45 UTC 2020 on sn-devel-184 - -(cherry picked from commit 9f24b5098f796f364a3f403ad4e9ae28b3c0935a) ---- - selftest/knownfail.d/smbclient_mget | 1 - - source3/client/client.c | 121 ++++++++-------------------- - 2 files changed, 33 insertions(+), 89 deletions(-) - delete mode 100644 selftest/knownfail.d/smbclient_mget - -diff --git a/selftest/knownfail.d/smbclient_mget b/selftest/knownfail.d/smbclient_mget -deleted file mode 100644 -index 64407a8c5d4..00000000000 ---- a/selftest/knownfail.d/smbclient_mget -+++ /dev/null -@@ -1 +0,0 @@ --^samba3.blackbox.smbclient-mget.smbclient\ mget\(fileserver\) -\ No newline at end of file -diff --git a/source3/client/client.c b/source3/client/client.c -index 5901419f427..8c7ceb644aa 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -1201,11 +1201,10 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - const char *dir) - { - TALLOC_CTX *ctx = talloc_tos(); -- NTSTATUS status = NT_STATUS_OK; -- char *rname = NULL; -- char *saved_curdir = NULL; -- char *mget_mask = NULL; -- char *new_cd = NULL; -+ const char *client_cwd = NULL; -+ size_t client_cwd_len; -+ char *path = NULL; -+ char *local_path = NULL; - - if (!finfo->name) { - return NT_STATUS_OK; -@@ -1214,6 +1213,10 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - if (strequal(finfo->name,".") || strequal(finfo->name,"..")) - return NT_STATUS_OK; - -+ if ((finfo->attr & FILE_ATTRIBUTE_DIRECTORY) && !recurse) { -+ return NT_STATUS_OK; -+ } -+ - if (prompt) { - const char *object = (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) ? - "directory" : "file"; -@@ -1233,98 +1236,40 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - } - } - -- if (!(finfo->attr & FILE_ATTRIBUTE_DIRECTORY)) { -- rname = talloc_asprintf(ctx, -- "%s%s", -- client_get_cur_dir(), -- finfo->name); -- if (!rname) { -- return NT_STATUS_NO_MEMORY; -- } -- rname = client_clean_name(ctx, rname); -- if (rname == NULL) { -- return NT_STATUS_NO_MEMORY; -- } -- do_get(rname, finfo->name, false); -- TALLOC_FREE(rname); -- return NT_STATUS_OK; -- } -- -- /* handle directories */ -- saved_curdir = talloc_strdup(ctx, client_get_cur_dir()); -- if (!saved_curdir) { -+ path = talloc_asprintf( -+ ctx, "%s%c%s", dir, CLI_DIRSEP_CHAR, finfo->name); -+ if (path == NULL) { - return NT_STATUS_NO_MEMORY; - } -- -- new_cd = talloc_asprintf(ctx, -- "%s%s%s", -- client_get_cur_dir(), -- finfo->name, -- CLI_DIRSEP_STR); -- if (!new_cd) { -- return NT_STATUS_NO_MEMORY; -- } -- new_cd = client_clean_name(ctx, new_cd); -- if (new_cd == NULL) { -+ path = client_clean_name(ctx, path); -+ if (path == NULL) { - return NT_STATUS_NO_MEMORY; - } -- client_set_cur_dir(new_cd); -- -- string_replace(finfo->name,'\\','/'); -- if (lowercase) { -- if (!strlower_m(finfo->name)) { -- return NT_STATUS_INVALID_PARAMETER; -- } -- } -- -- if (!directory_exist(finfo->name) && -- mkdir(finfo->name,0777) != 0) { -- d_printf("failed to create directory %s\n",finfo->name); -- client_set_cur_dir(saved_curdir); -- return map_nt_error_from_unix(errno); -- } -- -- if (chdir(finfo->name) != 0) { -- d_printf("failed to chdir to directory %s\n",finfo->name); -- client_set_cur_dir(saved_curdir); -- return map_nt_error_from_unix(errno); -- } - -- mget_mask = talloc_asprintf(ctx, -- "%s*", -- client_get_cur_dir()); -+ /* -+ * Skip the path prefix if we've done a remote "cd" when -+ * creating the local path -+ */ -+ client_cwd = client_get_cur_dir(); -+ client_cwd_len = strlen(client_cwd); - -- if (!mget_mask) { -+ local_path = talloc_strdup(ctx, path + client_cwd_len); -+ if (local_path == NULL) { -+ TALLOC_FREE(path); - return NT_STATUS_NO_MEMORY; - } -+ string_replace(local_path, CLI_DIRSEP_CHAR, '/'); - -- mget_mask = client_clean_name(ctx, mget_mask); -- if (mget_mask == NULL) { -- return NT_STATUS_NO_MEMORY; -- } -- status = do_list(mget_mask, -- (FILE_ATTRIBUTE_SYSTEM -- | FILE_ATTRIBUTE_HIDDEN -- | FILE_ATTRIBUTE_DIRECTORY), -- do_mget, false, true); -- if (!NT_STATUS_IS_OK(status) -- && !NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) { -- /* -- * Ignore access denied errors to ensure all permitted files are -- * pulled down. -- */ -- return status; -- } -+ if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { -+ int ret = mkdir(local_path, 0777); - -- if (chdir("..") == -1) { -- d_printf("do_mget: failed to chdir to .. (error %s)\n", -- strerror(errno) ); -- return map_nt_error_from_unix(errno); -+ if ((ret == -1) && (errno != EEXIST)) { -+ return map_nt_error_from_unix(errno); -+ } -+ } else { -+ do_get(path, local_path, false); - } -- client_set_cur_dir(saved_curdir); -- TALLOC_FREE(mget_mask); -- TALLOC_FREE(saved_curdir); -- TALLOC_FREE(new_cd); -+ - return NT_STATUS_OK; - } - -@@ -1431,7 +1376,7 @@ static int cmd_mget(void) - if (mget_mask == NULL) { - return 1; - } -- status = do_list(mget_mask, attribute, do_mget, false, true); -+ status = do_list(mget_mask, attribute, do_mget, recurse, true); - if (!NT_STATUS_IS_OK(status)) { - return 1; - } -@@ -1453,7 +1398,7 @@ static int cmd_mget(void) - if (mget_mask == NULL) { - return 1; - } -- status = do_list(mget_mask, attribute, do_mget, false, true); -+ status = do_list(mget_mask, attribute, do_mget, recurse, true); - if (!NT_STATUS_IS_OK(status)) { - return 1; - } --- -2.20.1 - diff --git a/samba.spec b/samba.spec index aca9fa5..91ad8a5 100644 --- a/samba.spec +++ b/samba.spec @@ -8,9 +8,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 2 +%define main_release 0 -%define samba_version 4.13.2 +%define samba_version 4.13.3 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -136,7 +136,6 @@ Patch1: samba-s4u.patch # # Generate the patchset using: git format-patch -l1 --stdout -N > samba-4.13-redhat.patch Patch2: samba-4.13-redhat.patch -Patch3: samba-smbclient-mget-bug-14517.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3629,6 +3628,9 @@ fi %endif %changelog +* Tue Dec 15 2020 Guenther Deschner - 4.13.3-0 +- Update to Samba 4.13.3 + * Wed Nov 25 2020 Alexander Bokovoy - 4.13.2-2 - rhbz#1892745, rhbz#1900232: smbclient mget crashes (upstream bug 14517) - Merge RHEL 8.4 patches: From fe07656b85d4146a9e7b0e9aa1496e1e0861e49b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 15 Dec 2020 17:11:54 +0100 Subject: [PATCH 14/30] Add missing sources Guenther --- .gitignore | 2 ++ sources | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 6578c2a..9170f96 100644 --- a/.gitignore +++ b/.gitignore @@ -227,3 +227,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.1.tar.asc /samba-4.13.2.tar.xz /samba-4.13.2.tar.asc +/samba-4.13.3.tar.xz +/samba-4.13.3.tar.asc diff --git a/sources b/sources index b1e4a0b..0e51188 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.2.tar.xz) = c5d1c4b74b458ab6da9314540043edb8129a17870a9a335fb26bbdaf194aeae647aa3d6cdc00fd4487fd459c123cc8feecb58d02633515c62f00287b652a502b -SHA512 (samba-4.13.2.tar.asc) = 07cce2f4f5130c56548ea14193b3d829dac7926141da56f7e1624fd48f73afcd875af6eaae0ce56396d5b23837b3bc7e3518f569d581afd6c5ee1dc7d49a8eb7 +SHA512 (samba-4.13.3.tar.xz) = 8dbd8a18ff8566f778b17c9a5306a0d3f45a79fc8d1ce7c2ea63f941eb1b310462f97f2bdd40c4e09c69e2aae3f5144e488cb20e1b6686695306b521d609b6dc +SHA512 (samba-4.13.3.tar.asc) = f5ef09ae3fa434b7c37564407ad3b62542d9abc7ca0e2a1e58ebb987307a5269c123b1af3755582edff7fdcfe2930a151d6256b97ab8dcd296492038a96a160a From 74b988a0b9eb7ee3e4c357b3ca7f7ae8abfbdab8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 26 Jan 2021 15:04:19 +0100 Subject: [PATCH 15/30] Update to Samba 4.13.4 Guenther --- .gitignore | 2 + ...FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg | Bin 1275 -> 0 bytes samba-4.13-redhat.patch | 240 +++++++++--------- samba-pubkey_AA99442FB680B620.gpg | Bin 0 -> 2290 bytes samba.spec | 8 +- sources | 4 +- 6 files changed, 129 insertions(+), 125 deletions(-) delete mode 100644 gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg create mode 100644 samba-pubkey_AA99442FB680B620.gpg diff --git a/.gitignore b/.gitignore index 9170f96..669acc7 100644 --- a/.gitignore +++ b/.gitignore @@ -229,3 +229,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.2.tar.asc /samba-4.13.3.tar.xz /samba-4.13.3.tar.asc +/samba-4.13.4.tar.xz +/samba-4.13.4.tar.asc diff --git a/gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg b/gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg deleted file mode 100644 index a61ebc450995a418da1144e95cbfb66bc1edcd0b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1275 zcmVW;H$ADVghZ2A8yO#p&`LaP9v$kcn*MvBhO zXtSVV1{<`oJX4V01OSk=yI-^RYHqjk7NgeC^OBK0^w(V+Z_~KS`{p0C@r-)1Ma9}( zRF97Mv;p*<%jsnY7sT_J!3G?3t&Vb{WF5~4HvnRke5Fu#)6QRfN=4sjobF^ZE8@OC zLV!i5a>0E`ErggqW)RdDn6==$g-dDuO(N0Fb|f*l256-u#y|uBqO+N-dX?&qw9dlbo*hlQ0(DCgAaI6|J zY8UK)DNW$72QJpZ%TuxTMrZmO^~lj0J=rMvZd(i9mZM~9og?)2qIv$>daZTBEQkgF zH76JnS0v-VZ z7k~u9mb&d^hg2gzhs(tRS{#34s2%P|* zf4YbL#idQe@gIs;4J;N^Jsq0TxdIIYMaDT{5C{OsIbIW`QM$A>)a`)vRx)?@7jB|x zmQD|Nbc2I~R@of8@KLTv)qeA`HYS1=c|oq0#Mvip9I#q;kI?gsT_Y@|Ri~&F6J|;A zbP7yt!~~L!DLj;m!PLXw?K0*YczM_K@v9bfAXDcn?&RjA;P29FbNQ6g9`Oy*jrx&d zB$wA~mV&3D`(kWBE_5!xYo9+rGBT=UOm@Gu%A6@Np`misd=8}e$+U})6{Lvd>!&u$ zp0ar7;UF)rPeW(VTf!%4S}`4Y=_Zl|T#V#~m%^-Js~@a*qj z{^c!?PL*}(;rT-}8ItmUJ$WQWbTuMcFOvIttf-zGEO?)!8E>0i^b3G_7HRL57ZDS? zrE-SdkV-&6_;`B{q7v}k(+Uk?x`eb};ADKi>`E+Huc>Bu%jkM#yS)^ z1DnZ&#fVP?7!d*h4+0wu1p-#6p34OZ62q9^0162ZZ!?iwWoWnRP&)vipS-vOdP4v< l{ Date: Mon, 13 Jul 2020 16:15:03 +0200 Subject: [PATCH 001/104] libcli:smb2: Do not leak ptext on error @@ -10,10 +10,10 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 1 insertion(+) diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c -index cc03607d789..4d430f56df5 100644 +index 230475480c2..cfb3b613f9d 100644 --- a/libcli/smb/smb2_signing.c +++ b/libcli/smb/smb2_signing.c -@@ -520,6 +520,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, +@@ -515,6 +515,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, ctext = talloc_size(talloc_tos(), ctext_size); if (ctext == NULL) { @@ -25,7 +25,7 @@ index cc03607d789..4d430f56df5 100644 2.29.2 -From 1310c58c3b8b9c7fcb0c811a9ef24b3bbe8c16f1 Mon Sep 17 00:00:00 2001 +From 630c6314778894a668c20fe2aa7d04627ed517a7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 17:23:37 +0200 Subject: [PATCH 002/104] libcli:smb2: Use talloc NULL context if we don't have @@ -44,10 +44,10 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c -index 4d430f56df5..6ece5f2e4d3 100644 +index cfb3b613f9d..b1e0253948f 100644 --- a/libcli/smb/smb2_signing.c +++ b/libcli/smb/smb2_signing.c -@@ -511,14 +511,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, +@@ -506,14 +506,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, uint8_t *ctext = NULL; size_t len = 0; int i; @@ -75,7 +75,7 @@ index 4d430f56df5..6ece5f2e4d3 100644 if (ctext == NULL) { TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; -@@ -710,16 +721,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, +@@ -705,16 +716,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, uint8_t *ptext = NULL; size_t len = 0; int i; @@ -109,7 +109,7 @@ index 4d430f56df5..6ece5f2e4d3 100644 2.29.2 -From ff15d93d1009a23428b9c11090836624255924cd Mon Sep 17 00:00:00 2001 +From 63cefdebe5c0e435b6174ff6bc72b48d12cec312 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 6 Nov 2019 17:37:45 +0100 Subject: [PATCH 003/104] auth:creds: Introduce CRED_SMB_CONF @@ -205,7 +205,7 @@ index d2a81506de3..6454ac9ff7c 100644 2.29.2 -From cc5e70efc8b9f45054d7e57002f59ac38c4c687f Mon Sep 17 00:00:00 2001 +From 0120aad504663c5e75054c2e322f1277acae63dd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 10 Oct 2019 14:18:23 +0200 Subject: [PATCH 004/104] param: Add 'server smb encrypt' parameter @@ -740,12 +740,12 @@ index a3abaa2ec67..c0070b716a5 100644 .durable_handles = true, .check_parent_directory_delete_on_close = false, diff --git a/source3/smbd/service.c b/source3/smbd/service.c -index ed38121f292..a263c33b7e2 100644 +index 3802d16179b..9aa89e3eb02 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c -@@ -567,9 +567,9 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, - conn->case_preserve = lp_preserve_case(snum); - conn->short_case_preserve = lp_short_preserve_case(snum); +@@ -558,9 +558,9 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, + /* Case options for the share. */ + conn_setup_case_options(conn); - conn->encrypt_level = lp_smb_encrypt(snum); + conn->encrypt_level = lp_server_smb_encrypt(snum); @@ -824,7 +824,7 @@ index 7acde285a90..b745e0906b1 100644 2.29.2 -From d78374a9e26428a48b3c6a2aa1d4280751620fb9 Mon Sep 17 00:00:00 2001 +From a351d15240e7c8638883155404fe2f3d70029e7e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 10:04:19 +0200 Subject: [PATCH 005/104] param: Create and use enum_smb_encryption_vals @@ -899,7 +899,7 @@ index 47b85de1f87..e2f737279dc 100644 {MDNS_NAME_NETBIOS, "netbios"}, {MDNS_NAME_MDNS, "mdns"}, diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h -index b424b13cde4..2fb1fd7189e 100644 +index d2345f094e1..8ee99e25566 100644 --- a/libcli/smb/smb_constants.h +++ b/libcli/smb/smb_constants.h @@ -106,6 +106,15 @@ enum smb_signing_setting { @@ -922,7 +922,7 @@ index b424b13cde4..2fb1fd7189e 100644 2.29.2 -From e2e0decfb117a8d6bb1428509f770315849e972b Mon Sep 17 00:00:00 2001 +From 021975ea03413244d02d35940973f67956adec2b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:34:54 +0200 Subject: [PATCH 006/104] s3:smbd: Use 'enum smb_encryption_setting' values @@ -952,11 +952,11 @@ index c0070b716a5..4ad541301b3 100644 .durable_handles = true, .check_parent_directory_delete_on_close = false, diff --git a/source3/smbd/service.c b/source3/smbd/service.c -index a263c33b7e2..43803e721c2 100644 +index 9aa89e3eb02..d7d17d3dee1 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c -@@ -568,16 +568,16 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, - conn->short_case_preserve = lp_short_preserve_case(snum); +@@ -559,16 +559,16 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, + conn_setup_case_options(conn); conn->encrypt_level = lp_server_smb_encrypt(snum); - if (conn->encrypt_level > SMB_SIGNING_OFF) { @@ -1046,7 +1046,7 @@ index b745e0906b1..2f2fdcb7260 100644 2.29.2 -From a461b9e0348f2f082cc59b601271ca5b3283df09 Mon Sep 17 00:00:00 2001 +From 7153b9b229a2feea129f1bb1cd423dd4e79d5a05 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Apr 2020 10:38:41 +0200 Subject: [PATCH 007/104] docs-xml: Add 'client smb encrypt' @@ -1224,7 +1224,7 @@ index 4ad541301b3..6418a42b6eb 100644 2.29.2 -From d55143fc3090b43390fdf14ff45d9c2971fc43d2 Mon Sep 17 00:00:00 2001 +From f151e19473330373801c4d85ef3d5ce0918ac17d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jul 2020 17:48:25 +0200 Subject: [PATCH 008/104] lib:param: Add lpcfg_parse_enum_vals() @@ -1291,7 +1291,7 @@ index 323fcf84523..e66ce2324b4 100644 2.29.2 -From d01ae8111553a71b80988eeb737e8b80bc765b20 Mon Sep 17 00:00:00 2001 +From 6364c5bcde41ed5bdb478747511003796a601e74 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:38:08 +0200 Subject: [PATCH 009/104] libcli:smb: Add smb_signing_setting_translate() @@ -1464,7 +1464,7 @@ index 6918e1306c3..20981754db4 100644 2.29.2 -From 4cef2825a3363a38fbfbff5f172053145f62f100 Mon Sep 17 00:00:00 2001 +From 8ceec22ead224c3581b18b0fc95cb7f7f9c061a8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 08:39:34 +0200 Subject: [PATCH 010/104] libcli:smb: Add smb_encryption_setting_translate() @@ -1558,7 +1558,7 @@ index da0e4db2bf3..ac2887ee5c4 100644 2.29.2 -From a0cb6b810b655298ce5b87d8e36d1089460feca7 Mon Sep 17 00:00:00 2001 +From dc53c158acdeffc6e53436359a56bcf7071b3d83 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:47:59 +0200 Subject: [PATCH 011/104] s3:lib: Use smb_signing_setting_translate for cmdline @@ -1609,7 +1609,7 @@ index 90ee67c4cb7..bc1f1c3ed25 100644 } diff --git a/source3/wscript_build b/source3/wscript_build -index 5a07eddac44..6a08afe4a25 100644 +index d86a9fcadbf..c1051c62393 100644 --- a/source3/wscript_build +++ b/source3/wscript_build @@ -279,7 +279,7 @@ bld.SAMBA3_LIBRARY('popt_samba3_cmdline', @@ -1625,7 +1625,7 @@ index 5a07eddac44..6a08afe4a25 100644 2.29.2 -From ef521e6b44710fb3ed567d36fa56687b677fe58a Mon Sep 17 00:00:00 2001 +From c6f52fc629ca09e450b3bd0c1bdc56fdabeae141 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 07:47:18 +0200 Subject: [PATCH 012/104] auth:creds: Remove unused credentials autoproto @@ -1705,7 +1705,7 @@ index 7711eac2afa..d9be3562adb 100644 2.29.2 -From 6fafcebb8bd6311a736d995af6641e68e43e03a1 Mon Sep 17 00:00:00 2001 +From 62bca83b540c9402d86f0668839150d2abf3adec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:32:44 +0200 Subject: [PATCH 013/104] auth:creds: Add @@ -1847,7 +1847,7 @@ index 68f1f25dce1..9cde0000b5f 100644 2.29.2 -From 64e2c99501677bfe52212c9ea99ec3512cf62f6e Mon Sep 17 00:00:00 2001 +From a14f3c5f3f39173650bd56ee034bd35ea111ee07 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 11:56:01 +0200 Subject: [PATCH 014/104] auth:creds: Add python bindings for @@ -1973,7 +1973,7 @@ index 6454ac9ff7c..e5f8122fa21 100644 2.29.2 -From 1280505f1396925851db5a29f2465d9c31d45f88 Mon Sep 17 00:00:00 2001 +From 9fdc98da5c625acd11205b2bb28deb780ef905ec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:31:35 +0200 Subject: [PATCH 015/104] auth:creds: Add @@ -2105,7 +2105,7 @@ index 9cde0000b5f..54e8271471f 100644 2.29.2 -From 32209d254bb7bd3bd6ad3af14f219cee306a19a3 Mon Sep 17 00:00:00 2001 +From d8e43a7c8058a6a395493360cf2faae24f64e2e2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:32:46 +0200 Subject: [PATCH 016/104] auth:creds: Add python bindings for @@ -2210,7 +2210,7 @@ index e5f8122fa21..8edf13ce6ff 100644 2.29.2 -From d0a1bf1a75426c1d334349a6a4f8e44c80c1915b Mon Sep 17 00:00:00 2001 +From 767d356f718965b4595b8322729556b63e66425d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:10:52 +0200 Subject: [PATCH 017/104] auth:creds: Add @@ -2344,7 +2344,7 @@ index 54e8271471f..3b86b742448 100644 2.29.2 -From 36ab2aa54102aa9cce92ac8ebf250db4d460324e Mon Sep 17 00:00:00 2001 +From 88dd0d8871ae2a54bc089f1e761ded6940b270b0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:38:30 +0200 Subject: [PATCH 018/104] auth:creds: Add python bindings for @@ -2462,7 +2462,7 @@ index 8edf13ce6ff..e0a6248d37a 100644 2.29.2 -From f866d9e80964e16307a8376ed448d0ca3a987538 Mon Sep 17 00:00:00 2001 +From 41df2d5330c051066691576af9ccf505cb0573e3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 11:19:53 +0200 Subject: [PATCH 019/104] auth:creds: Add python bindings for @@ -2590,7 +2590,7 @@ index e0a6248d37a..6187bded0b6 100644 2.29.2 -From 3f55ee05f024eacdd43fbbfb941703f8555df7c7 Mon Sep 17 00:00:00 2001 +From cdb470d7c408baa07eabf83ec566baecc8e5138c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 08:14:23 +0200 Subject: [PATCH 020/104] auth:creds: Bump library version @@ -2620,7 +2620,7 @@ index 564a04fe8dd..1e3302e3e48 100644 2.29.2 -From 492030e0e6179bdc0311e8d03b89b1cb01de1a3e Mon Sep 17 00:00:00 2001 +From a11a02e0802dbb3300d9b3232b936b74b1f89a32 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 May 2020 11:10:30 +0200 Subject: [PATCH 021/104] s3:lib: Use cli_credential_(get|set)_smb_signing() @@ -2691,7 +2691,7 @@ index bc1f1c3ed25..6038ec11515 100644 2.29.2 -From 6164c45feff5daf0e751526d1f7bd599c61b2a0e Mon Sep 17 00:00:00 2001 +From 6e5fba172b910545f722d33aa3fb185f48492c18 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:45:34 +0200 Subject: [PATCH 022/104] s3:lib: Set smb encryption also via cli creds API @@ -2720,7 +2720,7 @@ index 6038ec11515..9c9e2f0ac0f 100644 2.29.2 -From ddb7926bba603afbc1a588d1b6da9f9a625881ac Mon Sep 17 00:00:00 2001 +From 01eb7d2f16a4f16931a0adffc395ec0b5946ef56 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 10:40:23 +0200 Subject: [PATCH 023/104] python: Remove unused sign argument from @@ -2775,7 +2775,7 @@ index 1e2c2918ebe..ad60cda0690 100644 2.29.2 -From 8683eacfb9c053115a84be025bbd64471c55d1c8 Mon Sep 17 00:00:00 2001 +From 7ad70308d9f5b5d892e507a58eb946839be33374 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 14:02:37 +0200 Subject: [PATCH 024/104] python: Set smb signing via the creds API @@ -2879,7 +2879,7 @@ index ad60cda0690..0f2f6520fc3 100644 2.29.2 -From 86212ac5fb8d5f0710f23dde362dc35d908e3047 Mon Sep 17 00:00:00 2001 +From 70b7a6d80c3699727f7bf36a4a9255bb90c67cec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:22:12 +0200 Subject: [PATCH 025/104] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC @@ -3102,7 +3102,7 @@ index 6cea2ee306c..2241beb331f 100644 2.29.2 -From 834dae6a34aaef7dccfb84821ec3fa7013b07d15 Mon Sep 17 00:00:00 2001 +From 19ac5889da3b5bec1fddba0e08daed7cbe24f604 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:29:25 +0200 Subject: [PATCH 026/104] s3:pylibsmb: Add ipc=True support for @@ -3167,7 +3167,7 @@ index 3fcc3424a57..3579a040830 100644 2.29.2 -From 072dfd83ee6513658e0ec818fb548f70648d6a41 Mon Sep 17 00:00:00 2001 +From ff93a26bdd480edb3e488b207b1fb6529cd52a38 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 09:47:11 +0200 Subject: [PATCH 027/104] python:tests: Mark libsmb connection as an IPC @@ -3196,7 +3196,7 @@ index ba7440df13b..2c028d381db 100644 2.29.2 -From ceb25f6cb4fd07cd736085030a02aefbcb012e34 Mon Sep 17 00:00:00 2001 +From b904f4bf9279264438e7b50ba90930562f4146fa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 17 Aug 2020 12:52:39 +0200 Subject: [PATCH 028/104] python:tests: Set smb ipc signing via the creds API @@ -3234,7 +3234,7 @@ index 2c028d381db..d6f5de7440a 100644 2.29.2 -From d3fe919fa5b952d075353f0d5c5366cabd5ef976 Mon Sep 17 00:00:00 2001 +From 19c1b06e7ca4ae26f36207b7dd070b33a853ff29 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:59:19 +0200 Subject: [PATCH 029/104] s3:libsmb: Use 'enum smb_signing_setting' in @@ -3364,7 +3364,7 @@ index d214cdabca4..995187e21b4 100644 2.29.2 -From 0ec1b432bf807efe37fdedf346724e787742e3aa Mon Sep 17 00:00:00 2001 +From 8ecad37d1fcc8d6fe07560df1bab35f2f70595f7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:11:31 +0200 Subject: [PATCH 030/104] s3:client: Turn off smb signing for message op @@ -3516,7 +3516,7 @@ index 3579a040830..f8a4d56cf53 100644 2.29.2 -From dd6a89dd02e675e1b836042e4a4dec31667ac58c Mon Sep 17 00:00:00 2001 +From 5325ea198e03bf4a51b101c74788df548eeedbac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:20:02 +0200 Subject: [PATCH 031/104] s3:libsmb: Remove signing_state from @@ -3615,7 +3615,7 @@ index f8a4d56cf53..c7a2d73afcb 100644 2.29.2 -From b31e224159fe25e8cf84e7d2ef8bc53934ddd209 Mon Sep 17 00:00:00 2001 +From 1517d0eb1036056851871e994849c647217ef36d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 14:59:14 +0200 Subject: [PATCH 032/104] s3:libsmb: Remove signing_state from @@ -3986,7 +3986,7 @@ index 954d6eba804..fea066ce468 100644 2.29.2 -From 49430d65ac0e11cdfec07c55b72f030c959f576f Mon Sep 17 00:00:00 2001 +From 07ccfed08ceadd0b7497e7259e855b1937522129 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 8 Jun 2020 08:04:24 +0200 Subject: [PATCH 033/104] s3:libsmb: Add encryption support to @@ -4203,7 +4203,7 @@ index b24743d789b..abfd18bfaf1 100644 2.29.2 -From cc6eca3fe233c16d879f9a76aae022320e7044d7 Mon Sep 17 00:00:00 2001 +From bf05adca0d32212d4eead676ef89d4a96d3949a0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 11:26:00 +0200 Subject: [PATCH 034/104] python: Add a test for SMB encryption @@ -4277,7 +4277,7 @@ index e8f8e7fe94d..81d4e482644 100644 2.29.2 -From 3bb0f6be56244767f78e8d0e085f2f7555585225 Mon Sep 17 00:00:00 2001 +From 86954cbf471bf391f50866d5d983c57cf8a4f064 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:31:02 +0200 Subject: [PATCH 035/104] s3:net: Use cli_credentials_set_smb_encryption() @@ -4326,7 +4326,7 @@ index b139fb2d0da..5829d891075 100644 2.29.2 -From 16aaa2f7395d235f72582a5190c9bf5d90578b9d Mon Sep 17 00:00:00 2001 +From 1d065c5960ea2bce6bab5420476a0c21ba40d26e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:40:13 +0200 Subject: [PATCH 036/104] s3:libsmb: Use cli_credentials_set_smb_encryption() @@ -4685,7 +4685,7 @@ index ec4a516b2ee..61503d0a98b 100644 2.29.2 -From eaa0bdc5931b82f9adbb65070252208be26a9d28 Mon Sep 17 00:00:00 2001 +From a35be10e055edb18b961c30c106fbefd08cd8c42 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:43:33 +0200 Subject: [PATCH 037/104] s3:client: Remove unused smb encryption code @@ -4721,7 +4721,7 @@ index f56dc323b6e..16a8d44c069 100644 2.29.2 -From 63179da4a51fefc5d938339360d579f725875389 Mon Sep 17 00:00:00 2001 +From 59362e873109a541d5381fe9a302a9464b83b549 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:47:05 +0200 Subject: [PATCH 038/104] s3:utils: Remove obsolete force encryption from @@ -4758,7 +4758,7 @@ index 5983ebbd0a5..8fd9fcc5780 100644 2.29.2 -From f113666b62c0fbe960f9ac22aea63241b56ffc61 Mon Sep 17 00:00:00 2001 +From d642ed3f0e60699c5650eb80ba02f9552b8f7bd9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:48:18 +0200 Subject: [PATCH 039/104] s3:utils: Remove obsolete force encryption from @@ -4792,7 +4792,7 @@ index 2ac4fde7daf..ef2657e4fa5 100644 2.29.2 -From 4f3770237e1a3d41c725560d9e5c14786b98d2f9 Mon Sep 17 00:00:00 2001 +From 4588a03309c7ce7404f54e010f4a93656bf9ff47 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:49:28 +0200 Subject: [PATCH 040/104] s3:utils: Remove obsolete force encryption from @@ -4830,7 +4830,7 @@ index fea066ce468..4ceac7b3ab0 100644 2.29.2 -From b897f3360dae5737d646dbce9f7571b1cfb070b0 Mon Sep 17 00:00:00 2001 +From 23b759045448c9072f8342778ea36b721c481bfd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:51:18 +0200 Subject: [PATCH 041/104] s3:rpcclient: Remove obsolete force encryption from @@ -4868,7 +4868,7 @@ index 2ead6cc7ba5..575a42ebf70 100644 2.29.2 -From b01458095b5e815c09eb71fb597598e9f34ee342 Mon Sep 17 00:00:00 2001 +From b42861ddc3b16cdda39c86d0549ed3af8e22cf7b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 10:58:36 +0200 Subject: [PATCH 042/104] examples: Remove obsolete force encryption from @@ -4906,7 +4906,7 @@ index 6206c3a9701..c64be573462 100644 2.29.2 -From 66eb5d32234f2e7700a43504158507a6f828c50b Mon Sep 17 00:00:00 2001 +From 9718e834445fa9fb77a947aee35ff49f9ce98572 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 11:05:59 +0200 Subject: [PATCH 043/104] s3:libsmb: Make cli_cm_force_encryption_creds() @@ -4954,7 +4954,7 @@ index 850cf12c8a6..eeabcaa7463 100644 2.29.2 -From 3b8e9646f0a79e2cbb977b8c1d0fc5f28a9b7490 Mon Sep 17 00:00:00 2001 +From 7e0b354aca307a2eaf45dcf0ca2e1203e7784fd3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 16:16:55 +0200 Subject: [PATCH 044/104] s4:libcli: Return NTSTATUS errors for @@ -5054,7 +5054,7 @@ index 582d43ef173..ad50ae0ac81 100644 2.29.2 -From cecd31a2451e20046c0202837269fb533e3118a7 Mon Sep 17 00:00:00 2001 +From 667f1730533b589820c2c7c492000fb86445797a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:54:26 +0200 Subject: [PATCH 045/104] s4:libcli: Return if encryption is requested for SMB1 @@ -5091,7 +5091,7 @@ index 6ee4929e8d7..51e121bdce6 100644 2.29.2 -From ed5b2f36fec30ae7b277620cb82f01a07f027e0e Mon Sep 17 00:00:00 2001 +From 97ce0f36abf29c234fbc4d8846ce0b68b2e4a6ab Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:29:39 +0200 Subject: [PATCH 046/104] s3:libcli: Split out smb2_connect_tcon_start() @@ -5144,7 +5144,7 @@ index 6fc3993a4e8..95ff05eac8f 100644 2.29.2 -From 7eb81b6448064d8beee3972471723b90ea9307ec Mon Sep 17 00:00:00 2001 +From bf357c3c06df5ac5aeea7851a7e285d68f3ab974 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:44:26 +0200 Subject: [PATCH 047/104] s4:libcli: Add smb2_connect_enc_start() @@ -5215,7 +5215,7 @@ index 95ff05eac8f..3a3ecdf20e8 100644 2.29.2 -From b5b0c28d597d8ef98b632e4616d2d2cdaaad37a9 Mon Sep 17 00:00:00 2001 +From 5a984891f73b07211d64e5a2f262915386aea7f4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 10:18:52 +0200 Subject: [PATCH 048/104] s4:libcli: Require signing for SMB encryption @@ -5271,7 +5271,7 @@ index 3a3ecdf20e8..9540704491e 100644 2.29.2 -From ee95e01cdc3917fc371b3145dcbe6d23ffc054b1 Mon Sep 17 00:00:00 2001 +From b733749b324891e6352fbb9ef51fa0452baa313e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 14:27:07 +0200 Subject: [PATCH 049/104] python:tests: Add test for SMB encrypted DCERPC @@ -5392,7 +5392,7 @@ index 20981754db4..adcb5b53189 100644 2.29.2 -From fefa1d0236c67b2a93328eb9e0eac21da22235b2 Mon Sep 17 00:00:00 2001 +From 141c2ebfb18be8ca2b313e900539cfa6b5927ded Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:47:54 +0200 Subject: [PATCH 050/104] auth:gensec: Add gensec_security_sasl_names() @@ -5522,7 +5522,7 @@ index d2d62d6652e..4eb45643714 100644 2.29.2 -From adf58a175cea99c0b0147d3b3275563c7155edfa Mon Sep 17 00:00:00 2001 +From b68a26966dddb4ec8a7bc7ec3441dbf03efd6af9 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:48:27 +0200 Subject: [PATCH 051/104] s4:ldap_server: Use samba_server_gensec_start() in @@ -5634,7 +5634,7 @@ index 2839082daef..915d9b94f9b 100644 2.29.2 -From e887d94b47aca3609fd158efe0f4654101c5e02b Mon Sep 17 00:00:00 2001 +From fa5761777851f6d2ecdaa88fdea3260e42dc634c Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:39:15 +0200 Subject: [PATCH 052/104] auth:gensec: Make gensec_use_kerberos_mechs() a @@ -5684,7 +5684,7 @@ index 4eb45643714..ebcab76999a 100644 2.29.2 -From 08dc4775dbf72a1e8068d392360be158d8305bfa Mon Sep 17 00:00:00 2001 +From 3c052ba053b6fee6c97f13aca8eafe680321ded8 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:41:43 +0200 Subject: [PATCH 053/104] auth:gensec: Pass use_kerberos and keep_schannel to @@ -5758,7 +5758,7 @@ index ebcab76999a..8d1b41fec74 100644 2.29.2 -From bc505a449449267085778ec51c5362e256837edb Mon Sep 17 00:00:00 2001 +From ec9c5e93a31763c48d5c2d0e8859d9750aa36ed1 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 17:00:45 +0200 Subject: [PATCH 054/104] auth:gensec: If Kerberos is required, keep schannel @@ -5795,7 +5795,7 @@ index 8d1b41fec74..3f42d611140 100644 2.29.2 -From 9b7a189e038e3f783a2b23302f0ee4657ef18057 Mon Sep 17 00:00:00 2001 +From d3f6c14e95159b4fed2034d563479607b48ee9ea Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:21 +0200 Subject: [PATCH 055/104] auth:creds: Add cli_credentials_init_server() @@ -5861,7 +5861,7 @@ index 7d0cf53194b..438bcdce232 100644 2.29.2 -From 013d5eb87f3ddcda6df5c76796bede7a85c42207 Mon Sep 17 00:00:00 2001 +From b6249e4af652be9f02741ed0de59889734bff13f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:36 +0200 Subject: [PATCH 056/104] s4:rpc_server: Use cli_credentials_init_server() @@ -5909,7 +5909,7 @@ index 084857a44bf..e64148ef788 100644 2.29.2 -From 6e6030dca006e829150e6b64db0485e3c9895485 Mon Sep 17 00:00:00 2001 +From b0db24f086aad67ca9e536c6c94ef413983b5586 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 7 Sep 2020 09:19:43 +0200 Subject: [PATCH 057/104] s4:smb_server: Use cli_credentials_init_server() for @@ -6009,7 +6009,7 @@ index 4aaaf46793b..c433eb194bd 100644 2.29.2 -From f9f25b7690c2e234ea2e631f05c1fb0180776842 Mon Sep 17 00:00:00 2001 +From 96aae2c7cf11aeaadc98e0e18f88d1c9387019a7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:22 +0200 Subject: [PATCH 058/104] selftest: Rename 'smb encrypt' to 'server smb @@ -6060,7 +6060,7 @@ index e141f102ef1..c070086ca49 100755 2.29.2 -From 2fc16a8d11f48424fc2fff0380fb623f552ece5f Mon Sep 17 00:00:00 2001 +From f4d1c495b4eb8a3125812e1d1d81639afdd15c06 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 12:30:08 +0200 Subject: [PATCH 059/104] selftest: Move enc_desired to provision to have it in @@ -6107,7 +6107,7 @@ index c070086ca49..fa3ca8962a5 100755 2.29.2 -From 299d7d6868e9590693e465cbc0c10abe8b7fc5a0 Mon Sep 17 00:00:00 2001 +From c69630ece0849fdca724003600f1b39d6411e194 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:20 +0200 Subject: [PATCH 060/104] s3:tests: Add smbclient tests for 'client smb @@ -6248,7 +6248,7 @@ index 27dc7587b17..46bf274227c 100755 2.29.2 -From d996ccf7dc53046f92827ddab72aac6e92dd3a77 Mon Sep 17 00:00:00 2001 +From 5b15d0dd8783b8431e3d3913ee129b6e0f111de7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:19:27 +0200 Subject: [PATCH 061/104] s3:client: Remove global smb_encrypt @@ -6356,7 +6356,7 @@ index 56309efcea7..60d4fb3c5ee 100644 2.29.2 -From b923ea7625de03e23a999a3cb844d81dcd25316f Mon Sep 17 00:00:00 2001 +From 1c461fb323ba59539c8dab2547032bdb48c60178 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:24:27 +0200 Subject: [PATCH 062/104] s3:libsmb: Remove force_encrypt from cli_cm_open() @@ -6510,7 +6510,7 @@ index eeabcaa7463..bb3e9e6874e 100644 2.29.2 -From 2fd26f4c208556cd2f28f0c54fe11cea044c7881 Mon Sep 17 00:00:00 2001 +From 411587b7301ec115398e430bcac16c5a22bdfe41 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:26:39 +0200 Subject: [PATCH 063/104] s3:libsmb: Remove force_encrypt from cli_cm_connect() @@ -6572,7 +6572,7 @@ index 4825b8f3fae..b0032005398 100644 2.29.2 -From 3db1056dc42765aa3043b6ea0fd0389a34a41145 Mon Sep 17 00:00:00 2001 +From af532caa1ba9727663abf17465b04768c6f7173e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:28:28 +0200 Subject: [PATCH 064/104] s3:libsmb: Remove force_encrypt from clidfs @@ -6633,7 +6633,7 @@ index b0032005398..5503506de97 100644 2.29.2 -From 8b234932ec76052258078d08071c33fefd5f3a0e Mon Sep 17 00:00:00 2001 +From 918aa81d36bcd8b28fa98deadd811b8602fb3f6d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:52:11 +0200 Subject: [PATCH 065/104] s3:libsmb: Remove force_encrypt from @@ -6730,7 +6730,7 @@ index bb3e9e6874e..f2b0a8c5ff8 100644 2.29.2 -From b1324ba3361e66ca4bdf5b0cb0e1d8c8084955d4 Mon Sep 17 00:00:00 2001 +From 00bba24fda3f117eced7f306d5d4019f14595d38 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:15:09 +0200 Subject: [PATCH 066/104] s3:libsmb: Pass cli_credentials to clidfs @@ -6849,7 +6849,7 @@ index 736c565a7a8..d536e0597af 100644 2.29.2 -From 5997be2fc0d9b25c7a81d1d21e3cc1cd3f55e66f Mon Sep 17 00:00:00 2001 +From 0dfe1d347c131b66172d324a5a16336875b24d50 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:18:16 +0200 Subject: [PATCH 067/104] s3:libsmb: Pass cli_credentials to cli_cm_connect() @@ -6920,7 +6920,7 @@ index d536e0597af..a2c6f5fe5ec 100644 2.29.2 -From 62109132050092a5b4ac81d80cb358e563da605c Mon Sep 17 00:00:00 2001 +From baf5499376658651aa03ba864e6541e2daf06b3a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:26:54 +0200 Subject: [PATCH 068/104] s3:libsmb: Pass cli_credentials to cli_cm_open() @@ -7131,7 +7131,7 @@ index f2b0a8c5ff8..0b8cf2a6036 100644 2.29.2 -From 9500031d977b874b32085df3ff7f5b0ae28514c6 Mon Sep 17 00:00:00 2001 +From ee496daf60a5340ab9e4f16430e2d93fd121659b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:42:25 +0200 Subject: [PATCH 069/104] s3:libsmb: Pass cli_credentials to @@ -8018,7 +8018,7 @@ index 8fd9fcc5780..4989ec633c3 100644 2.29.2 -From e3ce5ba85266a08bd201c851e8fd59b71322d03e Mon Sep 17 00:00:00 2001 +From aa21292bdc66f8f26244da5f1422bc41afafa6f7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:40:49 +0200 Subject: [PATCH 070/104] s3:client: Remove global max_protocol @@ -8100,7 +8100,7 @@ index 13e48f80a01..902cdec8b64 100644 2.29.2 -From 156a763a247480a88ab79f8822a2f34670a0c63b Mon Sep 17 00:00:00 2001 +From 517baf60c6597388cfd1a17bf998272586d3bfc9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:43:46 +0200 Subject: [PATCH 071/104] s3:libsmb: Remove max_protocol from cli_cm_open() @@ -8225,7 +8225,7 @@ index 517738dbcd7..8aaaff2cb1e 100644 2.29.2 -From 2ad30b082df42e010ca88e7a84471629476e00b9 Mon Sep 17 00:00:00 2001 +From b35001a76bc0ff7fc10bd319abfda481b8a81c9b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:45:12 +0200 Subject: [PATCH 072/104] s3:libcmb: Remove max_protocol from cli_cm_connect() @@ -8278,7 +8278,7 @@ index fb1a0c72e6d..023dd4d2757 100644 2.29.2 -From 4cc3243a8cf7c18129ad41ea52abc325aef55f06 Mon Sep 17 00:00:00 2001 +From 4e405a5acc748c07f74a27ed57deeffc4e2c20d7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:46:29 +0200 Subject: [PATCH 073/104] s3:libsmb: Remove max_protocol from clidfs @@ -8341,7 +8341,7 @@ index 023dd4d2757..ee5becf76a6 100644 2.29.2 -From bfd80fa8f7a476b2fb37bd435697700ad032cc70 Mon Sep 17 00:00:00 2001 +From c710bcf3600beb7f9a08c56108c0c93f32a9139b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Aug 2020 15:47:35 +0200 Subject: [PATCH 074/104] s3:include: Move loadparm prototypes to own header @@ -8759,7 +8759,7 @@ index 00000000000..7686877ccf1 2.29.2 -From ad73140f7e08472179ac7598cfea780a207f0570 Mon Sep 17 00:00:00 2001 +From 62a13e686241e752ba927da046dda68324f3a550 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 11 Aug 2020 10:41:07 +0200 Subject: [PATCH 075/104] s3:lib: Move interface prototypes to own header file @@ -8865,7 +8865,7 @@ index 00000000000..f45435b4a81 2.29.2 -From bd958477d69c820766a30f818163cda9f9d171a3 Mon Sep 17 00:00:00 2001 +From 2b704c32b55432d08eae3cae2267a4b6319c6c6c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:16 +0100 Subject: [PATCH 076/104] idl: Add SID_SAMBA_SMB3 @@ -8895,7 +8895,7 @@ index a92e8f1518e..06bf7449a70 100644 2.29.2 -From 6b4e237ea0900e2ac7f46b889fd95d1d04db5bff Mon Sep 17 00:00:00 2001 +From ae4b1eccc9ef043a753126f942345a57a92004ed Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:29 +0100 Subject: [PATCH 077/104] s3:smbd: Add SMB3 connection information to session @@ -9052,7 +9052,7 @@ index cf9de185c1f..cd24b7d2ed5 100644 2.29.2 -From 466c2d98005e1e0a3c3aa7b17779031b426b5da6 Mon Sep 17 00:00:00 2001 +From 49853bdabadcde29032b0ae09f015a0adf3cd22c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Mar 2020 14:11:56 +0100 Subject: [PATCH 078/104] librpc: Add dcerpc helper @@ -9268,7 +9268,7 @@ index 27b180fa63d..109a1834841 100644 2.29.2 -From cc8a5479152c6131362e9ca9cfe6e5bab2a71af3 Mon Sep 17 00:00:00 2001 +From 0490f135fdcc293561b0af98b4ce0f4d56eb14a6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 28 Aug 2020 16:31:17 +0200 Subject: [PATCH 079/104] s3:smbd: Use defines to set 'srv_smb_encrypt' @@ -9305,7 +9305,7 @@ index d51a3de9497..785cbb23b5f 100644 2.29.2 -From dad6dc0e5a202d48a930504768394343823d5c42 Mon Sep 17 00:00:00 2001 +From bbbb58dd5f37f82b46872d4a9eb3c6f6c1939a26 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 12 Nov 2019 16:56:45 +0100 Subject: [PATCH 080/104] s3:rpc_server: Allow to use RC4 for setting passwords @@ -9542,7 +9542,7 @@ index 2af02ad6fa8..eb91ac09384 100644 2.29.2 -From 2932bdeff6ad18a36b2b64ab59d72ff1040acd09 Mon Sep 17 00:00:00 2001 +From c3ffe2ce09c761a69ba83ae55beb4af4e53095d7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 15 Nov 2019 13:49:40 +0100 Subject: [PATCH 081/104] s4:rpc_server: Allow to use RC4 for setting passwords @@ -9673,7 +9673,7 @@ index de55ad6239a..c9c1978f223 100644 2.29.2 -From 959978865400d20fe1b2f9b5343fbec7c0b1109a Mon Sep 17 00:00:00 2001 +From 6163af4d52811d487fa3568d0588e6afd7f43167 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:45:49 +0200 Subject: [PATCH 082/104] lib:crypto: Add py binding for set_relax/strict fips @@ -9731,7 +9731,7 @@ index 32b946eee8f..ad18d3ada0f 100644 2.29.2 -From e3059d24a83175efb4f9eb3844c2e02d2af7775a Mon Sep 17 00:00:00 2001 +From 0dbd9d87a529585cabd793ae4c2bc1d94044c619 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 28 Oct 2020 17:05:36 +0100 Subject: [PATCH 083/104] s4:param: Add 'weak crypto' getter to pyparam @@ -9787,7 +9787,7 @@ index 4023fac4dd6..e15592b5743 100644 2.29.2 -From 2c10e3c1bbd7527f8563dca42700310c86ec04d4 Mon Sep 17 00:00:00 2001 +From 29e334546e28b10ff31f0de453951648c4e51296 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 Subject: [PATCH 084/104] python:tests: Add SAMR password change tests for fips @@ -10012,7 +10012,7 @@ index adcb5b53189..86cab3f8046 100644 2.29.2 -From 65f6aef76ebc4b432f2743fb36cec64d7e06e71d Mon Sep 17 00:00:00 2001 +From de2b1caebf0183bd24d06969ebf7d03223f7d9fc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 Subject: [PATCH 085/104] python:tests: Add SAMR password change tests for fips @@ -10045,7 +10045,7 @@ index 649e923ff9a..1ebdf2a5484 100755 2.29.2 -From 114ce58de5ac14035c095e12aeb31931c7859d89 Mon Sep 17 00:00:00 2001 +From 5f240ac738df737712cbc2cdd40c8a56ab9e165b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 09:40:41 +0200 Subject: [PATCH 086/104] auth:creds: Rename CRED_USE_KERBEROS values @@ -10787,7 +10787,7 @@ index 07c6faebb15..701dfc10a07 100644 2.29.2 -From dd116a6a1b334431981b786c103503d9e2998247 Mon Sep 17 00:00:00 2001 +From 03fb4e57548098264386dfd056f37ad2c86a937a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Sep 2020 12:32:28 +0200 Subject: [PATCH 087/104] auth:creds:tests: Migrate test to a cmocka unit test @@ -11084,7 +11084,7 @@ index 38b6c8f4b6e..f0ab0357986 100644 2.29.2 -From 48c31546ad4c2a072497e3ce9eff37ef37bc81c8 Mon Sep 17 00:00:00 2001 +From 82565bd73ee76d51b6569743644be1b916461acd Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:09:05 +0200 Subject: [PATCH 088/104] Add smb2cli_session_get_encryption_cipher() @@ -11102,10 +11102,10 @@ Reviewed-by: Alexander Bokovoy 2 files changed, 14 insertions(+) diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c -index 7d2da4b9ebc..471319a32f1 100644 +index 4909797543c..1be3a5506a0 100644 --- a/libcli/smb/smbXcli_base.c +++ b/libcli/smb/smbXcli_base.c -@@ -6436,6 +6436,19 @@ NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session) +@@ -6461,6 +6461,19 @@ NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session) return NT_STATUS_OK; } @@ -11141,7 +11141,7 @@ index 2afc7165cd9..db5f5d58799 100644 2.29.2 -From 25a7d3534f7e3798cdf2432de62ed62f9e11547b Mon Sep 17 00:00:00 2001 +From f74c5cc57398ee42fecdfda17f4d442ca1abd9a5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:18:21 +0200 Subject: [PATCH 089/104] Add dcerpc_transport_encrypted() @@ -11233,7 +11233,7 @@ index bd79a072bc8..6ea27a8d9a3 100644 2.29.2 -From a0b8ea04d7030d2cb97d6ccea9d28072d6e3dbda Mon Sep 17 00:00:00 2001 +From 89a12dbf4a5b819dbd136e743c59025298009049 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:35:01 +0200 Subject: [PATCH 090/104] Add py binding for dcerpc_transport_encrypted @@ -11280,7 +11280,7 @@ index be914ed5f14..309a6d72e26 100644 2.29.2 -From ff38da1d43f7ec3312a90fb8c53f977c9466e199 Mon Sep 17 00:00:00 2001 +From a08aab47494ab4f2972de3ebe4b022a1d23216a5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:44:08 +0200 Subject: [PATCH 091/104] selftest: add a test for py dce transport_encrypted @@ -11345,7 +11345,7 @@ index 8e0d6a5ef0a..24e4ac77d89 100644 2.29.2 -From 5ffb0a0d9093bba2c4630d89512f623a35122f8e Mon Sep 17 00:00:00 2001 +From 4e8f7954ceed5a14987eb56197f265618fd77acc Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:47:12 +0200 Subject: [PATCH 092/104] Add CreateTrustedDomainRelax wrapper for fips mode @@ -11431,7 +11431,7 @@ index 00000000000..b4df0fa5bb8 2.29.2 -From d980bb1444e318825457ead9bdbce1c9353ccc66 Mon Sep 17 00:00:00 2001 +From 2e16b3d7d5419e76d33b2c3a794a043be5c0a4a5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:49:17 +0200 Subject: [PATCH 093/104] Use the new CreateTrustedDomainRelax() @@ -11538,7 +11538,7 @@ index 1d12c362911..93a3258d28d 100644 2.29.2 -From e06d01fe3370501ab45d01c5511aa0b5de9d854e Mon Sep 17 00:00:00 2001 +From 2661a29e81b6b33dce6ca1e39c9e4eeaab53fef7 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 1 Sep 2020 20:14:29 +0300 Subject: [PATCH 094/104] selftest: add a test for the CreateTrustedDomainRelax @@ -11723,7 +11723,7 @@ index 3a903a7eee0..96f51b68cfc 100755 2.29.2 -From 93b792d5d0dcf96833e32958aeb3877f74125f07 Mon Sep 17 00:00:00 2001 +From 3d3a03764d56b58a81ef99123720bd5555eaf040 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 5 Nov 2020 15:38:19 +0200 Subject: [PATCH 095/104] Remove source4/scripting/devel/createtrust script @@ -11878,7 +11878,7 @@ index 26b0d0dcb68..00000000000 2.29.2 -From 4577786be36993e958b745e4953f582e3de301a1 Mon Sep 17 00:00:00 2001 +From 8bdfdf2b2489393586dbc99b1d2282c61acdce09 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:30:26 +0100 Subject: [PATCH 096/104] s3:rpc_server: Use gnutls_cipher_decrypt() in @@ -11910,7 +11910,7 @@ index 198387424e6..e749caf2551 100644 2.29.2 -From ad9c90d18c2efdee16535ade97d4b151e4a64c5e Mon Sep 17 00:00:00 2001 +From 37fce305caff75a8ee1ab185f37e984809225239 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:33:38 +0100 Subject: [PATCH 097/104] s4:rpc_server: Use gnutls_cipher_decrypt() in @@ -11942,7 +11942,7 @@ index 8333cb149b6..4bb8aaa9592 100644 2.29.2 -From 6c73bf8553c48e28abd09ff225cbfb8278528d0d Mon Sep 17 00:00:00 2001 +From caf59e243ed0f99056176ef81fe617b170ec6cfd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:40:21 +0200 Subject: [PATCH 098/104] s3:rpc_server: Allow to use RC4 for creating trusts @@ -12009,7 +12009,7 @@ index e749caf2551..d6d606ddeca 100644 2.29.2 -From 20f0e078f2dd5681513253788216313851df428d Mon Sep 17 00:00:00 2001 +From 14b972e7f4224ccf87b1d08824194a4d7d37aef0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:51:39 +0200 Subject: [PATCH 099/104] s4:rpc_server: Allow to use RC4 for creating trusts @@ -12081,7 +12081,7 @@ index 4bb8aaa9592..5b3ef71d458 100644 2.29.2 -From 8c7a60700f7c7925749ccfd0f3ccb17ca47df7da Mon Sep 17 00:00:00 2001 +From 5fdca81ab920d021e5f1c81a05cf3a91244ef405 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 10:13:48 +0100 Subject: [PATCH 100/104] sefltest: Enable the dcerpc.createtrustrelax test @@ -12111,7 +12111,7 @@ index 80effda8343..00000000000 2.29.2 -From 9db0e9602ea96849a6f854415f4cd988576cccf2 Mon Sep 17 00:00:00 2001 +From 2547b1d495afa0f7235064f4949a297e46338287 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 11 Nov 2020 13:42:06 +0100 Subject: [PATCH 101/104] s3:smbd: Fix possible null pointer dereference in @@ -12147,7 +12147,7 @@ index 57754a0f766..694c0c290e8 100644 2.29.2 -From b92cbd97865ea6ef49892df75c59f37e9917ddb3 Mon Sep 17 00:00:00 2001 +From 14cba0db4c3e8a20923491f01cd6eb658c8d76ae Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 10 Nov 2020 17:35:24 +0200 Subject: [PATCH 102/104] lookup_name: allow lookup names prefixed with DNS @@ -12257,7 +12257,7 @@ index 82c47b3145b..864246da56e 100644 2.29.2 -From 5bf01d45325bcc6819f807620267e35841f826a3 Mon Sep 17 00:00:00 2001 +From 35297bdac5cf9699234ec45ae97e54ceec75ebe9 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 11 Nov 2020 14:42:55 +0200 Subject: [PATCH 103/104] auth_sam: use pdb_get_domain_info to look up DNS @@ -12480,7 +12480,7 @@ index 3c12f959faf..e8e0d543f8c 100644 2.29.2 -From edd405a3918b5d52e7eeff2f8425478a0a1867ed Mon Sep 17 00:00:00 2001 +From 173cabf40d71470a233b7648b1bf8795f8bda091 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 27 Nov 2020 11:22:15 +0100 Subject: [PATCH 104/104] docs-xml: Add a section about weak crypto in testparm diff --git a/samba-pubkey_AA99442FB680B620.gpg b/samba-pubkey_AA99442FB680B620.gpg new file mode 100644 index 0000000000000000000000000000000000000000..c901409c92a9ccaa3f29dca796283d35ba462c4c GIT binary patch literal 2290 zcmajfS5OlQ8U^4qdXZ|Ba_IshB^RYeAxJZT^b$ZiLO?(uAktfqVju}i2Px7bL3$w4 zL_k4B3|=}Yp(;(PbiH%k+1Y*DxBtxi=k3gw2jYM@&*A?9asfKH<7)kPQmzuWsfi2u zLI?!5F)xxa87n$=!Jmo%9)YS<7;&9{>B}if@Dw z(oCC>JU&|4`so(*Jy(Bh>uh}Oq48D|OHlJE`)&?bj5M6%ar~{y?*;|d@0u7enGOL} z#+bE<^m(nlQiVi|@^q+t;%4c+>oehWTJAi{lvV3&l6u13$LfL+>9uZ(=lXRIn8wzi zWmzzD4gD{M1b|uA^~b;F7>ealR~$qV9J8uOTAx2e&yS0%Jlz#QEX7A!K5BCLwQz7C zca;xtH6(j@F!(#l%FU<2B1H6*ad2dvD77pTymf47>s`=m7TWA7t(1crE#zTG8cY&j z{frRKJd<+uop~v4z=LItsNoN2(##3{Q=M!oZi+a>wePCEPi_NBv?FH)ygMCol`f!c zjYLPN4ZDOVyJ01imns{Ds!W%i04Q{-nC{5xmXU&rwZ+5P5*N6uCe=@1L%h;a9U4N{ zJ#xSDgI^o|E+@2jdZv6mN8yv^u!`T4yu)8|1+R~i*$MI0Nn3JP!-N zb+KtX$*!827uW1OE3$xNSNCs4q>07KO4Kp}5g;P~HxK}9*06N-b8{8dMF(So&~70Z zbb!C8jb{-0F52DocQEpNC<+h$=Skiz#4A|)_o)yNjVbrHC?s{#hDG5X`^=e&q#VU}Irs0x|NlvM{rOAm>3~Am|Su2pS7u zW#RfyX{45t2!nTU|cnp9INM-Nj! z8xHj3uA7J~7Zujt1Xq9ypN%FNSyJIQzIY|cH%k0;45r|fnfTJ0D?Z>(SBD)uc+;Ip zx~R%g)o?<7txDiFNs&D9_;iyQ()?uz_R)-kEQHMI?wI|&WPZ9$fRJ#M#u%R);#4)qBEq{e`A_BtO&Y4EeY+oOV z#D%je2l^5E_lAzWE_0Qh>XbkJPQm3|Xg)6dm<-B#tDedmWGZYYL;+V#M;RAfWbWyo z^w0I4Gik9sS>Wy+_gNVqtv%kvAI!ogeN~qgbVHW-5h}F`^_|13XW2;^VdMQ`8yAoC zir=+%&Uu(0xrE<1Pd?e$NyCJrh*l1M$%1=*79NN=^aHF%i>pgkh@5FN3Bnqkj zCF;Wl|3q~if`QnrL-X5(`Y*`kmtfR_w-+1obXc@5)-ZWqjBF74;7RYH3{^VX7eZ8d zYZ}Sj=Ds7wuU%tPR*6>W6@FMPLBv`Mky!I`I6c$tNKKvEgaE4cf~pr~h1Xyugr@$0 zqc_lRH4~^2i(J;rGK)Goos*%5Nt0zY3LZ4}l;MF*x@4G4^k#^E$&tpzQwN!a&jP&z z91%)5<*rG&7osofsS@@pKV-& z^p(a(hBm|vI*WT*E-L2YgIpo@*k~1>PkjN)Ff|eD|V=Q%_fq2^(ca zVax~`-ma|ba%-7ASP)yh#(*5M5DCTf)gOQ;;hYuy1y#20c+B>GgNp_q-h@;FtWzMb z0^+MY3^B|~MGW+)I$byqtIO+sLa~=C_-jTm?5sF{DJ0+A4yR5E`w?rN)2+1B7-eok z*}ueDo{ZstWBSnjwN2(gBUa~Z;DbMH{5x;y7WtSmVquZ??p-c=4zf(~6DBi8gC*Z61USMLAb9X77Tp>G*|f z=?!J{9#yKm+&ITGHmJ8hJpwZuU-!S?KJ}zhB^~eRskw84*EWXNxcuuoLQ^k=Yz>vF z&Nkwf>@HLIKpU`G&y6`Z_wxh`HpKEf?R@mP=S!1)aHo(JTF@~gm&SI9Lsj!dZ`)V5 zB!)9Ubu1wjAhmWuIQYHkM!g2Vd< z&UBb`f|^wUjG&EblJar+p^8ci+pwfE|B7r1Zf#5L`v4by3zn|g#;E2 zQ#K3y^ZrAda{TQ1-{QM;Ipp>k;kd~v(ig?>T(?V^3 zC}bM7h=M~_evuqB;_(yK7S|0@ac`*srrj{PzMEdBU23s(I&5Kb21wg|es`W(*T?IL F^WPx2REz)s literal 0 HcmV?d00001 diff --git a/samba.spec b/samba.spec index 91ad8a5..67be317 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.13.3 +%define samba_version 4.13.4 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -120,7 +120,7 @@ URL: https://www.samba.org # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz Source0: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.gz#/samba-%{version}%{pre_release}.tar.xz Source1: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.asc -Source2: gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg +Source2: samba-pubkey_AA99442FB680B620.gpg # Red Hat specific replacement-files Source10: samba.logrotate @@ -1537,7 +1537,6 @@ fi %{_libdir}/samba/libsmb-transport-samba4.so %{_libdir}/samba/libsmbclient-raw-samba4.so %{_libdir}/samba/libsmbd-base-samba4.so -%{_libdir}/samba/libsmbd-conn-samba4.so %{_libdir}/samba/libsmbd-shim-samba4.so %{_libdir}/samba/libsmbldaphelper-samba4.so %{_libdir}/samba/libsys-rw-samba4.so @@ -3628,6 +3627,9 @@ fi %endif %changelog +* Tue Jan 26 2021 Guenther Deschner - 4.13.4-0 +- Update to Samba 4.13.4 + * Tue Dec 15 2020 Guenther Deschner - 4.13.3-0 - Update to Samba 4.13.3 diff --git a/sources b/sources index 0e51188..2d17de0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.3.tar.xz) = 8dbd8a18ff8566f778b17c9a5306a0d3f45a79fc8d1ce7c2ea63f941eb1b310462f97f2bdd40c4e09c69e2aae3f5144e488cb20e1b6686695306b521d609b6dc -SHA512 (samba-4.13.3.tar.asc) = f5ef09ae3fa434b7c37564407ad3b62542d9abc7ca0e2a1e58ebb987307a5269c123b1af3755582edff7fdcfe2930a151d6256b97ab8dcd296492038a96a160a +SHA512 (samba-4.13.4.tar.xz) = c6fb8b4186da25c69d1bc662780a12c6fa6fa70fc65fa487dba2d547c96e8f7f8f8736b8edc2564b599be875b00d891631fa37838632efac593bf83eb33392f9 +SHA512 (samba-4.13.4.tar.asc) = b8c0ccd7e716d2de6e9da2a53577bc31983eaec4ed4583bb88b52b2ca8b80045c8c0349a97a12e796df84a5942293f5a40e74eff8c003b3062f8f6454dc2a631 From 457752eadc599cc124c6f6bbc28f3bcbd7a4e920 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 9 Mar 2021 17:33:57 +0100 Subject: [PATCH 16/30] Update to Samba 4.13.5 Guenther --- .gitignore | 2 + samba-4.13-redhat.patch | 565 ++++++++++++++++++++++------------------ samba.spec | 5 +- sources | 4 +- 4 files changed, 323 insertions(+), 253 deletions(-) diff --git a/.gitignore b/.gitignore index 669acc7..cc7e906 100644 --- a/.gitignore +++ b/.gitignore @@ -231,3 +231,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.3.tar.asc /samba-4.13.4.tar.xz /samba-4.13.4.tar.asc +/samba-4.13.5.tar.xz +/samba-4.13.5.tar.asc diff --git a/samba-4.13-redhat.patch b/samba-4.13-redhat.patch index 1b8484b..ae1208a 100644 --- a/samba-4.13-redhat.patch +++ b/samba-4.13-redhat.patch @@ -1,7 +1,7 @@ -From 2d3ad48f0c7337cda08a6588b06183120fc0731a Mon Sep 17 00:00:00 2001 +From 02f3f310bee630ed6e6b8adea542436f0dfadd83 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 16:15:03 +0200 -Subject: [PATCH 001/104] libcli:smb2: Do not leak ptext on error +Subject: [PATCH 001/105] libcli:smb2: Do not leak ptext on error Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -25,10 +25,10 @@ index 230475480c2..cfb3b613f9d 100644 2.29.2 -From 630c6314778894a668c20fe2aa7d04627ed517a7 Mon Sep 17 00:00:00 2001 +From 7680b849e6967ec6c364c10a46c205e4b61268e1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 17:23:37 +0200 -Subject: [PATCH 002/104] libcli:smb2: Use talloc NULL context if we don't have +Subject: [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have a stackframe If we execute this code from python we don't have a talloc stackframe @@ -109,10 +109,10 @@ index cfb3b613f9d..b1e0253948f 100644 2.29.2 -From 63cefdebe5c0e435b6174ff6bc72b48d12cec312 Mon Sep 17 00:00:00 2001 +From fd7b8857ddacb301e57b4ef0b87e786b47651b2d Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 6 Nov 2019 17:37:45 +0100 -Subject: [PATCH 003/104] auth:creds: Introduce CRED_SMB_CONF +Subject: [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF We have several places where we check '> CRED_UNINITIALISED', so we better don't use CRED_UNINITIALISED for values from @@ -205,10 +205,10 @@ index d2a81506de3..6454ac9ff7c 100644 2.29.2 -From 0120aad504663c5e75054c2e322f1277acae63dd Mon Sep 17 00:00:00 2001 +From d6d61e6863b2e393c115c0ec7fbd75a5ffdf8aba Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 10 Oct 2019 14:18:23 +0200 -Subject: [PATCH 004/104] param: Add 'server smb encrypt' parameter +Subject: [PATCH 004/105] param: Add 'server smb encrypt' parameter And this also makes 'smb encrypt' a synonym of that. @@ -824,10 +824,10 @@ index 7acde285a90..b745e0906b1 100644 2.29.2 -From a351d15240e7c8638883155404fe2f3d70029e7e Mon Sep 17 00:00:00 2001 +From eb2987a887281c9e2d8993ef646e354f3f5488f7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 10:04:19 +0200 -Subject: [PATCH 005/104] param: Create and use enum_smb_encryption_vals +Subject: [PATCH 005/105] param: Create and use enum_smb_encryption_vals Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -922,10 +922,10 @@ index d2345f094e1..8ee99e25566 100644 2.29.2 -From 021975ea03413244d02d35940973f67956adec2b Mon Sep 17 00:00:00 2001 +From 47f2864f002e34bc5efbb682dad4dab13855d39f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:34:54 +0200 -Subject: [PATCH 006/104] s3:smbd: Use 'enum smb_encryption_setting' values +Subject: [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1046,10 +1046,10 @@ index b745e0906b1..2f2fdcb7260 100644 2.29.2 -From 7153b9b229a2feea129f1bb1cd423dd4e79d5a05 Mon Sep 17 00:00:00 2001 +From 004c8bafd87a3d0109ab62522d47f7e376de7601 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Apr 2020 10:38:41 +0200 -Subject: [PATCH 007/104] docs-xml: Add 'client smb encrypt' +Subject: [PATCH 007/105] docs-xml: Add 'client smb encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1224,10 +1224,10 @@ index 4ad541301b3..6418a42b6eb 100644 2.29.2 -From f151e19473330373801c4d85ef3d5ce0918ac17d Mon Sep 17 00:00:00 2001 +From 2b0594870c4bd61e5a5aa012dd028b92020c542f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jul 2020 17:48:25 +0200 -Subject: [PATCH 008/104] lib:param: Add lpcfg_parse_enum_vals() +Subject: [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1291,10 +1291,10 @@ index 323fcf84523..e66ce2324b4 100644 2.29.2 -From 6364c5bcde41ed5bdb478747511003796a601e74 Mon Sep 17 00:00:00 2001 +From a68f4821cb7f2936a7437947db52fd20522893cc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:38:08 +0200 -Subject: [PATCH 009/104] libcli:smb: Add smb_signing_setting_translate() +Subject: [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1448,7 +1448,7 @@ index 86e377f570b..c047fd33278 100644 + deps='cmocka cli_smb_common', + for_selftest=True) diff --git a/selftest/tests.py b/selftest/tests.py -index 6918e1306c3..20981754db4 100644 +index 2b65943b2ed..9938bf53ed6 100644 --- a/selftest/tests.py +++ b/selftest/tests.py @@ -376,6 +376,8 @@ plantestsuite("samba.unittests.lib_util_modules", "none", @@ -1464,10 +1464,10 @@ index 6918e1306c3..20981754db4 100644 2.29.2 -From 8ceec22ead224c3581b18b0fc95cb7f7f9c061a8 Mon Sep 17 00:00:00 2001 +From e9943e865ea4d49f40fdee30c7af84c36fe5f604 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 08:39:34 +0200 -Subject: [PATCH 010/104] libcli:smb: Add smb_encryption_setting_translate() +Subject: [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() Add encryption enum and function to avoid confusion when reading the code. @@ -1558,10 +1558,10 @@ index da0e4db2bf3..ac2887ee5c4 100644 2.29.2 -From dc53c158acdeffc6e53436359a56bcf7071b3d83 Mon Sep 17 00:00:00 2001 +From 31f1863918cde009dd05a0cbd1d235ef024dd43d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:47:59 +0200 -Subject: [PATCH 011/104] s3:lib: Use smb_signing_setting_translate for cmdline +Subject: [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline parsing The function will be removed soon. @@ -1625,10 +1625,10 @@ index d86a9fcadbf..c1051c62393 100644 2.29.2 -From c6f52fc629ca09e450b3bd0c1bdc56fdabeae141 Mon Sep 17 00:00:00 2001 +From 2f2cc5f127c36b8b0731a589df63841660f6bece Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 07:47:18 +0200 -Subject: [PATCH 012/104] auth:creds: Remove unused credentials autoproto +Subject: [PATCH 012/105] auth:creds: Remove unused credentials autoproto header Signed-off-by: Andreas Schneider @@ -1705,10 +1705,10 @@ index 7711eac2afa..d9be3562adb 100644 2.29.2 -From 62bca83b540c9402d86f0668839150d2abf3adec Mon Sep 17 00:00:00 2001 +From aa7dcb366db8976571a0ead6fe2f75e37db1752d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:32:44 +0200 -Subject: [PATCH 013/104] auth:creds: Add +Subject: [PATCH 013/105] auth:creds: Add cli_credentials_(get|set)_smb_signing() Signed-off-by: Andreas Schneider @@ -1847,10 +1847,10 @@ index 68f1f25dce1..9cde0000b5f 100644 2.29.2 -From a14f3c5f3f39173650bd56ee034bd35ea111ee07 Mon Sep 17 00:00:00 2001 +From dd10642b665a212c1c4183209d878220f577a3e7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 11:56:01 +0200 -Subject: [PATCH 014/104] auth:creds: Add python bindings for +Subject: [PATCH 014/105] auth:creds: Add python bindings for (get|set)_smb_signing Signed-off-by: Andreas Schneider @@ -1973,10 +1973,10 @@ index 6454ac9ff7c..e5f8122fa21 100644 2.29.2 -From 9fdc98da5c625acd11205b2bb28deb780ef905ec Mon Sep 17 00:00:00 2001 +From 8c748d0fcdd5079402cdf6fc86e8c7b4e0f0b90c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:31:35 +0200 -Subject: [PATCH 015/104] auth:creds: Add +Subject: [PATCH 015/105] auth:creds: Add cli_credentials_(get|set)_smb_ipc_signing() Signed-off-by: Andreas Schneider @@ -2105,10 +2105,10 @@ index 9cde0000b5f..54e8271471f 100644 2.29.2 -From d8e43a7c8058a6a395493360cf2faae24f64e2e2 Mon Sep 17 00:00:00 2001 +From 72f28717b09a46482a2f1487946e3a230c33ced3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:32:46 +0200 -Subject: [PATCH 016/104] auth:creds: Add python bindings for +Subject: [PATCH 016/105] auth:creds: Add python bindings for (get|set)_smb_ipc_signing Signed-off-by: Andreas Schneider @@ -2210,10 +2210,10 @@ index e5f8122fa21..8edf13ce6ff 100644 2.29.2 -From 767d356f718965b4595b8322729556b63e66425d Mon Sep 17 00:00:00 2001 +From a688ad98ccd64e740d8be389e1e15d073a9ddada Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:10:52 +0200 -Subject: [PATCH 017/104] auth:creds: Add +Subject: [PATCH 017/105] auth:creds: Add cli_credentials_(get|set)_smb_encryption() Signed-off-by: Andreas Schneider @@ -2344,10 +2344,10 @@ index 54e8271471f..3b86b742448 100644 2.29.2 -From 88dd0d8871ae2a54bc089f1e761ded6940b270b0 Mon Sep 17 00:00:00 2001 +From 029866668c4cd4dda5b32528959a6784d74c604e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:38:30 +0200 -Subject: [PATCH 018/104] auth:creds: Add python bindings for +Subject: [PATCH 018/105] auth:creds: Add python bindings for (get|set)_smb_encryption Signed-off-by: Andreas Schneider @@ -2462,10 +2462,10 @@ index 8edf13ce6ff..e0a6248d37a 100644 2.29.2 -From 41df2d5330c051066691576af9ccf505cb0573e3 Mon Sep 17 00:00:00 2001 +From 621e40b6196c9f6f5e4400476601153234e86c28 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 11:19:53 +0200 -Subject: [PATCH 019/104] auth:creds: Add python bindings for +Subject: [PATCH 019/105] auth:creds: Add python bindings for cli_credentials_set_conf() Signed-off-by: Andreas Schneider @@ -2590,10 +2590,10 @@ index e0a6248d37a..6187bded0b6 100644 2.29.2 -From cdb470d7c408baa07eabf83ec566baecc8e5138c Mon Sep 17 00:00:00 2001 +From 5f1e16203fae87672e62aae1cb117ae91bfb3216 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 08:14:23 +0200 -Subject: [PATCH 020/104] auth:creds: Bump library version +Subject: [PATCH 020/105] auth:creds: Bump library version We added new functions so bump the version. @@ -2620,10 +2620,10 @@ index 564a04fe8dd..1e3302e3e48 100644 2.29.2 -From a11a02e0802dbb3300d9b3232b936b74b1f89a32 Mon Sep 17 00:00:00 2001 +From be3dcfd38f21e48dc9bc0fe35be8b95ccb82111b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 May 2020 11:10:30 +0200 -Subject: [PATCH 021/104] s3:lib: Use cli_credential_(get|set)_smb_signing() +Subject: [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2691,10 +2691,10 @@ index bc1f1c3ed25..6038ec11515 100644 2.29.2 -From 6e5fba172b910545f722d33aa3fb185f48492c18 Mon Sep 17 00:00:00 2001 +From 860f6d0de5bf56a457fdd75f80520741cd30ac77 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:45:34 +0200 -Subject: [PATCH 022/104] s3:lib: Set smb encryption also via cli creds API +Subject: [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2720,10 +2720,10 @@ index 6038ec11515..9c9e2f0ac0f 100644 2.29.2 -From 01eb7d2f16a4f16931a0adffc395ec0b5946ef56 Mon Sep 17 00:00:00 2001 +From 45641219a0dfcd4c0cd02e740086cb249df606eb Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 10:40:23 +0200 -Subject: [PATCH 023/104] python: Remove unused sign argument from +Subject: [PATCH 023/105] python: Remove unused sign argument from smb_connection() Signed-off-by: Andreas Schneider @@ -2775,10 +2775,10 @@ index 1e2c2918ebe..ad60cda0690 100644 2.29.2 -From 7ad70308d9f5b5d892e507a58eb946839be33374 Mon Sep 17 00:00:00 2001 +From b1851e401118a069e0b34722bd1106f9f7b17105 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 14:02:37 +0200 -Subject: [PATCH 024/104] python: Set smb signing via the creds API +Subject: [PATCH 024/105] python: Set smb signing via the creds API Pair-Programmed-With: Stefan Metzmacher @@ -2879,10 +2879,10 @@ index ad60cda0690..0f2f6520fc3 100644 2.29.2 -From 70b7a6d80c3699727f7bf36a4a9255bb90c67cec Mon Sep 17 00:00:00 2001 +From 5689e0f72d3a32b7b76f6c2927c184d8b748c6aa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:22:12 +0200 -Subject: [PATCH 025/104] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC +Subject: [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -3102,10 +3102,10 @@ index 6cea2ee306c..2241beb331f 100644 2.29.2 -From 19ac5889da3b5bec1fddba0e08daed7cbe24f604 Mon Sep 17 00:00:00 2001 +From eff95f5b430d241d9036be2c899094d1cc3f39b1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:29:25 +0200 -Subject: [PATCH 026/104] s3:pylibsmb: Add ipc=True support for +Subject: [PATCH 026/105] s3:pylibsmb: Add ipc=True support for CLI_FULL_CONNECTION_IPC Signed-off-by: Andreas Schneider @@ -3167,10 +3167,10 @@ index 3fcc3424a57..3579a040830 100644 2.29.2 -From ff93a26bdd480edb3e488b207b1fb6529cd52a38 Mon Sep 17 00:00:00 2001 +From 280ae642e1842fad44b9628130100db98894929f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 09:47:11 +0200 -Subject: [PATCH 027/104] python:tests: Mark libsmb connection as an IPC +Subject: [PATCH 027/105] python:tests: Mark libsmb connection as an IPC connection Signed-off-by: Andreas Schneider @@ -3196,10 +3196,10 @@ index ba7440df13b..2c028d381db 100644 2.29.2 -From b904f4bf9279264438e7b50ba90930562f4146fa Mon Sep 17 00:00:00 2001 +From 28843ea17ad1abb916177a25142c7bc57727a7be Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 17 Aug 2020 12:52:39 +0200 -Subject: [PATCH 028/104] python:tests: Set smb ipc signing via the creds API +Subject: [PATCH 028/105] python:tests: Set smb ipc signing via the creds API Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -3234,10 +3234,10 @@ index 2c028d381db..d6f5de7440a 100644 2.29.2 -From 19c1b06e7ca4ae26f36207b7dd070b33a853ff29 Mon Sep 17 00:00:00 2001 +From 158e5d6e21515f95daa469ea8bd69d330463e0dd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:59:19 +0200 -Subject: [PATCH 029/104] s3:libsmb: Use 'enum smb_signing_setting' in +Subject: [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in cliconnect.c Signed-off-by: Andreas Schneider @@ -3364,10 +3364,10 @@ index d214cdabca4..995187e21b4 100644 2.29.2 -From 8ecad37d1fcc8d6fe07560df1bab35f2f70595f7 Mon Sep 17 00:00:00 2001 +From ec3033ed2ca61778efaa291e0f3f66e0bbc73a01 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:11:31 +0200 -Subject: [PATCH 030/104] s3:client: Turn off smb signing for message op +Subject: [PATCH 030/105] s3:client: Turn off smb signing for message op Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -3516,10 +3516,10 @@ index 3579a040830..f8a4d56cf53 100644 2.29.2 -From 5325ea198e03bf4a51b101c74788df548eeedbac Mon Sep 17 00:00:00 2001 +From 73abea023b529c2c37a4c11875c0fca554ff32ab Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:20:02 +0200 -Subject: [PATCH 031/104] s3:libsmb: Remove signing_state from +Subject: [PATCH 031/105] s3:libsmb: Remove signing_state from cli_full_connection_creds_send() Signed-off-by: Andreas Schneider @@ -3615,10 +3615,10 @@ index f8a4d56cf53..c7a2d73afcb 100644 2.29.2 -From 1517d0eb1036056851871e994849c647217ef36d Mon Sep 17 00:00:00 2001 +From 5134d4a361d8984ca62e24679c3b3010106e8819 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 14:59:14 +0200 -Subject: [PATCH 032/104] s3:libsmb: Remove signing_state from +Subject: [PATCH 032/105] s3:libsmb: Remove signing_state from cli_full_connection_creds() Signed-off-by: Andreas Schneider @@ -3848,7 +3848,7 @@ index 84c335f959f..92ddb7629b9 100644 if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("cli_full_connection failed with error %s\n", nt_errstr(nt_status))); diff --git a/source3/torture/torture.c b/source3/torture/torture.c -index 2a3133373e9..a4edeefd628 100644 +index 5e263797730..922d0c73193 100644 --- a/source3/torture/torture.c +++ b/source3/torture/torture.c @@ -345,8 +345,7 @@ static bool torture_open_connection_share(struct cli_state **c, @@ -3861,7 +3861,7 @@ index 2a3133373e9..a4edeefd628 100644 if (!NT_STATUS_IS_OK(status)) { printf("failed to open share connection: //%s/%s port:%d - %s\n", hostname, sharename, port_to_use, nt_errstr(status)); -@@ -1523,8 +1522,7 @@ static bool run_tcon_devtype_test(int dummy) +@@ -1528,8 +1527,7 @@ static bool run_tcon_devtype_test(int dummy) NULL, /* service */ NULL, /* service_type */ torture_creds, @@ -3986,10 +3986,10 @@ index 954d6eba804..fea066ce468 100644 2.29.2 -From 07ccfed08ceadd0b7497e7259e855b1937522129 Mon Sep 17 00:00:00 2001 +From bdcbd317d650b381f71f463941c0779333cea2f2 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 8 Jun 2020 08:04:24 +0200 -Subject: [PATCH 033/104] s3:libsmb: Add encryption support to +Subject: [PATCH 033/105] s3:libsmb: Add encryption support to cli_full_connection_creds*() Pair-Programmed-With: Andreas Schneider @@ -4203,10 +4203,10 @@ index b24743d789b..abfd18bfaf1 100644 2.29.2 -From bf05adca0d32212d4eead676ef89d4a96d3949a0 Mon Sep 17 00:00:00 2001 +From 9f1dfbc190ba7c83e0197036c102479015f9f416 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 11:26:00 +0200 -Subject: [PATCH 034/104] python: Add a test for SMB encryption +Subject: [PATCH 034/105] python: Add a test for SMB encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4277,10 +4277,10 @@ index e8f8e7fe94d..81d4e482644 100644 2.29.2 -From 86954cbf471bf391f50866d5d983c57cf8a4f064 Mon Sep 17 00:00:00 2001 +From 87985a403abb4ef396d277a1e51a1983cf079875 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:31:02 +0200 -Subject: [PATCH 035/104] s3:net: Use cli_credentials_set_smb_encryption() +Subject: [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4326,10 +4326,10 @@ index b139fb2d0da..5829d891075 100644 2.29.2 -From 1d065c5960ea2bce6bab5420476a0c21ba40d26e Mon Sep 17 00:00:00 2001 +From 386fde23e657b1160b890d30e235c003ad3f41ec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:40:13 +0200 -Subject: [PATCH 036/104] s3:libsmb: Use cli_credentials_set_smb_encryption() +Subject: [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() This also adds a SMBC_ENCRYPTLEVEL_DEFAULT to 'enum smbc_smb_encrypt_level' in order to use the smb.conf default value. @@ -4685,10 +4685,10 @@ index ec4a516b2ee..61503d0a98b 100644 2.29.2 -From a35be10e055edb18b961c30c106fbefd08cd8c42 Mon Sep 17 00:00:00 2001 +From c228afe71fdaf950790f46a1f497f52198bd77ca Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:43:33 +0200 -Subject: [PATCH 037/104] s3:client: Remove unused smb encryption code +Subject: [PATCH 037/105] s3:client: Remove unused smb encryption code Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4721,10 +4721,10 @@ index f56dc323b6e..16a8d44c069 100644 2.29.2 -From 59362e873109a541d5381fe9a302a9464b83b549 Mon Sep 17 00:00:00 2001 +From 421b1bfc7f110787b541976c9bcdf7857bc93dfa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:47:05 +0200 -Subject: [PATCH 038/104] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 038/105] s3:utils: Remove obsolete force encryption from smbacls Signed-off-by: Andreas Schneider @@ -4758,10 +4758,10 @@ index 5983ebbd0a5..8fd9fcc5780 100644 2.29.2 -From d642ed3f0e60699c5650eb80ba02f9552b8f7bd9 Mon Sep 17 00:00:00 2001 +From 3f08abb5fa7eaf7785690234b773aee5392c45ac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:48:18 +0200 -Subject: [PATCH 039/104] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 039/105] s3:utils: Remove obsolete force encryption from mdfind Signed-off-by: Andreas Schneider @@ -4792,10 +4792,10 @@ index 2ac4fde7daf..ef2657e4fa5 100644 2.29.2 -From 4588a03309c7ce7404f54e010f4a93656bf9ff47 Mon Sep 17 00:00:00 2001 +From 9d67a64586896ea912933f5742225f30399fc401 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:49:28 +0200 -Subject: [PATCH 040/104] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 040/105] s3:utils: Remove obsolete force encryption from smbcquotas Signed-off-by: Andreas Schneider @@ -4830,10 +4830,10 @@ index fea066ce468..4ceac7b3ab0 100644 2.29.2 -From 23b759045448c9072f8342778ea36b721c481bfd Mon Sep 17 00:00:00 2001 +From 33bd60da866aec4212533e72410a9440f7727a33 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:51:18 +0200 -Subject: [PATCH 041/104] s3:rpcclient: Remove obsolete force encryption from +Subject: [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from rpcclient Signed-off-by: Andreas Schneider @@ -4868,10 +4868,10 @@ index 2ead6cc7ba5..575a42ebf70 100644 2.29.2 -From b42861ddc3b16cdda39c86d0549ed3af8e22cf7b Mon Sep 17 00:00:00 2001 +From 1e5c002e86fd794ee4c972fe9b802b1cc90910cd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 10:58:36 +0200 -Subject: [PATCH 042/104] examples: Remove obsolete force encryption from +Subject: [PATCH 042/105] examples: Remove obsolete force encryption from smb2mount Signed-off-by: Andreas Schneider @@ -4906,10 +4906,10 @@ index 6206c3a9701..c64be573462 100644 2.29.2 -From 9718e834445fa9fb77a947aee35ff49f9ce98572 Mon Sep 17 00:00:00 2001 +From a207a4a9f0633c4f658152ef5715a18e655027d2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 11:05:59 +0200 -Subject: [PATCH 043/104] s3:libsmb: Make cli_cm_force_encryption_creds() +Subject: [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() static Signed-off-by: Andreas Schneider @@ -4920,7 +4920,7 @@ Reviewed-by: Stefan Metzmacher 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 4495a027830..aff998f6187 100644 +index 3cc52cc5ac9..a7230c84db1 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -43,9 +43,9 @@ @@ -4954,10 +4954,10 @@ index 850cf12c8a6..eeabcaa7463 100644 2.29.2 -From 7e0b354aca307a2eaf45dcf0ca2e1203e7784fd3 Mon Sep 17 00:00:00 2001 +From bff823d8817a1f2734e8e3b52a9b7e4f3a964908 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 16:16:55 +0200 -Subject: [PATCH 044/104] s4:libcli: Return NTSTATUS errors for +Subject: [PATCH 044/105] s4:libcli: Return NTSTATUS errors for smb_composite_connect_send() Signed-off-by: Andreas Schneider @@ -5054,10 +5054,10 @@ index 582d43ef173..ad50ae0ac81 100644 2.29.2 -From 667f1730533b589820c2c7c492000fb86445797a Mon Sep 17 00:00:00 2001 +From b48bca36393efebd55a46c59656ea9d2bca592f3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:54:26 +0200 -Subject: [PATCH 045/104] s4:libcli: Return if encryption is requested for SMB1 +Subject: [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5091,10 +5091,10 @@ index 6ee4929e8d7..51e121bdce6 100644 2.29.2 -From 97ce0f36abf29c234fbc4d8846ce0b68b2e4a6ab Mon Sep 17 00:00:00 2001 +From 262b7b90d4618ee6b20414b19c3c79831b72a5d9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:29:39 +0200 -Subject: [PATCH 046/104] s3:libcli: Split out smb2_connect_tcon_start() +Subject: [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5144,10 +5144,10 @@ index 6fc3993a4e8..95ff05eac8f 100644 2.29.2 -From bf357c3c06df5ac5aeea7851a7e285d68f3ab974 Mon Sep 17 00:00:00 2001 +From dfd9ffca1955efa021aae9b73c9d4aec65d9e7da Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:44:26 +0200 -Subject: [PATCH 047/104] s4:libcli: Add smb2_connect_enc_start() +Subject: [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5215,10 +5215,10 @@ index 95ff05eac8f..3a3ecdf20e8 100644 2.29.2 -From 5a984891f73b07211d64e5a2f262915386aea7f4 Mon Sep 17 00:00:00 2001 +From c5bfb3e621e7a386f64d7e9c9a6eb05905aec4d2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 10:18:52 +0200 -Subject: [PATCH 048/104] s4:libcli: Require signing for SMB encryption +Subject: [PATCH 048/105] s4:libcli: Require signing for SMB encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5271,10 +5271,10 @@ index 3a3ecdf20e8..9540704491e 100644 2.29.2 -From b733749b324891e6352fbb9ef51fa0452baa313e Mon Sep 17 00:00:00 2001 +From b8406d50c6b52838f14f2e5e29c06919d4949386 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 14:27:07 +0200 -Subject: [PATCH 049/104] python:tests: Add test for SMB encrypted DCERPC +Subject: [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC connection Signed-off-by: Andreas Schneider @@ -5377,7 +5377,7 @@ index 00000000000..8e0d6a5ef0a + binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) + self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds) diff --git a/selftest/tests.py b/selftest/tests.py -index 20981754db4..adcb5b53189 100644 +index 9938bf53ed6..3246161f0d7 100644 --- a/selftest/tests.py +++ b/selftest/tests.py @@ -92,6 +92,7 @@ planpythontestsuite( @@ -5392,10 +5392,10 @@ index 20981754db4..adcb5b53189 100644 2.29.2 -From 141c2ebfb18be8ca2b313e900539cfa6b5927ded Mon Sep 17 00:00:00 2001 +From bf61849ded5c9a389b0f2a2d4a14ac74e4470852 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:47:54 +0200 -Subject: [PATCH 050/104] auth:gensec: Add gensec_security_sasl_names() +Subject: [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() Pair-Programmed-With: Andreas Schneider @@ -5522,10 +5522,10 @@ index d2d62d6652e..4eb45643714 100644 2.29.2 -From b68a26966dddb4ec8a7bc7ec3441dbf03efd6af9 Mon Sep 17 00:00:00 2001 +From 311a23ab25c306093b4c60fa0113a85ccc875f20 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:48:27 +0200 -Subject: [PATCH 051/104] s4:ldap_server: Use samba_server_gensec_start() in +Subject: [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in ldapsrv_backend_Init() Signed-off-by: Stefan Metzmacher @@ -5634,10 +5634,10 @@ index 2839082daef..915d9b94f9b 100644 2.29.2 -From fa5761777851f6d2ecdaa88fdea3260e42dc634c Mon Sep 17 00:00:00 2001 +From b7a4e9531c434b9e120588fa721d96cee73abc27 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:39:15 +0200 -Subject: [PATCH 052/104] auth:gensec: Make gensec_use_kerberos_mechs() a +Subject: [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a static function Signed-off-by: Stefan Metzmacher @@ -5684,10 +5684,10 @@ index 4eb45643714..ebcab76999a 100644 2.29.2 -From 3c052ba053b6fee6c97f13aca8eafe680321ded8 Mon Sep 17 00:00:00 2001 +From 938a5b9a816000ac505aab0d49e0feee5ebc02a7 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:41:43 +0200 -Subject: [PATCH 053/104] auth:gensec: Pass use_kerberos and keep_schannel to +Subject: [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to gensec_use_kerberos_mechs() Signed-off-by: Stefan Metzmacher @@ -5758,10 +5758,10 @@ index ebcab76999a..8d1b41fec74 100644 2.29.2 -From ec9c5e93a31763c48d5c2d0e8859d9750aa36ed1 Mon Sep 17 00:00:00 2001 +From 634283ed239a5759645ad7e9cf63b723fae4d184 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 17:00:45 +0200 -Subject: [PATCH 054/104] auth:gensec: If Kerberos is required, keep schannel +Subject: [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel for machine account auth Signed-off-by: Stefan Metzmacher @@ -5795,10 +5795,10 @@ index 8d1b41fec74..3f42d611140 100644 2.29.2 -From d3f6c14e95159b4fed2034d563479607b48ee9ea Mon Sep 17 00:00:00 2001 +From 712f4b7a2f8826f68e9862256bfc1a59eb5e2dfb Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:21 +0200 -Subject: [PATCH 055/104] auth:creds: Add cli_credentials_init_server() +Subject: [PATCH 055/105] auth:creds: Add cli_credentials_init_server() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5861,10 +5861,10 @@ index 7d0cf53194b..438bcdce232 100644 2.29.2 -From b6249e4af652be9f02741ed0de59889734bff13f Mon Sep 17 00:00:00 2001 +From 589d1ee99d6f4591da90731cd61b3932874a6c96 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:36 +0200 -Subject: [PATCH 056/104] s4:rpc_server: Use cli_credentials_init_server() +Subject: [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() Signed-off-by: Andreas Schneider (cherry picked from commit 6c94ebf77fdb7383be2042f5e20ba2ef598cd4a4) @@ -5909,10 +5909,10 @@ index 084857a44bf..e64148ef788 100644 2.29.2 -From b0db24f086aad67ca9e536c6c94ef413983b5586 Mon Sep 17 00:00:00 2001 +From 0be08bb35342640aab826b8ba5a17a270170a7c4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 7 Sep 2020 09:19:43 +0200 -Subject: [PATCH 057/104] s4:smb_server: Use cli_credentials_init_server() for +Subject: [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for negprot Signed-off-by: Andreas Schneider @@ -6009,10 +6009,10 @@ index 4aaaf46793b..c433eb194bd 100644 2.29.2 -From 96aae2c7cf11aeaadc98e0e18f88d1c9387019a7 Mon Sep 17 00:00:00 2001 +From db71a0fa865cdd7339121f91a1e490289ada14f8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:22 +0200 -Subject: [PATCH 058/104] selftest: Rename 'smb encrypt' to 'server smb +Subject: [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb encrypt' This makes it more clear what we want. 'smb encrypt' is a synonym for @@ -6026,10 +6026,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index e141f102ef1..c070086ca49 100755 +index c15057fa80b..aeebf303c9b 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm -@@ -1178,7 +1178,7 @@ sub setup_simpleserver +@@ -1182,7 +1182,7 @@ sub setup_simpleserver ntlm auth = yes vfs objects = xattr_tdb streams_depot change notify = no @@ -6038,7 +6038,7 @@ index e141f102ef1..c070086ca49 100755 [vfs_aio_pthread] path = $prefix_abs/share -@@ -1245,7 +1245,7 @@ sub setup_simpleserver +@@ -1249,7 +1249,7 @@ sub setup_simpleserver [enc_desired] path = $prefix_abs/share vfs objects = @@ -6047,7 +6047,7 @@ index e141f102ef1..c070086ca49 100755 [hidenewfiles] path = $prefix_abs/share -@@ -2351,7 +2351,7 @@ sub provision($$) +@@ -2372,7 +2372,7 @@ sub provision($$) [tmpenc] path = $shrdir comment = encrypt smb username is [%U] @@ -6060,10 +6060,10 @@ index e141f102ef1..c070086ca49 100755 2.29.2 -From f4d1c495b4eb8a3125812e1d1d81639afdd15c06 Mon Sep 17 00:00:00 2001 +From 9adc33b7364d8a7bce384d5a17de8a450ad8c642 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 12:30:08 +0200 -Subject: [PATCH 059/104] selftest: Move enc_desired to provision to have it in +Subject: [PATCH 059/105] selftest: Move enc_desired to provision to have it in 'fileserver' too Signed-off-by: Andreas Schneider @@ -6074,10 +6074,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index c070086ca49..fa3ca8962a5 100755 +index aeebf303c9b..7873692b8ec 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm -@@ -1242,11 +1242,6 @@ sub setup_simpleserver +@@ -1246,11 +1246,6 @@ sub setup_simpleserver hide files = /hidefile/ hide dot files = yes @@ -6089,7 +6089,7 @@ index c070086ca49..fa3ca8962a5 100755 [hidenewfiles] path = $prefix_abs/share hide new files timeout = 5 -@@ -2833,7 +2828,13 @@ sub provision($$) +@@ -2854,7 +2849,13 @@ sub provision($$) [delete_readonly] path = $prefix_abs/share delete readonly = yes @@ -6107,10 +6107,10 @@ index c070086ca49..fa3ca8962a5 100755 2.29.2 -From c69630ece0849fdca724003600f1b39d6411e194 Mon Sep 17 00:00:00 2001 +From 79f57ea590227441e510113863740bea6643c942 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:20 +0200 -Subject: [PATCH 060/104] s3:tests: Add smbclient tests for 'client smb +Subject: [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb encrypt' Signed-off-by: Andreas Schneider @@ -6134,10 +6134,10 @@ index 00000000000..972096bdc8b +^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver +^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index fa3ca8962a5..ffc19c7d5a2 100755 +index 7873692b8ec..844743d4145 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm -@@ -2833,6 +2833,11 @@ sub provision($$) +@@ -2854,6 +2854,11 @@ sub provision($$) path = $prefix_abs/share vfs objects = server smb encrypt = desired @@ -6228,10 +6228,10 @@ index 00000000000..9a717cdac4f + +testok $0 $failed diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py -index 27dc7587b17..46bf274227c 100755 +index 47e914b1009..61a5b3e1cbd 100755 --- a/source3/selftest/tests.py +++ b/source3/selftest/tests.py -@@ -1040,6 +1040,12 @@ plantestsuite("samba3.blackbox.smbclient.encryption_off", "simpleserver", +@@ -1043,6 +1043,12 @@ plantestsuite("samba3.blackbox.smbclient.encryption_off", "simpleserver", "$USERNAME", "$PASSWORD", "$SERVER", smbclient3]) @@ -6248,10 +6248,10 @@ index 27dc7587b17..46bf274227c 100755 2.29.2 -From 5b15d0dd8783b8431e3d3913ee129b6e0f111de7 Mon Sep 17 00:00:00 2001 +From adb9139bb935553b9cf5f1201129eea563afa931 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:19:27 +0200 -Subject: [PATCH 061/104] s3:client: Remove global smb_encrypt +Subject: [PATCH 061/105] s3:client: Remove global smb_encrypt Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6356,10 +6356,10 @@ index 56309efcea7..60d4fb3c5ee 100644 2.29.2 -From 1c461fb323ba59539c8dab2547032bdb48c60178 Mon Sep 17 00:00:00 2001 +From 0babfdb10e32d729f8750096126c8ea117cb2f8a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:24:27 +0200 -Subject: [PATCH 062/104] s3:libsmb: Remove force_encrypt from cli_cm_open() +Subject: [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6466,7 +6466,7 @@ index 1b8f2a4e97a..0fd31ef3d5a 100644 NULL, 0, 0x20, &cli_ipc); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index aff998f6187..4825b8f3fae 100644 +index a7230c84db1..f190698b38d 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -383,7 +383,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, @@ -6510,10 +6510,10 @@ index eeabcaa7463..bb3e9e6874e 100644 2.29.2 -From 411587b7301ec115398e430bcac16c5a22bdfe41 Mon Sep 17 00:00:00 2001 +From 099ce3bae15197294b1cb6e136bb3fc35ab64f43 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:26:39 +0200 -Subject: [PATCH 063/104] s3:libsmb: Remove force_encrypt from cli_cm_connect() +Subject: [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6523,7 +6523,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 4825b8f3fae..b0032005398 100644 +index f190698b38d..7f2faee94bb 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -287,7 +287,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, @@ -6572,10 +6572,10 @@ index 4825b8f3fae..b0032005398 100644 2.29.2 -From af532caa1ba9727663abf17465b04768c6f7173e Mon Sep 17 00:00:00 2001 +From f469d4511115bd0a707a8a05e4ef575bd8fdffd0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:28:28 +0200 -Subject: [PATCH 064/104] s3:libsmb: Remove force_encrypt from clidfs +Subject: [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs do_connect() Signed-off-by: Andreas Schneider @@ -6586,7 +6586,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index b0032005398..5503506de97 100644 +index 7f2faee94bb..e81d86ae059 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, @@ -6633,23 +6633,23 @@ index b0032005398..5503506de97 100644 2.29.2 -From 918aa81d36bcd8b28fa98deadd811b8602fb3f6d Mon Sep 17 00:00:00 2001 +From 787d8a2976a642b2ae175e41290990a8908a6d6a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:52:11 +0200 -Subject: [PATCH 065/104] s3:libsmb: Remove force_encrypt from +Subject: [PATCH 065/105] s3:libsmb: Remove force_encrypt from cli_check_msdfs_proxy() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit 4ddec1ca257fff418847c5d1e83a3fb7cb5ade1a) --- - source3/libsmb/clidfs.c | 17 ++++++++++++----- + source3/libsmb/clidfs.c | 19 +++++++++++++------ source3/libsmb/libsmb_server.c | 4 ---- source3/libsmb/proto.h | 1 - - 3 files changed, 12 insertions(+), 10 deletions(-) + 3 files changed, 13 insertions(+), 11 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 5503506de97..736c565a7a8 100644 +index e81d86ae059..a4caf807856 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -230,7 +230,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, @@ -6678,7 +6678,7 @@ index 5503506de97..736c565a7a8 100644 if (!cli || !sharename) { return false; -@@ -1223,11 +1224,17 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, +@@ -1223,12 +1224,18 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, return false; } @@ -6686,6 +6686,7 @@ index 5503506de97..736c565a7a8 100644 + if (encryption_state >= SMB_ENCRYPTION_DESIRED) { status = cli_cm_force_encryption_creds(cli, creds, "IPC$"); if (!NT_STATUS_IS_OK(status)) { +- cli_tdis(cli); - cli_state_restore_tcon(cli, orig_tcon); - return false; + switch (encryption_state) { @@ -6693,6 +6694,7 @@ index 5503506de97..736c565a7a8 100644 + break; + case SMB_ENCRYPTION_REQUIRED: + default: ++ cli_tdis(cli); + cli_state_restore_tcon(cli, orig_tcon); + return false; + } @@ -6730,10 +6732,10 @@ index bb3e9e6874e..f2b0a8c5ff8 100644 2.29.2 -From 00bba24fda3f117eced7f306d5d4019f14595d38 Mon Sep 17 00:00:00 2001 +From 7bbe38b45690781e6fe110a10bb5f63b3af21009 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:15:09 +0200 -Subject: [PATCH 066/104] s3:libsmb: Pass cli_credentials to clidfs +Subject: [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs do_connect() Signed-off-by: Andreas Schneider @@ -6754,7 +6756,7 @@ index 972096bdc8b..00000000000 -^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver -^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 736c565a7a8..d536e0597af 100644 +index a4caf807856..29177cbb6f3 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -106,7 +106,7 @@ static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, @@ -6849,10 +6851,10 @@ index 736c565a7a8..d536e0597af 100644 2.29.2 -From 0dfe1d347c131b66172d324a5a16336875b24d50 Mon Sep 17 00:00:00 2001 +From 8b391c8c45ce09498ed16908943a9e6639bb7b00 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:18:16 +0200 -Subject: [PATCH 067/104] s3:libsmb: Pass cli_credentials to cli_cm_connect() +Subject: [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6862,7 +6864,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index d536e0597af..a2c6f5fe5ec 100644 +index 29177cbb6f3..316786f99ca 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -292,7 +292,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, @@ -6920,10 +6922,10 @@ index d536e0597af..a2c6f5fe5ec 100644 2.29.2 -From baf5499376658651aa03ba864e6541e2daf06b3a Mon Sep 17 00:00:00 2001 +From e7b69b7c59c19bd835655d2da1b655ec600d8f70 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:26:54 +0200 -Subject: [PATCH 068/104] s3:libsmb: Pass cli_credentials to cli_cm_open() +Subject: [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -7043,7 +7045,7 @@ index 0fd31ef3d5a..943f7498e8c 100644 NULL, 0, 0x20, &cli_ipc); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index a2c6f5fe5ec..ef75fb36a45 100644 +index 316786f99ca..8e404ab1d57 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -384,19 +384,18 @@ static struct cli_state *cli_cm_find(struct cli_state *cli, @@ -7131,10 +7133,10 @@ index f2b0a8c5ff8..0b8cf2a6036 100644 2.29.2 -From ee496daf60a5340ab9e4f16430e2d93fd121659b Mon Sep 17 00:00:00 2001 +From e506eaca259328d78c8dd971738c20944f920d48 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:42:25 +0200 -Subject: [PATCH 069/104] s3:libsmb: Pass cli_credentials to +Subject: [PATCH 069/105] s3:libsmb: Pass cli_credentials to cli_resolve_path(), using helper variables. Signed-off-by: Andreas Schneider @@ -7688,7 +7690,7 @@ index c54b5065b44..13e48f80a01 100644 if (!NT_STATUS_IS_OK(status)) { goto cleanup; diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index ef75fb36a45..e6695159a96 100644 +index 8e404ab1d57..6e492fc522c 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -859,7 +859,7 @@ struct cli_dfs_path_split { @@ -8018,10 +8020,10 @@ index 8fd9fcc5780..4989ec633c3 100644 2.29.2 -From aa21292bdc66f8f26244da5f1422bc41afafa6f7 Mon Sep 17 00:00:00 2001 +From d6f6b5eb7fe635caaf143b04af053c492e4251f5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:40:49 +0200 -Subject: [PATCH 070/104] s3:client: Remove global max_protocol +Subject: [PATCH 070/105] s3:client: Remove global max_protocol Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8100,10 +8102,10 @@ index 13e48f80a01..902cdec8b64 100644 2.29.2 -From 517baf60c6597388cfd1a17bf998272586d3bfc9 Mon Sep 17 00:00:00 2001 +From 012de005d6bb319d47bdb4c281c910820b3eb71a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:43:46 +0200 -Subject: [PATCH 071/104] s3:libsmb: Remove max_protocol from cli_cm_open() +Subject: [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8181,7 +8183,7 @@ index 943f7498e8c..3f4e188b396 100644 if (!NT_STATUS_IS_OK(status)) { cli_ipc = NULL; diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index e6695159a96..fb1a0c72e6d 100644 +index 6e492fc522c..d659040693e 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -388,7 +388,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, @@ -8225,10 +8227,10 @@ index 517738dbcd7..8aaaff2cb1e 100644 2.29.2 -From b35001a76bc0ff7fc10bd319abfda481b8a81c9b Mon Sep 17 00:00:00 2001 +From f5861c11522b199a506e931d8d60f61a4667f9a6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:45:12 +0200 -Subject: [PATCH 072/104] s3:libcmb: Remove max_protocol from cli_cm_connect() +Subject: [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8238,7 +8240,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index fb1a0c72e6d..023dd4d2757 100644 +index d659040693e..a76f97203ee 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -293,7 +293,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, @@ -8278,10 +8280,10 @@ index fb1a0c72e6d..023dd4d2757 100644 2.29.2 -From 4e405a5acc748c07f74a27ed57deeffc4e2c20d7 Mon Sep 17 00:00:00 2001 +From a5e1b39df83ebd300fbc3ac1022468e944dc90d5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:46:29 +0200 -Subject: [PATCH 073/104] s3:libsmb: Remove max_protocol from clidfs +Subject: [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs do_connect() The if check for max_protocol == 0 is part of lp_client_max_protocol(). @@ -8294,7 +8296,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 023dd4d2757..ee5becf76a6 100644 +index a76f97203ee..286ca41fd71 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, @@ -8341,10 +8343,10 @@ index 023dd4d2757..ee5becf76a6 100644 2.29.2 -From c710bcf3600beb7f9a08c56108c0c93f32a9139b Mon Sep 17 00:00:00 2001 +From 82163b46808648c22c57f69cdf03d9ff9bcfe3e4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Aug 2020 15:47:35 +0200 -Subject: [PATCH 074/104] s3:include: Move loadparm prototypes to own header +Subject: [PATCH 074/105] s3:include: Move loadparm prototypes to own header file Signed-off-by: Andreas Schneider @@ -8372,10 +8374,10 @@ index 8fa65cc3122..c94f919ed59 100644 /* String routines */ diff --git a/source3/include/proto.h b/source3/include/proto.h -index 12aa392abae..b9a6cb7f116 100644 +index de5d1be5208..4f14a2d546d 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h -@@ -739,173 +739,6 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context, +@@ -740,173 +740,6 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context, const char *dcname, bool force); @@ -8759,10 +8761,10 @@ index 00000000000..7686877ccf1 2.29.2 -From 62a13e686241e752ba927da046dda68324f3a550 Mon Sep 17 00:00:00 2001 +From a9365a42a95633e4b479c4126368b9e3e3368ba5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 11 Aug 2020 10:41:07 +0200 -Subject: [PATCH 075/104] s3:lib: Move interface prototypes to own header file +Subject: [PATCH 075/105] s3:lib: Move interface prototypes to own header file Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8778,7 +8780,7 @@ Autobuild-Date(master): Fri Oct 9 20:36:13 UTC 2020 on sn-devel-184 create mode 100644 source3/lib/interface.h diff --git a/source3/include/proto.h b/source3/include/proto.h -index b9a6cb7f116..1bbd8e9d526 100644 +index 4f14a2d546d..d3b758aa43d 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -84,26 +84,7 @@ NTSTATUS vfs_at_fspcwd(TALLOC_CTX *mem_ctx, @@ -8865,10 +8867,10 @@ index 00000000000..f45435b4a81 2.29.2 -From 2b704c32b55432d08eae3cae2267a4b6319c6c6c Mon Sep 17 00:00:00 2001 +From 358074c6edc583521865538926dbcd96b1c541e6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:16 +0100 -Subject: [PATCH 076/104] idl: Add SID_SAMBA_SMB3 +Subject: [PATCH 076/105] idl: Add SID_SAMBA_SMB3 Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -8895,10 +8897,10 @@ index a92e8f1518e..06bf7449a70 100644 2.29.2 -From ae4b1eccc9ef043a753126f942345a57a92004ed Mon Sep 17 00:00:00 2001 +From 118cf8e5df14da9654950af2ce613b00904b6c3f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:29 +0100 -Subject: [PATCH 077/104] s3:smbd: Add SMB3 connection information to session +Subject: [PATCH 077/105] s3:smbd: Add SMB3 connection information to session info Signed-off-by: Andreas Schneider @@ -9052,10 +9054,10 @@ index cf9de185c1f..cd24b7d2ed5 100644 2.29.2 -From 49853bdabadcde29032b0ae09f015a0adf3cd22c Mon Sep 17 00:00:00 2001 +From abfbb9d7e1968f8b6c3687e1057c8efc4d91cc82 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Mar 2020 14:11:56 +0100 -Subject: [PATCH 078/104] librpc: Add dcerpc helper +Subject: [PATCH 078/105] librpc: Add dcerpc helper dcerpc_is_transport_encrypted() Signed-off-by: Andreas Schneider @@ -9268,10 +9270,10 @@ index 27b180fa63d..109a1834841 100644 2.29.2 -From 0490f135fdcc293561b0af98b4ce0f4d56eb14a6 Mon Sep 17 00:00:00 2001 +From bf5a114f7d5a6772de3a6ca6b17bbef3237a0815 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 28 Aug 2020 16:31:17 +0200 -Subject: [PATCH 079/104] s3:smbd: Use defines to set 'srv_smb_encrypt' +Subject: [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9305,10 +9307,10 @@ index d51a3de9497..785cbb23b5f 100644 2.29.2 -From bbbb58dd5f37f82b46872d4a9eb3c6f6c1939a26 Mon Sep 17 00:00:00 2001 +From 8fe707228fa12164b4c43740a2a6909650cd39b0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 12 Nov 2019 16:56:45 +0100 -Subject: [PATCH 080/104] s3:rpc_server: Allow to use RC4 for setting passwords +Subject: [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9542,10 +9544,10 @@ index 2af02ad6fa8..eb91ac09384 100644 2.29.2 -From c3ffe2ce09c761a69ba83ae55beb4af4e53095d7 Mon Sep 17 00:00:00 2001 +From aa7b608747e1735b4edafe18ec06ddfaf5530067 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 15 Nov 2019 13:49:40 +0100 -Subject: [PATCH 081/104] s4:rpc_server: Allow to use RC4 for setting passwords +Subject: [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9673,10 +9675,10 @@ index de55ad6239a..c9c1978f223 100644 2.29.2 -From 6163af4d52811d487fa3568d0588e6afd7f43167 Mon Sep 17 00:00:00 2001 +From b4708a9ee2133cc5b5159246add53f785bea0952 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:45:49 +0200 -Subject: [PATCH 082/104] lib:crypto: Add py binding for set_relax/strict fips +Subject: [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips mode Signed-off-by: Isaac Boukris @@ -9731,10 +9733,10 @@ index 32b946eee8f..ad18d3ada0f 100644 2.29.2 -From 0dbd9d87a529585cabd793ae4c2bc1d94044c619 Mon Sep 17 00:00:00 2001 +From 99dc2113b90c7852fdd30aa9037a965331d68b71 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 28 Oct 2020 17:05:36 +0100 -Subject: [PATCH 083/104] s4:param: Add 'weak crypto' getter to pyparam +Subject: [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9787,10 +9789,10 @@ index 4023fac4dd6..e15592b5743 100644 2.29.2 -From 29e334546e28b10ff31f0de453951648c4e51296 Mon Sep 17 00:00:00 2001 +From e3de8e62a904f3f8d5d5aebef3c3c0f71f287bc8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 -Subject: [PATCH 084/104] python:tests: Add SAMR password change tests for fips +Subject: [PATCH 084/105] python:tests: Add SAMR password change tests for fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9996,7 +9998,7 @@ index 00000000000..109eeea98cc + + self.conn.SetUserInfo2(self.user_handle, level, info) diff --git a/selftest/tests.py b/selftest/tests.py -index adcb5b53189..86cab3f8046 100644 +index 3246161f0d7..4f164db9c73 100644 --- a/selftest/tests.py +++ b/selftest/tests.py @@ -93,6 +93,8 @@ planpythontestsuite( @@ -10012,10 +10014,10 @@ index adcb5b53189..86cab3f8046 100644 2.29.2 -From de2b1caebf0183bd24d06969ebf7d03223f7d9fc Mon Sep 17 00:00:00 2001 +From 08e686dd19925a62aaa98f3a558dc933bea83463 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 -Subject: [PATCH 085/104] python:tests: Add SAMR password change tests for fips +Subject: [PATCH 085/105] python:tests: Add SAMR password change tests for fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -10029,12 +10031,12 @@ Autobuild-Date(master): Thu Oct 29 15:41:37 UTC 2020 on sn-devel-184 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm -index 649e923ff9a..1ebdf2a5484 100755 +index 77bd741d476..1ae9fb9d996 100755 --- a/selftest/target/Samba4.pm +++ b/selftest/target/Samba4.pm -@@ -1040,7 +1040,7 @@ servicePrincipalName: http/testupnspn.$ctx->{dnsname} - $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; - $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" "; +@@ -1051,7 +1051,7 @@ servicePrincipalName: http/testupnspn.$ctx->{dnsname} + + $samba_tool_cmd = ${cmd_env}; $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool") - . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'"; + . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account' -d10"; @@ -10045,10 +10047,10 @@ index 649e923ff9a..1ebdf2a5484 100755 2.29.2 -From 5f240ac738df737712cbc2cdd40c8a56ab9e165b Mon Sep 17 00:00:00 2001 +From 8f5ee560b92a607a5e28bf3b164a034226badfaf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 09:40:41 +0200 -Subject: [PATCH 086/104] auth:creds: Rename CRED_USE_KERBEROS values +Subject: [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -10787,10 +10789,10 @@ index 07c6faebb15..701dfc10a07 100644 2.29.2 -From 03fb4e57548098264386dfd056f37ad2c86a937a Mon Sep 17 00:00:00 2001 +From 7bafd2824cb87ce6999b502d97217f1581acae97 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Sep 2020 12:32:28 +0200 -Subject: [PATCH 087/104] auth:creds:tests: Migrate test to a cmocka unit test +Subject: [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -11046,10 +11048,10 @@ index ad16b7d8008..46111164b36 100644 + local_include=False, + for_selftest=True) diff --git a/selftest/tests.py b/selftest/tests.py -index 86cab3f8046..4a968cdbe8a 100644 +index 4f164db9c73..003698a5eb3 100644 --- a/selftest/tests.py +++ b/selftest/tests.py -@@ -418,3 +418,5 @@ plantestsuite("samba.unittests.test_oLschema2ldif", "none", +@@ -420,3 +420,5 @@ plantestsuite("samba.unittests.test_oLschema2ldif", "none", if with_elasticsearch_backend: plantestsuite("samba.unittests.mdsparser_es", "none", [os.path.join(bindir(), "default/source3/test_mdsparser_es")] + [configuration]) @@ -11084,10 +11086,10 @@ index 38b6c8f4b6e..f0ab0357986 100644 2.29.2 -From 82565bd73ee76d51b6569743644be1b916461acd Mon Sep 17 00:00:00 2001 +From 3d8041a90cc293c52989e4fa25ea7b66209d036f Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:09:05 +0200 -Subject: [PATCH 088/104] Add smb2cli_session_get_encryption_cipher() +Subject: [PATCH 088/105] Add smb2cli_session_get_encryption_cipher() When 'session->smb2->should_encrypt' is true, the client MUST encrypt all transport messages (see also MS-SMB2 3.2.4.1.8). @@ -11141,10 +11143,10 @@ index 2afc7165cd9..db5f5d58799 100644 2.29.2 -From f74c5cc57398ee42fecdfda17f4d442ca1abd9a5 Mon Sep 17 00:00:00 2001 +From f7f374387cf30bf0811bcd83e12c0eb26c917ff8 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:18:21 +0200 -Subject: [PATCH 089/104] Add dcerpc_transport_encrypted() +Subject: [PATCH 089/105] Add dcerpc_transport_encrypted() Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11233,10 +11235,10 @@ index bd79a072bc8..6ea27a8d9a3 100644 2.29.2 -From 89a12dbf4a5b819dbd136e743c59025298009049 Mon Sep 17 00:00:00 2001 +From 46419d69586855c3df51ec79f0dd0b852912901c Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:35:01 +0200 -Subject: [PATCH 090/104] Add py binding for dcerpc_transport_encrypted +Subject: [PATCH 090/105] Add py binding for dcerpc_transport_encrypted Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11280,10 +11282,10 @@ index be914ed5f14..309a6d72e26 100644 2.29.2 -From a08aab47494ab4f2972de3ebe4b022a1d23216a5 Mon Sep 17 00:00:00 2001 +From df9e9ab494b224679d90af041d4b23ce082b1b5f Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:44:08 +0200 -Subject: [PATCH 091/104] selftest: add a test for py dce transport_encrypted +Subject: [PATCH 091/105] selftest: add a test for py dce transport_encrypted Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11345,10 +11347,10 @@ index 8e0d6a5ef0a..24e4ac77d89 100644 2.29.2 -From 4e8f7954ceed5a14987eb56197f265618fd77acc Mon Sep 17 00:00:00 2001 +From e2ee83d423afb38255e4e7bf042c5eafbaa476d3 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:47:12 +0200 -Subject: [PATCH 092/104] Add CreateTrustedDomainRelax wrapper for fips mode +Subject: [PATCH 092/105] Add CreateTrustedDomainRelax wrapper for fips mode Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11431,10 +11433,10 @@ index 00000000000..b4df0fa5bb8 2.29.2 -From 2e16b3d7d5419e76d33b2c3a794a043be5c0a4a5 Mon Sep 17 00:00:00 2001 +From 25d7ca94cb6adb3142dcbf02115562f366ce6632 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:49:17 +0200 -Subject: [PATCH 093/104] Use the new CreateTrustedDomainRelax() +Subject: [PATCH 093/105] Use the new CreateTrustedDomainRelax() Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11538,10 +11540,10 @@ index 1d12c362911..93a3258d28d 100644 2.29.2 -From 2661a29e81b6b33dce6ca1e39c9e4eeaab53fef7 Mon Sep 17 00:00:00 2001 +From 37eddec853ef26cd87dc21c2424a9aa565a350b7 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 1 Sep 2020 20:14:29 +0300 -Subject: [PATCH 094/104] selftest: add a test for the CreateTrustedDomainRelax +Subject: [PATCH 094/105] selftest: add a test for the CreateTrustedDomainRelax wrapper Originally copied from 'source4/scripting/devel/createtrust' @@ -11705,10 +11707,10 @@ index 00000000000..80effda8343 @@ -0,0 +1 @@ +^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py -index 3a903a7eee0..96f51b68cfc 100755 +index 258c9122edc..18b671d0f29 100755 --- a/source4/selftest/tests.py +++ b/source4/selftest/tests.py -@@ -704,6 +704,10 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex +@@ -705,6 +705,10 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex name = module plantestsuite_loadlist(name, env, args) @@ -11723,10 +11725,10 @@ index 3a903a7eee0..96f51b68cfc 100755 2.29.2 -From 3d3a03764d56b58a81ef99123720bd5555eaf040 Mon Sep 17 00:00:00 2001 +From 809a40543a137ede5d5d4ad7b87de5472e6855a8 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 5 Nov 2020 15:38:19 +0200 -Subject: [PATCH 095/104] Remove source4/scripting/devel/createtrust script +Subject: [PATCH 095/105] Remove source4/scripting/devel/createtrust script We now have the 'samba-tool domain trust' command. @@ -11878,10 +11880,10 @@ index 26b0d0dcb68..00000000000 2.29.2 -From 8bdfdf2b2489393586dbc99b1d2282c61acdce09 Mon Sep 17 00:00:00 2001 +From 291cf61ae4eeefe061f2a0c13d8fedc58d5a6901 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:30:26 +0100 -Subject: [PATCH 096/104] s3:rpc_server: Use gnutls_cipher_decrypt() in +Subject: [PATCH 096/105] s3:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob() It doesn't matter for RC4, but just to be correct. @@ -11910,10 +11912,10 @@ index 198387424e6..e749caf2551 100644 2.29.2 -From 37fce305caff75a8ee1ab185f37e984809225239 Mon Sep 17 00:00:00 2001 +From abe5d5910739da48f3684f455e29c45a1e5772ce Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:33:38 +0100 -Subject: [PATCH 097/104] s4:rpc_server: Use gnutls_cipher_decrypt() in +Subject: [PATCH 097/105] s4:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob() It doesn't matter for RC4, but just to be correct. @@ -11942,10 +11944,10 @@ index 8333cb149b6..4bb8aaa9592 100644 2.29.2 -From caf59e243ed0f99056176ef81fe617b170ec6cfd Mon Sep 17 00:00:00 2001 +From 86def665c392f613f7b37a854487bf4037e1f8e0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:40:21 +0200 -Subject: [PATCH 098/104] s3:rpc_server: Allow to use RC4 for creating trusts +Subject: [PATCH 098/105] s3:rpc_server: Allow to use RC4 for creating trusts Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -12009,10 +12011,10 @@ index e749caf2551..d6d606ddeca 100644 2.29.2 -From 14b972e7f4224ccf87b1d08824194a4d7d37aef0 Mon Sep 17 00:00:00 2001 +From 4a7c7876ca2c67b02e4fec6c35e829126de0b740 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:51:39 +0200 -Subject: [PATCH 099/104] s4:rpc_server: Allow to use RC4 for creating trusts +Subject: [PATCH 099/105] s4:rpc_server: Allow to use RC4 for creating trusts Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -12081,10 +12083,10 @@ index 4bb8aaa9592..5b3ef71d458 100644 2.29.2 -From 5fdca81ab920d021e5f1c81a05cf3a91244ef405 Mon Sep 17 00:00:00 2001 +From 345e9b4bd3983356474311cc878db89e4657cdf2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 10:13:48 +0100 -Subject: [PATCH 100/104] sefltest: Enable the dcerpc.createtrustrelax test +Subject: [PATCH 100/105] sefltest: Enable the dcerpc.createtrustrelax test against ad_dc_fips Signed-off-by: Andreas Schneider @@ -12111,10 +12113,10 @@ index 80effda8343..00000000000 2.29.2 -From 2547b1d495afa0f7235064f4949a297e46338287 Mon Sep 17 00:00:00 2001 +From f0ac7a131e942175295ab471b44b662216a346b6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 11 Nov 2020 13:42:06 +0100 -Subject: [PATCH 101/104] s3:smbd: Fix possible null pointer dereference in +Subject: [PATCH 101/105] s3:smbd: Fix possible null pointer dereference in token_contains_name() BUG: https://bugzilla.samba.org/show_bug.cgi?id=14572 @@ -12147,10 +12149,10 @@ index 57754a0f766..694c0c290e8 100644 2.29.2 -From 14cba0db4c3e8a20923491f01cd6eb658c8d76ae Mon Sep 17 00:00:00 2001 +From 2ed81da6506e43e3b94f479cd5edcbd11654fa6a Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 10 Nov 2020 17:35:24 +0200 -Subject: [PATCH 102/104] lookup_name: allow lookup names prefixed with DNS +Subject: [PATCH 102/105] lookup_name: allow lookup names prefixed with DNS forest root for FreeIPA DC In FreeIPA deployment with active Global Catalog service, when a two-way @@ -12257,10 +12259,10 @@ index 82c47b3145b..864246da56e 100644 2.29.2 -From 35297bdac5cf9699234ec45ae97e54ceec75ebe9 Mon Sep 17 00:00:00 2001 +From 311a71971be6cb39806349291fd2cd44a4a7e214 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 11 Nov 2020 14:42:55 +0200 -Subject: [PATCH 103/104] auth_sam: use pdb_get_domain_info to look up DNS +Subject: [PATCH 103/105] auth_sam: use pdb_get_domain_info to look up DNS forest information When Samba is used as a part of FreeIPA domain controller, Windows @@ -12480,10 +12482,10 @@ index 3c12f959faf..e8e0d543f8c 100644 2.29.2 -From 173cabf40d71470a233b7648b1bf8795f8bda091 Mon Sep 17 00:00:00 2001 +From cee41a7d2c051e6669f3fe63b7833c530d39212a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 27 Nov 2020 11:22:15 +0100 -Subject: [PATCH 104/104] docs-xml: Add a section about weak crypto in testparm +Subject: [PATCH 104/105] docs-xml: Add a section about weak crypto in testparm manpage BUG: https://bugzilla.samba.org/show_bug.cgi?id=14583 @@ -12522,3 +12524,66 @@ index 9099cda010f..7c7abf50e8b 100644 -- 2.29.2 + +From 75bac5fc644cfd36faa554b299f125f519bd3e89 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Tue, 15 Dec 2020 15:17:04 +0100 +Subject: [PATCH 105/105] HACK:s3:winbind: Rely on the domain child for online + check + +--- + source3/winbindd/winbindd_cm.c | 9 +++++++++ + source3/winbindd/winbindd_dual.c | 3 +++ + 2 files changed, 12 insertions(+) + +diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c +index 466a0095ef2..ebc92e30706 100644 +--- a/source3/winbindd/winbindd_cm.c ++++ b/source3/winbindd/winbindd_cm.c +@@ -89,6 +89,8 @@ + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_WINBIND + ++extern bool wb_idmap_child; ++ + struct dc_name_ip { + fstring name; + struct sockaddr_storage ss; +@@ -176,6 +178,13 @@ static void msg_try_to_go_online(struct messaging_context *msg, + continue; + } + ++ if (wb_child_domain() == NULL && !wb_idmap_child) { ++ DEBUG(5,("msg_try_to_go_online: domain %s " ++ "NOT CONNECTING IN MAIN PROCESS.\n", domainname)); ++ domain->online = true; ++ continue; ++ } ++ + /* This call takes care of setting the online + flag to true if we connected, or re-adding + the offline handler if false. Bypasses online +diff --git a/source3/winbindd/winbindd_dual.c b/source3/winbindd/winbindd_dual.c +index b1c86b2979c..c6362019877 100644 +--- a/source3/winbindd/winbindd_dual.c ++++ b/source3/winbindd/winbindd_dual.c +@@ -1674,6 +1674,8 @@ static void child_handler(struct tevent_context *ev, struct tevent_fd *fde, + } + } + ++bool wb_idmap_child; ++ + static bool fork_domain_child(struct winbindd_child *child) + { + int fdpair[2]; +@@ -1778,6 +1780,7 @@ static bool fork_domain_child(struct winbindd_child *child) + setproctitle("domain child [%s]", child_domain->name); + } else if (child == idmap_child()) { + setproctitle("idmap child"); ++ wb_idmap_child = true; + } + + /* Handle online/offline messages. */ +-- +2.29.2 + diff --git a/samba.spec b/samba.spec index 67be317..198411a 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.13.4 +%define samba_version 4.13.5 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3627,6 +3627,9 @@ fi %endif %changelog +* Tue Mar 09 2021 Guenther Deschner - 4.13.5-0 +- Update to Samba 4.13.5 + * Tue Jan 26 2021 Guenther Deschner - 4.13.4-0 - Update to Samba 4.13.4 diff --git a/sources b/sources index 2d17de0..94a59a8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.4.tar.xz) = c6fb8b4186da25c69d1bc662780a12c6fa6fa70fc65fa487dba2d547c96e8f7f8f8736b8edc2564b599be875b00d891631fa37838632efac593bf83eb33392f9 -SHA512 (samba-4.13.4.tar.asc) = b8c0ccd7e716d2de6e9da2a53577bc31983eaec4ed4583bb88b52b2ca8b80045c8c0349a97a12e796df84a5942293f5a40e74eff8c003b3062f8f6454dc2a631 +SHA512 (samba-4.13.5.tar.xz) = 93afa6aba7a34a1141c988c1b57830f7ae025647e9f78981d9af3477bccf37ae0957e1cdff9851898067e25be7cb00ea04902d0b8ff4e5c399a2a7e7146f9817 +SHA512 (samba-4.13.5.tar.asc) = 6e24d1b2993f79f645337fc90ad54c89d030f0ef72067c2656dc3f69f2ce1bbef6bd4d3bcd6a82fc226f36eb795fb8f5122a74f38e1afdb4cb942432da0d790d From ede8ff5ae9ebba115b9b5a3d03859b7eb1860d9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 24 Mar 2021 11:50:37 +0100 Subject: [PATCH 17/30] Update to Samba 4.13.6 resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 Guenther --- .gitignore | 2 ++ samba.spec | 7 ++++++- sources | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index cc7e906..66f28b9 100644 --- a/.gitignore +++ b/.gitignore @@ -233,3 +233,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.4.tar.asc /samba-4.13.5.tar.xz /samba-4.13.5.tar.asc +/samba-4.13.6.tar.xz +/samba-4.13.6.tar.asc diff --git a/samba.spec b/samba.spec index 198411a..2ad35a9 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.13.5 +%define samba_version 4.13.6 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3627,6 +3627,11 @@ fi %endif %changelog +* Wed Mar 23 2021 Guenther Deschner - 4.13.6-0 +- Update to Samba 4.13.6 +- resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 + * Tue Mar 09 2021 Guenther Deschner - 4.13.5-0 - Update to Samba 4.13.5 diff --git a/sources b/sources index 94a59a8..aaf65b2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.5.tar.xz) = 93afa6aba7a34a1141c988c1b57830f7ae025647e9f78981d9af3477bccf37ae0957e1cdff9851898067e25be7cb00ea04902d0b8ff4e5c399a2a7e7146f9817 -SHA512 (samba-4.13.5.tar.asc) = 6e24d1b2993f79f645337fc90ad54c89d030f0ef72067c2656dc3f69f2ce1bbef6bd4d3bcd6a82fc226f36eb795fb8f5122a74f38e1afdb4cb942432da0d790d +SHA512 (samba-4.13.6.tar.xz) = 1bb52ecfb7825e6583c23b47dd04e2c8bb59fcb7570815bb26aa782ae572f8fd54a4003c619a178c138fa9cfc761247e959bc67f24946a4d1f048169af2de442 +SHA512 (samba-4.13.6.tar.asc) = b1ba265b74840b18930adc159dc8b57266283ffc11bba63a03f5f177edc2086a7ae8a2e02329d52f9af880c874d25f1ffd0d3462fa1ada500c4a1a95af07adce From 49bc60d14a4e8e82c6a5743b1a5e6a286470bfb7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 24 Mar 2021 20:06:59 +0100 Subject: [PATCH 18/30] Fix changelog date Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 2ad35a9..5c4cc17 100644 --- a/samba.spec +++ b/samba.spec @@ -3627,7 +3627,7 @@ fi %endif %changelog -* Wed Mar 23 2021 Guenther Deschner - 4.13.6-0 +* Wed Mar 24 2021 Guenther Deschner - 4.13.6-0 - Update to Samba 4.13.6 - resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 - resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 From 9031c9ac4872625e60f443d431e008717d38af19 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 25 Mar 2021 12:19:00 +0100 Subject: [PATCH 19/30] Update to Samba 4.13.7 related: #1941400, #1942496 - Security fixes for CVE-2020-27840 related: #1941402, #1942497 - Security fixes for CVE-2021-20277 Guenther --- .gitignore | 2 ++ samba.spec | 11 ++++++++--- sources | 4 ++-- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 66f28b9..0696950 100644 --- a/.gitignore +++ b/.gitignore @@ -235,3 +235,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.5.tar.asc /samba-4.13.6.tar.xz /samba-4.13.6.tar.asc +/samba-4.13.7.tar.xz +/samba-4.13.7.tar.asc diff --git a/samba.spec b/samba.spec index 5c4cc17..4161ea1 100644 --- a/samba.spec +++ b/samba.spec @@ -10,11 +10,11 @@ %define main_release 0 -%define samba_version 4.13.6 -%define talloc_version 2.3.1 +%define samba_version 4.13.7 +%define talloc_version 2.3.2 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.2.0 +%define ldb_version 2.3.0 # This should be rc1 or nil %define pre_release %nil @@ -3627,6 +3627,11 @@ fi %endif %changelog +* Thu Mar 25 2021 Guenther Deschner - 4.13.7-0 +- Update to Samba 4.13.7 +- related: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- related: #1941402, #1942497 - Security fixes for CVE-2021-20277 + * Wed Mar 24 2021 Guenther Deschner - 4.13.6-0 - Update to Samba 4.13.6 - resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 diff --git a/sources b/sources index aaf65b2..e69c225 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.6.tar.xz) = 1bb52ecfb7825e6583c23b47dd04e2c8bb59fcb7570815bb26aa782ae572f8fd54a4003c619a178c138fa9cfc761247e959bc67f24946a4d1f048169af2de442 -SHA512 (samba-4.13.6.tar.asc) = b1ba265b74840b18930adc159dc8b57266283ffc11bba63a03f5f177edc2086a7ae8a2e02329d52f9af880c874d25f1ffd0d3462fa1ada500c4a1a95af07adce +SHA512 (samba-4.13.7.tar.xz) = 2e22370523c7ecee94b374f0950c91217fcbc5e087433ca7375eb6341b7132611c675b869bfa6d9c726d77a279f7a6c2bbeb30dcdd84dc77841b295eafe15557 +SHA512 (samba-4.13.7.tar.asc) = 1af3cdfde624ed93f44c368981b4d45ec6a78645a920e952e2b0965c78a1e515322cfd23199c93c38f50ebb85cfe0f6998ff59e50ac20e0f526276f762f917ed From 75295596089d197c44519932e594a42c42facf2d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 25 Mar 2021 13:22:11 +0100 Subject: [PATCH 20/30] Fix talloc and ldb required versions Guenther --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 4161ea1..32f0e4b 100644 --- a/samba.spec +++ b/samba.spec @@ -11,10 +11,10 @@ %define main_release 0 %define samba_version 4.13.7 -%define talloc_version 2.3.2 +%define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.3.0 +%define ldb_version 2.2.1 # This should be rc1 or nil %define pre_release %nil From 4ff027fceb63130e7af3f110c1cc3f2a5b1a5030 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 7 Apr 2021 20:03:45 +0300 Subject: [PATCH 21/30] Fix memory leaks in RPC server resolves: #1946950 Signed-off-by: Alexander Bokovoy --- samba-bz14675-fix.patch | 157 ++++++++++++++++++++++++++++++++++++++++ samba.spec | 7 +- 2 files changed, 163 insertions(+), 1 deletion(-) create mode 100644 samba-bz14675-fix.patch diff --git a/samba-bz14675-fix.patch b/samba-bz14675-fix.patch new file mode 100644 index 0000000..f625a95 --- /dev/null +++ b/samba-bz14675-fix.patch @@ -0,0 +1,157 @@ +From 75a66ce1da41c5b081771b2db55c2994d378d882 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Tue, 23 Mar 2021 11:40:21 +0100 +Subject: [PATCH 1/3] pidl: set the per-request memory context in the pidl + generator + +The talloc memory context referenced by the pipe_struct mem_ctx member is used +as talloc parent for RPC response data by the RPC service implementations. + +In Samba versions up to 4.10 all talloc children of p->mem_ctx were freed after +a RPC response was delivered by calling talloc_free_children(p->mem_ctx). Commit +60fa8e255254d38e9443bf96f2c0f31430be6ab8 removed this call which resulted in all +memory allocations on this context not getting released, which can consume +significant memory in long running RPC connections. + +Instead of putting the talloc_free_children(p->mem_ctx) back, just use the +mem_ctx argument of the ${pipename}_op_dispatch_internal() function which is a +dcesrv_call_state object created by dcesrv_process_ncacn_packet() and released +by the RPC server when the RPC request processing is finished. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 +CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 + +Signed-off-by: Ralph Boehme +Reviewed-by: Volker Lendecke +(cherry picked from commit 4c3fb2a5912966a61e7ebdb05eb3231a0e1d6033) +--- + pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm | 2 ++ + source3/rpc_server/rpc_handles.c | 6 ------ + 2 files changed, 2 insertions(+), 6 deletions(-) + +diff --git a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm +index 54feea0a9ef..d1368c3dbca 100644 +--- a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm ++++ b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm +@@ -299,6 +299,7 @@ sub boilerplate_iface($) + $self->pidl("/* Update pipes struct opnum */"); + $self->pidl("p->opnum = opnum;"); + $self->pidl("p->dce_call = dce_call;"); ++ $self->pidl("p->mem_ctx = mem_ctx;"); + $self->pidl("/* Update pipes struct session info */"); + $self->pidl("pipe_session_info = p->session_info;"); + $self->pidl("p->session_info = dce_call->auth_state->session_info;"); +@@ -344,6 +345,7 @@ sub boilerplate_iface($) + $self->pidl(""); + + $self->pidl("p->dce_call = NULL;"); ++ $self->pidl("p->mem_ctx = NULL;"); + $self->pidl("/* Restore session info */"); + $self->pidl("p->session_info = pipe_session_info;"); + $self->pidl("p->auth.auth_type = 0;"); +diff --git a/source3/rpc_server/rpc_handles.c b/source3/rpc_server/rpc_handles.c +index 45968746440..9ef93231466 100644 +--- a/source3/rpc_server/rpc_handles.c ++++ b/source3/rpc_server/rpc_handles.c +@@ -60,12 +60,6 @@ int make_base_pipes_struct(TALLOC_CTX *mem_ctx, + return ENOMEM; + } + +- p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p); +- if (!p->mem_ctx) { +- talloc_free(p); +- return ENOMEM; +- } +- + p->msg_ctx = msg_ctx; + p->transport = transport; + +-- +2.30.2 + + +From 33a7749f7fc5c58752815789d086d696a20878e7 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 22 Mar 2021 12:06:39 +0100 +Subject: [PATCH 2/3] spools: avoid leaking memory into the callers mem_ctx + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 +CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 + +Signed-off-by: Ralph Boehme +Reviewed-by: Volker Lendecke +(cherry picked from commit 481176ec745c14b78fca68e01a61c83405a4b97b) +--- + source3/rpc_server/spoolss/srv_spoolss_nt.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c +index d20c19d5271..24ea7367ec8 100644 +--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c ++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c +@@ -5731,7 +5731,8 @@ static WERROR construct_printer_driver_info_level(TALLOC_CTX *mem_ctx, + } + + if (pinfo2->drivername == NULL || pinfo2->drivername[0] == '\0') { +- return WERR_UNKNOWN_PRINTER_DRIVER; ++ result = WERR_UNKNOWN_PRINTER_DRIVER; ++ goto done; + } + + DBG_INFO("Construct printer driver [%s] for [%s]\n", +@@ -7023,7 +7024,8 @@ static WERROR update_printer(struct pipes_struct *p, + raddr = tsocket_address_inet_addr_string(p->remote_address, + p->mem_ctx); + if (raddr == NULL) { +- return WERR_NOT_ENOUGH_MEMORY; ++ result = WERR_NOT_ENOUGH_MEMORY; ++ goto done; + } + + /* add_printer_hook() will call reload_services() */ +-- +2.30.2 + + +From 602290d48d3bc49acca64a089822f26da293ee1e Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Tue, 23 Mar 2021 17:06:15 +0100 +Subject: [PATCH 3/3] rpc_server3: Fix a memleak for internal pipes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +state->call should not be talloc'ed off a long-lived context + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 +CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 +RN: Memory leak in the RPC server + +Signed-off-by: Volker Lendecke +Reviewed-by: Samuel Cabrero +Reviewed-by: Ralph Boehme + +Autobuild-User(master): Ralph Böhme +Autobuild-Date(master): Wed Mar 31 12:14:01 UTC 2021 on sn-devel-184 + +(cherry picked from commit 12f516e4680753460e7fe8811e6c6ff70057580c) +--- + source3/rpc_server/rpc_ncacn_np.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/rpc_server/rpc_ncacn_np.c b/source3/rpc_server/rpc_ncacn_np.c +index 9ba271c2479..494b002e714 100644 +--- a/source3/rpc_server/rpc_ncacn_np.c ++++ b/source3/rpc_server/rpc_ncacn_np.c +@@ -476,7 +476,7 @@ static struct tevent_req *rpcint_bh_raw_call_send(TALLOC_CTX *mem_ctx, + return tevent_req_post(req, ev); + } + +- state->call = talloc_zero(hs->conn, struct dcesrv_call_state); ++ state->call = talloc_zero(state, struct dcesrv_call_state); + if (tevent_req_nomem(state->call, req)) { + return tevent_req_post(req, ev); + } +-- +2.30.2 + diff --git a/samba.spec b/samba.spec index 32f0e4b..69a67a1 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.13.7 %define talloc_version 2.3.1 @@ -136,6 +136,7 @@ Patch1: samba-s4u.patch # # Generate the patchset using: git format-patch -l1 --stdout -N > samba-4.13-redhat.patch Patch2: samba-4.13-redhat.patch +Patch3: samba-bz14675-fix.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3627,6 +3628,10 @@ fi %endif %changelog +* Wed Apr 07 2021 Alexander Bokovoy - 4.13.7-1 +- Fix memory leaks in RPC server +- resolves: #1946950 + * Thu Mar 25 2021 Guenther Deschner - 4.13.7-0 - Update to Samba 4.13.7 - related: #1941400, #1942496 - Security fixes for CVE-2020-27840 From 4ccc117a9dc5e3ef79939b12649a611ee5684ea7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Apr 2021 11:53:23 +0200 Subject: [PATCH 22/30] Update to Samba 4.13.8 resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 0696950..da7e9f7 100644 --- a/.gitignore +++ b/.gitignore @@ -237,3 +237,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.6.tar.asc /samba-4.13.7.tar.xz /samba-4.13.7.tar.asc +/samba-4.13.8.tar.xz +/samba-4.13.8.tar.asc diff --git a/samba.spec b/samba.spec index 69a67a1..427f130 100644 --- a/samba.spec +++ b/samba.spec @@ -8,9 +8,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 0 -%define samba_version 4.13.7 +%define samba_version 4.13.8 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3628,6 +3628,10 @@ fi %endif %changelog +* Thu Apr 29 2021 Guenther Deschner - 4.13.8-0 +- Update to Samba 4.13.8 +- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 + * Wed Apr 07 2021 Alexander Bokovoy - 4.13.7-1 - Fix memory leaks in RPC server - resolves: #1946950 diff --git a/sources b/sources index e69c225..ef6fe0d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.7.tar.xz) = 2e22370523c7ecee94b374f0950c91217fcbc5e087433ca7375eb6341b7132611c675b869bfa6d9c726d77a279f7a6c2bbeb30dcdd84dc77841b295eafe15557 -SHA512 (samba-4.13.7.tar.asc) = 1af3cdfde624ed93f44c368981b4d45ec6a78645a920e952e2b0965c78a1e515322cfd23199c93c38f50ebb85cfe0f6998ff59e50ac20e0f526276f762f917ed +SHA512 (samba-4.13.8.tar.xz) = 777cb3ff452288fb086daa4772bb88a4c97144330fec46738f00c0e74263be0d00f75106c666ec42158f986e77f81a0e7ec04c1088753ec2847474984a89ee7e +SHA512 (samba-4.13.8.tar.asc) = 105530a11014bac9f4466a1413fee0060078264c08426a65aab86f52947a8d8d3557dbf6216cae6808cc3deab1a37378f1da3f17cae956a24adf69c7908908b7 From 0bbffd4f995e37b93a7483c716aa5a0929bad883 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 11 May 2021 12:43:03 +0200 Subject: [PATCH 23/30] Update to Samba 4.13.9 Guenther --- .gitignore | 2 + samba-bz14675-fix.patch | 157 ---------------------------------------- samba.spec | 6 +- sources | 4 +- 4 files changed, 8 insertions(+), 161 deletions(-) delete mode 100644 samba-bz14675-fix.patch diff --git a/.gitignore b/.gitignore index da7e9f7..ff8e176 100644 --- a/.gitignore +++ b/.gitignore @@ -239,3 +239,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.7.tar.asc /samba-4.13.8.tar.xz /samba-4.13.8.tar.asc +/samba-4.13.9.tar.xz +/samba-4.13.9.tar.asc diff --git a/samba-bz14675-fix.patch b/samba-bz14675-fix.patch deleted file mode 100644 index f625a95..0000000 --- a/samba-bz14675-fix.patch +++ /dev/null @@ -1,157 +0,0 @@ -From 75a66ce1da41c5b081771b2db55c2994d378d882 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Tue, 23 Mar 2021 11:40:21 +0100 -Subject: [PATCH 1/3] pidl: set the per-request memory context in the pidl - generator - -The talloc memory context referenced by the pipe_struct mem_ctx member is used -as talloc parent for RPC response data by the RPC service implementations. - -In Samba versions up to 4.10 all talloc children of p->mem_ctx were freed after -a RPC response was delivered by calling talloc_free_children(p->mem_ctx). Commit -60fa8e255254d38e9443bf96f2c0f31430be6ab8 removed this call which resulted in all -memory allocations on this context not getting released, which can consume -significant memory in long running RPC connections. - -Instead of putting the talloc_free_children(p->mem_ctx) back, just use the -mem_ctx argument of the ${pipename}_op_dispatch_internal() function which is a -dcesrv_call_state object created by dcesrv_process_ncacn_packet() and released -by the RPC server when the RPC request processing is finished. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 -CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 - -Signed-off-by: Ralph Boehme -Reviewed-by: Volker Lendecke -(cherry picked from commit 4c3fb2a5912966a61e7ebdb05eb3231a0e1d6033) ---- - pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm | 2 ++ - source3/rpc_server/rpc_handles.c | 6 ------ - 2 files changed, 2 insertions(+), 6 deletions(-) - -diff --git a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm -index 54feea0a9ef..d1368c3dbca 100644 ---- a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm -+++ b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm -@@ -299,6 +299,7 @@ sub boilerplate_iface($) - $self->pidl("/* Update pipes struct opnum */"); - $self->pidl("p->opnum = opnum;"); - $self->pidl("p->dce_call = dce_call;"); -+ $self->pidl("p->mem_ctx = mem_ctx;"); - $self->pidl("/* Update pipes struct session info */"); - $self->pidl("pipe_session_info = p->session_info;"); - $self->pidl("p->session_info = dce_call->auth_state->session_info;"); -@@ -344,6 +345,7 @@ sub boilerplate_iface($) - $self->pidl(""); - - $self->pidl("p->dce_call = NULL;"); -+ $self->pidl("p->mem_ctx = NULL;"); - $self->pidl("/* Restore session info */"); - $self->pidl("p->session_info = pipe_session_info;"); - $self->pidl("p->auth.auth_type = 0;"); -diff --git a/source3/rpc_server/rpc_handles.c b/source3/rpc_server/rpc_handles.c -index 45968746440..9ef93231466 100644 ---- a/source3/rpc_server/rpc_handles.c -+++ b/source3/rpc_server/rpc_handles.c -@@ -60,12 +60,6 @@ int make_base_pipes_struct(TALLOC_CTX *mem_ctx, - return ENOMEM; - } - -- p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p); -- if (!p->mem_ctx) { -- talloc_free(p); -- return ENOMEM; -- } -- - p->msg_ctx = msg_ctx; - p->transport = transport; - --- -2.30.2 - - -From 33a7749f7fc5c58752815789d086d696a20878e7 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 22 Mar 2021 12:06:39 +0100 -Subject: [PATCH 2/3] spools: avoid leaking memory into the callers mem_ctx - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 -CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 - -Signed-off-by: Ralph Boehme -Reviewed-by: Volker Lendecke -(cherry picked from commit 481176ec745c14b78fca68e01a61c83405a4b97b) ---- - source3/rpc_server/spoolss/srv_spoolss_nt.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index d20c19d5271..24ea7367ec8 100644 ---- a/source3/rpc_server/spoolss/srv_spoolss_nt.c -+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -5731,7 +5731,8 @@ static WERROR construct_printer_driver_info_level(TALLOC_CTX *mem_ctx, - } - - if (pinfo2->drivername == NULL || pinfo2->drivername[0] == '\0') { -- return WERR_UNKNOWN_PRINTER_DRIVER; -+ result = WERR_UNKNOWN_PRINTER_DRIVER; -+ goto done; - } - - DBG_INFO("Construct printer driver [%s] for [%s]\n", -@@ -7023,7 +7024,8 @@ static WERROR update_printer(struct pipes_struct *p, - raddr = tsocket_address_inet_addr_string(p->remote_address, - p->mem_ctx); - if (raddr == NULL) { -- return WERR_NOT_ENOUGH_MEMORY; -+ result = WERR_NOT_ENOUGH_MEMORY; -+ goto done; - } - - /* add_printer_hook() will call reload_services() */ --- -2.30.2 - - -From 602290d48d3bc49acca64a089822f26da293ee1e Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Tue, 23 Mar 2021 17:06:15 +0100 -Subject: [PATCH 3/3] rpc_server3: Fix a memleak for internal pipes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -state->call should not be talloc'ed off a long-lived context - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 -CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 -RN: Memory leak in the RPC server - -Signed-off-by: Volker Lendecke -Reviewed-by: Samuel Cabrero -Reviewed-by: Ralph Boehme - -Autobuild-User(master): Ralph Böhme -Autobuild-Date(master): Wed Mar 31 12:14:01 UTC 2021 on sn-devel-184 - -(cherry picked from commit 12f516e4680753460e7fe8811e6c6ff70057580c) ---- - source3/rpc_server/rpc_ncacn_np.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/rpc_server/rpc_ncacn_np.c b/source3/rpc_server/rpc_ncacn_np.c -index 9ba271c2479..494b002e714 100644 ---- a/source3/rpc_server/rpc_ncacn_np.c -+++ b/source3/rpc_server/rpc_ncacn_np.c -@@ -476,7 +476,7 @@ static struct tevent_req *rpcint_bh_raw_call_send(TALLOC_CTX *mem_ctx, - return tevent_req_post(req, ev); - } - -- state->call = talloc_zero(hs->conn, struct dcesrv_call_state); -+ state->call = talloc_zero(state, struct dcesrv_call_state); - if (tevent_req_nomem(state->call, req)) { - return tevent_req_post(req, ev); - } --- -2.30.2 - diff --git a/samba.spec b/samba.spec index 427f130..fe8c2ca 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.13.8 +%define samba_version 4.13.9 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -136,7 +136,6 @@ Patch1: samba-s4u.patch # # Generate the patchset using: git format-patch -l1 --stdout -N > samba-4.13-redhat.patch Patch2: samba-4.13-redhat.patch -Patch3: samba-bz14675-fix.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3628,6 +3627,9 @@ fi %endif %changelog +* Tue May 11 2021 Guenther Deschner - 4.13.9-0 +- Update to Samba 4.13.9 + * Thu Apr 29 2021 Guenther Deschner - 4.13.8-0 - Update to Samba 4.13.8 - resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 diff --git a/sources b/sources index ef6fe0d..5a6ca2d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.8.tar.xz) = 777cb3ff452288fb086daa4772bb88a4c97144330fec46738f00c0e74263be0d00f75106c666ec42158f986e77f81a0e7ec04c1088753ec2847474984a89ee7e -SHA512 (samba-4.13.8.tar.asc) = 105530a11014bac9f4466a1413fee0060078264c08426a65aab86f52947a8d8d3557dbf6216cae6808cc3deab1a37378f1da3f17cae956a24adf69c7908908b7 +SHA512 (samba-4.13.9.tar.xz) = 1e0a55e741c67cf5a63a3954906487a497a258e745c59f9a82a3c058426d4bbe5ca2855c3aab479299a88dafb05aa3e3fb0bead3d30e4777034470960ad22bad +SHA512 (samba-4.13.9.tar.asc) = 8c5a6ef154188eca0beb7913b75979db5f407d4d052f65bcd5daca0ac355d52c701dd9704da9252461ed3303f240b60873cafc6e16451a47681abaf7f45c15d0 From 62ad5fa92246456a2c1a42e8ed6cc748e823d017 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 14 Jul 2021 11:58:32 +0200 Subject: [PATCH 24/30] Update to Samba 4.13.10 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index ff8e176..d7b9b4e 100644 --- a/.gitignore +++ b/.gitignore @@ -241,3 +241,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.8.tar.asc /samba-4.13.9.tar.xz /samba-4.13.9.tar.asc +/samba-4.13.10.tar.xz +/samba-4.13.10.tar.asc diff --git a/samba.spec b/samba.spec index fe8c2ca..c3d6b62 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.13.9 +%define samba_version 4.13.10 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3627,6 +3627,9 @@ fi %endif %changelog +* Wed Jul 14 2021 Guenther Deschner - 4.13.10-0 +- Update to Samba 4.13.10 + * Tue May 11 2021 Guenther Deschner - 4.13.9-0 - Update to Samba 4.13.9 diff --git a/sources b/sources index 5a6ca2d..9563a8c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.9.tar.xz) = 1e0a55e741c67cf5a63a3954906487a497a258e745c59f9a82a3c058426d4bbe5ca2855c3aab479299a88dafb05aa3e3fb0bead3d30e4777034470960ad22bad -SHA512 (samba-4.13.9.tar.asc) = 8c5a6ef154188eca0beb7913b75979db5f407d4d052f65bcd5daca0ac355d52c701dd9704da9252461ed3303f240b60873cafc6e16451a47681abaf7f45c15d0 +SHA512 (samba-4.13.10.tar.xz) = c55114d3539c6bc824787b32d972f6121c29fb35758a5c932543dc99280d4d711c3f54b72064e10be51f8a3502d5095efe9ef833c4cc1ba9bdb6a2dfaf2ddd29 +SHA512 (samba-4.13.10.tar.asc) = 27a8313606486a8acc5f31f383bc5541aaadde34eb557427658810e3dc3f33a0f2b93c0bda921287424771f16741bb6d2de1b505d7efe47669e211b3625358fd From 2998d6791991a35c27cb6c3f3fd9a9c58823cdba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 7 Sep 2021 12:09:02 +0200 Subject: [PATCH 25/30] Update to Samba 4.13.11 Guenther --- .gitignore | 2 + samba-4.13-redhat.patch | 586 ++++++++++++++++++++-------------------- samba.spec | 5 +- sources | 4 +- 4 files changed, 301 insertions(+), 296 deletions(-) diff --git a/.gitignore b/.gitignore index d7b9b4e..2f476b8 100644 --- a/.gitignore +++ b/.gitignore @@ -243,3 +243,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.9.tar.asc /samba-4.13.10.tar.xz /samba-4.13.10.tar.asc +/samba-4.13.11.tar.xz +/samba-4.13.11.tar.asc diff --git a/samba-4.13-redhat.patch b/samba-4.13-redhat.patch index ae1208a..a5d4832 100644 --- a/samba-4.13-redhat.patch +++ b/samba-4.13-redhat.patch @@ -1,4 +1,4 @@ -From 02f3f310bee630ed6e6b8adea542436f0dfadd83 Mon Sep 17 00:00:00 2001 +From a1f5903240ac444b867c7f0aaf1e0e2b815ea2e8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 16:15:03 +0200 Subject: [PATCH 001/105] libcli:smb2: Do not leak ptext on error @@ -22,10 +22,10 @@ index 230475480c2..cfb3b613f9d 100644 goto out; } -- -2.29.2 +2.31.1 -From 7680b849e6967ec6c364c10a46c205e4b61268e1 Mon Sep 17 00:00:00 2001 +From 343b6fb03e6c26054adb02b3fbd866e5650e9766 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 17:23:37 +0200 Subject: [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have @@ -106,10 +106,10 @@ index cfb3b613f9d..b1e0253948f 100644 TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; -- -2.29.2 +2.31.1 -From fd7b8857ddacb301e57b4ef0b87e786b47651b2d Mon Sep 17 00:00:00 2001 +From 844c227f014581c46f75cb72fe749ceb8c062f23 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 6 Nov 2019 17:37:45 +0100 Subject: [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF @@ -202,10 +202,10 @@ index d2a81506de3..6454ac9ff7c 100644 self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) self.assertEqual(creds.get_realm(), realm.upper()) -- -2.29.2 +2.31.1 -From d6d61e6863b2e393c115c0ec7fbd75a5ffdf8aba Mon Sep 17 00:00:00 2001 +From e4bca5f38ed6ad8cd48b1b3e97569165b3d8d189 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 10 Oct 2019 14:18:23 +0200 Subject: [PATCH 004/105] param: Add 'server smb encrypt' parameter @@ -821,10 +821,10 @@ index 7acde285a90..b745e0906b1 100644 req, NT_STATUS_NOT_SUPPORTED); -- -2.29.2 +2.31.1 -From eb2987a887281c9e2d8993ef646e354f3f5488f7 Mon Sep 17 00:00:00 2001 +From fd86806d67c924a5a18ee1cc2b876082b0bc024e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 10:04:19 +0200 Subject: [PATCH 005/105] param: Create and use enum_smb_encryption_vals @@ -899,7 +899,7 @@ index 47b85de1f87..e2f737279dc 100644 {MDNS_NAME_NETBIOS, "netbios"}, {MDNS_NAME_MDNS, "mdns"}, diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h -index d2345f094e1..8ee99e25566 100644 +index af8e7204013..8e757dbc5b5 100644 --- a/libcli/smb/smb_constants.h +++ b/libcli/smb/smb_constants.h @@ -106,6 +106,15 @@ enum smb_signing_setting { @@ -919,10 +919,10 @@ index d2345f094e1..8ee99e25566 100644 #define SMB_DATA_BLOCK 0x1 #define SMB_ASCII4 0x4 -- -2.29.2 +2.31.1 -From 47f2864f002e34bc5efbb682dad4dab13855d39f Mon Sep 17 00:00:00 2001 +From 9edfbc5907c07eb82bef0ddaa2d888e0baac8b43 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:34:54 +0200 Subject: [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values @@ -1043,10 +1043,10 @@ index b745e0906b1..2f2fdcb7260 100644 req, NT_STATUS_NOT_SUPPORTED); -- -2.29.2 +2.31.1 -From 004c8bafd87a3d0109ab62522d47f7e376de7601 Mon Sep 17 00:00:00 2001 +From 326b92aeb4b20301ff5eebb9e6d7650330854394 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Apr 2020 10:38:41 +0200 Subject: [PATCH 007/105] docs-xml: Add 'client smb encrypt' @@ -1221,10 +1221,10 @@ index 4ad541301b3..6418a42b6eb 100644 apply_lp_set_cmdline(); } -- -2.29.2 +2.31.1 -From 2b0594870c4bd61e5a5aa012dd028b92020c542f Mon Sep 17 00:00:00 2001 +From 63b9df55730fc876988eca33c129f769de75b0fd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jul 2020 17:48:25 +0200 Subject: [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() @@ -1288,10 +1288,10 @@ index 323fcf84523..e66ce2324b4 100644 struct loadparm_substitution; #ifdef LOADPARM_SUBSTITUTION_INTERNALS -- -2.29.2 +2.31.1 -From a68f4821cb7f2936a7437947db52fd20522893cc Mon Sep 17 00:00:00 2001 +From 36a90aee5b31b0d71cd3ea0ce405deb7d89674a0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:38:08 +0200 Subject: [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() @@ -1461,10 +1461,10 @@ index 2b65943b2ed..9938bf53ed6 100644 plantestsuite("samba.unittests.talloc_keep_secret", "none", [os.path.join(bindir(), "default/lib/util/test_talloc_keep_secret")]) -- -2.29.2 +2.31.1 -From e9943e865ea4d49f40fdee30c7af84c36fe5f604 Mon Sep 17 00:00:00 2001 +From 982e1bcc7c451eb4cb20d3c105b2d67eb3dbbf89 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 08:39:34 +0200 Subject: [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() @@ -1555,10 +1555,10 @@ index da0e4db2bf3..ac2887ee5c4 100644 + return encryption_state; +} -- -2.29.2 +2.31.1 -From 31f1863918cde009dd05a0cbd1d235ef024dd43d Mon Sep 17 00:00:00 2001 +From ccf0bea67282852031d12205e1e741f974d0b56d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:47:59 +0200 Subject: [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline @@ -1622,10 +1622,10 @@ index d86a9fcadbf..c1051c62393 100644 bld.SAMBA3_LIBRARY('cmdline_contexts', -- -2.29.2 +2.31.1 -From 2f2cc5f127c36b8b0731a589df63841660f6bece Mon Sep 17 00:00:00 2001 +From 9ff8e1d264555f35d49455c10ad1e4d8b5064566 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 07:47:18 +0200 Subject: [PATCH 012/105] auth:creds: Remove unused credentials autoproto @@ -1702,10 +1702,10 @@ index 7711eac2afa..d9be3562adb 100644 #include "auth/kerberos/kerberos_credentials.h" #include "auth/kerberos/kerberos_util.h" -- -2.29.2 +2.31.1 -From aa7dcb366db8976571a0ead6fe2f75e37db1752d Mon Sep 17 00:00:00 2001 +From 62e645e77e33b16e060c81838a281f8ea9cabb99 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:32:44 +0200 Subject: [PATCH 013/105] auth:creds: Add @@ -1844,10 +1844,10 @@ index 68f1f25dce1..9cde0000b5f 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.29.2 +2.31.1 -From dd10642b665a212c1c4183209d878220f577a3e7 Mon Sep 17 00:00:00 2001 +From b63074e5adcc245672fc8cb5c1b7eb1d2670ba5d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 11:56:01 +0200 Subject: [PATCH 014/105] auth:creds: Add python bindings for @@ -1970,10 +1970,10 @@ index 6454ac9ff7c..e5f8122fa21 100644 + creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) -- -2.29.2 +2.31.1 -From 8c748d0fcdd5079402cdf6fc86e8c7b4e0f0b90c Mon Sep 17 00:00:00 2001 +From e04467371cc14f6aa9e19befc387b8e0f2ef1f53 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:31:35 +0200 Subject: [PATCH 015/105] auth:creds: Add @@ -2102,10 +2102,10 @@ index 9cde0000b5f..54e8271471f 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.29.2 +2.31.1 -From 72f28717b09a46482a2f1487946e3a230c33ced3 Mon Sep 17 00:00:00 2001 +From 063f2b6f2f128a513e6ee4506640783657a9cc31 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:32:46 +0200 Subject: [PATCH 016/105] auth:creds: Add python bindings for @@ -2207,10 +2207,10 @@ index e5f8122fa21..8edf13ce6ff 100644 + creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) -- -2.29.2 +2.31.1 -From a688ad98ccd64e740d8be389e1e15d073a9ddada Mon Sep 17 00:00:00 2001 +From bcdc3b4af590e4d80405724cf47c0e97b1fa20a4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:10:52 +0200 Subject: [PATCH 017/105] auth:creds: Add @@ -2341,10 +2341,10 @@ index 54e8271471f..3b86b742448 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.29.2 +2.31.1 -From 029866668c4cd4dda5b32528959a6784d74c604e Mon Sep 17 00:00:00 2001 +From f6cb4cf6c7163849756cca238aecd4065120892a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:38:30 +0200 Subject: [PATCH 018/105] auth:creds: Add python bindings for @@ -2459,10 +2459,10 @@ index 8edf13ce6ff..e0a6248d37a 100644 + creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) -- -2.29.2 +2.31.1 -From 621e40b6196c9f6f5e4400476601153234e86c28 Mon Sep 17 00:00:00 2001 +From 9b64d94eef247bd6f778dac3b32f8daa50c298b5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 11:19:53 +0200 Subject: [PATCH 019/105] auth:creds: Add python bindings for @@ -2587,10 +2587,10 @@ index e0a6248d37a..6187bded0b6 100644 + creds.set_conf(lp) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) -- -2.29.2 +2.31.1 -From 5f1e16203fae87672e62aae1cb117ae91bfb3216 Mon Sep 17 00:00:00 2001 +From d20272910d64fcd380e11ca059060a60d731799e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 08:14:23 +0200 Subject: [PATCH 020/105] auth:creds: Bump library version @@ -2617,10 +2617,10 @@ index 564a04fe8dd..1e3302e3e48 100644 bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', -- -2.29.2 +2.31.1 -From be3dcfd38f21e48dc9bc0fe35be8b95ccb82111b Mon Sep 17 00:00:00 2001 +From 54767e3ac82152bef1c2d8a4231ce498da7ccf1c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 May 2020 11:10:30 +0200 Subject: [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() @@ -2688,10 +2688,10 @@ index bc1f1c3ed25..6038ec11515 100644 void set_cmdline_auth_info_use_ccache(struct user_auth_info *auth_info, bool b) -- -2.29.2 +2.31.1 -From 860f6d0de5bf56a457fdd75f80520741cd30ac77 Mon Sep 17 00:00:00 2001 +From eb90be62d5708553dd2c2da2d2bd305d69676531 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:45:34 +0200 Subject: [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API @@ -2717,10 +2717,10 @@ index 6038ec11515..9c9e2f0ac0f 100644 } -- -2.29.2 +2.31.1 -From 45641219a0dfcd4c0cd02e740086cb249df606eb Mon Sep 17 00:00:00 2001 +From cbb6cfe771e664f6232e0691724a09db714ae50e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 10:40:23 +0200 Subject: [PATCH 023/105] python: Remove unused sign argument from @@ -2772,10 +2772,10 @@ index 1e2c2918ebe..ad60cda0690 100644 smb_dir = '\\'.join([self.lp.get('realm').lower(), 'Policies', 'PolicyDefinitions']) -- -2.29.2 +2.31.1 -From b1851e401118a069e0b34722bd1106f9f7b17105 Mon Sep 17 00:00:00 2001 +From 3a93f116d5a219fef008fe2709e79e134988c31e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 14:02:37 +0200 Subject: [PATCH 024/105] python: Set smb signing via the creds API @@ -2817,10 +2817,10 @@ index cc574e12a42..1781a55a618 100644 for gpo in gpos: if not gpo.file_sys_path: diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py -index a3dc7fb454f..a9e0ba5bc67 100644 +index a629b31d70f..15704459fc1 100644 --- a/python/samba/netcmd/domain_backup.py +++ b/python/samba/netcmd/domain_backup.py -@@ -54,6 +54,7 @@ from subprocess import CalledProcessError +@@ -55,6 +55,7 @@ from subprocess import CalledProcessError from samba import sites from samba.dsdb import _dsdb_load_udv_v2 from samba.ndr import ndr_pack @@ -2828,7 +2828,7 @@ index a3dc7fb454f..a9e0ba5bc67 100644 # work out a SID (based on a free RID) to use when the domain gets restored. -@@ -115,7 +116,14 @@ def smb_sysvol_conn(server, lp, creds): +@@ -113,7 +114,14 @@ def smb_sysvol_conn(server, lp, creds): # the SMB bindings rely on having a s3 loadparm s3_lp = s3param.get_context() s3_lp.load(lp.configfile) @@ -2876,10 +2876,10 @@ index ad60cda0690..0f2f6520fc3 100644 -- -2.29.2 +2.31.1 -From 5689e0f72d3a32b7b76f6c2927c184d8b748c6aa Mon Sep 17 00:00:00 2001 +From 0948c3afb426cbba2f245da1a85eb3c6f31dc91e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:22:12 +0200 Subject: [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC @@ -2977,7 +2977,7 @@ index 1fb1f0127b9..f20146378e3 100644 nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", get_cmdline_auth_info_creds(user_info), diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index 10c1b1d54f2..f578f1c4131 100644 +index 7951543747d..29afbb9ccb5 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c @@ -2482,7 +2482,9 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c @@ -3099,10 +3099,10 @@ index 6cea2ee306c..2241beb331f 100644 if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); -- -2.29.2 +2.31.1 -From eff95f5b430d241d9036be2c899094d1cc3f39b1 Mon Sep 17 00:00:00 2001 +From c3ca4b0ab10a2643ee70a1765505142d3f8abde5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:29:25 +0200 Subject: [PATCH 026/105] s3:pylibsmb: Add ipc=True support for @@ -3164,10 +3164,10 @@ index 3fcc3424a57..3579a040830 100644 #ifdef HAVE_PTHREAD ret = py_cli_state_setup_mt_ev(self); -- -2.29.2 +2.31.1 -From 280ae642e1842fad44b9628130100db98894929f Mon Sep 17 00:00:00 2001 +From 12fbff7317277e1e7f43659268936f9e02b42fe9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 09:47:11 +0200 Subject: [PATCH 027/105] python:tests: Mark libsmb connection as an IPC @@ -3193,10 +3193,10 @@ index ba7440df13b..2c028d381db 100644 DesiredAccess=0x12019f, ShareAccess=0x7, -- -2.29.2 +2.31.1 -From 28843ea17ad1abb916177a25142c7bc57727a7be Mon Sep 17 00:00:00 2001 +From d75ad55c81f1e15f197e8eda1e43a43be6c89f90 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 17 Aug 2020 12:52:39 +0200 Subject: [PATCH 028/105] python:tests: Set smb ipc signing via the creds API @@ -3231,10 +3231,10 @@ index 2c028d381db..d6f5de7440a 100644 DesiredAccess=0x12019f, ShareAccess=0x7, -- -2.29.2 +2.31.1 -From 158e5d6e21515f95daa469ea8bd69d330463e0dd Mon Sep 17 00:00:00 2001 +From 40c2118465404e84368ba6db8a27a68620878b5d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:59:19 +0200 Subject: [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in @@ -3361,10 +3361,10 @@ index d214cdabca4..995187e21b4 100644 void cli_nt_pipes_close(struct cli_state *cli); void cli_shutdown(struct cli_state *cli); -- -2.29.2 +2.31.1 -From ec3033ed2ca61778efaa291e0f3f66e0bbc73a01 Mon Sep 17 00:00:00 2001 +From 6c640b56c8d8ac11b60a5b8e2e55fbe63982cae8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:11:31 +0200 Subject: [PATCH 030/105] s3:client: Turn off smb signing for message op @@ -3394,10 +3394,10 @@ index 1781a55a618..2c00f5349a0 100644 creds.set_smb_signing(saved_signing_state) cache_path = lp.cache_path('gpo_cache') diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py -index a9e0ba5bc67..2977b071ec3 100644 +index 15704459fc1..f441e7407ee 100644 --- a/python/samba/netcmd/domain_backup.py +++ b/python/samba/netcmd/domain_backup.py -@@ -120,7 +120,7 @@ def smb_sysvol_conn(server, lp, creds): +@@ -118,7 +118,7 @@ def smb_sysvol_conn(server, lp, creds): # Force signing for the connection saved_signing_state = creds.get_smb_signing() creds.set_smb_signing(SMB_SIGNING_REQUIRED) @@ -3513,10 +3513,10 @@ index 3579a040830..f8a4d56cf53 100644 NULL, self->ev, "myname", host, NULL, 0, share, "?????", cli_creds, flags, signing_state); -- -2.29.2 +2.31.1 -From 73abea023b529c2c37a4c11875c0fca554ff32ab Mon Sep 17 00:00:00 2001 +From 8ce8cf3ac5b6587609a4772e5272733bb0b2668f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:20:02 +0200 Subject: [PATCH 031/105] s3:libsmb: Remove signing_state from @@ -3612,10 +3612,10 @@ index f8a4d56cf53..c7a2d73afcb 100644 return -1; } -- -2.29.2 +2.31.1 -From 5134d4a361d8984ca62e24679c3b3010106e8819 Mon Sep 17 00:00:00 2001 +From a26fc81d9dd0ee303ffa48dc9ab73cb3f7e059a6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 14:59:14 +0200 Subject: [PATCH 032/105] s3:libsmb: Remove signing_state from @@ -3782,7 +3782,7 @@ index bef04d32638..850cf12c8a6 100644 const char *service, const char *pass, const char *dev, uint16_t *max_xmit, uint16_t *tid); diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index f578f1c4131..906fab2adb5 100644 +index 29afbb9ccb5..adbc0c9db10 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c @@ -2483,8 +2483,7 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c @@ -3983,10 +3983,10 @@ index 954d6eba804..fea066ce468 100644 DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); return NULL; -- -2.29.2 +2.31.1 -From bdcbd317d650b381f71f463941c0779333cea2f2 Mon Sep 17 00:00:00 2001 +From cd8bcd19a3dd5be0cb54df9ecbe43bee13c69763 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 8 Jun 2020 08:04:24 +0200 Subject: [PATCH 033/105] s3:libsmb: Add encryption support to @@ -4200,10 +4200,10 @@ index b24743d789b..abfd18bfaf1 100644 } -- -2.29.2 +2.31.1 -From 9f1dfbc190ba7c83e0197036c102479015f9f416 Mon Sep 17 00:00:00 2001 +From e7e622ffa049878df69bc59002255f89ae6b0b94 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 11:26:00 +0200 Subject: [PATCH 034/105] python: Add a test for SMB encryption @@ -4274,10 +4274,10 @@ index e8f8e7fe94d..81d4e482644 100644 if __name__ == "__main__": import unittest -- -2.29.2 +2.31.1 -From 87985a403abb4ef396d277a1e51a1983cf079875 Mon Sep 17 00:00:00 2001 +From 0b2a5d5372a76ce3d56c12d670f232f22d672bad Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:31:02 +0200 Subject: [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() @@ -4323,10 +4323,10 @@ index b139fb2d0da..5829d891075 100644 } -- -2.29.2 +2.31.1 -From 386fde23e657b1160b890d30e235c003ad3f41ec Mon Sep 17 00:00:00 2001 +From d9db3f116c0afeafaf599df9d48be58ce4b28b98 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:40:13 +0200 Subject: [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() @@ -4682,10 +4682,10 @@ index ec4a516b2ee..61503d0a98b 100644 + vnum='0.7.0', pc_files='smbclient.pc') -- -2.29.2 +2.31.1 -From c228afe71fdaf950790f46a1f497f52198bd77ca Mon Sep 17 00:00:00 2001 +From 93fbea950f6bd5edc1b61c8f069f9518f251f5f0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:43:33 +0200 Subject: [PATCH 037/105] s3:client: Remove unused smb encryption code @@ -4718,10 +4718,10 @@ index f56dc323b6e..16a8d44c069 100644 *output_cli = cli; return NT_STATUS_OK; -- -2.29.2 +2.31.1 -From 421b1bfc7f110787b541976c9bcdf7857bc93dfa Mon Sep 17 00:00:00 2001 +From 47001c60bd87b2da1d2b17838d79ab7f88b0fbd4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:47:05 +0200 Subject: [PATCH 038/105] s3:utils: Remove obsolete force encryption from @@ -4755,10 +4755,10 @@ index 5983ebbd0a5..8fd9fcc5780 100644 } -- -2.29.2 +2.31.1 -From 3f08abb5fa7eaf7785690234b773aee5392c45ac Mon Sep 17 00:00:00 2001 +From 15d7a20de7217b69a1a78081f550fb81082b6629 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:48:18 +0200 Subject: [PATCH 039/105] s3:utils: Remove obsolete force encryption from @@ -4789,10 +4789,10 @@ index 2ac4fde7daf..ef2657e4fa5 100644 NCACN_NP, &ndr_table_mdssvc, -- -2.29.2 +2.31.1 -From 9d67a64586896ea912933f5742225f30399fc401 Mon Sep 17 00:00:00 2001 +From 0b48c264633422fa459b1d59001f0edc743b1aba Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:49:28 +0200 Subject: [PATCH 040/105] s3:utils: Remove obsolete force encryption from @@ -4827,10 +4827,10 @@ index fea066ce468..4ceac7b3ab0 100644 } -- -2.29.2 +2.31.1 -From 33bd60da866aec4212533e72410a9440f7727a33 Mon Sep 17 00:00:00 2001 +From ebecd6b5b125630a3ff9c08f3ef6ffa7137795c0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:51:18 +0200 Subject: [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from @@ -4865,10 +4865,10 @@ index 2ead6cc7ba5..575a42ebf70 100644 memset(cmdline_auth_info.password,'X',sizeof(cmdline_auth_info.password)); #endif -- -2.29.2 +2.31.1 -From 1e5c002e86fd794ee4c972fe9b802b1cc90910cd Mon Sep 17 00:00:00 2001 +From ae3879060ccef1c7bb19cf26505575c164904c2b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 10:58:36 +0200 Subject: [PATCH 042/105] examples: Remove obsolete force encryption from @@ -4903,10 +4903,10 @@ index 6206c3a9701..c64be573462 100644 } -- -2.29.2 +2.31.1 -From a207a4a9f0633c4f658152ef5715a18e655027d2 Mon Sep 17 00:00:00 2001 +From ece6dfebb43ada628fa97965ef834bd4433c3e6d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 11:05:59 +0200 Subject: [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() @@ -4920,7 +4920,7 @@ Reviewed-by: Stefan Metzmacher 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 3cc52cc5ac9..a7230c84db1 100644 +index 2a2509870e3..93b2525b204 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -43,9 +43,9 @@ @@ -4951,10 +4951,10 @@ index 850cf12c8a6..eeabcaa7463 100644 struct cli_state *referring_cli, const char *server, -- -2.29.2 +2.31.1 -From bff823d8817a1f2734e8e3b52a9b7e4f3a964908 Mon Sep 17 00:00:00 2001 +From 0d89aa3c788314a9bf53b9164ec774f5a903261c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 16:16:55 +0200 Subject: [PATCH 044/105] s4:libcli: Return NTSTATUS errors for @@ -5051,10 +5051,10 @@ index 582d43ef173..ad50ae0ac81 100644 return smb_composite_connect_recv(c, mem_ctx); } -- -2.29.2 +2.31.1 -From b48bca36393efebd55a46c59656ea9d2bca592f3 Mon Sep 17 00:00:00 2001 +From 94406c0bf84ff8a3a8bbb55ebedcddcf0f832333 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:54:26 +0200 Subject: [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 @@ -5088,10 +5088,10 @@ index 6ee4929e8d7..51e121bdce6 100644 if (composite_nomem(state, c)) return c; c->private_data = state; -- -2.29.2 +2.31.1 -From 262b7b90d4618ee6b20414b19c3c79831b72a5d9 Mon Sep 17 00:00:00 2001 +From 2b05d3a069d98b49542f14cab802f5a75e04ca43 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:29:39 +0200 Subject: [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() @@ -5141,10 +5141,10 @@ index 6fc3993a4e8..95ff05eac8f 100644 subreq = smb2cli_tcon_send(state, state->ev, -- -2.29.2 +2.31.1 -From dfd9ffca1955efa021aae9b73c9d4aec65d9e7da Mon Sep 17 00:00:00 2001 +From 48998a581ddce11e3eebbd0b16493caa4a891b3b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:44:26 +0200 Subject: [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() @@ -5212,10 +5212,10 @@ index 95ff05eac8f..3a3ecdf20e8 100644 } -- -2.29.2 +2.31.1 -From c5bfb3e621e7a386f64d7e9c9a6eb05905aec4d2 Mon Sep 17 00:00:00 2001 +From 0dab6d1c2f21f01a09f0152a52e0b07b244e680a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 10:18:52 +0200 Subject: [PATCH 048/105] s4:libcli: Require signing for SMB encryption @@ -5268,10 +5268,10 @@ index 3a3ecdf20e8..9540704491e 100644 if (tevent_req_nterror(req, status)) { return tevent_req_post(req, ev); -- -2.29.2 +2.31.1 -From b8406d50c6b52838f14f2e5e29c06919d4949386 Mon Sep 17 00:00:00 2001 +From 7b781fafcb94f3a6e3bccc57b5e75fe5ecc8c30d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 14:27:07 +0200 Subject: [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC @@ -5389,10 +5389,10 @@ index 9938bf53ed6..3246161f0d7 100644 def cmdline(script, *args): -- -2.29.2 +2.31.1 -From bf61849ded5c9a389b0f2a2d4a14ac74e4470852 Mon Sep 17 00:00:00 2001 +From 84fbe5d588f735d7284e652cea18628d0ab4d5e0 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:47:54 +0200 Subject: [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() @@ -5519,10 +5519,10 @@ index d2d62d6652e..4eb45643714 100644 * Return a unique list of security subsystems from those specified in * the list of SASL names. -- -2.29.2 +2.31.1 -From 311a23ab25c306093b4c60fa0113a85ccc875f20 Mon Sep 17 00:00:00 2001 +From 953c1831d397e2699343778244679deeebb3c2b3 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:48:27 +0200 Subject: [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in @@ -5631,10 +5631,10 @@ index 2839082daef..915d9b94f9b 100644 ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs); } -- -2.29.2 +2.31.1 -From b7a4e9531c434b9e120588fa721d96cee73abc27 Mon Sep 17 00:00:00 2001 +From 71f34484b5573e85e2db0e3bcaddca6dea921d75 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:39:15 +0200 Subject: [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a @@ -5681,10 +5681,10 @@ index 4eb45643714..ebcab76999a 100644 const struct gensec_security_ops **new_gensec_list; int i, j, num_mechs_in; -- -2.29.2 +2.31.1 -From 938a5b9a816000ac505aab0d49e0feee5ebc02a7 Mon Sep 17 00:00:00 2001 +From f974fcb76a58515a848e2c94ff43a3a8ab781b98 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:41:43 +0200 Subject: [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to @@ -5755,10 +5755,10 @@ index ebcab76999a..8d1b41fec74 100644 } -- -2.29.2 +2.31.1 -From 634283ed239a5759645ad7e9cf63b723fae4d184 Mon Sep 17 00:00:00 2001 +From 373566a4c0b9f466098edaaca2cb769dc1e77014 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 17:00:45 +0200 Subject: [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel @@ -5792,10 +5792,10 @@ index 8d1b41fec74..3f42d611140 100644 if (gensec_security->settings->backends) { -- -2.29.2 +2.31.1 -From 712f4b7a2f8826f68e9862256bfc1a59eb5e2dfb Mon Sep 17 00:00:00 2001 +From c701769574ddedd0fd22569c72993a79caa28d82 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:21 +0200 Subject: [PATCH 055/105] auth:creds: Add cli_credentials_init_server() @@ -5858,10 +5858,10 @@ index 7d0cf53194b..438bcdce232 100644 bool cli_credentials_wrong_password(struct cli_credentials *cred); const char *cli_credentials_get_password(struct cli_credentials *cred); -- -2.29.2 +2.31.1 -From 589d1ee99d6f4591da90731cd61b3932874a6c96 Mon Sep 17 00:00:00 2001 +From 3b30ef57090aebd30fa48e671025a11f1f0aba6e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:36 +0200 Subject: [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() @@ -5906,10 +5906,10 @@ index 084857a44bf..e64148ef788 100644 call->event_ctx, imsg_ctx, -- -2.29.2 +2.31.1 -From 0be08bb35342640aab826b8ba5a17a270170a7c4 Mon Sep 17 00:00:00 2001 +From c9b1c8897ddd39045c45b75c63f7344fcd35ee92 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 7 Sep 2020 09:19:43 +0200 Subject: [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for @@ -6006,10 +6006,10 @@ index 4aaaf46793b..c433eb194bd 100644 req->smb_conn->negotiate.server_credentials = talloc_steal(req->smb_conn, server_credentials); -- -2.29.2 +2.31.1 -From db71a0fa865cdd7339121f91a1e490289ada14f8 Mon Sep 17 00:00:00 2001 +From 190f1455e2e783ac0590ef3317724c7210f5a1ef Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:22 +0200 Subject: [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb @@ -6057,10 +6057,10 @@ index c15057fa80b..aeebf303c9b 100755 [tmpguest] path = $shrdir -- -2.29.2 +2.31.1 -From 9adc33b7364d8a7bce384d5a17de8a450ad8c642 Mon Sep 17 00:00:00 2001 +From e875960f0c9dd06faa1bc685bb477b4aa2df36ab Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 12:30:08 +0200 Subject: [PATCH 059/105] selftest: Move enc_desired to provision to have it in @@ -6104,10 +6104,10 @@ index aeebf303c9b..7873692b8ec 100755 my $net = Samba::bindir_path($self, "net"); -- -2.29.2 +2.31.1 -From 79f57ea590227441e510113863740bea6643c942 Mon Sep 17 00:00:00 2001 +From bbfa3bd50d5c7ba3e810e4dd4c44694b045e4889 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:20 +0200 Subject: [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb @@ -6228,10 +6228,10 @@ index 00000000000..9a717cdac4f + +testok $0 $failed diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py -index 47e914b1009..61a5b3e1cbd 100755 +index 90bda2052af..26d8c2230b6 100755 --- a/source3/selftest/tests.py +++ b/source3/selftest/tests.py -@@ -1043,6 +1043,12 @@ plantestsuite("samba3.blackbox.smbclient.encryption_off", "simpleserver", +@@ -1047,6 +1047,12 @@ plantestsuite("samba3.blackbox.smbclient.encryption_off", "simpleserver", "$USERNAME", "$PASSWORD", "$SERVER", smbclient3]) @@ -6245,10 +6245,10 @@ index 47e914b1009..61a5b3e1cbd 100755 [os.path.join(samba3srcdir, "script/tests/test_rpcclient_netsessenum.sh"), -- -2.29.2 +2.31.1 -From adb9139bb935553b9cf5f1201129eea563afa931 Mon Sep 17 00:00:00 2001 +From 76ca7b477dc739777b01322f3225cd1b6f8ca97e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:19:27 +0200 Subject: [PATCH 061/105] s3:client: Remove global smb_encrypt @@ -6353,10 +6353,10 @@ index 56309efcea7..60d4fb3c5ee 100644 max_protocol = lp_client_max_protocol(); -- -2.29.2 +2.31.1 -From 0babfdb10e32d729f8750096126c8ea117cb2f8a Mon Sep 17 00:00:00 2001 +From 402b5cd6e6a8b541d6bdf6494692c36f924ee6c9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:24:27 +0200 Subject: [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() @@ -6466,10 +6466,10 @@ index 1b8f2a4e97a..0fd31ef3d5a 100644 NULL, 0, 0x20, &cli_ipc); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index a7230c84db1..f190698b38d 100644 +index 93b2525b204..13613afb6e7 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -383,7 +383,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +@@ -407,7 +407,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, const char *server, const char *share, const struct user_auth_info *auth_info, @@ -6477,7 +6477,7 @@ index a7230c84db1..f190698b38d 100644 int max_protocol, const struct sockaddr_storage *dest_ss, int port, -@@ -393,6 +392,8 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +@@ -417,6 +416,8 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, /* Try to reuse an existing connection in this list. */ struct cli_state *c = cli_cm_find(referring_cli, server, share); NTSTATUS status; @@ -6486,7 +6486,7 @@ index a7230c84db1..f190698b38d 100644 if (c) { *pcli = c; -@@ -962,7 +963,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, +@@ -986,7 +987,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, smbXcli_conn_remote_name(rootcli->conn), "IPC$", dfs_auth_info, @@ -6507,10 +6507,10 @@ index eeabcaa7463..bb3e9e6874e 100644 const struct sockaddr_storage *dest_ss, int port, -- -2.29.2 +2.31.1 -From 099ce3bae15197294b1cb6e136bb3fc35ab64f43 Mon Sep 17 00:00:00 2001 +From eb6b9b3fe6bde3544347b50b8576986b9f4635fb Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:26:39 +0200 Subject: [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() @@ -6523,10 +6523,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index f190698b38d..7f2faee94bb 100644 +index 13613afb6e7..9e5c9e57e74 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -287,7 +287,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, +@@ -311,7 +311,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, const char *server, const char *share, const struct user_auth_info *auth_info, @@ -6534,7 +6534,7 @@ index f190698b38d..7f2faee94bb 100644 int max_protocol, const struct sockaddr_storage *dest_ss, int port, -@@ -296,6 +295,8 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, +@@ -320,6 +319,8 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, { struct cli_state *cli = NULL; NTSTATUS status; @@ -6543,7 +6543,7 @@ index f190698b38d..7f2faee94bb 100644 status = do_connect(ctx, server, share, auth_info, -@@ -392,8 +393,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +@@ -416,8 +417,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, /* Try to reuse an existing connection in this list. */ struct cli_state *c = cli_cm_find(referring_cli, server, share); NTSTATUS status; @@ -6552,7 +6552,7 @@ index f190698b38d..7f2faee94bb 100644 if (c) { *pcli = c; -@@ -414,7 +413,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +@@ -438,7 +437,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, server, share, auth_info, @@ -6560,7 +6560,7 @@ index f190698b38d..7f2faee94bb 100644 max_protocol, dest_ss, port, -@@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, +@@ -1044,7 +1042,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, dfs_refs[count].server, dfs_refs[count].share, dfs_auth_info, @@ -6569,10 +6569,10 @@ index f190698b38d..7f2faee94bb 100644 NULL, /* dest_ss */ 0, /* port */ -- -2.29.2 +2.31.1 -From f469d4511115bd0a707a8a05e4ef575bd8fdffd0 Mon Sep 17 00:00:00 2001 +From d9c3cbc0ea5d33a42e4d213b0caa5d39585b46a2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:28:28 +0200 Subject: [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs @@ -6586,10 +6586,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 7f2faee94bb..e81d86ae059 100644 +index 9e5c9e57e74..c5b79bb37dd 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, +@@ -131,7 +131,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, const char *server, const char *share, const struct user_auth_info *auth_info, @@ -6597,7 +6597,7 @@ index 7f2faee94bb..e81d86ae059 100644 int max_protocol, const struct sockaddr_storage *dest_ss, int port, -@@ -123,6 +122,8 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, +@@ -147,6 +146,8 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, enum protocol_types protocol = PROTOCOL_NONE; int signing_state = get_cmdline_auth_info_signing_state(auth_info); struct cli_credentials *creds = NULL; @@ -6606,7 +6606,7 @@ index 7f2faee94bb..e81d86ae059 100644 if (force_encrypt) { signing_state = SMB_SIGNING_REQUIRED; -@@ -233,7 +234,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, +@@ -267,7 +268,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, cli_shutdown(c); return do_connect(ctx, newserver, newshare, auth_info, @@ -6615,7 +6615,7 @@ index 7f2faee94bb..e81d86ae059 100644 NULL, port, name_type, pcli); } -@@ -295,12 +296,10 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, +@@ -319,12 +320,10 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, { struct cli_state *cli = NULL; NTSTATUS status; @@ -6630,10 +6630,10 @@ index 7f2faee94bb..e81d86ae059 100644 if (!NT_STATUS_IS_OK(status)) { -- -2.29.2 +2.31.1 -From 787d8a2976a642b2ae175e41290990a8908a6d6a Mon Sep 17 00:00:00 2001 +From 9848ab05ef48882218cf1ca2a4e9ddf74d18504f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:52:11 +0200 Subject: [PATCH 065/105] s3:libsmb: Remove force_encrypt from @@ -6649,10 +6649,10 @@ Reviewed-by: Jeremy Allison 3 files changed, 13 insertions(+), 11 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index e81d86ae059..a4caf807856 100644 +index c5b79bb37dd..8fb450b5327 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -230,7 +230,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, +@@ -264,7 +264,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, if (smbXcli_conn_dfs_supported(c->conn) && cli_check_msdfs_proxy(ctx, c, sharename, &newserver, &newshare, @@ -6661,7 +6661,7 @@ index e81d86ae059..a4caf807856 100644 cli_shutdown(c); return do_connect(ctx, newserver, newshare, auth_info, -@@ -1176,7 +1176,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, +@@ -1200,7 +1200,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, const char *sharename, char **pp_newserver, char **pp_newshare, @@ -6669,7 +6669,7 @@ index e81d86ae059..a4caf807856 100644 struct cli_credentials *creds) { struct client_dfs_referral *refs = NULL; -@@ -1188,6 +1187,8 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, +@@ -1212,6 +1211,8 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, char *newextrapath = NULL; NTSTATUS status; const char *remote_name; @@ -6678,7 +6678,7 @@ index e81d86ae059..a4caf807856 100644 if (!cli || !sharename) { return false; -@@ -1223,12 +1224,18 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, +@@ -1247,12 +1248,18 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, return false; } @@ -6729,10 +6729,10 @@ index bb3e9e6874e..f2b0a8c5ff8 100644 /* The following definitions come from libsmb/clientgen.c */ -- -2.29.2 +2.31.1 -From 7bbe38b45690781e6fe110a10bb5f63b3af21009 Mon Sep 17 00:00:00 2001 +From 0c6fd4334f82cace19124e9e4887372cefeb3891 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:15:09 +0200 Subject: [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs @@ -6756,10 +6756,10 @@ index 972096bdc8b..00000000000 -^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver -^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index a4caf807856..29177cbb6f3 100644 +index 8fb450b5327..396856842aa 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -106,7 +106,7 @@ static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, +@@ -130,7 +130,7 @@ static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, static NTSTATUS do_connect(TALLOC_CTX *ctx, const char *server, const char *share, @@ -6768,7 +6768,7 @@ index a4caf807856..29177cbb6f3 100644 int max_protocol, const struct sockaddr_storage *dest_ss, int port, -@@ -120,12 +120,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, +@@ -144,12 +144,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, NTSTATUS status; int flags = 0; enum protocol_types protocol = PROTOCOL_NONE; @@ -6786,7 +6786,7 @@ index a4caf807856..29177cbb6f3 100644 signing_state = SMB_SIGNING_REQUIRED; } -@@ -192,13 +192,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, +@@ -216,13 +216,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, smb2cli_conn_set_max_credits(c->conn, DEFAULT_SMB2_MAX_CREDITS); } @@ -6802,18 +6802,9 @@ index a4caf807856..29177cbb6f3 100644 cli_credentials_authentication_requested(creds) || cli_credentials_is_anonymous(creds) || !NT_STATUS_IS_OK(status = cli_session_setup_anon(c))) -@@ -233,7 +232,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - creds)) { - cli_shutdown(c); - return do_connect(ctx, newserver, -- newshare, auth_info, -+ newshare, creds, - max_protocol, - NULL, port, name_type, pcli); - } -@@ -247,13 +246,19 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - return status; - } +@@ -246,13 +245,19 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + + DEBUG(4,(" session setup ok\n")); - if (force_encrypt) { + if (encryption_state >= SMB_ENCRYPTION_DESIRED) { @@ -6834,7 +6825,16 @@ index a4caf807856..29177cbb6f3 100644 } } -@@ -295,10 +300,11 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, +@@ -267,7 +272,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + creds)) { + cli_shutdown(c); + return do_connect(ctx, newserver, +- newshare, auth_info, ++ newshare, creds, + max_protocol, + NULL, port, name_type, pcli); + } +@@ -319,10 +324,11 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, struct cli_state **pcli) { struct cli_state *cli = NULL; @@ -6848,10 +6848,10 @@ index a4caf807856..29177cbb6f3 100644 dest_ss, port, name_type, &cli); -- -2.29.2 +2.31.1 -From 8b391c8c45ce09498ed16908943a9e6639bb7b00 Mon Sep 17 00:00:00 2001 +From 8846652624edc546bc5588d3aa0905e3f43db637 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:18:16 +0200 Subject: [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() @@ -6864,10 +6864,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 29177cbb6f3..316786f99ca 100644 +index 396856842aa..e17c0b875fd 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -292,7 +292,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, +@@ -316,7 +316,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, struct cli_state *referring_cli, const char *server, const char *share, @@ -6876,7 +6876,7 @@ index 29177cbb6f3..316786f99ca 100644 int max_protocol, const struct sockaddr_storage *dest_ss, int port, -@@ -300,7 +300,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, +@@ -324,7 +324,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, struct cli_state **pcli) { struct cli_state *cli = NULL; @@ -6884,7 +6884,7 @@ index 29177cbb6f3..316786f99ca 100644 NTSTATUS status; status = do_connect(ctx, server, share, -@@ -397,6 +396,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +@@ -421,6 +420,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, { /* Try to reuse an existing connection in this list. */ struct cli_state *c = cli_cm_find(referring_cli, server, share); @@ -6892,7 +6892,7 @@ index 29177cbb6f3..316786f99ca 100644 NTSTATUS status; if (c) { -@@ -417,7 +417,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +@@ -441,7 +441,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, referring_cli, server, share, @@ -6901,7 +6901,7 @@ index 29177cbb6f3..316786f99ca 100644 max_protocol, dest_ss, port, -@@ -886,6 +886,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, +@@ -910,6 +910,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, struct smbXcli_tcon *root_tcon = NULL; struct smbXcli_tcon *target_tcon = NULL; struct cli_dfs_path_split *dfs_refs = NULL; @@ -6909,7 +6909,7 @@ index 29177cbb6f3..316786f99ca 100644 if ( !rootcli || !path || !targetcli ) { return NT_STATUS_INVALID_PARAMETER; -@@ -1022,7 +1023,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, +@@ -1046,7 +1047,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, status = cli_cm_connect(ctx, rootcli, dfs_refs[count].server, dfs_refs[count].share, @@ -6919,10 +6919,10 @@ index 29177cbb6f3..316786f99ca 100644 NULL, /* dest_ss */ 0, /* port */ -- -2.29.2 +2.31.1 -From e7b69b7c59c19bd835655d2da1b655ec600d8f70 Mon Sep 17 00:00:00 2001 +From 9abf11b2475cf7e46840b64025ccdc2a0d3c6dbb Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:26:54 +0200 Subject: [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() @@ -7045,10 +7045,10 @@ index 0fd31ef3d5a..943f7498e8c 100644 NULL, 0, 0x20, &cli_ipc); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 316786f99ca..8e404ab1d57 100644 +index e17c0b875fd..5b04b63634f 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -384,19 +384,18 @@ static struct cli_state *cli_cm_find(struct cli_state *cli, +@@ -408,19 +408,18 @@ static struct cli_state *cli_cm_find(struct cli_state *cli, ****************************************************************************/ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, @@ -7077,7 +7077,7 @@ index 316786f99ca..8e404ab1d57 100644 NTSTATUS status; if (c) { -@@ -404,11 +403,11 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +@@ -428,11 +427,11 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, return NT_STATUS_OK; } @@ -7091,7 +7091,7 @@ index 316786f99ca..8e404ab1d57 100644 server, share ); return NT_STATUS_INVALID_PARAMETER; } -@@ -966,7 +965,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, +@@ -990,7 +989,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, rootcli, smbXcli_conn_remote_name(rootcli->conn), "IPC$", @@ -7130,10 +7130,10 @@ index f2b0a8c5ff8..0b8cf2a6036 100644 struct client_dfs_referral; NTSTATUS cli_dfs_get_referral_ex(TALLOC_CTX *ctx, -- -2.29.2 +2.31.1 -From e506eaca259328d78c8dd971738c20944f920d48 Mon Sep 17 00:00:00 2001 +From 16840d117c536de77b21e453c66f25d23871c4e0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:42:25 +0200 Subject: [PATCH 069/105] s3:libsmb: Pass cli_credentials to @@ -7690,10 +7690,10 @@ index c54b5065b44..13e48f80a01 100644 if (!NT_STATUS_IS_OK(status)) { goto cleanup; diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 8e404ab1d57..6e492fc522c 100644 +index 5b04b63634f..b4b8057ed2f 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -859,7 +859,7 @@ struct cli_dfs_path_split { +@@ -883,7 +883,7 @@ struct cli_dfs_path_split { NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, const char *mountpt, @@ -7702,7 +7702,7 @@ index 8e404ab1d57..6e492fc522c 100644 struct cli_state *rootcli, const char *path, struct cli_state **targetcli, -@@ -885,7 +885,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, +@@ -909,7 +909,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, struct smbXcli_tcon *root_tcon = NULL; struct smbXcli_tcon *target_tcon = NULL; struct cli_dfs_path_split *dfs_refs = NULL; @@ -7710,7 +7710,7 @@ index 8e404ab1d57..6e492fc522c 100644 if ( !rootcli || !path || !targetcli ) { return NT_STATUS_INVALID_PARAMETER; -@@ -1130,7 +1129,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, +@@ -1154,7 +1153,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, if (!strequal(*pp_targetpath, "\\") && !strequal(*pp_targetpath, "/")) { status = cli_resolve_path(ctx, newmount, @@ -8017,10 +8017,10 @@ index 8fd9fcc5780..4989ec633c3 100644 filename, &targetcli, -- -2.29.2 +2.31.1 -From d6f6b5eb7fe635caaf143b04af053c492e4251f5 Mon Sep 17 00:00:00 2001 +From 6b3a5bdb98434cb3eb88c5b9eec2b9ebc4ed79ba Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:40:49 +0200 Subject: [PATCH 070/105] s3:client: Remove global max_protocol @@ -8099,10 +8099,10 @@ index 13e48f80a01..902cdec8b64 100644 if (cmdstr) process_command_string(cmdstr); -- -2.29.2 +2.31.1 -From 012de005d6bb319d47bdb4c281c910820b3eb71a Mon Sep 17 00:00:00 2001 +From 067e4f27e24f874ebcce497851337905b48ee7e2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:43:46 +0200 Subject: [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() @@ -8183,10 +8183,10 @@ index 943f7498e8c..3f4e188b396 100644 if (!NT_STATUS_IS_OK(status)) { cli_ipc = NULL; diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 6e492fc522c..d659040693e 100644 +index b4b8057ed2f..eb7da18c5ce 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -388,7 +388,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +@@ -412,7 +412,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, const char *server, const char *share, struct cli_credentials *creds, @@ -8194,7 +8194,7 @@ index 6e492fc522c..d659040693e 100644 const struct sockaddr_storage *dest_ss, int port, int name_type, -@@ -417,7 +416,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +@@ -441,7 +440,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, server, share, creds, @@ -8203,7 +8203,7 @@ index 6e492fc522c..d659040693e 100644 dest_ss, port, name_type, -@@ -965,7 +964,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, +@@ -989,7 +988,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, smbXcli_conn_remote_name(rootcli->conn), "IPC$", creds, @@ -8224,10 +8224,10 @@ index 517738dbcd7..8aaaff2cb1e 100644 int port, int name_type, -- -2.29.2 +2.31.1 -From f5861c11522b199a506e931d8d60f61a4667f9a6 Mon Sep 17 00:00:00 2001 +From d2a07db0250e067d07adf69fee78c88ce51baf88 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:45:12 +0200 Subject: [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() @@ -8240,10 +8240,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index d659040693e..a76f97203ee 100644 +index eb7da18c5ce..88faf22507e 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -293,7 +293,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, +@@ -317,7 +317,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, const char *server, const char *share, struct cli_credentials *creds, @@ -8251,7 +8251,7 @@ index d659040693e..a76f97203ee 100644 const struct sockaddr_storage *dest_ss, int port, int name_type, -@@ -304,7 +303,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, +@@ -328,7 +327,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, status = do_connect(ctx, server, share, creds, @@ -8260,7 +8260,7 @@ index d659040693e..a76f97203ee 100644 dest_ss, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -416,7 +415,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +@@ -440,7 +439,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, server, share, creds, @@ -8268,7 +8268,7 @@ index d659040693e..a76f97203ee 100644 dest_ss, port, name_type, -@@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, +@@ -1044,7 +1042,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, dfs_refs[count].server, dfs_refs[count].share, creds, @@ -8277,10 +8277,10 @@ index d659040693e..a76f97203ee 100644 0, /* port */ 0x20, -- -2.29.2 +2.31.1 -From a5e1b39df83ebd300fbc3ac1022468e944dc90d5 Mon Sep 17 00:00:00 2001 +From bfaa7e48c302ceee9080d5f3fe640950a4a9a6c7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:46:29 +0200 Subject: [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs @@ -8296,10 +8296,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index a76f97203ee..286ca41fd71 100644 +index 88faf22507e..2c2e77b685a 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c -@@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, +@@ -131,7 +131,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, const char *server, const char *share, struct cli_credentials *creds, @@ -8307,7 +8307,7 @@ index a76f97203ee..286ca41fd71 100644 const struct sockaddr_storage *dest_ss, int port, int name_type, -@@ -167,14 +166,11 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, +@@ -191,14 +190,11 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, return status; } @@ -8323,7 +8323,7 @@ index a76f97203ee..286ca41fd71 100644 if (!NT_STATUS_IS_OK(status)) { d_printf("protocol negotiation failed: %s\n", -@@ -233,7 +229,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, +@@ -273,7 +269,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, cli_shutdown(c); return do_connect(ctx, newserver, newshare, creds, @@ -8331,7 +8331,7 @@ index a76f97203ee..286ca41fd71 100644 NULL, port, name_type, pcli); } -@@ -303,7 +298,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, +@@ -327,7 +322,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, status = do_connect(ctx, server, share, creds, @@ -8340,10 +8340,10 @@ index a76f97203ee..286ca41fd71 100644 if (!NT_STATUS_IS_OK(status)) { -- -2.29.2 +2.31.1 -From 82163b46808648c22c57f69cdf03d9ff9bcfe3e4 Mon Sep 17 00:00:00 2001 +From a87be8325e17a16f8e89f9ff7f12c79212a5645f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Aug 2020 15:47:35 +0200 Subject: [PATCH 074/105] s3:include: Move loadparm prototypes to own header @@ -8758,10 +8758,10 @@ index 00000000000..7686877ccf1 + +#endif /* _S3_LOADPARM_H */ -- -2.29.2 +2.31.1 -From a9365a42a95633e4b479c4126368b9e3e3368ba5 Mon Sep 17 00:00:00 2001 +From d06b27b2344875cc2bfa77d5438d9543f215b233 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 11 Aug 2020 10:41:07 +0200 Subject: [PATCH 075/105] s3:lib: Move interface prototypes to own header file @@ -8864,10 +8864,10 @@ index 00000000000..f45435b4a81 + +#endif /* _INTERFACE_H */ -- -2.29.2 +2.31.1 -From 358074c6edc583521865538926dbcd96b1c541e6 Mon Sep 17 00:00:00 2001 +From 7e2cbeddea7398a3bf98e70bf0bd0cc8f8631dfd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:16 +0100 Subject: [PATCH 076/105] idl: Add SID_SAMBA_SMB3 @@ -8894,10 +8894,10 @@ index a92e8f1518e..06bf7449a70 100644 const string NAME_NT_SERVICE = "NT SERVICE"; -- -2.29.2 +2.31.1 -From 118cf8e5df14da9654950af2ce613b00904b6c3f Mon Sep 17 00:00:00 2001 +From 7c3c02fa82ad5463ac586066c64eb56481f121d2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:29 +0100 Subject: [PATCH 077/105] s3:smbd: Add SMB3 connection information to session @@ -9051,10 +9051,10 @@ index cf9de185c1f..cd24b7d2ed5 100644 } -- -2.29.2 +2.31.1 -From abfbb9d7e1968f8b6c3687e1057c8efc4d91cc82 Mon Sep 17 00:00:00 2001 +From 545e659f4be06d90c3d201e300a6ba66879f4d54 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Mar 2020 14:11:56 +0100 Subject: [PATCH 078/105] librpc: Add dcerpc helper @@ -9267,10 +9267,10 @@ index 27b180fa63d..109a1834841 100644 source='gen_ndr/ndr_winbind.c', public_deps='ndr NDR_LSA' -- -2.29.2 +2.31.1 -From bf5a114f7d5a6772de3a6ca6b17bbef3237a0815 Mon Sep 17 00:00:00 2001 +From edf4ad5bfc2e78acfe506bb273d1170331836091 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 28 Aug 2020 16:31:17 +0200 Subject: [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' @@ -9304,10 +9304,10 @@ index d51a3de9497..785cbb23b5f 100644 char smb3_sid_str[SID_MAX_SIZE]; struct dom_sid smb3_dom_sid; -- -2.29.2 +2.31.1 -From 8fe707228fa12164b4c43740a2a6909650cd39b0 Mon Sep 17 00:00:00 2001 +From 59ce51b4e559b9b376e90a0c2244c879f6251881 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 12 Nov 2019 16:56:45 +0100 Subject: [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords @@ -9541,10 +9541,10 @@ index 2af02ad6fa8..eb91ac09384 100644 bld.SAMBA3_SUBSYSTEM('RPC_SPOOLSS', source='''spoolss/srv_spoolss_nt.c -- -2.29.2 +2.31.1 -From aa7b608747e1735b4edafe18ec06ddfaf5530067 Mon Sep 17 00:00:00 2001 +From 9301741e90f81ba99442c9b56f763ed79c2072f7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 15 Nov 2019 13:49:40 +0100 Subject: [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords @@ -9672,10 +9672,10 @@ index de55ad6239a..c9c1978f223 100644 -- -2.29.2 +2.31.1 -From b4708a9ee2133cc5b5159246add53f785bea0952 Mon Sep 17 00:00:00 2001 +From 0491de23f74496546f8e046d17c2d35a982f542a Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:45:49 +0200 Subject: [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips @@ -9730,10 +9730,10 @@ index 32b946eee8f..ad18d3ada0f 100644 }; -- -2.29.2 +2.31.1 -From 99dc2113b90c7852fdd30aa9037a965331d68b71 Mon Sep 17 00:00:00 2001 +From 4d7d990e7b2f025afbd9681de98cc888670636e7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 28 Oct 2020 17:05:36 +0100 Subject: [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam @@ -9786,10 +9786,10 @@ index 4023fac4dd6..e15592b5743 100644 }; -- -2.29.2 +2.31.1 -From e3de8e62a904f3f8d5d5aebef3c3c0f71f287bc8 Mon Sep 17 00:00:00 2001 +From 12e7ec664999bc03bd34c5d1636a13baef13d438 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 Subject: [PATCH 084/105] python:tests: Add SAMR password change tests for fips @@ -10011,10 +10011,10 @@ index 3246161f0d7..4f164db9c73 100644 def cmdline(script, *args): -- -2.29.2 +2.31.1 -From 08e686dd19925a62aaa98f3a558dc933bea83463 Mon Sep 17 00:00:00 2001 +From e93db2d240339ae9b6ec7b579e4a6bc2bedc77d2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 Subject: [PATCH 085/105] python:tests: Add SAMR password change tests for fips @@ -10044,10 +10044,10 @@ index 77bd741d476..1ae9fb9d996 100755 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n"); return undef; -- -2.29.2 +2.31.1 -From 8f5ee560b92a607a5e28bf3b164a034226badfaf Mon Sep 17 00:00:00 2001 +From 3fa184ebdae4f84fee5231ca46e0c52c09b5a425 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 09:40:41 +0200 Subject: [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values @@ -10786,10 +10786,10 @@ index 07c6faebb15..701dfc10a07 100644 torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); } -- -2.29.2 +2.31.1 -From 7bafd2824cb87ce6999b502d97217f1581acae97 Mon Sep 17 00:00:00 2001 +From c71b681c5dcdea518411c4bebfbdb5f72c89c6c8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Sep 2020 12:32:28 +0200 Subject: [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test @@ -11083,10 +11083,10 @@ index 38b6c8f4b6e..f0ab0357986 100644 ../../dsdb/schema/tests/schema_syntax.c ../../../lib/util/tests/anonymous_shared.c -- -2.29.2 +2.31.1 -From 3d8041a90cc293c52989e4fa25ea7b66209d036f Mon Sep 17 00:00:00 2001 +From 4115d47379781fe319c36fd6452188c6430ccd08 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:09:05 +0200 Subject: [PATCH 088/105] Add smb2cli_session_get_encryption_cipher() @@ -11104,7 +11104,7 @@ Reviewed-by: Alexander Bokovoy 2 files changed, 14 insertions(+) diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c -index 4909797543c..1be3a5506a0 100644 +index bcb601dde59..91c670706fc 100644 --- a/libcli/smb/smbXcli_base.c +++ b/libcli/smb/smbXcli_base.c @@ -6461,6 +6461,19 @@ NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session) @@ -11128,10 +11128,10 @@ index 4909797543c..1be3a5506a0 100644 { struct smbXcli_tcon *tcon; diff --git a/libcli/smb/smbXcli_base.h b/libcli/smb/smbXcli_base.h -index 2afc7165cd9..db5f5d58799 100644 +index 4452cd808ea..247bac98904 100644 --- a/libcli/smb/smbXcli_base.h +++ b/libcli/smb/smbXcli_base.h -@@ -518,6 +518,7 @@ NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session, +@@ -527,6 +527,7 @@ NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session, const DATA_BLOB channel_key, const struct iovec *recv_iov); NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session); @@ -11140,10 +11140,10 @@ index 2afc7165cd9..db5f5d58799 100644 struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx); struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx, -- -2.29.2 +2.31.1 -From f7f374387cf30bf0811bcd83e12c0eb26c917ff8 Mon Sep 17 00:00:00 2001 +From e770fc65ac9c1dfc35619b0863ebaabc43b1412c Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:18:21 +0200 Subject: [PATCH 089/105] Add dcerpc_transport_encrypted() @@ -11232,10 +11232,10 @@ index bd79a072bc8..6ea27a8d9a3 100644 create a secondary context from a primary connection -- -2.29.2 +2.31.1 -From 46419d69586855c3df51ec79f0dd0b852912901c Mon Sep 17 00:00:00 2001 +From 12b3bcec468fc71b9567b85ebba3a18e5b8fb4d5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:35:01 +0200 Subject: [PATCH 090/105] Add py binding for dcerpc_transport_encrypted @@ -11279,10 +11279,10 @@ index be914ed5f14..309a6d72e26 100644 }; -- -2.29.2 +2.31.1 -From df9e9ab494b224679d90af041d4b23ce082b1b5f Mon Sep 17 00:00:00 2001 +From 4d040fa848f1c71713b5e07594ab888f15dad5ec Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:44:08 +0200 Subject: [PATCH 091/105] selftest: add a test for py dce transport_encrypted @@ -11344,10 +11344,10 @@ index 8e0d6a5ef0a..24e4ac77d89 100644 objectAttr = lsa.ObjectAttribute() objectAttr.sec_qos = lsa.QosInfo() -- -2.29.2 +2.31.1 -From e2ee83d423afb38255e4e7bf042c5eafbaa476d3 Mon Sep 17 00:00:00 2001 +From 1e8f32667d93cd81df68eb43de6a882fdd4e025e Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:47:12 +0200 Subject: [PATCH 092/105] Add CreateTrustedDomainRelax wrapper for fips mode @@ -11430,10 +11430,10 @@ index 00000000000..b4df0fa5bb8 + + return lsaconn.CreateTrustedDomainEx2(policy, trust_info, auth_info, mask) -- -2.29.2 +2.31.1 -From 25d7ca94cb6adb3142dcbf02115562f366ce6632 Mon Sep 17 00:00:00 2001 +From 5569a217d2778a16d0c2364b1fecf6ad327fa441 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:49:17 +0200 Subject: [PATCH 093/105] Use the new CreateTrustedDomainRelax() @@ -11537,10 +11537,10 @@ index 1d12c362911..93a3258d28d 100644 if enc_types: self.outf.write("Setting supported encryption types on local TDO.\n") -- -2.29.2 +2.31.1 -From 37eddec853ef26cd87dc21c2424a9aa565a350b7 Mon Sep 17 00:00:00 2001 +From 38f2363fea820551563398ee378aa84227274424 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 1 Sep 2020 20:14:29 +0300 Subject: [PATCH 094/105] selftest: add a test for the CreateTrustedDomainRelax @@ -11707,7 +11707,7 @@ index 00000000000..80effda8343 @@ -0,0 +1 @@ +^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py -index 258c9122edc..18b671d0f29 100755 +index e16e64fb2f0..6e08e2e92e4 100755 --- a/source4/selftest/tests.py +++ b/source4/selftest/tests.py @@ -705,6 +705,10 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex @@ -11722,10 +11722,10 @@ index 258c9122edc..18b671d0f29 100755 # Right now ad_dc has mdb and ad_dc_ntvfs has tdb mdb_testenv = "ad_dc" -- -2.29.2 +2.31.1 -From 809a40543a137ede5d5d4ad7b87de5472e6855a8 Mon Sep 17 00:00:00 2001 +From 17e68dee20fcabf2764809ea25beeca7b522434f Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 5 Nov 2020 15:38:19 +0200 Subject: [PATCH 095/105] Remove source4/scripting/devel/createtrust script @@ -11877,10 +11877,10 @@ index 26b0d0dcb68..00000000000 - auth_info, - security.SEC_STD_DELETE) -- -2.29.2 +2.31.1 -From 291cf61ae4eeefe061f2a0c13d8fedc58d5a6901 Mon Sep 17 00:00:00 2001 +From 8858b3bdc6e63a91f1d4d756cb0007d2394361f7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:30:26 +0100 Subject: [PATCH 096/105] s3:rpc_server: Use gnutls_cipher_decrypt() in @@ -11909,10 +11909,10 @@ index 198387424e6..e749caf2551 100644 auth_blob->length); gnutls_cipher_deinit(cipher_hnd); -- -2.29.2 +2.31.1 -From abe5d5910739da48f3684f455e29c45a1e5772ce Mon Sep 17 00:00:00 2001 +From 07c786c60b88cec84e2246f6515443f20a4aa8ed Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:33:38 +0100 Subject: [PATCH 097/105] s4:rpc_server: Use gnutls_cipher_decrypt() in @@ -11941,10 +11941,10 @@ index 8333cb149b6..4bb8aaa9592 100644 auth_blob->length); gnutls_cipher_deinit(cipher_hnd); -- -2.29.2 +2.31.1 -From 86def665c392f613f7b37a854487bf4037e1f8e0 Mon Sep 17 00:00:00 2001 +From f6d6dd2a5fbd754036bd4ac1a41f252ca36e2180 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:40:21 +0200 Subject: [PATCH 098/105] s3:rpc_server: Allow to use RC4 for creating trusts @@ -12008,10 +12008,10 @@ index e749caf2551..d6d606ddeca 100644 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; -- -2.29.2 +2.31.1 -From 4a7c7876ca2c67b02e4fec6c35e829126de0b740 Mon Sep 17 00:00:00 2001 +From e0f3eb1f42974944b99b67279c476e4ef4de3b3b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:51:39 +0200 Subject: [PATCH 099/105] s4:rpc_server: Allow to use RC4 for creating trusts @@ -12080,10 +12080,10 @@ index 4bb8aaa9592..5b3ef71d458 100644 nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; -- -2.29.2 +2.31.1 -From 345e9b4bd3983356474311cc878db89e4657cdf2 Mon Sep 17 00:00:00 2001 +From 6bd9116afeb5be59a6701a2dc349c5bcb78c91f6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 10:13:48 +0100 Subject: [PATCH 100/105] sefltest: Enable the dcerpc.createtrustrelax test @@ -12110,10 +12110,10 @@ index 80effda8343..00000000000 @@ -1 +0,0 @@ -^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) -- -2.29.2 +2.31.1 -From f0ac7a131e942175295ab471b44b662216a346b6 Mon Sep 17 00:00:00 2001 +From ecbcd57c425c69646ba649ea21f320cc7e56b02e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 11 Nov 2020 13:42:06 +0100 Subject: [PATCH 101/105] s3:smbd: Fix possible null pointer dereference in @@ -12146,10 +12146,10 @@ index 57754a0f766..694c0c290e8 100644 /* Check if username starts with domain name */ if (domain_len > 0) { -- -2.29.2 +2.31.1 -From 2ed81da6506e43e3b94f479cd5edcbd11654fa6a Mon Sep 17 00:00:00 2001 +From f0654e4786cb44d5c2834c4cbeedec42a66107b5 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 10 Nov 2020 17:35:24 +0200 Subject: [PATCH 102/105] lookup_name: allow lookup names prefixed with DNS @@ -12206,10 +12206,10 @@ Autobuild-Date(master): Wed Nov 11 10:59:01 UTC 2020 on sn-devel-184 1 file changed, 28 insertions(+), 9 deletions(-) diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c -index 82c47b3145b..864246da56e 100644 +index 4b3aa7e435d..99f9bdd7693 100644 --- a/source3/passdb/lookup_sid.c +++ b/source3/passdb/lookup_sid.c -@@ -113,17 +113,36 @@ bool lookup_name(TALLOC_CTX *mem_ctx, +@@ -114,17 +114,36 @@ bool lookup_name(TALLOC_CTX *mem_ctx, full_name, domain, name)); DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); @@ -12256,10 +12256,10 @@ index 82c47b3145b..864246da56e 100644 if ((flags & LOOKUP_NAME_BUILTIN) && -- -2.29.2 +2.31.1 -From 311a71971be6cb39806349291fd2cd44a4a7e214 Mon Sep 17 00:00:00 2001 +From 4ab1bdc465b7a02ab2dd8531be11518579e97f59 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 11 Nov 2020 14:42:55 +0200 Subject: [PATCH 103/105] auth_sam: use pdb_get_domain_info to look up DNS @@ -12479,10 +12479,10 @@ index 3c12f959faf..e8e0d543f8c 100644 DBG_INFO("%s is not our domain name (DC for %s)\n", effective_domain, lp_workgroup()); -- -2.29.2 +2.31.1 -From cee41a7d2c051e6669f3fe63b7833c530d39212a Mon Sep 17 00:00:00 2001 +From fe9dffe41d545e41d4a1d9b2b1c6d5246a9f81af Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 27 Nov 2020 11:22:15 +0100 Subject: [PATCH 104/105] docs-xml: Add a section about weak crypto in testparm @@ -12522,10 +12522,10 @@ index 9099cda010f..7c7abf50e8b 100644 -- -2.29.2 +2.31.1 -From 75bac5fc644cfd36faa554b299f125f519bd3e89 Mon Sep 17 00:00:00 2001 +From 8abb1fa3b7972e89543f38a23d0979e1f0c2062f Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 15 Dec 2020 15:17:04 +0100 Subject: [PATCH 105/105] HACK:s3:winbind: Rely on the domain child for online @@ -12585,5 +12585,5 @@ index b1c86b2979c..c6362019877 100644 /* Handle online/offline messages. */ -- -2.29.2 +2.31.1 diff --git a/samba.spec b/samba.spec index c3d6b62..4ae5dfe 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.13.10 +%define samba_version 4.13.11 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3627,6 +3627,9 @@ fi %endif %changelog +* Tue Sep 07 2021 Guenther Deschner - 4.13.11-0 +- Update to Samba 4.13.11 + * Wed Jul 14 2021 Guenther Deschner - 4.13.10-0 - Update to Samba 4.13.10 diff --git a/sources b/sources index 9563a8c..4e4a878 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.10.tar.xz) = c55114d3539c6bc824787b32d972f6121c29fb35758a5c932543dc99280d4d711c3f54b72064e10be51f8a3502d5095efe9ef833c4cc1ba9bdb6a2dfaf2ddd29 -SHA512 (samba-4.13.10.tar.asc) = 27a8313606486a8acc5f31f383bc5541aaadde34eb557427658810e3dc3f33a0f2b93c0bda921287424771f16741bb6d2de1b505d7efe47669e211b3625358fd +SHA512 (samba-4.13.11.tar.xz) = e8e4ff9d7de03f474791f8db3d68e38c5031ca0a70d3dd482aac5d7f18f2649d209c9ef144cab152a7d4b9cd2fa292dfcdefe8c9b988c29c3493cd29d4e98dc6 +SHA512 (samba-4.13.11.tar.asc) = 5d3c9565bf90833e44965a2418ae9bdcf7177724b2f5248e9f71ef11548c9c5d5af0dcb9f9fa5b89b5fbf4e658b147f41e69c838ea2abbde01d93839fa99b9a7 From 42f8f093c955c3a9102a8d144bc9c8c70b1ccdac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 22 Sep 2021 12:19:31 +0200 Subject: [PATCH 26/30] Update to Samba 4.13.12 Guenther --- .gitignore | 2 ++ samba.spec | 38 +++++++++++++++++++++++++++++++++++--- sources | 4 ++-- 3 files changed, 39 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 2f476b8..404466f 100644 --- a/.gitignore +++ b/.gitignore @@ -245,3 +245,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.10.tar.asc /samba-4.13.11.tar.xz /samba-4.13.11.tar.asc +/samba-4.13.12.tar.xz +/samba-4.13.12.tar.asc diff --git a/samba.spec b/samba.spec index 4ae5dfe..d3e0982 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.13.11 +%define samba_version 4.13.12 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -2039,6 +2039,7 @@ fi %{python3_sitearch}/samba/dcerpc/idmap.*.so %{python3_sitearch}/samba/dcerpc/initshutdown.*.so %{python3_sitearch}/samba/dcerpc/irpc.*.so +%{python3_sitearch}/samba/dcerpc/krb5ccache.*.so %{python3_sitearch}/samba/dcerpc/krb5pac.*.so %{python3_sitearch}/samba/dcerpc/lsa.*.so %{python3_sitearch}/samba/dcerpc/messaging.*.so @@ -2437,6 +2438,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc @@ -2456,6 +2458,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py +%{python3_sitearch}/samba/tests/dcerpc/lsa.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py %{python3_sitearch}/samba/tests/dcerpc/misc.py %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py @@ -2518,17 +2521,43 @@ fi %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ +%{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc -%{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py +%{python3_sitearch}/samba/tests/krb5/as_req_tests.py +%{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py +%{python3_sitearch}/samba/tests/krb5/kdc_base_test.py +%{python3_sitearch}/samba/tests/krb5/kdc_tests.py +%{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py +%{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py +%{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py -%{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py +%{python3_sitearch}/samba/tests/krb5/simple_tests.py +%{python3_sitearch}/samba/tests/krb5/test_ccache.py +%{python3_sitearch}/samba/tests/krb5/test_ldap.py +%{python3_sitearch}/samba/tests/krb5/test_rpc.py +%{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/xrealm_tests.py %{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/ldap_raw.py @@ -3627,6 +3656,9 @@ fi %endif %changelog +* Wed Sep 22 2021 Guenther Deschner - 4.13.12-0 +- Update to Samba 4.13.12 + * Tue Sep 07 2021 Guenther Deschner - 4.13.11-0 - Update to Samba 4.13.11 diff --git a/sources b/sources index 4e4a878..7aa022d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.11.tar.xz) = e8e4ff9d7de03f474791f8db3d68e38c5031ca0a70d3dd482aac5d7f18f2649d209c9ef144cab152a7d4b9cd2fa292dfcdefe8c9b988c29c3493cd29d4e98dc6 -SHA512 (samba-4.13.11.tar.asc) = 5d3c9565bf90833e44965a2418ae9bdcf7177724b2f5248e9f71ef11548c9c5d5af0dcb9f9fa5b89b5fbf4e658b147f41e69c838ea2abbde01d93839fa99b9a7 +SHA512 (samba-4.13.12.tar.xz) = 845e4b38f64548b8f994c640c6c52ab86b9c1af4b421319a6d58652ed8a5f50fbefbfea0f846130d82ee9d405be0248126ce7ba84957fdfceac17ee2d815e64f +SHA512 (samba-4.13.12.tar.asc) = d040cc2d67f49c7f194378431a0693988fe96b7943ac937bd33676c8b2ab9867021827ab3ae01ef3c60bc06ffc0d0cd7f3c71fe3546e48871b7175bed51fba1b From afe3fcb7fde557a57378ff442f9c6355b0c8faad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 29 Oct 2021 11:18:58 +0200 Subject: [PATCH 27/30] Update to Samba 4.13.13 Guenther --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 404466f..5b444cd 100644 --- a/.gitignore +++ b/.gitignore @@ -247,3 +247,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.11.tar.asc /samba-4.13.12.tar.xz /samba-4.13.12.tar.asc +/samba-4.13.13.tar.xz +/samba-4.13.13.tar.asc diff --git a/samba.spec b/samba.spec index d3e0982..fb8fabe 100644 --- a/samba.spec +++ b/samba.spec @@ -10,11 +10,11 @@ %define main_release 0 -%define samba_version 4.13.12 +%define samba_version 4.13.13 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.2.1 +%define ldb_version 2.2.2 # This should be rc1 or nil %define pre_release %nil @@ -2533,7 +2533,9 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc @@ -2552,7 +2554,9 @@ fi %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py +%{python3_sitearch}/samba/tests/krb5/rodc_tests.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py +%{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py @@ -3656,6 +3660,9 @@ fi %endif %changelog +* Fri Oct 29 2021 Guenther Deschner - 4.13.13-0 +- Update to Samba 4.13.13 + * Wed Sep 22 2021 Guenther Deschner - 4.13.12-0 - Update to Samba 4.13.12 diff --git a/sources b/sources index 7aa022d..341dd17 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.12.tar.xz) = 845e4b38f64548b8f994c640c6c52ab86b9c1af4b421319a6d58652ed8a5f50fbefbfea0f846130d82ee9d405be0248126ce7ba84957fdfceac17ee2d815e64f -SHA512 (samba-4.13.12.tar.asc) = d040cc2d67f49c7f194378431a0693988fe96b7943ac937bd33676c8b2ab9867021827ab3ae01ef3c60bc06ffc0d0cd7f3c71fe3546e48871b7175bed51fba1b +SHA512 (samba-4.13.13.tar.xz) = dbc4f64a7a3d3d7566df3bcd6baa132bce6e13642fd283b22945db1431c2a3eaad1e9fc7f3b7907383561e63c4648129633aedc16e5f452c5747754143d9485c +SHA512 (samba-4.13.13.tar.asc) = 51b2d0c2f18a3a94bef08d825214e90708d1c4c273f54b33d83d8efdb3f77062147c225db64f077550b69378689c64675bf5e8b552769d89f4aecb33ddee0b17 From 85d7de80b224dc6ee57e012acb9a9c6aab33d814 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 9 Nov 2021 19:30:09 +0100 Subject: [PATCH 28/30] Update to Samba 4.13.14 resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 Guenther --- .gitignore | 2 + samba-4.13-redhat.patch | 1334 +++++++++++++++------------------------ samba-s4u.patch | 147 ++--- samba.spec | 29 +- sources | 4 +- 5 files changed, 614 insertions(+), 902 deletions(-) diff --git a/.gitignore b/.gitignore index 5b444cd..0f69f79 100644 --- a/.gitignore +++ b/.gitignore @@ -249,3 +249,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.12.tar.asc /samba-4.13.13.tar.xz /samba-4.13.13.tar.asc +/samba-4.13.14.tar.xz +/samba-4.13.14.tar.asc diff --git a/samba-4.13-redhat.patch b/samba-4.13-redhat.patch index a5d4832..b380020 100644 --- a/samba-4.13-redhat.patch +++ b/samba-4.13-redhat.patch @@ -1,7 +1,7 @@ -From a1f5903240ac444b867c7f0aaf1e0e2b815ea2e8 Mon Sep 17 00:00:00 2001 +From 3b80faa8b0592c35fe884cea5b01169ae9ec3243 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 16:15:03 +0200 -Subject: [PATCH 001/105] libcli:smb2: Do not leak ptext on error +Subject: [PATCH 001/103] libcli:smb2: Do not leak ptext on error Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -22,13 +22,13 @@ index 230475480c2..cfb3b613f9d 100644 goto out; } -- -2.31.1 +2.33.1 -From 343b6fb03e6c26054adb02b3fbd866e5650e9766 Mon Sep 17 00:00:00 2001 +From 87aed0a5891d81d4e49e5dfa68bd9c61a52eb511 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 17:23:37 +0200 -Subject: [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have +Subject: [PATCH 002/103] libcli:smb2: Use talloc NULL context if we don't have a stackframe If we execute this code from python we don't have a talloc stackframe @@ -106,13 +106,13 @@ index cfb3b613f9d..b1e0253948f 100644 TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; -- -2.31.1 +2.33.1 -From 844c227f014581c46f75cb72fe749ceb8c062f23 Mon Sep 17 00:00:00 2001 +From 0005c4c973fac93c74b1c958a29f0574b15fe63f Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 6 Nov 2019 17:37:45 +0100 -Subject: [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF +Subject: [PATCH 003/103] auth:creds: Introduce CRED_SMB_CONF We have several places where we check '> CRED_UNINITIALISED', so we better don't use CRED_UNINITIALISED for values from @@ -168,10 +168,10 @@ index 9fe6a82b1ea..7154c2a008c 100644 CRED_GUESS_ENV, /* Current value should be used, which was guessed */ CRED_GUESS_FILE, /* A guess from a file (or file pointed at in env variable) */ diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index a5d0f9e051c..68edc282741 100644 +index e583b83d9a4..171be1b0c6a 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c -@@ -1275,6 +1275,7 @@ MODULE_INIT_FUNC(credentials) +@@ -1273,6 +1273,7 @@ MODULE_INIT_FUNC(credentials) return NULL; PyModule_AddObject(m, "UNINITIALISED", PyLong_FromLong(CRED_UNINITIALISED)); @@ -202,13 +202,13 @@ index d2a81506de3..6454ac9ff7c 100644 self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) self.assertEqual(creds.get_realm(), realm.upper()) -- -2.31.1 +2.33.1 -From e4bca5f38ed6ad8cd48b1b3e97569165b3d8d189 Mon Sep 17 00:00:00 2001 +From b5fb9f7a12dc900487e32296a42278ae91b7673f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 10 Oct 2019 14:18:23 +0200 -Subject: [PATCH 004/105] param: Add 'server smb encrypt' parameter +Subject: [PATCH 004/103] param: Add 'server smb encrypt' parameter And this also makes 'smb encrypt' a synonym of that. @@ -727,7 +727,7 @@ index 32a22cb58f5..798e616b765 100644 default diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index a3abaa2ec67..c0070b716a5 100644 +index 56cf0abb33a..cf969c18c66 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = @@ -821,13 +821,13 @@ index 7acde285a90..b745e0906b1 100644 req, NT_STATUS_NOT_SUPPORTED); -- -2.31.1 +2.33.1 -From fd86806d67c924a5a18ee1cc2b876082b0bc024e Mon Sep 17 00:00:00 2001 +From bc64cc476c6bb5a1bb01ad734004ab1fdb167a1b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 10:04:19 +0200 -Subject: [PATCH 005/105] param: Create and use enum_smb_encryption_vals +Subject: [PATCH 005/103] param: Create and use enum_smb_encryption_vals Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -865,10 +865,10 @@ index 798e616b765..60271200c0a 100644 synonym="1" xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> diff --git a/lib/param/param_table.c b/lib/param/param_table.c -index 47b85de1f87..e2f737279dc 100644 +index 780252017d2..3dc5fc59991 100644 --- a/lib/param/param_table.c +++ b/lib/param/param_table.c -@@ -138,6 +138,29 @@ static const struct enum_list enum_smb_signing_vals[] = { +@@ -139,6 +139,29 @@ static const struct enum_list enum_smb_signing_vals[] = { {-1, NULL} }; @@ -919,13 +919,13 @@ index af8e7204013..8e757dbc5b5 100644 #define SMB_DATA_BLOCK 0x1 #define SMB_ASCII4 0x4 -- -2.31.1 +2.33.1 -From 9edfbc5907c07eb82bef0ddaa2d888e0baac8b43 Mon Sep 17 00:00:00 2001 +From c18739c3022304776864f558b8c712e5f000722f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:34:54 +0200 -Subject: [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values +Subject: [PATCH 006/103] s3:smbd: Use 'enum smb_encryption_setting' values Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -939,7 +939,7 @@ Reviewed-by: Stefan Metzmacher 6 files changed, 12 insertions(+), 11 deletions(-) diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index c0070b716a5..4ad541301b3 100644 +index cf969c18c66..1df42ed530e 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = @@ -1043,21 +1043,21 @@ index b745e0906b1..2f2fdcb7260 100644 req, NT_STATUS_NOT_SUPPORTED); -- -2.31.1 +2.33.1 -From 326b92aeb4b20301ff5eebb9e6d7650330854394 Mon Sep 17 00:00:00 2001 +From a10ae5f534dd548049073e0991ef1000d8395e8d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Apr 2020 10:38:41 +0200 -Subject: [PATCH 007/105] docs-xml: Add 'client smb encrypt' +Subject: [PATCH 007/103] docs-xml: Add 'client smb encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- .../smbdotconf/security/clientsmbencrypt.xml | 126 ++++++++++++++++++ - lib/param/loadparm.c | 4 + - source3/param/loadparm.c | 2 + - 3 files changed, 132 insertions(+) + lib/param/loadparm.c | 3 + + source3/param/loadparm.c | 1 + + 3 files changed, 130 insertions(+) create mode 100644 docs-xml/smbdotconf/security/clientsmbencrypt.xml diff --git a/docs-xml/smbdotconf/security/clientsmbencrypt.xml b/docs-xml/smbdotconf/security/clientsmbencrypt.xml @@ -1193,41 +1193,39 @@ index 00000000000..05df152e734 +default + diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c -index 006caabc092..67f5709b213 100644 +index d2f6e6241ad..f894f3fa2d4 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c -@@ -3079,6 +3079,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) - lpcfg_do_global_parameter( - lp_ctx, "ldap max search request size", "256000"); - +@@ -3082,6 +3082,9 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) + lpcfg_do_global_parameter(lp_ctx, + "min domain uid", + "1000"); + lpcfg_do_global_parameter(lp_ctx, + "client smb encrypt", + "default"); -+ + for (i = 0; parm_table[i].label; i++) { if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { - lp_ctx->flags[i] |= FLAG_DEFAULT; diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index 4ad541301b3..6418a42b6eb 100644 +index 1df42ed530e..96b4e3f39c0 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c -@@ -960,6 +960,8 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) - Globals.ldap_max_authenticated_request_size = 16777216; +@@ -961,6 +961,7 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) Globals.ldap_max_search_request_size = 256000; + Globals.min_domain_uid = 1000; + Globals.client_smb_encrypt = SMB_ENCRYPTION_DEFAULT; -+ + /* Now put back the settings that were set with lp_set_cmdline() */ apply_lp_set_cmdline(); - } -- -2.31.1 +2.33.1 -From 63b9df55730fc876988eca33c129f769de75b0fd Mon Sep 17 00:00:00 2001 +From 9bd56e83b5f03b02e771a7c993e5a949457bdb4e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jul 2020 17:48:25 +0200 -Subject: [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() +Subject: [PATCH 008/103] lib:param: Add lpcfg_parse_enum_vals() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1237,10 +1235,10 @@ Reviewed-by: Stefan Metzmacher 2 files changed, 32 insertions(+) diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c -index 67f5709b213..b1410791c60 100644 +index f894f3fa2d4..521ce78b548 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c -@@ -3675,3 +3675,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx, +@@ -3678,3 +3678,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx, raw_value, lp_sub->private_data); } @@ -1288,13 +1286,13 @@ index 323fcf84523..e66ce2324b4 100644 struct loadparm_substitution; #ifdef LOADPARM_SUBSTITUTION_INTERNALS -- -2.31.1 +2.33.1 -From 36a90aee5b31b0d71cd3ea0ce405deb7d89674a0 Mon Sep 17 00:00:00 2001 +From ed8db9c1a25596fb294f15b27d8e5f96101e3c6e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:38:08 +0200 -Subject: [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() +Subject: [PATCH 009/103] libcli:smb: Add smb_signing_setting_translate() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1448,10 +1446,10 @@ index 86e377f570b..c047fd33278 100644 + deps='cmocka cli_smb_common', + for_selftest=True) diff --git a/selftest/tests.py b/selftest/tests.py -index 2b65943b2ed..9938bf53ed6 100644 +index a2b8bf5c4d5..68cbcd5fbf1 100644 --- a/selftest/tests.py +++ b/selftest/tests.py -@@ -376,6 +376,8 @@ plantestsuite("samba.unittests.lib_util_modules", "none", +@@ -378,6 +378,8 @@ plantestsuite("samba.unittests.lib_util_modules", "none", plantestsuite("samba.unittests.smb1cli_session", "none", [os.path.join(bindir(), "default/libcli/smb/test_smb1cli_session")]) @@ -1461,13 +1459,13 @@ index 2b65943b2ed..9938bf53ed6 100644 plantestsuite("samba.unittests.talloc_keep_secret", "none", [os.path.join(bindir(), "default/lib/util/test_talloc_keep_secret")]) -- -2.31.1 +2.33.1 -From 982e1bcc7c451eb4cb20d3c105b2d67eb3dbbf89 Mon Sep 17 00:00:00 2001 +From cbe5aaf56bc96993bcb463540371cd4b15b065e2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 08:39:34 +0200 -Subject: [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() +Subject: [PATCH 010/103] libcli:smb: Add smb_encryption_setting_translate() Add encryption enum and function to avoid confusion when reading the code. @@ -1555,13 +1553,13 @@ index da0e4db2bf3..ac2887ee5c4 100644 + return encryption_state; +} -- -2.31.1 +2.33.1 -From ccf0bea67282852031d12205e1e741f974d0b56d Mon Sep 17 00:00:00 2001 +From 717b0a825460d1fbfe8f35864ba3ee3393ba5117 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:47:59 +0200 -Subject: [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline +Subject: [PATCH 011/103] s3:lib: Use smb_signing_setting_translate for cmdline parsing The function will be removed soon. @@ -1609,7 +1607,7 @@ index 90ee67c4cb7..bc1f1c3ed25 100644 } diff --git a/source3/wscript_build b/source3/wscript_build -index d86a9fcadbf..c1051c62393 100644 +index 46c914c7b22..8178d5b6ab3 100644 --- a/source3/wscript_build +++ b/source3/wscript_build @@ -279,7 +279,7 @@ bld.SAMBA3_LIBRARY('popt_samba3_cmdline', @@ -1622,13 +1620,13 @@ index d86a9fcadbf..c1051c62393 100644 bld.SAMBA3_LIBRARY('cmdline_contexts', -- -2.31.1 +2.33.1 -From 9ff8e1d264555f35d49455c10ad1e4d8b5064566 Mon Sep 17 00:00:00 2001 +From 7b83c50814e121a0fd5b5e0f11b2e6e0d3efd3c1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 07:47:18 +0200 -Subject: [PATCH 012/105] auth:creds: Remove unused credentials autoproto +Subject: [PATCH 012/103] auth:creds: Remove unused credentials autoproto header Signed-off-by: Andreas Schneider @@ -1642,7 +1640,7 @@ Reviewed-by: Stefan Metzmacher 5 files changed, 5 deletions(-) diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c -index 20e677e521a..259b35b73b0 100644 +index 61e55f7032d..2d2fccfff88 100644 --- a/auth/credentials/credentials_krb5.c +++ b/auth/credentials/credentials_krb5.c @@ -27,7 +27,6 @@ @@ -1702,13 +1700,13 @@ index 7711eac2afa..d9be3562adb 100644 #include "auth/kerberos/kerberos_credentials.h" #include "auth/kerberos/kerberos_util.h" -- -2.31.1 +2.33.1 -From 62e645e77e33b16e060c81838a281f8ea9cabb99 Mon Sep 17 00:00:00 2001 +From 63e3da5b79de2aa774106bffcd77ad78f1111af7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:32:44 +0200 -Subject: [PATCH 013/105] auth:creds: Add +Subject: [PATCH 013/103] auth:creds: Add cli_credentials_(get|set)_smb_signing() Signed-off-by: Andreas Schneider @@ -1844,13 +1842,13 @@ index 68f1f25dce1..9cde0000b5f 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.31.1 +2.33.1 -From b63074e5adcc245672fc8cb5c1b7eb1d2670ba5d Mon Sep 17 00:00:00 2001 +From 4d16dcc995e0854c9b14d44ea065fda4ebccdcd6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 11:56:01 +0200 -Subject: [PATCH 014/105] auth:creds: Add python bindings for +Subject: [PATCH 014/103] auth:creds: Add python bindings for (get|set)_smb_signing Signed-off-by: Andreas Schneider @@ -1861,7 +1859,7 @@ Reviewed-by: Stefan Metzmacher 2 files changed, 69 insertions(+) diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index 68edc282741..846c418419f 100644 +index 171be1b0c6a..60fecbe494c 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c @@ -34,6 +34,7 @@ @@ -1872,7 +1870,7 @@ index 68edc282741..846c418419f 100644 void initcredentials(void); -@@ -929,6 +930,52 @@ static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self, +@@ -927,6 +928,52 @@ static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self, Py_RETURN_NONE; } @@ -1925,7 +1923,7 @@ index 68edc282741..846c418419f 100644 static PyMethodDef py_creds_methods[] = { { .ml_name = "get_username", -@@ -1209,6 +1256,16 @@ static PyMethodDef py_creds_methods[] = { +@@ -1207,6 +1254,16 @@ static PyMethodDef py_creds_methods[] = { "Encrypt the supplied password using the session key and\n" "the negotiated encryption algorithm in place\n" "i.e. it overwrites the original data"}, @@ -1942,7 +1940,7 @@ index 68edc282741..846c418419f 100644 { .ml_name = NULL } }; -@@ -1295,6 +1352,12 @@ MODULE_INIT_FUNC(credentials) +@@ -1293,6 +1350,12 @@ MODULE_INIT_FUNC(credentials) PyModule_AddObject(m, "CLI_CRED_NTLM_AUTH", PyLong_FromLong(CLI_CRED_NTLM_AUTH)); PyModule_AddObject(m, "CLI_CRED_CLEAR_AUTH", PyLong_FromLong(CLI_CRED_CLEAR_AUTH)); @@ -1970,13 +1968,13 @@ index 6454ac9ff7c..e5f8122fa21 100644 + creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) -- -2.31.1 +2.33.1 -From e04467371cc14f6aa9e19befc387b8e0f2ef1f53 Mon Sep 17 00:00:00 2001 +From 9e5ac9604f7b59c5a6af8892eefed79d558f505b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:31:35 +0200 -Subject: [PATCH 015/105] auth:creds: Add +Subject: [PATCH 015/103] auth:creds: Add cli_credentials_(get|set)_smb_ipc_signing() Signed-off-by: Andreas Schneider @@ -2102,13 +2100,13 @@ index 9cde0000b5f..54e8271471f 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.31.1 +2.33.1 -From 063f2b6f2f128a513e6ee4506640783657a9cc31 Mon Sep 17 00:00:00 2001 +From 53ddf5030b8f9c1dc9610903a8da4f176fc7a38a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:32:46 +0200 -Subject: [PATCH 016/105] auth:creds: Add python bindings for +Subject: [PATCH 016/103] auth:creds: Add python bindings for (get|set)_smb_ipc_signing Signed-off-by: Andreas Schneider @@ -2119,10 +2117,10 @@ Reviewed-by: Stefan Metzmacher 2 files changed, 62 insertions(+) diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index 846c418419f..1a83c506088 100644 +index 60fecbe494c..b270eabeb6c 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c -@@ -976,6 +976,52 @@ static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args) +@@ -974,6 +974,52 @@ static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args) Py_RETURN_NONE; } @@ -2175,7 +2173,7 @@ index 846c418419f..1a83c506088 100644 static PyMethodDef py_creds_methods[] = { { .ml_name = "get_username", -@@ -1266,6 +1312,16 @@ static PyMethodDef py_creds_methods[] = { +@@ -1264,6 +1310,16 @@ static PyMethodDef py_creds_methods[] = { .ml_meth = py_creds_set_smb_signing, .ml_flags = METH_VARARGS, }, @@ -2207,13 +2205,13 @@ index e5f8122fa21..8edf13ce6ff 100644 + creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) -- -2.31.1 +2.33.1 -From bcdc3b4af590e4d80405724cf47c0e97b1fa20a4 Mon Sep 17 00:00:00 2001 +From 90381fa63e531bf0cd7b5ec71205bc1c6de6696c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:10:52 +0200 -Subject: [PATCH 017/105] auth:creds: Add +Subject: [PATCH 017/103] auth:creds: Add cli_credentials_(get|set)_smb_encryption() Signed-off-by: Andreas Schneider @@ -2341,13 +2339,13 @@ index 54e8271471f..3b86b742448 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.31.1 +2.33.1 -From f6cb4cf6c7163849756cca238aecd4065120892a Mon Sep 17 00:00:00 2001 +From c89917cb2313398d2610458e278b48019e7d468c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:38:30 +0200 -Subject: [PATCH 018/105] auth:creds: Add python bindings for +Subject: [PATCH 018/103] auth:creds: Add python bindings for (get|set)_smb_encryption Signed-off-by: Andreas Schneider @@ -2358,10 +2356,10 @@ Reviewed-by: Stefan Metzmacher 2 files changed, 68 insertions(+) diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index 1a83c506088..628aae6500b 100644 +index b270eabeb6c..a27039d8cfd 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c -@@ -1022,6 +1022,52 @@ static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args) +@@ -1020,6 +1020,52 @@ static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args) Py_RETURN_NONE; } @@ -2414,7 +2412,7 @@ index 1a83c506088..628aae6500b 100644 static PyMethodDef py_creds_methods[] = { { .ml_name = "get_username", -@@ -1322,6 +1368,16 @@ static PyMethodDef py_creds_methods[] = { +@@ -1320,6 +1366,16 @@ static PyMethodDef py_creds_methods[] = { .ml_meth = py_creds_set_smb_ipc_signing, .ml_flags = METH_VARARGS, }, @@ -2431,7 +2429,7 @@ index 1a83c506088..628aae6500b 100644 { .ml_name = NULL } }; -@@ -1414,6 +1470,12 @@ MODULE_INIT_FUNC(credentials) +@@ -1412,6 +1468,12 @@ MODULE_INIT_FUNC(credentials) PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED)); PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED)); @@ -2459,13 +2457,13 @@ index 8edf13ce6ff..e0a6248d37a 100644 + creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) -- -2.31.1 +2.33.1 -From 9b64d94eef247bd6f778dac3b32f8daa50c298b5 Mon Sep 17 00:00:00 2001 +From 7c0b661f8f6fc39ee6e2a24636186653d9236843 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 11:19:53 +0200 -Subject: [PATCH 019/105] auth:creds: Add python bindings for +Subject: [PATCH 019/103] auth:creds: Add python bindings for cli_credentials_set_conf() Signed-off-by: Andreas Schneider @@ -2476,10 +2474,10 @@ Reviewed-by: Stefan Metzmacher 2 files changed, 74 insertions(+) diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index 628aae6500b..17c90573f09 100644 +index a27039d8cfd..f588d6c962e 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c -@@ -621,6 +621,42 @@ static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args) +@@ -618,6 +618,42 @@ static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args) Py_RETURN_NONE; } @@ -2522,7 +2520,7 @@ index 628aae6500b..17c90573f09 100644 static PyObject *py_creds_guess(PyObject *self, PyObject *args) { PyObject *py_lp_ctx = Py_None; -@@ -1279,6 +1315,11 @@ static PyMethodDef py_creds_methods[] = { +@@ -1277,6 +1313,11 @@ static PyMethodDef py_creds_methods[] = { .ml_meth = py_creds_set_krb_forwardable, .ml_flags = METH_VARARGS, }, @@ -2587,13 +2585,13 @@ index e0a6248d37a..6187bded0b6 100644 + creds.set_conf(lp) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) -- -2.31.1 +2.33.1 -From d20272910d64fcd380e11ca059060a60d731799e Mon Sep 17 00:00:00 2001 +From 6be418fb4ff2f4be546c6bcf3bee296cd9a8edd8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 08:14:23 +0200 -Subject: [PATCH 020/105] auth:creds: Bump library version +Subject: [PATCH 020/103] auth:creds: Bump library version We added new functions so bump the version. @@ -2617,13 +2615,13 @@ index 564a04fe8dd..1e3302e3e48 100644 bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', -- -2.31.1 +2.33.1 -From 54767e3ac82152bef1c2d8a4231ce498da7ccf1c Mon Sep 17 00:00:00 2001 +From cc6c0f99b9ded4801b5f86f6a6bb5a8471620557 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 May 2020 11:10:30 +0200 -Subject: [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() +Subject: [PATCH 021/103] s3:lib: Use cli_credential_(get|set)_smb_signing() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2688,13 +2686,13 @@ index bc1f1c3ed25..6038ec11515 100644 void set_cmdline_auth_info_use_ccache(struct user_auth_info *auth_info, bool b) -- -2.31.1 +2.33.1 -From eb90be62d5708553dd2c2da2d2bd305d69676531 Mon Sep 17 00:00:00 2001 +From abef02315ac0301c9cb0d39b9bafc927a54641d8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:45:34 +0200 -Subject: [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API +Subject: [PATCH 022/103] s3:lib: Set smb encryption also via cli creds API Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2717,13 +2715,13 @@ index 6038ec11515..9c9e2f0ac0f 100644 } -- -2.31.1 +2.33.1 -From cbb6cfe771e664f6232e0691724a09db714ae50e Mon Sep 17 00:00:00 2001 +From 1be915e64b991bd1e4905be60ec1407ce34a6cdb Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 10:40:23 +0200 -Subject: [PATCH 023/105] python: Remove unused sign argument from +Subject: [PATCH 023/103] python: Remove unused sign argument from smb_connection() Signed-off-by: Andreas Schneider @@ -2772,13 +2770,13 @@ index 1e2c2918ebe..ad60cda0690 100644 smb_dir = '\\'.join([self.lp.get('realm').lower(), 'Policies', 'PolicyDefinitions']) -- -2.31.1 +2.33.1 -From 3a93f116d5a219fef008fe2709e79e134988c31e Mon Sep 17 00:00:00 2001 +From 9e9da4fa35dc4a49c60bcbf828dcee4b98dddf7b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 14:02:37 +0200 -Subject: [PATCH 024/105] python: Set smb signing via the creds API +Subject: [PATCH 024/103] python: Set smb signing via the creds API Pair-Programmed-With: Stefan Metzmacher @@ -2876,13 +2874,13 @@ index ad60cda0690..0f2f6520fc3 100644 -- -2.31.1 +2.33.1 -From 0948c3afb426cbba2f245da1a85eb3c6f31dc91e Mon Sep 17 00:00:00 2001 +From 83bb2d950c6a5c303fad8af88dc268a790aad82d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:22:12 +0200 -Subject: [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC +Subject: [PATCH 025/103] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2956,10 +2954,10 @@ index 34938603606..392e3eff74f 100644 } diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index 1fb1f0127b9..f20146378e3 100644 +index a79abfaf157..004a9a57af7 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c -@@ -2788,7 +2788,7 @@ static struct tevent_req *cli_start_connection_send( +@@ -2797,7 +2797,7 @@ static struct tevent_req *cli_start_connection_send( } state->ev = ev; @@ -2968,7 +2966,7 @@ index 1fb1f0127b9..f20146378e3 100644 state->min_protocol = lp_client_ipc_min_protocol(); state->max_protocol = lp_client_ipc_max_protocol(); } else { -@@ -3673,6 +3673,7 @@ struct cli_state *get_ipc_connect(char *server, +@@ -3682,6 +3682,7 @@ struct cli_state *get_ipc_connect(char *server, uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK; flags |= CLI_FULL_CONNECTION_FORCE_SMB1; @@ -3099,13 +3097,13 @@ index 6cea2ee306c..2241beb331f 100644 if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); -- -2.31.1 +2.33.1 -From c3ca4b0ab10a2643ee70a1765505142d3f8abde5 Mon Sep 17 00:00:00 2001 +From f0a5443694fdc47bcbd607bc0b0f1f862d331ccd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:29:25 +0200 -Subject: [PATCH 026/105] s3:pylibsmb: Add ipc=True support for +Subject: [PATCH 026/103] s3:pylibsmb: Add ipc=True support for CLI_FULL_CONNECTION_IPC Signed-off-by: Andreas Schneider @@ -3115,10 +3113,10 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c -index 3fcc3424a57..3579a040830 100644 +index 551f552527e..7eb99eba12b 100644 --- a/source3/libsmb/pylibsmb.c +++ b/source3/libsmb/pylibsmb.c -@@ -445,6 +445,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -447,6 +447,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, int signing_state = SMB_SIGNING_DEFAULT; PyObject *py_force_smb1 = Py_False; bool force_smb1 = false; @@ -3127,7 +3125,7 @@ index 3fcc3424a57..3579a040830 100644 struct tevent_req *req; bool ret; int flags = 0; -@@ -452,6 +454,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -454,6 +456,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, static const char *kwlist[] = { "host", "share", "lp", "creds", "multi_threaded", "sign", "force_smb1", @@ -3135,7 +3133,7 @@ index 3fcc3424a57..3579a040830 100644 NULL }; -@@ -462,12 +465,13 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -464,12 +467,13 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, } ret = ParseTupleAndKeywords( @@ -3151,7 +3149,7 @@ index 3fcc3424a57..3579a040830 100644 Py_DECREF(py_type_Credentials); -@@ -493,6 +497,11 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -495,6 +499,11 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, flags = CLI_FULL_CONNECTION_FORCE_SMB1; } @@ -3164,13 +3162,13 @@ index 3fcc3424a57..3579a040830 100644 #ifdef HAVE_PTHREAD ret = py_cli_state_setup_mt_ev(self); -- -2.31.1 +2.33.1 -From 12fbff7317277e1e7f43659268936f9e02b42fe9 Mon Sep 17 00:00:00 2001 +From 232942c0d1914558c997b955a9e6f4b30d2bd46d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 09:47:11 +0200 -Subject: [PATCH 027/105] python:tests: Mark libsmb connection as an IPC +Subject: [PATCH 027/103] python:tests: Mark libsmb connection as an IPC connection Signed-off-by: Andreas Schneider @@ -3180,7 +3178,7 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py -index ba7440df13b..2c028d381db 100644 +index 7cffccbf1d0..16b58bfa4d7 100644 --- a/python/samba/tests/dcerpc/raw_testcase.py +++ b/python/samba/tests/dcerpc/raw_testcase.py @@ -43,7 +43,7 @@ class smb_pipe_socket(object): @@ -3193,13 +3191,13 @@ index ba7440df13b..2c028d381db 100644 DesiredAccess=0x12019f, ShareAccess=0x7, -- -2.31.1 +2.33.1 -From d75ad55c81f1e15f197e8eda1e43a43be6c89f90 Mon Sep 17 00:00:00 2001 +From 42079e65fa7c6b0b574538940f71d9220abdc329 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 17 Aug 2020 12:52:39 +0200 -Subject: [PATCH 028/105] python:tests: Set smb ipc signing via the creds API +Subject: [PATCH 028/103] python:tests: Set smb ipc signing via the creds API Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -3208,7 +3206,7 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 4 insertions(+) diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py -index 2c028d381db..d6f5de7440a 100644 +index 16b58bfa4d7..97d9c7fada9 100644 --- a/python/samba/tests/dcerpc/raw_testcase.py +++ b/python/samba/tests/dcerpc/raw_testcase.py @@ -36,14 +36,18 @@ from samba.ntstatus import ( @@ -3231,13 +3229,13 @@ index 2c028d381db..d6f5de7440a 100644 DesiredAccess=0x12019f, ShareAccess=0x7, -- -2.31.1 +2.33.1 -From 40c2118465404e84368ba6db8a27a68620878b5d Mon Sep 17 00:00:00 2001 +From 51c895807ae272520bb5ffa21f783eb64f3e028e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:59:19 +0200 -Subject: [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in +Subject: [PATCH 029/103] s3:libsmb: Use 'enum smb_signing_setting' in cliconnect.c Signed-off-by: Andreas Schneider @@ -3248,10 +3246,10 @@ Reviewed-by: Stefan Metzmacher 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index f20146378e3..bb20aa59385 100644 +index 004a9a57af7..c12c0c15f4d 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c -@@ -2631,7 +2631,7 @@ static NTSTATUS cli_connect_sock_recv(struct tevent_req *req, +@@ -2640,7 +2640,7 @@ static NTSTATUS cli_connect_sock_recv(struct tevent_req *req, struct cli_connect_nb_state { const char *desthost; @@ -3260,7 +3258,7 @@ index f20146378e3..bb20aa59385 100644 int flags; struct cli_state *cli; }; -@@ -2642,7 +2642,7 @@ static struct tevent_req *cli_connect_nb_send( +@@ -2651,7 +2651,7 @@ static struct tevent_req *cli_connect_nb_send( TALLOC_CTX *mem_ctx, struct tevent_context *ev, const char *host, const struct sockaddr_storage *dest_ss, uint16_t port, int name_type, const char *myname, @@ -3269,7 +3267,7 @@ index f20146378e3..bb20aa59385 100644 { struct tevent_req *req, *subreq; struct cli_connect_nb_state *state; -@@ -2727,7 +2727,7 @@ static NTSTATUS cli_connect_nb_recv(struct tevent_req *req, +@@ -2736,7 +2736,7 @@ static NTSTATUS cli_connect_nb_recv(struct tevent_req *req, NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss, uint16_t port, int name_type, const char *myname, @@ -3278,7 +3276,7 @@ index f20146378e3..bb20aa59385 100644 { struct tevent_context *ev; struct tevent_req *req; -@@ -2776,7 +2776,7 @@ static struct tevent_req *cli_start_connection_send( +@@ -2785,7 +2785,7 @@ static struct tevent_req *cli_start_connection_send( TALLOC_CTX *mem_ctx, struct tevent_context *ev, const char *my_name, const char *dest_host, const struct sockaddr_storage *dest_ss, int port, @@ -3287,7 +3285,7 @@ index f20146378e3..bb20aa59385 100644 { struct tevent_req *req, *subreq; struct cli_start_connection_state *state; -@@ -2881,7 +2881,7 @@ NTSTATUS cli_start_connection(struct cli_state **output_cli, +@@ -2890,7 +2890,7 @@ NTSTATUS cli_start_connection(struct cli_state **output_cli, const char *my_name, const char *dest_host, const struct sockaddr_storage *dest_ss, int port, @@ -3296,7 +3294,7 @@ index f20146378e3..bb20aa59385 100644 { struct tevent_context *ev; struct tevent_req *req; -@@ -3361,7 +3361,7 @@ struct tevent_req *cli_full_connection_creds_send( +@@ -3370,7 +3370,7 @@ struct tevent_req *cli_full_connection_creds_send( const struct sockaddr_storage *dest_ss, int port, const char *service, const char *service_type, struct cli_credentials *creds, @@ -3305,7 +3303,7 @@ index f20146378e3..bb20aa59385 100644 { struct tevent_req *req, *subreq; struct cli_full_connection_creds_state *state; -@@ -3520,7 +3520,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, +@@ -3529,7 +3529,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, const char *service, const char *service_type, struct cli_credentials *creds, int flags, @@ -3361,13 +3359,13 @@ index d214cdabca4..995187e21b4 100644 void cli_nt_pipes_close(struct cli_state *cli); void cli_shutdown(struct cli_state *cli); -- -2.31.1 +2.33.1 -From 6c640b56c8d8ac11b60a5b8e2e55fbe63982cae8 Mon Sep 17 00:00:00 2001 +From 88564455bb8d70d8bf7e79970c8b76b0445f0105 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:11:31 +0200 -Subject: [PATCH 030/105] s3:client: Turn off smb signing for message op +Subject: [PATCH 030/103] s3:client: Turn off smb signing for message op Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -3420,7 +3418,7 @@ index 0f2f6520fc3..bbaa0c17881 100644 raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) # Reset signing state diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py -index d6f5de7440a..34785e2a2a7 100644 +index 97d9c7fada9..0a085a04171 100644 --- a/python/samba/tests/dcerpc/raw_testcase.py +++ b/python/samba/tests/dcerpc/raw_testcase.py @@ -46,7 +46,7 @@ class smb_pipe_socket(object): @@ -3449,10 +3447,10 @@ index 8c7ceb644aa..56309efcea7 100644 d_printf("Connection to %s failed. Error %s\n", desthost, nt_errstr(status)); return 1; diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c -index 3579a040830..f8a4d56cf53 100644 +index 7eb99eba12b..87a1c286b16 100644 --- a/source3/libsmb/pylibsmb.c +++ b/source3/libsmb/pylibsmb.c -@@ -440,9 +440,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -442,9 +442,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, PyObject *py_lp = Py_None; PyObject *py_multi_threaded = Py_False; bool multi_threaded = false; @@ -3463,7 +3461,7 @@ index 3579a040830..f8a4d56cf53 100644 PyObject *py_force_smb1 = Py_False; bool force_smb1 = false; PyObject *py_ipc = Py_False; -@@ -453,7 +451,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -455,7 +453,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, static const char *kwlist[] = { "host", "share", "lp", "creds", @@ -3472,7 +3470,7 @@ index 3579a040830..f8a4d56cf53 100644 "ipc", NULL }; -@@ -465,11 +463,10 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -467,11 +465,10 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, } ret = ParseTupleAndKeywords( @@ -3485,7 +3483,7 @@ index 3579a040830..f8a4d56cf53 100644 &py_force_smb1, &py_ipc); -@@ -480,13 +477,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -482,13 +479,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, } multi_threaded = PyObject_IsTrue(py_multi_threaded); @@ -3499,7 +3497,7 @@ index 3579a040830..f8a4d56cf53 100644 if (force_smb1) { /* * As most of the cli_*_send() function -@@ -532,6 +524,12 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -534,6 +526,12 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, cli_creds = PyCredentials_AsCliCredentials(creds); } @@ -3513,13 +3511,13 @@ index 3579a040830..f8a4d56cf53 100644 NULL, self->ev, "myname", host, NULL, 0, share, "?????", cli_creds, flags, signing_state); -- -2.31.1 +2.33.1 -From 8ce8cf3ac5b6587609a4772e5272733bb0b2668f Mon Sep 17 00:00:00 2001 +From a3a45a76a3446078667658ee1b328c032abee866 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:20:02 +0200 -Subject: [PATCH 031/105] s3:libsmb: Remove signing_state from +Subject: [PATCH 031/103] s3:libsmb: Remove signing_state from cli_full_connection_creds_send() Signed-off-by: Andreas Schneider @@ -3531,10 +3529,10 @@ Reviewed-by: Stefan Metzmacher 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index bb20aa59385..0ff9c283e39 100644 +index c12c0c15f4d..40d82070232 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c -@@ -3361,10 +3361,11 @@ struct tevent_req *cli_full_connection_creds_send( +@@ -3370,10 +3370,11 @@ struct tevent_req *cli_full_connection_creds_send( const struct sockaddr_storage *dest_ss, int port, const char *service, const char *service_type, struct cli_credentials *creds, @@ -3547,7 +3545,7 @@ index bb20aa59385..0ff9c283e39 100644 req = tevent_req_create(mem_ctx, &state, struct cli_full_connection_creds_state); -@@ -3379,6 +3380,12 @@ struct tevent_req *cli_full_connection_creds_send( +@@ -3388,6 +3389,12 @@ struct tevent_req *cli_full_connection_creds_send( state->creds = creds; state->flags = flags; @@ -3560,7 +3558,7 @@ index bb20aa59385..0ff9c283e39 100644 subreq = cli_start_connection_send( state, ev, my_name, dest_host, dest_ss, port, signing_state, flags); -@@ -3532,7 +3539,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, +@@ -3541,7 +3548,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, } req = cli_full_connection_creds_send( ev, ev, my_name, dest_host, dest_ss, port, service, @@ -3583,10 +3581,10 @@ index 995187e21b4..bef04d32638 100644 struct cli_state **output_cli); NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c -index f8a4d56cf53..c7a2d73afcb 100644 +index 87a1c286b16..7715f4108f3 100644 --- a/source3/libsmb/pylibsmb.c +++ b/source3/libsmb/pylibsmb.c -@@ -440,7 +440,6 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -442,7 +442,6 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, PyObject *py_lp = Py_None; PyObject *py_multi_threaded = Py_False; bool multi_threaded = false; @@ -3594,7 +3592,7 @@ index f8a4d56cf53..c7a2d73afcb 100644 PyObject *py_force_smb1 = Py_False; bool force_smb1 = false; PyObject *py_ipc = Py_False; -@@ -524,15 +523,9 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, +@@ -526,15 +525,9 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, cli_creds = PyCredentials_AsCliCredentials(creds); } @@ -3612,13 +3610,13 @@ index f8a4d56cf53..c7a2d73afcb 100644 return -1; } -- -2.31.1 +2.33.1 -From a26fc81d9dd0ee303ffa48dc9ab73cb3f7e059a6 Mon Sep 17 00:00:00 2001 +From d0ff800cfe39cf6fb0c41bf0dcdf5c7c8462f53a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 14:59:14 +0200 -Subject: [PATCH 032/105] s3:libsmb: Remove signing_state from +Subject: [PATCH 032/103] s3:libsmb: Remove signing_state from cli_full_connection_creds() Signed-off-by: Andreas Schneider @@ -3714,10 +3712,10 @@ index 392e3eff74f..f3bf27e6c00 100644 if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index 0ff9c283e39..b24743d789b 100644 +index 40d82070232..ca5d3e77da7 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c -@@ -3526,8 +3526,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, +@@ -3535,8 +3535,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, const struct sockaddr_storage *dest_ss, int port, const char *service, const char *service_type, struct cli_credentials *creds, @@ -3727,7 +3725,7 @@ index 0ff9c283e39..b24743d789b 100644 { struct tevent_context *ev; struct tevent_req *req; -@@ -3684,8 +3683,7 @@ struct cli_state *get_ipc_connect(char *server, +@@ -3693,8 +3692,7 @@ struct cli_state *get_ipc_connect(char *server, nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", get_cmdline_auth_info_creds(user_info), @@ -3983,13 +3981,13 @@ index 954d6eba804..fea066ce468 100644 DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); return NULL; -- -2.31.1 +2.33.1 -From cd8bcd19a3dd5be0cb54df9ecbe43bee13c69763 Mon Sep 17 00:00:00 2001 +From e43c942a69eb70822e015b008828e432ca8889d0 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 8 Jun 2020 08:04:24 +0200 -Subject: [PATCH 033/105] s3:libsmb: Add encryption support to +Subject: [PATCH 033/103] s3:libsmb: Add encryption support to cli_full_connection_creds*() Pair-Programmed-With: Andreas Schneider @@ -4002,10 +4000,10 @@ Reviewed-by: Andreas Schneider 1 file changed, 166 insertions(+) diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index b24743d789b..abfd18bfaf1 100644 +index ca5d3e77da7..45eafa97885 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c -@@ -3352,6 +3352,10 @@ static int cli_full_connection_creds_state_destructor( +@@ -3361,6 +3361,10 @@ static int cli_full_connection_creds_state_destructor( static void cli_full_connection_creds_conn_done(struct tevent_req *subreq); static void cli_full_connection_creds_sess_start(struct tevent_req *req); static void cli_full_connection_creds_sess_done(struct tevent_req *subreq); @@ -4016,7 +4014,7 @@ index b24743d789b..abfd18bfaf1 100644 static void cli_full_connection_creds_tcon_start(struct tevent_req *req); static void cli_full_connection_creds_tcon_done(struct tevent_req *subreq); -@@ -3366,6 +3370,8 @@ struct tevent_req *cli_full_connection_creds_send( +@@ -3375,6 +3379,8 @@ struct tevent_req *cli_full_connection_creds_send( struct tevent_req *req, *subreq; struct cli_full_connection_creds_state *state; enum smb_signing_setting signing_state; @@ -4025,7 +4023,7 @@ index b24743d789b..abfd18bfaf1 100644 req = tevent_req_create(mem_ctx, &state, struct cli_full_connection_creds_state); -@@ -3386,6 +3392,16 @@ struct tevent_req *cli_full_connection_creds_send( +@@ -3395,6 +3401,16 @@ struct tevent_req *cli_full_connection_creds_send( signing_state = cli_credentials_get_smb_signing(creds); } @@ -4042,7 +4040,7 @@ index b24743d789b..abfd18bfaf1 100644 subreq = cli_start_connection_send( state, ev, my_name, dest_host, dest_ss, port, signing_state, flags); -@@ -3460,6 +3476,156 @@ static void cli_full_connection_creds_sess_done(struct tevent_req *subreq) +@@ -3469,6 +3485,156 @@ static void cli_full_connection_creds_sess_done(struct tevent_req *subreq) return; } @@ -4200,13 +4198,13 @@ index b24743d789b..abfd18bfaf1 100644 } -- -2.31.1 +2.33.1 -From e7e622ffa049878df69bc59002255f89ae6b0b94 Mon Sep 17 00:00:00 2001 +From 57bba0cd6455944d53a24cb23595fec4501084b7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 11:26:00 +0200 -Subject: [PATCH 034/105] python: Add a test for SMB encryption +Subject: [PATCH 034/103] python: Add a test for SMB encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4274,13 +4272,13 @@ index e8f8e7fe94d..81d4e482644 100644 if __name__ == "__main__": import unittest -- -2.31.1 +2.33.1 -From 0b2a5d5372a76ce3d56c12d670f232f22d672bad Mon Sep 17 00:00:00 2001 +From 99f6e2a0b4ff21fb3c5ccf5e4c270d2abcbdaebc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:31:02 +0200 -Subject: [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() +Subject: [PATCH 035/103] s3:net: Use cli_credentials_set_smb_encryption() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4323,13 +4321,13 @@ index b139fb2d0da..5829d891075 100644 } -- -2.31.1 +2.33.1 -From d9db3f116c0afeafaf599df9d48be58ce4b28b98 Mon Sep 17 00:00:00 2001 +From 346648850bfff3b98d4fdbe6868434692f95470f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:40:13 +0200 -Subject: [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() +Subject: [PATCH 036/103] s3:libsmb: Use cli_credentials_set_smb_encryption() This also adds a SMBC_ENCRYPTLEVEL_DEFAULT to 'enum smbc_smb_encrypt_level' in order to use the smb.conf default value. @@ -4682,13 +4680,13 @@ index ec4a516b2ee..61503d0a98b 100644 + vnum='0.7.0', pc_files='smbclient.pc') -- -2.31.1 +2.33.1 -From 93fbea950f6bd5edc1b61c8f069f9518f251f5f0 Mon Sep 17 00:00:00 2001 +From c1a9a8948749d3ad29eb38de86780e488a7331cd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:43:33 +0200 -Subject: [PATCH 037/105] s3:client: Remove unused smb encryption code +Subject: [PATCH 037/103] s3:client: Remove unused smb encryption code Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4718,13 +4716,13 @@ index f56dc323b6e..16a8d44c069 100644 *output_cli = cli; return NT_STATUS_OK; -- -2.31.1 +2.33.1 -From 47001c60bd87b2da1d2b17838d79ab7f88b0fbd4 Mon Sep 17 00:00:00 2001 +From f3b752d28681c6f072399fbc76d1f995b795e337 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:47:05 +0200 -Subject: [PATCH 038/105] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 038/103] s3:utils: Remove obsolete force encryption from smbacls Signed-off-by: Andreas Schneider @@ -4755,13 +4753,13 @@ index 5983ebbd0a5..8fd9fcc5780 100644 } -- -2.31.1 +2.33.1 -From 15d7a20de7217b69a1a78081f550fb81082b6629 Mon Sep 17 00:00:00 2001 +From 43c3b77a0b94d2e183552879739fdf7d14fcf606 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:48:18 +0200 -Subject: [PATCH 039/105] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 039/103] s3:utils: Remove obsolete force encryption from mdfind Signed-off-by: Andreas Schneider @@ -4789,13 +4787,13 @@ index 2ac4fde7daf..ef2657e4fa5 100644 NCACN_NP, &ndr_table_mdssvc, -- -2.31.1 +2.33.1 -From 0b48c264633422fa459b1d59001f0edc743b1aba Mon Sep 17 00:00:00 2001 +From da64006bca958b76435c43bcd7f8d033571180cc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:49:28 +0200 -Subject: [PATCH 040/105] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 040/103] s3:utils: Remove obsolete force encryption from smbcquotas Signed-off-by: Andreas Schneider @@ -4827,13 +4825,13 @@ index fea066ce468..4ceac7b3ab0 100644 } -- -2.31.1 +2.33.1 -From ebecd6b5b125630a3ff9c08f3ef6ffa7137795c0 Mon Sep 17 00:00:00 2001 +From a8c8f4e8476ad81b4d0f6d9536e52e412ee6a844 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:51:18 +0200 -Subject: [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from +Subject: [PATCH 041/103] s3:rpcclient: Remove obsolete force encryption from rpcclient Signed-off-by: Andreas Schneider @@ -4865,13 +4863,13 @@ index 2ead6cc7ba5..575a42ebf70 100644 memset(cmdline_auth_info.password,'X',sizeof(cmdline_auth_info.password)); #endif -- -2.31.1 +2.33.1 -From ae3879060ccef1c7bb19cf26505575c164904c2b Mon Sep 17 00:00:00 2001 +From e06ad4469e48400c24ab4238f0e91ab528aaff7c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 10:58:36 +0200 -Subject: [PATCH 042/105] examples: Remove obsolete force encryption from +Subject: [PATCH 042/103] examples: Remove obsolete force encryption from smb2mount Signed-off-by: Andreas Schneider @@ -4903,13 +4901,13 @@ index 6206c3a9701..c64be573462 100644 } -- -2.31.1 +2.33.1 -From ece6dfebb43ada628fa97965ef834bd4433c3e6d Mon Sep 17 00:00:00 2001 +From 1f7fa4dce808e604ac108c31ef7fd1aca2ef6ff7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 11:05:59 +0200 -Subject: [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() +Subject: [PATCH 043/103] s3:libsmb: Make cli_cm_force_encryption_creds() static Signed-off-by: Andreas Schneider @@ -4951,13 +4949,13 @@ index 850cf12c8a6..eeabcaa7463 100644 struct cli_state *referring_cli, const char *server, -- -2.31.1 +2.33.1 -From 0d89aa3c788314a9bf53b9164ec774f5a903261c Mon Sep 17 00:00:00 2001 +From 77a43ba0dcadc63fba33816c9739158db0107b17 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 16:16:55 +0200 -Subject: [PATCH 044/105] s4:libcli: Return NTSTATUS errors for +Subject: [PATCH 044/103] s4:libcli: Return NTSTATUS errors for smb_composite_connect_send() Signed-off-by: Andreas Schneider @@ -5051,13 +5049,13 @@ index 582d43ef173..ad50ae0ac81 100644 return smb_composite_connect_recv(c, mem_ctx); } -- -2.31.1 +2.33.1 -From 94406c0bf84ff8a3a8bbb55ebedcddcf0f832333 Mon Sep 17 00:00:00 2001 +From 27229818ac811f9abd5cc4c01617822f0fc17f83 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:54:26 +0200 -Subject: [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 +Subject: [PATCH 045/103] s4:libcli: Return if encryption is requested for SMB1 Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5066,13 +5064,13 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 7 insertions(+) diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c -index 6ee4929e8d7..51e121bdce6 100644 +index a0a1f4baa56..93f6ce55177 100644 --- a/source4/libcli/smb_composite/sesssetup.c +++ b/source4/libcli/smb_composite/sesssetup.c -@@ -620,10 +620,17 @@ struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *se - struct composite_context *c; - struct sesssetup_state *state; +@@ -622,10 +622,17 @@ struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *se NTSTATUS status; + enum credentials_use_kerberos krb5_state = + cli_credentials_get_kerberos_state(io->in.credentials); + enum smb_encryption_setting encryption_state = + cli_credentials_get_smb_encryption(io->in.credentials); @@ -5088,13 +5086,13 @@ index 6ee4929e8d7..51e121bdce6 100644 if (composite_nomem(state, c)) return c; c->private_data = state; -- -2.31.1 +2.33.1 -From 2b05d3a069d98b49542f14cab802f5a75e04ca43 Mon Sep 17 00:00:00 2001 +From b1d3cf8457ed85198b184869ceedf6ff987c6cfd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:29:39 +0200 -Subject: [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() +Subject: [PATCH 046/103] s3:libcli: Split out smb2_connect_tcon_start() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5141,13 +5139,13 @@ index 6fc3993a4e8..95ff05eac8f 100644 subreq = smb2cli_tcon_send(state, state->ev, -- -2.31.1 +2.33.1 -From 48998a581ddce11e3eebbd0b16493caa4a891b3b Mon Sep 17 00:00:00 2001 +From 27484fd0b100a41ca8b187530c1174389034aa34 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:44:26 +0200 -Subject: [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() +Subject: [PATCH 047/103] s4:libcli: Add smb2_connect_enc_start() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5212,13 +5210,13 @@ index 95ff05eac8f..3a3ecdf20e8 100644 } -- -2.31.1 +2.33.1 -From 0dab6d1c2f21f01a09f0152a52e0b07b244e680a Mon Sep 17 00:00:00 2001 +From a595827453d33b136af7d3955c7f4009e879e986 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 10:18:52 +0200 -Subject: [PATCH 048/105] s4:libcli: Require signing for SMB encryption +Subject: [PATCH 048/103] s4:libcli: Require signing for SMB encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5268,13 +5266,13 @@ index 3a3ecdf20e8..9540704491e 100644 if (tevent_req_nterror(req, status)) { return tevent_req_post(req, ev); -- -2.31.1 +2.33.1 -From 7b781fafcb94f3a6e3bccc57b5e75fe5ecc8c30d Mon Sep 17 00:00:00 2001 +From fdab74deed1afb45152f3b1b73fbda0f92de1f1f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 14:27:07 +0200 -Subject: [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC +Subject: [PATCH 049/103] python:tests: Add test for SMB encrypted DCERPC connection Signed-off-by: Andreas Schneider @@ -5377,10 +5375,10 @@ index 00000000000..8e0d6a5ef0a + binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) + self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds) diff --git a/selftest/tests.py b/selftest/tests.py -index 9938bf53ed6..3246161f0d7 100644 +index 68cbcd5fbf1..f3fcdca4ab3 100644 --- a/selftest/tests.py +++ b/selftest/tests.py -@@ -92,6 +92,7 @@ planpythontestsuite( +@@ -93,6 +93,7 @@ planpythontestsuite( extra_path=[os.path.join(samba4srcdir, "..", "buildtools"), os.path.join(samba4srcdir, "..", "third_party", "waf")]) planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest") @@ -5389,13 +5387,13 @@ index 9938bf53ed6..3246161f0d7 100644 def cmdline(script, *args): -- -2.31.1 +2.33.1 -From 84fbe5d588f735d7284e652cea18628d0ab4d5e0 Mon Sep 17 00:00:00 2001 +From 3442d029d320975c792b5a2876999c9852e4842c Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:47:54 +0200 -Subject: [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() +Subject: [PATCH 050/103] auth:gensec: Add gensec_security_sasl_names() Pair-Programmed-With: Andreas Schneider @@ -5519,13 +5517,13 @@ index d2d62d6652e..4eb45643714 100644 * Return a unique list of security subsystems from those specified in * the list of SASL names. -- -2.31.1 +2.33.1 -From 953c1831d397e2699343778244679deeebb3c2b3 Mon Sep 17 00:00:00 2001 +From 51a7d8be1d4374394216ca12cb65f17bffaa27e6 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:48:27 +0200 -Subject: [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in +Subject: [PATCH 051/103] s4:ldap_server: Use samba_server_gensec_start() in ldapsrv_backend_Init() Signed-off-by: Stefan Metzmacher @@ -5631,13 +5629,13 @@ index 2839082daef..915d9b94f9b 100644 ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs); } -- -2.31.1 +2.33.1 -From 71f34484b5573e85e2db0e3bcaddca6dea921d75 Mon Sep 17 00:00:00 2001 +From 1f2dca557a1295077f411ba1af522583d094f819 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:39:15 +0200 -Subject: [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a +Subject: [PATCH 052/103] auth:gensec: Make gensec_use_kerberos_mechs() a static function Signed-off-by: Stefan Metzmacher @@ -5681,13 +5679,13 @@ index 4eb45643714..ebcab76999a 100644 const struct gensec_security_ops **new_gensec_list; int i, j, num_mechs_in; -- -2.31.1 +2.33.1 -From f974fcb76a58515a848e2c94ff43a3a8ab781b98 Mon Sep 17 00:00:00 2001 +From f32eacf0d4903a4e46da2506b47718eed0265980 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:41:43 +0200 -Subject: [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to +Subject: [PATCH 053/103] auth:gensec: Pass use_kerberos and keep_schannel to gensec_use_kerberos_mechs() Signed-off-by: Stefan Metzmacher @@ -5755,13 +5753,13 @@ index ebcab76999a..8d1b41fec74 100644 } -- -2.31.1 +2.33.1 -From 373566a4c0b9f466098edaaca2cb769dc1e77014 Mon Sep 17 00:00:00 2001 +From 5f95f53d05dc9d43676c397e244ab7632ef1bbcb Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 17:00:45 +0200 -Subject: [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel +Subject: [PATCH 054/103] auth:gensec: If Kerberos is required, keep schannel for machine account auth Signed-off-by: Stefan Metzmacher @@ -5792,13 +5790,13 @@ index 8d1b41fec74..3f42d611140 100644 if (gensec_security->settings->backends) { -- -2.31.1 +2.33.1 -From c701769574ddedd0fd22569c72993a79caa28d82 Mon Sep 17 00:00:00 2001 +From 67b4e53ff5c23d23d3d452d4df044afc2e998377 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:21 +0200 -Subject: [PATCH 055/105] auth:creds: Add cli_credentials_init_server() +Subject: [PATCH 055/103] auth:creds: Add cli_credentials_init_server() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5858,13 +5856,13 @@ index 7d0cf53194b..438bcdce232 100644 bool cli_credentials_wrong_password(struct cli_credentials *cred); const char *cli_credentials_get_password(struct cli_credentials *cred); -- -2.31.1 +2.33.1 -From 3b30ef57090aebd30fa48e671025a11f1f0aba6e Mon Sep 17 00:00:00 2001 +From d9769d2cc7c42392b72fd7f76f7beac799501f92 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:36 +0200 -Subject: [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() +Subject: [PATCH 056/103] s4:rpc_server: Use cli_credentials_init_server() Signed-off-by: Andreas Schneider (cherry picked from commit 6c94ebf77fdb7383be2042f5e20ba2ef598cd4a4) @@ -5906,13 +5904,13 @@ index 084857a44bf..e64148ef788 100644 call->event_ctx, imsg_ctx, -- -2.31.1 +2.33.1 -From c9b1c8897ddd39045c45b75c63f7344fcd35ee92 Mon Sep 17 00:00:00 2001 +From 65911e611e461f8c53a4ee89f83906d6c38735ed Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 7 Sep 2020 09:19:43 +0200 -Subject: [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for +Subject: [PATCH 057/103] s4:smb_server: Use cli_credentials_init_server() for negprot Signed-off-by: Andreas Schneider @@ -6006,13 +6004,13 @@ index 4aaaf46793b..c433eb194bd 100644 req->smb_conn->negotiate.server_credentials = talloc_steal(req->smb_conn, server_credentials); -- -2.31.1 +2.33.1 -From 190f1455e2e783ac0590ef3317724c7210f5a1ef Mon Sep 17 00:00:00 2001 +From ac7a244a45672197efdafceff0599c6ac405862e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:22 +0200 -Subject: [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb +Subject: [PATCH 058/103] selftest: Rename 'smb encrypt' to 'server smb encrypt' This makes it more clear what we want. 'smb encrypt' is a synonym for @@ -6026,10 +6024,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index c15057fa80b..aeebf303c9b 100755 +index 39327964569..5119535b707 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm -@@ -1182,7 +1182,7 @@ sub setup_simpleserver +@@ -1244,7 +1244,7 @@ sub setup_simpleserver ntlm auth = yes vfs objects = xattr_tdb streams_depot change notify = no @@ -6038,7 +6036,7 @@ index c15057fa80b..aeebf303c9b 100755 [vfs_aio_pthread] path = $prefix_abs/share -@@ -1249,7 +1249,7 @@ sub setup_simpleserver +@@ -1311,7 +1311,7 @@ sub setup_simpleserver [enc_desired] path = $prefix_abs/share vfs objects = @@ -6047,7 +6045,7 @@ index c15057fa80b..aeebf303c9b 100755 [hidenewfiles] path = $prefix_abs/share -@@ -2372,7 +2372,7 @@ sub provision($$) +@@ -2432,7 +2432,7 @@ sub provision($$) [tmpenc] path = $shrdir comment = encrypt smb username is [%U] @@ -6057,13 +6055,13 @@ index c15057fa80b..aeebf303c9b 100755 [tmpguest] path = $shrdir -- -2.31.1 +2.33.1 -From e875960f0c9dd06faa1bc685bb477b4aa2df36ab Mon Sep 17 00:00:00 2001 +From 6bb81bdc8d04736693a0255a620febb39af6f8ea Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 12:30:08 +0200 -Subject: [PATCH 059/105] selftest: Move enc_desired to provision to have it in +Subject: [PATCH 059/103] selftest: Move enc_desired to provision to have it in 'fileserver' too Signed-off-by: Andreas Schneider @@ -6074,10 +6072,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index aeebf303c9b..7873692b8ec 100755 +index 5119535b707..d773e14746c 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm -@@ -1246,11 +1246,6 @@ sub setup_simpleserver +@@ -1308,11 +1308,6 @@ sub setup_simpleserver hide files = /hidefile/ hide dot files = yes @@ -6089,7 +6087,7 @@ index aeebf303c9b..7873692b8ec 100755 [hidenewfiles] path = $prefix_abs/share hide new files timeout = 5 -@@ -2854,7 +2849,13 @@ sub provision($$) +@@ -2914,7 +2909,13 @@ sub provision($$) [delete_readonly] path = $prefix_abs/share delete readonly = yes @@ -6104,13 +6102,13 @@ index aeebf303c9b..7873692b8ec 100755 my $net = Samba::bindir_path($self, "net"); -- -2.31.1 +2.33.1 -From bbfa3bd50d5c7ba3e810e4dd4c44694b045e4889 Mon Sep 17 00:00:00 2001 +From f7468c0c5654d24818639e2d2a44f64dc9c5b8d0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:20 +0200 -Subject: [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb +Subject: [PATCH 060/103] s3:tests: Add smbclient tests for 'client smb encrypt' Signed-off-by: Andreas Schneider @@ -6134,10 +6132,10 @@ index 00000000000..972096bdc8b +^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver +^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index 7873692b8ec..844743d4145 100755 +index d773e14746c..1c44b44edc4 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm -@@ -2854,6 +2854,11 @@ sub provision($$) +@@ -2914,6 +2914,11 @@ sub provision($$) path = $prefix_abs/share vfs objects = server smb encrypt = desired @@ -6245,13 +6243,13 @@ index 90bda2052af..26d8c2230b6 100755 [os.path.join(samba3srcdir, "script/tests/test_rpcclient_netsessenum.sh"), -- -2.31.1 +2.33.1 -From 76ca7b477dc739777b01322f3225cd1b6f8ca97e Mon Sep 17 00:00:00 2001 +From d62e4122c1062a43d3cbfa3eda0755b0f888484c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:19:27 +0200 -Subject: [PATCH 061/105] s3:client: Remove global smb_encrypt +Subject: [PATCH 061/103] s3:client: Remove global smb_encrypt Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6353,13 +6351,13 @@ index 56309efcea7..60d4fb3c5ee 100644 max_protocol = lp_client_max_protocol(); -- -2.31.1 +2.33.1 -From 402b5cd6e6a8b541d6bdf6494692c36f924ee6c9 Mon Sep 17 00:00:00 2001 +From d62caf7a37fab43cd2fdd706cd1fb8b67233a720 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:24:27 +0200 -Subject: [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() +Subject: [PATCH 062/103] s3:libsmb: Remove force_encrypt from cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6507,13 +6505,13 @@ index eeabcaa7463..bb3e9e6874e 100644 const struct sockaddr_storage *dest_ss, int port, -- -2.31.1 +2.33.1 -From eb6b9b3fe6bde3544347b50b8576986b9f4635fb Mon Sep 17 00:00:00 2001 +From 2a6929e61014c731bd4202c4b8a983c800c8cf69 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:26:39 +0200 -Subject: [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() +Subject: [PATCH 063/103] s3:libsmb: Remove force_encrypt from cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6569,13 +6567,13 @@ index 13613afb6e7..9e5c9e57e74 100644 NULL, /* dest_ss */ 0, /* port */ -- -2.31.1 +2.33.1 -From d9c3cbc0ea5d33a42e4d213b0caa5d39585b46a2 Mon Sep 17 00:00:00 2001 +From 984ec1e557f7b6cd37b2c102abf390e3c83fa07e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:28:28 +0200 -Subject: [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs +Subject: [PATCH 064/103] s3:libsmb: Remove force_encrypt from clidfs do_connect() Signed-off-by: Andreas Schneider @@ -6630,13 +6628,13 @@ index 9e5c9e57e74..c5b79bb37dd 100644 if (!NT_STATUS_IS_OK(status)) { -- -2.31.1 +2.33.1 -From 9848ab05ef48882218cf1ca2a4e9ddf74d18504f Mon Sep 17 00:00:00 2001 +From 00f21bf822dabfffe4b61b9e3390f06617bab391 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:52:11 +0200 -Subject: [PATCH 065/105] s3:libsmb: Remove force_encrypt from +Subject: [PATCH 065/103] s3:libsmb: Remove force_encrypt from cli_check_msdfs_proxy() Signed-off-by: Andreas Schneider @@ -6729,13 +6727,13 @@ index bb3e9e6874e..f2b0a8c5ff8 100644 /* The following definitions come from libsmb/clientgen.c */ -- -2.31.1 +2.33.1 -From 0c6fd4334f82cace19124e9e4887372cefeb3891 Mon Sep 17 00:00:00 2001 +From 8cd4318aa460b00db9c36aae638094ce8af24488 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:15:09 +0200 -Subject: [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs +Subject: [PATCH 066/103] s3:libsmb: Pass cli_credentials to clidfs do_connect() Signed-off-by: Andreas Schneider @@ -6848,13 +6846,13 @@ index 8fb450b5327..396856842aa 100644 dest_ss, port, name_type, &cli); -- -2.31.1 +2.33.1 -From 8846652624edc546bc5588d3aa0905e3f43db637 Mon Sep 17 00:00:00 2001 +From b7e861f8b85b16351a74c302b1c3e4844f661329 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:18:16 +0200 -Subject: [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() +Subject: [PATCH 067/103] s3:libsmb: Pass cli_credentials to cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6919,13 +6917,13 @@ index 396856842aa..e17c0b875fd 100644 NULL, /* dest_ss */ 0, /* port */ -- -2.31.1 +2.33.1 -From 9abf11b2475cf7e46840b64025ccdc2a0d3c6dbb Mon Sep 17 00:00:00 2001 +From b6338098c53547645ff000ee945d337fa6bddf69 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:26:54 +0200 -Subject: [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() +Subject: [PATCH 068/103] s3:libsmb: Pass cli_credentials to cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -7130,13 +7128,13 @@ index f2b0a8c5ff8..0b8cf2a6036 100644 struct client_dfs_referral; NTSTATUS cli_dfs_get_referral_ex(TALLOC_CTX *ctx, -- -2.31.1 +2.33.1 -From 16840d117c536de77b21e453c66f25d23871c4e0 Mon Sep 17 00:00:00 2001 +From 5f3bd46bc86ca988491f9b3ce23a94ab13af471f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:42:25 +0200 -Subject: [PATCH 069/105] s3:libsmb: Pass cli_credentials to +Subject: [PATCH 069/103] s3:libsmb: Pass cli_credentials to cli_resolve_path(), using helper variables. Signed-off-by: Andreas Schneider @@ -8017,13 +8015,13 @@ index 8fd9fcc5780..4989ec633c3 100644 filename, &targetcli, -- -2.31.1 +2.33.1 -From 6b3a5bdb98434cb3eb88c5b9eec2b9ebc4ed79ba Mon Sep 17 00:00:00 2001 +From e6f06ec0efd3138a4785fb762b39e03b326fc23a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:40:49 +0200 -Subject: [PATCH 070/105] s3:client: Remove global max_protocol +Subject: [PATCH 070/103] s3:client: Remove global max_protocol Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8099,13 +8097,13 @@ index 13e48f80a01..902cdec8b64 100644 if (cmdstr) process_command_string(cmdstr); -- -2.31.1 +2.33.1 -From 067e4f27e24f874ebcce497851337905b48ee7e2 Mon Sep 17 00:00:00 2001 +From 62bf2411cfb8057e7ea98f826bf619244e3f1035 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:43:46 +0200 -Subject: [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() +Subject: [PATCH 071/103] s3:libsmb: Remove max_protocol from cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8224,13 +8222,13 @@ index 517738dbcd7..8aaaff2cb1e 100644 int port, int name_type, -- -2.31.1 +2.33.1 -From d2a07db0250e067d07adf69fee78c88ce51baf88 Mon Sep 17 00:00:00 2001 +From 7d1fb6232eb0769d2b5519cf1fb80bebbefe7200 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:45:12 +0200 -Subject: [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() +Subject: [PATCH 072/103] s3:libcmb: Remove max_protocol from cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8277,13 +8275,13 @@ index eb7da18c5ce..88faf22507e 100644 0, /* port */ 0x20, -- -2.31.1 +2.33.1 -From bfaa7e48c302ceee9080d5f3fe640950a4a9a6c7 Mon Sep 17 00:00:00 2001 +From ec9acf69a3bc8ef8e90b18b84e772e705c8dc5ae Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:46:29 +0200 -Subject: [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs +Subject: [PATCH 073/103] s3:libsmb: Remove max_protocol from clidfs do_connect() The if check for max_protocol == 0 is part of lp_client_max_protocol(). @@ -8340,13 +8338,13 @@ index 88faf22507e..2c2e77b685a 100644 if (!NT_STATUS_IS_OK(status)) { -- -2.31.1 +2.33.1 -From a87be8325e17a16f8e89f9ff7f12c79212a5645f Mon Sep 17 00:00:00 2001 +From 59037ca851f7072da88744a59e367f11742a895a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Aug 2020 15:47:35 +0200 -Subject: [PATCH 074/105] s3:include: Move loadparm prototypes to own header +Subject: [PATCH 074/103] s3:include: Move loadparm prototypes to own header file Signed-off-by: Andreas Schneider @@ -8758,13 +8756,13 @@ index 00000000000..7686877ccf1 + +#endif /* _S3_LOADPARM_H */ -- -2.31.1 +2.33.1 -From d06b27b2344875cc2bfa77d5438d9543f215b233 Mon Sep 17 00:00:00 2001 +From 02f7af27b6a13328fc5e081b43753f5f60e11114 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 11 Aug 2020 10:41:07 +0200 -Subject: [PATCH 075/105] s3:lib: Move interface prototypes to own header file +Subject: [PATCH 075/103] s3:lib: Move interface prototypes to own header file Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8864,13 +8862,13 @@ index 00000000000..f45435b4a81 + +#endif /* _INTERFACE_H */ -- -2.31.1 +2.33.1 -From 7e2cbeddea7398a3bf98e70bf0bd0cc8f8631dfd Mon Sep 17 00:00:00 2001 +From 36596f29922a861ef1eb8ad05a29671031241279 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:16 +0100 -Subject: [PATCH 076/105] idl: Add SID_SAMBA_SMB3 +Subject: [PATCH 076/103] idl: Add SID_SAMBA_SMB3 Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -8880,7 +8878,7 @@ Reviewed-by: Alexander Bokovoy 1 file changed, 3 insertions(+) diff --git a/librpc/idl/security.idl b/librpc/idl/security.idl -index a92e8f1518e..06bf7449a70 100644 +index 9845becd826..3df96dedbdd 100644 --- a/librpc/idl/security.idl +++ b/librpc/idl/security.idl @@ -282,6 +282,9 @@ interface security @@ -8894,13 +8892,13 @@ index a92e8f1518e..06bf7449a70 100644 const string NAME_NT_SERVICE = "NT SERVICE"; -- -2.31.1 +2.33.1 -From 7c3c02fa82ad5463ac586066c64eb56481f121d2 Mon Sep 17 00:00:00 2001 +From 5ba8528b744b245b73f187b75b4bf39193d5a799 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:29 +0100 -Subject: [PATCH 077/105] s3:smbd: Add SMB3 connection information to session +Subject: [PATCH 077/103] s3:smbd: Add SMB3 connection information to session info Signed-off-by: Andreas Schneider @@ -9051,13 +9049,13 @@ index cf9de185c1f..cd24b7d2ed5 100644 } -- -2.31.1 +2.33.1 -From 545e659f4be06d90c3d201e300a6ba66879f4d54 Mon Sep 17 00:00:00 2001 +From dcd118ced1389720b2123fe30bca21bdf714dda4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Mar 2020 14:11:56 +0100 -Subject: [PATCH 078/105] librpc: Add dcerpc helper +Subject: [PATCH 078/103] librpc: Add dcerpc helper dcerpc_is_transport_encrypted() Signed-off-by: Andreas Schneider @@ -9247,10 +9245,10 @@ index 00000000000..c0f09ee494e + +#endif /* _DCERPC_HELPER_H */ diff --git a/librpc/wscript_build b/librpc/wscript_build -index 27b180fa63d..109a1834841 100644 +index a1c3c994876..5e78d1e634b 100644 --- a/librpc/wscript_build +++ b/librpc/wscript_build -@@ -669,6 +669,15 @@ bld.SAMBA_LIBRARY('dcerpc-server-core', +@@ -694,6 +694,15 @@ bld.SAMBA_LIBRARY('dcerpc-server-core', autoproto='rpc/dcesrv_core_proto.h', vnum='0.0.1') @@ -9267,13 +9265,13 @@ index 27b180fa63d..109a1834841 100644 source='gen_ndr/ndr_winbind.c', public_deps='ndr NDR_LSA' -- -2.31.1 +2.33.1 -From edf4ad5bfc2e78acfe506bb273d1170331836091 Mon Sep 17 00:00:00 2001 +From 007e530ce0194b77e17589f25465136f2df4c0a3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 28 Aug 2020 16:31:17 +0200 -Subject: [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' +Subject: [PATCH 079/103] s3:smbd: Use defines to set 'srv_smb_encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9304,13 +9302,13 @@ index d51a3de9497..785cbb23b5f 100644 char smb3_sid_str[SID_MAX_SIZE]; struct dom_sid smb3_dom_sid; -- -2.31.1 +2.33.1 -From 59ce51b4e559b9b376e90a0c2244c879f6251881 Mon Sep 17 00:00:00 2001 +From 21568b31f941d8b534036710dae71811b36b0f30 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 12 Nov 2019 16:56:45 +0100 -Subject: [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords +Subject: [PATCH 080/103] s3:rpc_server: Allow to use RC4 for setting passwords Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9541,27 +9539,27 @@ index 2af02ad6fa8..eb91ac09384 100644 bld.SAMBA3_SUBSYSTEM('RPC_SPOOLSS', source='''spoolss/srv_spoolss_nt.c -- -2.31.1 +2.33.1 -From 9301741e90f81ba99442c9b56f763ed79c2072f7 Mon Sep 17 00:00:00 2001 +From d682c7a4e59c4f402096de5ddcd54ddb33886fe6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 15 Nov 2019 13:49:40 +0100 -Subject: [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords +Subject: [PATCH 081/103] s4:rpc_server: Allow to use RC4 for setting passwords Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit a9c532c6d3e85fbe49b7040254cfc66ab54074bc) --- - source4/rpc_server/samr/samr_password.c | 30 +++++++++++++++++++++++++ + source4/rpc_server/samr/samr_password.c | 32 +++++++++++++++++++++++++ source4/rpc_server/wscript_build | 2 +- - 2 files changed, 31 insertions(+), 1 deletion(-) + 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c -index 52a644176e2..83b104fbd0e 100644 +index 9144c23155b..437e8f66275 100644 --- a/source4/rpc_server/samr/samr_password.c +++ b/source4/rpc_server/samr/samr_password.c -@@ -31,6 +31,8 @@ +@@ -32,6 +32,8 @@ #include "../lib/util/util_ldb.h" #include "rpc_server/samr/proto.h" #include "auth/auth_sam.h" @@ -9570,7 +9568,16 @@ index 52a644176e2..83b104fbd0e 100644 #include "lib/crypto/gnutls_helpers.h" #include -@@ -129,6 +131,8 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, +@@ -102,6 +104,8 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_OemChangePasswordUser2 *r) + { ++ struct auth_session_info *session_info = ++ dcesrv_call_session_info(dce_call); + struct imessaging_context *imsg_ctx = + dcesrv_imessaging_context(dce_call->conn); + NTSTATUS status = NT_STATUS_WRONG_PASSWORD; +@@ -128,6 +132,8 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, struct dom_sid *user_objectSid = NULL; gnutls_cipher_hd_t cipher_hnd = NULL; gnutls_datum_t lm_session_key; @@ -9579,7 +9586,7 @@ index 52a644176e2..83b104fbd0e 100644 int rc; if (pwbuf == NULL) { -@@ -144,6 +148,12 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, +@@ -143,6 +149,12 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, return NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER; } @@ -9591,8 +9598,8 @@ index 52a644176e2..83b104fbd0e 100644 + /* Connect to a SAMDB with system privileges for fetching the old pw * hashes. */ - sam_ctx = samdb_connect(mem_ctx, -@@ -188,11 +198,13 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + sam_ctx = dcesrv_samdb_connect_as_system(mem_ctx, dce_call); +@@ -182,11 +194,13 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, .size = sizeof(lm_pwd->hash), }; @@ -9606,7 +9613,7 @@ index 52a644176e2..83b104fbd0e 100644 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto failed; } -@@ -201,6 +213,7 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, +@@ -195,6 +209,7 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, pwbuf->data, 516); gnutls_cipher_deinit(cipher_hnd); @@ -9614,7 +9621,7 @@ index 52a644176e2..83b104fbd0e 100644 if (rc < 0) { status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto failed; -@@ -607,7 +620,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, +@@ -584,7 +599,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, DATA_BLOB session_key = data_blob(NULL, 0); gnutls_cipher_hd_t cipher_hnd = NULL; gnutls_datum_t _session_key; @@ -9632,7 +9639,7 @@ index 52a644176e2..83b104fbd0e 100644 nt_status = dcesrv_transport_session_key(dce_call, &session_key); if (!NT_STATUS_IS_OK(nt_status)) { -@@ -621,11 +644,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, +@@ -598,11 +623,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, .size = session_key.length, }; @@ -9650,7 +9657,7 @@ index 52a644176e2..83b104fbd0e 100644 nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; } -@@ -634,6 +663,7 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, +@@ -611,6 +642,7 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, pwbuf->data, 516); gnutls_cipher_deinit(cipher_hnd); @@ -9659,10 +9666,10 @@ index 52a644176e2..83b104fbd0e 100644 nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build -index de55ad6239a..c9c1978f223 100644 +index 765ae7ba62a..8c756721232 100644 --- a/source4/rpc_server/wscript_build +++ b/source4/rpc_server/wscript_build -@@ -87,7 +87,7 @@ bld.SAMBA_MODULE('dcesrv_samr', +@@ -80,7 +80,7 @@ bld.SAMBA_MODULE('dcesrv_samr', autoproto='samr/proto.h', subsystem='dcerpc_server', init_function='dcerpc_server_samr_init', @@ -9672,13 +9679,13 @@ index de55ad6239a..c9c1978f223 100644 -- -2.31.1 +2.33.1 -From 0491de23f74496546f8e046d17c2d35a982f542a Mon Sep 17 00:00:00 2001 +From 6fd9f85fbd60e1c78167a1c5a5f806a43e7add70 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:45:49 +0200 -Subject: [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips +Subject: [PATCH 082/103] lib:crypto: Add py binding for set_relax/strict fips mode Signed-off-by: Isaac Boukris @@ -9730,13 +9737,13 @@ index 32b946eee8f..ad18d3ada0f 100644 }; -- -2.31.1 +2.33.1 -From 4d7d990e7b2f025afbd9681de98cc888670636e7 Mon Sep 17 00:00:00 2001 +From 13d29ab8debfa0d92422849f85ec6bc7d9697adc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 28 Oct 2020 17:05:36 +0100 -Subject: [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam +Subject: [PATCH 083/103] s4:param: Add 'weak crypto' getter to pyparam Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9786,13 +9793,13 @@ index 4023fac4dd6..e15592b5743 100644 }; -- -2.31.1 +2.33.1 -From 12e7ec664999bc03bd34c5d1636a13baef13d438 Mon Sep 17 00:00:00 2001 +From a456c0ed4f3845a6d10efa9f2f96275daaa9d751 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 -Subject: [PATCH 084/105] python:tests: Add SAMR password change tests for fips +Subject: [PATCH 084/103] python:tests: Add SAMR password change tests for fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9998,10 +10005,10 @@ index 00000000000..109eeea98cc + + self.conn.SetUserInfo2(self.user_handle, level, info) diff --git a/selftest/tests.py b/selftest/tests.py -index 3246161f0d7..4f164db9c73 100644 +index f3fcdca4ab3..7fdd9788014 100644 --- a/selftest/tests.py +++ b/selftest/tests.py -@@ -93,6 +93,8 @@ planpythontestsuite( +@@ -94,6 +94,8 @@ planpythontestsuite( os.path.join(samba4srcdir, "..", "third_party", "waf")]) planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest") planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding") @@ -10011,13 +10018,13 @@ index 3246161f0d7..4f164db9c73 100644 def cmdline(script, *args): -- -2.31.1 +2.33.1 -From e93db2d240339ae9b6ec7b579e4a6bc2bedc77d2 Mon Sep 17 00:00:00 2001 +From ec553d4d01d03616d6c7fe630753652396081b15 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 -Subject: [PATCH 085/105] python:tests: Add SAMR password change tests for fips +Subject: [PATCH 085/103] python:tests: Add SAMR password change tests for fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -10031,10 +10038,10 @@ Autobuild-Date(master): Thu Oct 29 15:41:37 UTC 2020 on sn-devel-184 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm -index 77bd741d476..1ae9fb9d996 100755 +index 156dc16bda0..651faa73ec7 100755 --- a/selftest/target/Samba4.pm +++ b/selftest/target/Samba4.pm -@@ -1051,7 +1051,7 @@ servicePrincipalName: http/testupnspn.$ctx->{dnsname} +@@ -1078,7 +1078,7 @@ servicePrincipalName: http/testupnspn.$ctx->{dnsname} $samba_tool_cmd = ${cmd_env}; $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool") @@ -10044,49 +10051,50 @@ index 77bd741d476..1ae9fb9d996 100755 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n"); return undef; -- -2.31.1 +2.33.1 -From 3fa184ebdae4f84fee5231ca46e0c52c09b5a425 Mon Sep 17 00:00:00 2001 +From 0f45e361a6bbb69b0e32ad163e91f0706826b3d5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 09:40:41 +0200 -Subject: [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values +Subject: [PATCH 086/103] auth:creds: Rename CRED_USE_KERBEROS values Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 1298280a22ef7494fb85a6a5953bae15d22fa204) --- - auth/credentials/credentials.c | 8 +++++--- - auth/credentials/credentials.h | 9 ++++++--- - auth/credentials/credentials_krb5.c | 4 ++-- - auth/credentials/credentials_ntlm.c | 2 +- - auth/credentials/credentials_secrets.c | 5 +++-- - auth/credentials/pycredentials.c | 6 +++--- - auth/credentials/tests/simple.c | 2 +- - auth/credentials/wscript_build | 2 +- - auth/gensec/gensec_start.c | 8 ++++---- - examples/winexe/winexe.c | 4 ++-- - source3/auth/auth_generic.c | 4 ++-- - source3/lib/util_cmdline.c | 18 +++++++++--------- - source3/libads/sasl.c | 8 ++++---- - source3/libnet/libnet_join.c | 2 +- - source3/libsmb/cliconnect.c | 16 ++++++++-------- - source3/passdb/passdb.c | 6 +++--- - source3/passdb/pdb_samba_dsdb.c | 4 ++-- - source3/rpc_client/cli_pipe.c | 2 +- - source3/rpcclient/rpcclient.c | 8 ++++---- - source3/utils/net_ads.c | 2 +- - source3/utils/net_util.c | 6 +++--- - source3/utils/ntlm_auth.c | 4 ++-- - source3/winbindd/winbindd_cm.c | 2 +- - source4/auth/gensec/gensec_gssapi.c | 2 +- - source4/auth/session.c | 2 +- - source4/lib/cmdline/popt_credentials.c | 4 ++-- - source4/torture/ldap/session_expiry.c | 2 +- - source4/torture/raw/session.c | 4 ++-- - source4/torture/rpc/schannel.c | 4 ++-- - source4/torture/smb2/session.c | 12 ++++++------ - 30 files changed, 84 insertions(+), 78 deletions(-) + auth/credentials/credentials.c | 8 +++++--- + auth/credentials/credentials.h | 9 ++++++--- + auth/credentials/credentials_krb5.c | 4 ++-- + auth/credentials/credentials_ntlm.c | 2 +- + auth/credentials/credentials_secrets.c | 5 +++-- + auth/credentials/pycredentials.c | 6 +++--- + auth/credentials/tests/simple.c | 2 +- + auth/credentials/wscript_build | 2 +- + auth/gensec/gensec_start.c | 8 ++++---- + examples/winexe/winexe.c | 4 ++-- + source3/auth/auth_generic.c | 4 ++-- + source3/lib/util_cmdline.c | 18 +++++++++--------- + source3/libads/sasl.c | 8 ++++---- + source3/libnet/libnet_join.c | 2 +- + source3/libsmb/cliconnect.c | 18 +++++++++--------- + source3/passdb/passdb.c | 6 +++--- + source3/passdb/pdb_samba_dsdb.c | 4 ++-- + source3/rpc_client/cli_pipe.c | 2 +- + source3/rpcclient/rpcclient.c | 8 ++++---- + source3/utils/net_ads.c | 2 +- + source3/utils/net_util.c | 6 +++--- + source3/utils/ntlm_auth.c | 4 ++-- + source3/winbindd/winbindd_cm.c | 2 +- + source4/auth/gensec/gensec_gssapi.c | 2 +- + source4/auth/session.c | 2 +- + source4/lib/cmdline/popt_credentials.c | 4 ++-- + source4/libcli/smb_composite/sesssetup.c | 6 +++--- + source4/torture/ldap/session_expiry.c | 2 +- + source4/torture/raw/session.c | 4 ++-- + source4/torture/rpc/schannel.c | 4 ++-- + source4/torture/smb2/session.c | 12 ++++++------ + 31 files changed, 88 insertions(+), 82 deletions(-) diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c index 77c35dd104b..1bdd6f15a09 100644 @@ -10149,7 +10157,7 @@ index 438bcdce232..f468b8558dd 100644 enum credentials_krb_forwardable { diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c -index 259b35b73b0..36f6b59a72b 100644 +index 2d2fccfff88..aeab550a0a6 100644 --- a/auth/credentials/credentials_krb5.c +++ b/auth/credentials/credentials_krb5.c @@ -871,7 +871,7 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred, @@ -10207,10 +10215,10 @@ index 52a89d4d5b4..58067a5bece 100644 } } diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index 17c90573f09..95dde276ef7 100644 +index f588d6c962e..5a168e6dd7f 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c -@@ -1492,9 +1492,9 @@ MODULE_INIT_FUNC(credentials) +@@ -1490,9 +1490,9 @@ MODULE_INIT_FUNC(credentials) PyModule_AddObject(m, "CALLBACK_RESULT", PyLong_FromLong(CRED_CALLBACK_RESULT)); PyModule_AddObject(m, "SPECIFIED", PyLong_FromLong(CRED_SPECIFIED)); @@ -10300,10 +10308,10 @@ index 03e7ec85198..95386211c0a 100644 if (options->runas == NULL && options->runas_file != NULL) { diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c -index 0e9500ac08d..f314acd9559 100644 +index b429c5f9f04..fa22a0b2339 100644 --- a/source3/auth/auth_generic.c +++ b/source3/auth/auth_generic.c -@@ -356,9 +356,9 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx, +@@ -426,9 +426,9 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx, cli_credentials_set_conf(server_credentials, lp_ctx); if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { @@ -10426,7 +10434,7 @@ index f3bf27e6c00..bd3aeec9434 100644 status = cli_full_connection_creds(&cli, NULL, diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index abfd18bfaf1..f7b4741de89 100644 +index 45eafa97885..f8be0cd5a90 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -124,13 +124,13 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx, @@ -10490,6 +10498,15 @@ index abfd18bfaf1..f7b4741de89 100644 TALLOC_FREE(frame); return krb5_to_nt_status(ret); } +@@ -1486,7 +1486,7 @@ struct tevent_req *cli_session_setup_creds_send(TALLOC_CTX *mem_ctx, + return req; + } + +- if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + DBG_WARNING("Kerberos authentication requested, but " + "the server does not support SPNEGO authentication\n"); + tevent_req_nterror(req, NT_STATUS_NETWORK_CREDENTIAL_CONFLICT); diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index 8ed1bafcea3..b12c845d9d2 100644 --- a/source3/passdb/passdb.c @@ -10542,10 +10559,10 @@ index 276bda88efc..93e8f5bebe6 100644 *_creds = talloc_move(mem_ctx, &creds); diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c -index 8227ef0b0bd..ba6c86cc227 100644 +index 408c0063baf..a51aa4b2f6d 100644 --- a/source3/rpc_client/cli_pipe.c +++ b/source3/rpc_client/cli_pipe.c -@@ -2637,7 +2637,7 @@ NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx, +@@ -2638,7 +2638,7 @@ NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx, NAME_NT_AUTHORITY, /* domain */ "SYSTEM", NULL, /* password */ @@ -10617,10 +10634,10 @@ index 5829d891075..6c5321db0fd 100644 if (c->opt_ccache) { diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c -index 7f8d2688978..bfaeff5188d 100644 +index 5541c58350b..c1854b83bc4 100644 --- a/source3/utils/ntlm_auth.c +++ b/source3/utils/ntlm_auth.c -@@ -1364,9 +1364,9 @@ static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx, +@@ -1335,9 +1335,9 @@ static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx, cli_credentials_set_conf(server_credentials, lp_ctx); if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC || lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { @@ -10633,7 +10650,7 @@ index 7f8d2688978..bfaeff5188d 100644 nt_status = gensec_server_start(tmp_ctx, gensec_settings, diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c -index 5fb22d7e9c8..466a0095ef2 100644 +index bb819bbba19..809aed4376c 100644 --- a/source3/winbindd/winbindd_cm.c +++ b/source3/winbindd/winbindd_cm.c @@ -706,7 +706,7 @@ static NTSTATUS cm_get_ipc_credentials(TALLOC_CTX *mem_ctx, @@ -10646,10 +10663,10 @@ index 5fb22d7e9c8..466a0095ef2 100644 ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED); if (!ok) { diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c -index d66abf32a7f..b668d4ed258 100644 +index dbda18ede09..b2d4dcac8cc 100644 --- a/source4/auth/gensec/gensec_gssapi.c +++ b/source4/auth/gensec/gensec_gssapi.c -@@ -1556,7 +1556,7 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi +@@ -1560,7 +1560,7 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi } /* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */ @@ -10686,6 +10703,36 @@ index 5dd61f6339c..7d8963da99e 100644 break; } +diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c +index 93f6ce55177..01ca5d1341b 100644 +--- a/source4/libcli/smb_composite/sesssetup.c ++++ b/source4/libcli/smb_composite/sesssetup.c +@@ -644,7 +644,7 @@ struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *se + + /* no session setup at all in earliest protocol varients */ + if (session->transport->negotiate.protocol < PROTOCOL_LANMAN1) { +- if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + composite_error(c, NT_STATUS_NETWORK_CREDENTIAL_CONFLICT); + return c; + } +@@ -655,14 +655,14 @@ struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *se + + /* see what session setup interface we will use */ + if (session->transport->negotiate.protocol < PROTOCOL_NT1) { +- if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + composite_error(c, NT_STATUS_NETWORK_CREDENTIAL_CONFLICT); + return c; + } + status = session_setup_old(c, session, io, &state->req); + } else if (!session->transport->options.use_spnego || + !(io->in.capabilities & CAP_EXTENDED_SECURITY)) { +- if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + composite_error(c, NT_STATUS_NETWORK_CREDENTIAL_CONFLICT); + return c; + } diff --git a/source4/torture/ldap/session_expiry.c b/source4/torture/ldap/session_expiry.c index 35dda439b17..e5e38450745 100644 --- a/source4/torture/ldap/session_expiry.c @@ -10719,7 +10766,7 @@ index 0c460ae3069..e246d25e9fb 100644 lpcfg_set_option(tctx->lp_ctx, "gensec_gssapi:requested_life_time=4"); diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c -index fff0b1aacbd..a5755041040 100644 +index 6dc58c86076..08a5120b66d 100644 --- a/source4/torture/rpc/schannel.c +++ b/source4/torture/rpc/schannel.c @@ -965,8 +965,8 @@ bool torture_rpc_schannel_bench1(struct torture_context *torture) @@ -10786,13 +10833,13 @@ index 07c6faebb15..701dfc10a07 100644 torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); } -- -2.31.1 +2.33.1 -From c71b681c5dcdea518411c4bebfbdb5f72c89c6c8 Mon Sep 17 00:00:00 2001 +From 764891873edeae581714601b75287868b9367a8c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Sep 2020 12:32:28 +0200 -Subject: [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test +Subject: [PATCH 087/103] auth:creds:tests: Migrate test to a cmocka unit test Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -11048,10 +11095,10 @@ index ad16b7d8008..46111164b36 100644 + local_include=False, + for_selftest=True) diff --git a/selftest/tests.py b/selftest/tests.py -index 4f164db9c73..003698a5eb3 100644 +index 7fdd9788014..7485fcc5370 100644 --- a/selftest/tests.py +++ b/selftest/tests.py -@@ -420,3 +420,5 @@ plantestsuite("samba.unittests.test_oLschema2ldif", "none", +@@ -422,3 +422,5 @@ plantestsuite("samba.unittests.test_oLschema2ldif", "none", if with_elasticsearch_backend: plantestsuite("samba.unittests.mdsparser_es", "none", [os.path.join(bindir(), "default/source3/test_mdsparser_es")] + [configuration]) @@ -11083,13 +11130,13 @@ index 38b6c8f4b6e..f0ab0357986 100644 ../../dsdb/schema/tests/schema_syntax.c ../../../lib/util/tests/anonymous_shared.c -- -2.31.1 +2.33.1 -From 4115d47379781fe319c36fd6452188c6430ccd08 Mon Sep 17 00:00:00 2001 +From b9e93f3dab2519458fc5dc3fee6da09ba9021ed9 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:09:05 +0200 -Subject: [PATCH 088/105] Add smb2cli_session_get_encryption_cipher() +Subject: [PATCH 088/103] Add smb2cli_session_get_encryption_cipher() When 'session->smb2->should_encrypt' is true, the client MUST encrypt all transport messages (see also MS-SMB2 3.2.4.1.8). @@ -11140,13 +11187,13 @@ index 4452cd808ea..247bac98904 100644 struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx); struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx, -- -2.31.1 +2.33.1 -From e770fc65ac9c1dfc35619b0863ebaabc43b1412c Mon Sep 17 00:00:00 2001 +From 545a74f90e4ff7b74b55b84636be58eacc918af0 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:18:21 +0200 -Subject: [PATCH 089/105] Add dcerpc_transport_encrypted() +Subject: [PATCH 089/103] Add dcerpc_transport_encrypted() Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11232,13 +11279,13 @@ index bd79a072bc8..6ea27a8d9a3 100644 create a secondary context from a primary connection -- -2.31.1 +2.33.1 -From 12b3bcec468fc71b9567b85ebba3a18e5b8fb4d5 Mon Sep 17 00:00:00 2001 +From 91188c527d6fda5238633de652f2c4d604af9277 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:35:01 +0200 -Subject: [PATCH 090/105] Add py binding for dcerpc_transport_encrypted +Subject: [PATCH 090/103] Add py binding for dcerpc_transport_encrypted Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11279,13 +11326,13 @@ index be914ed5f14..309a6d72e26 100644 }; -- -2.31.1 +2.33.1 -From 4d040fa848f1c71713b5e07594ab888f15dad5ec Mon Sep 17 00:00:00 2001 +From e107ce3136d1bda1bc1d2ee07194d1b380313ab4 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:44:08 +0200 -Subject: [PATCH 091/105] selftest: add a test for py dce transport_encrypted +Subject: [PATCH 091/103] selftest: add a test for py dce transport_encrypted Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11344,13 +11391,13 @@ index 8e0d6a5ef0a..24e4ac77d89 100644 objectAttr = lsa.ObjectAttribute() objectAttr.sec_qos = lsa.QosInfo() -- -2.31.1 +2.33.1 -From 1e8f32667d93cd81df68eb43de6a882fdd4e025e Mon Sep 17 00:00:00 2001 +From 562d70d899f3871ead10c339479be84eae1d90fa Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:47:12 +0200 -Subject: [PATCH 092/105] Add CreateTrustedDomainRelax wrapper for fips mode +Subject: [PATCH 092/103] Add CreateTrustedDomainRelax wrapper for fips mode Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11430,13 +11477,13 @@ index 00000000000..b4df0fa5bb8 + + return lsaconn.CreateTrustedDomainEx2(policy, trust_info, auth_info, mask) -- -2.31.1 +2.33.1 -From 5569a217d2778a16d0c2364b1fecf6ad327fa441 Mon Sep 17 00:00:00 2001 +From 62c20810029616fa2286b51ab473f9f7fcc2b766 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:49:17 +0200 -Subject: [PATCH 093/105] Use the new CreateTrustedDomainRelax() +Subject: [PATCH 093/103] Use the new CreateTrustedDomainRelax() Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11537,13 +11584,13 @@ index 1d12c362911..93a3258d28d 100644 if enc_types: self.outf.write("Setting supported encryption types on local TDO.\n") -- -2.31.1 +2.33.1 -From 38f2363fea820551563398ee378aa84227274424 Mon Sep 17 00:00:00 2001 +From 98d411336827fef8e6e650ea510f73dc4bb74d74 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 1 Sep 2020 20:14:29 +0300 -Subject: [PATCH 094/105] selftest: add a test for the CreateTrustedDomainRelax +Subject: [PATCH 094/103] selftest: add a test for the CreateTrustedDomainRelax wrapper Originally copied from 'source4/scripting/devel/createtrust' @@ -11707,7 +11754,7 @@ index 00000000000..80effda8343 @@ -0,0 +1 @@ +^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py -index e16e64fb2f0..6e08e2e92e4 100755 +index cdc7bc77c0a..8864a710bfb 100755 --- a/source4/selftest/tests.py +++ b/source4/selftest/tests.py @@ -705,6 +705,10 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex @@ -11722,13 +11769,13 @@ index e16e64fb2f0..6e08e2e92e4 100755 # Right now ad_dc has mdb and ad_dc_ntvfs has tdb mdb_testenv = "ad_dc" -- -2.31.1 +2.33.1 -From 17e68dee20fcabf2764809ea25beeca7b522434f Mon Sep 17 00:00:00 2001 +From 84b03e21fc234735bbd59e1797126c2013d0ac38 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 5 Nov 2020 15:38:19 +0200 -Subject: [PATCH 095/105] Remove source4/scripting/devel/createtrust script +Subject: [PATCH 095/103] Remove source4/scripting/devel/createtrust script We now have the 'samba-tool domain trust' command. @@ -11877,13 +11924,13 @@ index 26b0d0dcb68..00000000000 - auth_info, - security.SEC_STD_DELETE) -- -2.31.1 +2.33.1 -From 8858b3bdc6e63a91f1d4d756cb0007d2394361f7 Mon Sep 17 00:00:00 2001 +From 55b91ef9d792b99d3dcf95dd913cf7799889b24f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:30:26 +0100 -Subject: [PATCH 096/105] s3:rpc_server: Use gnutls_cipher_decrypt() in +Subject: [PATCH 096/103] s3:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob() It doesn't matter for RC4, but just to be correct. @@ -11909,13 +11956,13 @@ index 198387424e6..e749caf2551 100644 auth_blob->length); gnutls_cipher_deinit(cipher_hnd); -- -2.31.1 +2.33.1 -From 07c786c60b88cec84e2246f6515443f20a4aa8ed Mon Sep 17 00:00:00 2001 +From 04fbc570271973c15c4a28a95bd6ef3b0fd5de95 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:33:38 +0100 -Subject: [PATCH 097/105] s4:rpc_server: Use gnutls_cipher_decrypt() in +Subject: [PATCH 097/103] s4:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob() It doesn't matter for RC4, but just to be correct. @@ -11941,13 +11988,13 @@ index 8333cb149b6..4bb8aaa9592 100644 auth_blob->length); gnutls_cipher_deinit(cipher_hnd); -- -2.31.1 +2.33.1 -From f6d6dd2a5fbd754036bd4ac1a41f252ca36e2180 Mon Sep 17 00:00:00 2001 +From 8c423c8dc1a8ae63970616ff5b4ad5db8d083641 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:40:21 +0200 -Subject: [PATCH 098/105] s3:rpc_server: Allow to use RC4 for creating trusts +Subject: [PATCH 098/103] s3:rpc_server: Allow to use RC4 for creating trusts Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -12008,13 +12055,13 @@ index e749caf2551..d6d606ddeca 100644 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; -- -2.31.1 +2.33.1 -From e0f3eb1f42974944b99b67279c476e4ef4de3b3b Mon Sep 17 00:00:00 2001 +From a396fce11011d22dda9ff26027fef789bf2ab33a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:51:39 +0200 -Subject: [PATCH 099/105] s4:rpc_server: Allow to use RC4 for creating trusts +Subject: [PATCH 099/103] s4:rpc_server: Allow to use RC4 for creating trusts Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -12080,13 +12127,13 @@ index 4bb8aaa9592..5b3ef71d458 100644 nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; -- -2.31.1 +2.33.1 -From 6bd9116afeb5be59a6701a2dc349c5bcb78c91f6 Mon Sep 17 00:00:00 2001 +From e48534608b8a60428ef1aa8f5edc357ba9ffc9c0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 10:13:48 +0100 -Subject: [PATCH 100/105] sefltest: Enable the dcerpc.createtrustrelax test +Subject: [PATCH 100/103] sefltest: Enable the dcerpc.createtrustrelax test against ad_dc_fips Signed-off-by: Andreas Schneider @@ -12110,13 +12157,13 @@ index 80effda8343..00000000000 @@ -1 +0,0 @@ -^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) -- -2.31.1 +2.33.1 -From ecbcd57c425c69646ba649ea21f320cc7e56b02e Mon Sep 17 00:00:00 2001 +From a69a998ae5575e8bcd17162b5c75895a4dfc9aed Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 11 Nov 2020 13:42:06 +0100 -Subject: [PATCH 101/105] s3:smbd: Fix possible null pointer dereference in +Subject: [PATCH 101/103] s3:smbd: Fix possible null pointer dereference in token_contains_name() BUG: https://bugzilla.samba.org/show_bug.cgi?id=14572 @@ -12146,346 +12193,13 @@ index 57754a0f766..694c0c290e8 100644 /* Check if username starts with domain name */ if (domain_len > 0) { -- -2.31.1 +2.33.1 -From f0654e4786cb44d5c2834c4cbeedec42a66107b5 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 10 Nov 2020 17:35:24 +0200 -Subject: [PATCH 102/105] lookup_name: allow lookup names prefixed with DNS - forest root for FreeIPA DC - -In FreeIPA deployment with active Global Catalog service, when a two-way -trust to Active Directory forest is established, Windows systems can -look up FreeIPA users and groups. When using a security tab in Windows -Explorer on AD side, a lookup over a trusted forest might come as -realm\name instead of NetBIOS domain name: - --------------------------------------------------------------------- -[2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) - lsa_LookupNames3: struct lsa_LookupNames3 - in: struct lsa_LookupNames3 - handle : * - handle: struct policy_handle - handle_type : 0x00000000 (0) - uuid : 0000000e-0000-0000-1c5e-a750e5810000 - num_names : 0x00000001 (1) - names: ARRAY(1) - names: struct lsa_String - length : 0x001e (30) - size : 0x0020 (32) - string : * - string : 'ipa.test\admins' - sids : * - sids: struct lsa_TransSidArray3 - count : 0x00000000 (0) - sids : NULL - level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) - count : * - count : 0x00000000 (0) - lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) - client_revision : LSA_CLIENT_REVISION_2 (2) --------------------------------------------------------------------- - -If we are running as a DC and PASSDB supports returning domain info -(pdb_get_domain_info() returns a valid structure), check domain of the -name in lookup_name() against DNS forest name and allow the request to -be done against the primary domain. This corresponds to FreeIPA's use of -Samba as a DC. For normal domain members a realm-based lookup falls back -to a lookup over to its own domain controller with the help of winbindd. - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Stefan Metzmacher - -Autobuild-User(master): Alexander Bokovoy -Autobuild-Date(master): Wed Nov 11 10:59:01 UTC 2020 on sn-devel-184 - -(cherry picked from commit 31c703766fd2b89737826fb7e9a707f0622bb8cd) ---- - source3/passdb/lookup_sid.c | 37 ++++++++++++++++++++++++++++--------- - 1 file changed, 28 insertions(+), 9 deletions(-) - -diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c -index 4b3aa7e435d..99f9bdd7693 100644 ---- a/source3/passdb/lookup_sid.c -+++ b/source3/passdb/lookup_sid.c -@@ -114,17 +114,36 @@ bool lookup_name(TALLOC_CTX *mem_ctx, - full_name, domain, name)); - DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); - -- if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && -- strequal(domain, get_global_sam_name())) -- { -+ if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) { -+ bool check_global_sam = false; -+ -+ check_global_sam = strequal(domain, get_global_sam_name()); -+ -+ /* If we are running on a DC that has PASSDB module with domain -+ * information, check if DNS forest name is matching the domain -+ * name. This is the case of FreeIPA domain controller when -+ * trusted AD DC looks up users found in a Global Catalog of -+ * the forest root domain. */ -+ if (!check_global_sam && (IS_DC)) { -+ struct pdb_domain_info *dom_info = NULL; -+ dom_info = pdb_get_domain_info(tmp_ctx); -+ -+ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { -+ check_global_sam = strequal(domain, dom_info->dns_forest); -+ } - -- /* It's our own domain, lookup the name in passdb */ -- if (lookup_global_sam_name(name, flags, &rid, &type)) { -- sid_compose(&sid, get_global_sam_sid(), rid); -- goto ok; -+ TALLOC_FREE(dom_info); -+ } -+ -+ if (check_global_sam) { -+ /* It's our own domain, lookup the name in passdb */ -+ if (lookup_global_sam_name(name, flags, &rid, &type)) { -+ sid_compose(&sid, get_global_sam_sid(), rid); -+ goto ok; -+ } -+ TALLOC_FREE(tmp_ctx); -+ return false; - } -- TALLOC_FREE(tmp_ctx); -- return false; - } - - if ((flags & LOOKUP_NAME_BUILTIN) && --- -2.31.1 - - -From 4ab1bdc465b7a02ab2dd8531be11518579e97f59 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 11 Nov 2020 14:42:55 +0200 -Subject: [PATCH 103/105] auth_sam: use pdb_get_domain_info to look up DNS - forest information - -When Samba is used as a part of FreeIPA domain controller, Windows -clients for a trusted AD forest may try to authenticate (perform logon -operation) as a REALM\name user account. - -Fix auth_sam plugins to accept DNS forest name if we are running on a DC -with PASSDB module providing domain information (e.g. pdb_get_domain_info() -returning non-NULL structure). Right now, only FreeIPA or Samba AD DC -PASSDB backends return this information but Samba AD DC configuration is -explicitly ignored by the two auth_sam (strict and netlogon3) modules. - -Detailed logs below: - -[2020/11/11 09:23:53.281296, 1, pid=42677, effective(65534, 65534), real(65534, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:482(ndr_print_function_debug) - netr_LogonSamLogonWithFlags: struct netr_LogonSamLogonWithFlags - in: struct netr_LogonSamLogonWithFlags - server_name : * - server_name : '\\master.ipa.test' - computer_name : * - computer_name : 'AD1' - credential : * - credential: struct netr_Authenticator - cred: struct netr_Credential - data : 529f4b087c5f6546 - timestamp : Wed Nov 11 09:23:55 AM 2020 UTC - return_authenticator : * - return_authenticator: struct netr_Authenticator - cred: struct netr_Credential - data : 204f28f622010000 - timestamp : Fri May 2 06:37:50 AM 1986 UTC - logon_level : NetlogonNetworkTransitiveInformation (6) - logon : * - logon : union netr_LogonLevel(case 6) - network : * - network: struct netr_NetworkInfo - identity_info: struct netr_IdentityInfo - domain_name: struct lsa_String - length : 0x0010 (16) - size : 0x01fe (510) - string : * - string : 'IPA.TEST' - parameter_control : 0x00002ae0 (10976) - 0: MSV1_0_CLEARTEXT_PASSWORD_ALLOWED - 0: MSV1_0_UPDATE_LOGON_STATISTICS - 0: MSV1_0_RETURN_USER_PARAMETERS - 0: MSV1_0_DONT_TRY_GUEST_ACCOUNT - 1: MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT - 1: MSV1_0_RETURN_PASSWORD_EXPIRY - 1: MSV1_0_USE_CLIENT_CHALLENGE - 0: MSV1_0_TRY_GUEST_ACCOUNT_ONLY - 1: MSV1_0_RETURN_PROFILE_PATH - 0: MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY - 1: MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT - 0: MSV1_0_DISABLE_PERSONAL_FALLBACK - 1: MSV1_0_ALLOW_FORCE_GUEST - 0: MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED - 0: MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY - 0: MSV1_0_ALLOW_MSVCHAPV2 - 0: MSV1_0_S4U2SELF - 0: MSV1_0_CHECK_LOGONHOURS_FOR_S4U - 0: MSV1_0_SUBAUTHENTICATION_DLL_EX - logon_id : 0x0000000000884ef2 (8933106) - account_name: struct lsa_String - length : 0x000e (14) - size : 0x000e (14) - string : * - string : 'idmuser' - workstation: struct lsa_String - length : 0x0000 (0) - size : 0x0000 (0) - string : * - string : '' - challenge : 417207867bd33c74 - nt: struct netr_ChallengeResponse - length : 0x00c0 (192) - size : 0x00c0 (192) - data : * - data: ARRAY(192) - [0000] A5 24 62 6E 31 DF 69 66 9E DC 54 D6 63 4C D6 2F .$bn1.if ..T.cL./ - [0010] 01 01 00 00 00 00 00 00 50 37 D7 60 0C B8 D6 01 ........ P7.`.... - [0020] 15 1B 38 4F 47 95 4D 62 00 00 00 00 02 00 0E 00 ..8OG.Mb ........ - [0030] 57 00 49 00 4E 00 32 00 30 00 31 00 36 00 01 00 W.I.N.2. 0.1.6... - [0040] 06 00 41 00 44 00 31 00 04 00 18 00 77 00 69 00 ..A.D.1. ....w.i. - [0050] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e. - [0060] 73 00 74 00 03 00 20 00 61 00 64 00 31 00 2E 00 s.t... . a.d.1... - [0070] 77 00 69 00 6E 00 32 00 30 00 31 00 36 00 2E 00 w.i.n.2. 0.1.6... - [0080] 74 00 65 00 73 00 74 00 05 00 18 00 77 00 69 00 t.e.s.t. ....w.i. - [0090] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e. - [00A0] 73 00 74 00 07 00 08 00 50 37 D7 60 0C B8 D6 01 s.t..... P7.`.... - [00B0] 06 00 04 00 02 00 00 00 00 00 00 00 00 00 00 00 ........ ........ - lm: struct netr_ChallengeResponse - length : 0x0018 (24) - size : 0x0018 (24) - data : * - data : 000000000000000000000000000000000000000000000000 - validation_level : 0x0006 (6) - flags : * - flags : 0x00000000 (0) - 0: NETLOGON_SAMLOGON_FLAG_PASS_TO_FOREST_ROOT - 0: NETLOGON_SAMLOGON_FLAG_PASS_CROSS_FOREST_HOP - 0: NETLOGON_SAMLOGON_FLAG_RODC_TO_OTHER_DOMAIN - 0: NETLOGON_SAMLOGON_FLAG_RODC_NTLM_REQUEST - -In such case checks for a workgroup name will not match the DNS forest -name used in the username specification: - -[2020/11/11 09:23:53.283055, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:200(auth_check_ntlm_password) - check_ntlm_password: Checking password for unmapped user [IPA.TEST]\[idmuser]@[] with the new password interface -[2020/11/11 09:23:53.283073, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:203(auth_check_ntlm_password) - check_ntlm_password: mapped user is: [IPA.TEST]\[idmuser]@[] -[2020/11/11 09:23:53.283082, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:213(auth_check_ntlm_password) - check_ntlm_password: auth_context challenge created by fixed -[2020/11/11 09:23:53.283091, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:216(auth_check_ntlm_password) - challenge is: -[2020/11/11 09:23:53.283099, 5, pid=42677, effective(65534, 65534), real(65534, 0)] ../../lib/util/util.c:678(dump_data) - [0000] 41 72 07 86 7B D3 3C 74 Ar..{. -Reviewed-by: Andreas Schneider -(cherry picked from commit 2a8b672652dcbcf55ec59be537773d76f0f14d0a) ---- - source3/auth/auth_sam.c | 45 +++++++++++++++++++++++++++++++++++++---- - 1 file changed, 41 insertions(+), 4 deletions(-) - -diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c -index 3c12f959faf..e8e0d543f8c 100644 ---- a/source3/auth/auth_sam.c -+++ b/source3/auth/auth_sam.c -@@ -22,6 +22,7 @@ - - #include "includes.h" - #include "auth.h" -+#include "passdb.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_AUTH -@@ -142,10 +143,28 @@ static NTSTATUS auth_samstrict_auth(const struct auth_context *auth_context, - break; - case ROLE_DOMAIN_PDC: - case ROLE_DOMAIN_BDC: -- if ( !is_local_name && !is_my_domain ) { -- DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n", -- effective_domain)); -- return NT_STATUS_NOT_IMPLEMENTED; -+ if (!is_local_name && !is_my_domain) { -+ /* If we are running on a DC that has PASSDB module with domain -+ * information, check if DNS forest name is matching the domain -+ * name. This is the case of FreeIPA domain controller when -+ * trusted AD DCs attempt to authenticate FreeIPA users using -+ * the forest root domain (which is the only domain in FreeIPA). -+ */ -+ struct pdb_domain_info *dom_info = NULL; -+ -+ dom_info = pdb_get_domain_info(mem_ctx); -+ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { -+ is_my_domain = strequal(user_info->mapped.domain_name, -+ dom_info->dns_forest); -+ } -+ -+ TALLOC_FREE(dom_info); -+ if (!is_my_domain) { -+ DEBUG(6,("check_samstrict_security: %s is not one " -+ "of my local names or domain name (DC)\n", -+ effective_domain)); -+ return NT_STATUS_NOT_IMPLEMENTED; -+ } - } - - break; -@@ -230,6 +249,24 @@ static NTSTATUS auth_sam_netlogon3_auth(const struct auth_context *auth_context, - } - - is_my_domain = strequal(user_info->mapped.domain_name, lp_workgroup()); -+ if (!is_my_domain) { -+ /* If we are running on a DC that has PASSDB module with domain -+ * information, check if DNS forest name is matching the domain -+ * name. This is the case of FreeIPA domain controller when -+ * trusted AD DCs attempt to authenticate FreeIPA users using -+ * the forest root domain (which is the only domain in FreeIPA). -+ */ -+ struct pdb_domain_info *dom_info = NULL; -+ dom_info = pdb_get_domain_info(mem_ctx); -+ -+ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { -+ is_my_domain = strequal(user_info->mapped.domain_name, -+ dom_info->dns_forest); -+ } -+ -+ TALLOC_FREE(dom_info); -+ } -+ - if (!is_my_domain) { - DBG_INFO("%s is not our domain name (DC for %s)\n", - effective_domain, lp_workgroup()); --- -2.31.1 - - -From fe9dffe41d545e41d4a1d9b2b1c6d5246a9f81af Mon Sep 17 00:00:00 2001 +From 8f0c383642177558e726c780debde7c8a6800b41 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 27 Nov 2020 11:22:15 +0100 -Subject: [PATCH 104/105] docs-xml: Add a section about weak crypto in testparm +Subject: [PATCH 102/103] docs-xml: Add a section about weak crypto in testparm manpage BUG: https://bugzilla.samba.org/show_bug.cgi?id=14583 @@ -12522,13 +12236,13 @@ index 9099cda010f..7c7abf50e8b 100644 -- -2.31.1 +2.33.1 -From 8abb1fa3b7972e89543f38a23d0979e1f0c2062f Mon Sep 17 00:00:00 2001 +From 60e8564f5cfff819b6d8e47ded1976003c2078a8 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 15 Dec 2020 15:17:04 +0100 -Subject: [PATCH 105/105] HACK:s3:winbind: Rely on the domain child for online +Subject: [PATCH 103/103] HACK:s3:winbind: Rely on the domain child for online check --- @@ -12537,7 +12251,7 @@ Subject: [PATCH 105/105] HACK:s3:winbind: Rely on the domain child for online 2 files changed, 12 insertions(+) diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c -index 466a0095ef2..ebc92e30706 100644 +index 809aed4376c..4f544f5ab50 100644 --- a/source3/winbindd/winbindd_cm.c +++ b/source3/winbindd/winbindd_cm.c @@ -89,6 +89,8 @@ @@ -12564,7 +12278,7 @@ index 466a0095ef2..ebc92e30706 100644 flag to true if we connected, or re-adding the offline handler if false. Bypasses online diff --git a/source3/winbindd/winbindd_dual.c b/source3/winbindd/winbindd_dual.c -index b1c86b2979c..c6362019877 100644 +index 4f07ff49445..a2b59b06208 100644 --- a/source3/winbindd/winbindd_dual.c +++ b/source3/winbindd/winbindd_dual.c @@ -1674,6 +1674,8 @@ static void child_handler(struct tevent_context *ev, struct tevent_fd *fde, @@ -12578,12 +12292,12 @@ index b1c86b2979c..c6362019877 100644 int fdpair[2]; @@ -1778,6 +1780,7 @@ static bool fork_domain_child(struct winbindd_child *child) setproctitle("domain child [%s]", child_domain->name); - } else if (child == idmap_child()) { + } else if (is_idmap_child(child)) { setproctitle("idmap child"); + wb_idmap_child = true; } /* Handle online/offline messages. */ -- -2.31.1 +2.33.1 diff --git a/samba-s4u.patch b/samba-s4u.patch index 83ed873..120bac3 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,19 +1,18 @@ -From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001 +From e649f9aedfa8a0d5caa241743bb4191927430879 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support +Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider --- - source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++--------- - source4/kdc/mit_samba.c | 47 ++---- - source4/kdc/mit_samba.h | 6 +- - wscript_configure_system_mitkrb5 | 3 + - 6 files changed, 91 insertions(+), 115 deletions(-) + source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------ + source4/kdc/mit_samba.c | 47 ++------- + source4/kdc/mit_samba.h | 6 +- + 3 files changed, 71 insertions(+), 106 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index 9197551ed61..944324d9a2f 100644 +index 7bc9a7b3347..fc20bfed2f4 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c @@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, @@ -134,16 +133,15 @@ index 9197551ed61..944324d9a2f 100644 return code; } -@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - { - #endif +@@ -328,6 +339,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krb5_authdata **pac_auth_data = NULL; krb5_authdata **authdata = NULL; -- krb5_boolean is_as_req; + krb5_boolean is_as_req; + krb5_const_principal pac_client; krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -341,11 +353,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; #endif @@ -152,13 +150,13 @@ index 9197551ed61..944324d9a2f 100644 - return KRB5_KDB_DBTYPE_NOSUP; - } - -- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); -- -- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { -- code = ks_get_pac(context, client, client_key, &pac); -- if (code != 0) { -- goto done; -- } + is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); + + /* +@@ -406,6 +413,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + ks_client_princ = client->princ; + } + + /* In protocol transition, we are currently not provided with the tgt + * client name to verify the PAC, we could probably skip the name + * verification and just verify the signatures, but since we don't @@ -166,59 +164,31 @@ index 9197551ed61..944324d9a2f 100644 + if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { + pac_client = server->princ; + } else { -+ pac_client = client_princ; - } - -- if (!is_as_req) { -+ /* TGS request */ -+ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) { - code = ks_verify_pac(context, - flags, -- client_princ, -+ pac_client, - client, - server, - krbtgt, -@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (code != 0) { - goto done; - } -+ -+ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */ -+ if (pac == NULL) { -+ code = KRB5_KDB_DBTYPE_NOSUP; -+ goto done; -+ } - } - -- if (pac == NULL && client != NULL) { -+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { -+ krb5_pac_free(context, pac); -+ pac = NULL; ++ pac_client = ks_client_princ; + } - -+ /* AS request or local realm protocol transition */ -+ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) || -+ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) { - code = ks_get_pac(context, client, client_key, &pac); - if (code != 0) { - goto done; - } -+ /* We require a pac! */ -+ SMB_ASSERT(pac != NULL); ++ + if (client_entry == NULL) { + client_entry = client; } +@@ -470,7 +487,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (pac == NULL) { -@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - } - - code = krb5_pac_sign(context, pac, authtime, client_princ, + code = ks_verify_pac(context, + flags, +- ks_client_princ, ++ pac_client, + client_entry, + server, + krbtgt, +@@ -510,7 +527,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + is_as_req ? "AS-REQ" : "TGS-REQ", + client_name); + code = krb5_pac_sign(context, pac, authtime, ks_client_princ, - server_key, krbtgt_key, &pac_data); + server_key, krbtgt_key, &pac_data); if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -536,12 +553,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -227,10 +197,11 @@ index 9197551ed61..944324d9a2f 100644 - } - - code = 0; - +- done: - krb5_pac_free(context, pac); -@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + if (client_entry != NULL && client_entry != client) { + ks_free_principal(context, client_entry); +@@ -567,32 +578,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -265,10 +236,10 @@ index 9197551ed61..944324d9a2f 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 54dcd545ea1..f23327c9613 100644 +index e015c5a52db..2a48d731501 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -475,7 +475,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -276,7 +247,7 @@ index 54dcd545ea1..f23327c9613 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -639,7 +638,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -285,7 +256,7 @@ index 54dcd545ea1..f23327c9613 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -961,41 +960,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -338,7 +309,7 @@ index 54dcd545ea1..f23327c9613 100644 static krb5_error_code mit_samba_change_pwd_error(krb5_context context, diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h -index ba824557bd5..5aadf206443 100644 +index 636c77ec97c..9cb00c9610e 100644 --- a/source4/kdc/mit_samba.h +++ b/source4/kdc/mit_samba.h @@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, @@ -362,12 +333,13 @@ index ba824557bd5..5aadf206443 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.25.4 +2.33.1 -From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001 + +From 9eca7b08a3987d6320d6584e146005bbc01720f6 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build +Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -375,13 +347,13 @@ Pair-Programmed-With: Andreas Schneider lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ lib/krb5_wrap/krb5_samba.h | 2 - source4/auth/kerberos/kerberos_util.c | 11 -- - 4 files changed, 185 insertions(+), 14 deletions(-) + 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index 20ce86c708d..e72ab3c30f7 100644 +index fff5b4e2a22..791b417d5ba 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c -@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, +@@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return 0; } @@ -574,7 +546,7 @@ index 20ce86c708d..e72ab3c30f7 100644 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index ca9a893e4f7..3264ce5eb3b 100644 +index 56a2a975278..5af9c6d73c1 100644 --- a/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -639,14 +611,13 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.25.4 +2.33.1 - -From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001 +From 80289eca2bb614aacd0df86bcf7ad7027c080671 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code +Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code --- source4/heimdal/lib/hdb/hdb.h | 1 + @@ -656,7 +627,7 @@ Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code 4 files changed, 11 insertions(+), 2 deletions(-) diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h -index 6a09ecb6fe1..bc5211fef35 100644 +index 5ef9d9565f3..dafaffc6c2d 100644 --- a/source4/heimdal/lib/hdb/hdb.h +++ b/source4/heimdal/lib/hdb/hdb.h @@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; @@ -668,7 +639,7 @@ index 6a09ecb6fe1..bc5211fef35 100644 /* hdb_capability_flags */ #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index a560a1cd84b..c27b6a8ef4c 100644 +index aff74f2ee71..d16b4c3329a 100644 --- a/source4/kdc/db-glue.c +++ b/source4/kdc/db-glue.c @@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, @@ -696,7 +667,7 @@ index a560a1cd84b..c27b6a8ef4c 100644 ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index f23327c9613..4084e893cc2 100644 +index 2a48d731501..a8d3e7ed493 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c @@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, @@ -722,5 +693,5 @@ index c929acccce6..a9115ec23d7 100644 void sdb_free_entry(struct sdb_entry_ex *e); void free_sdb_entry(struct sdb_entry *s); -- -2.25.4 +2.33.1 diff --git a/samba.spec b/samba.spec index fb8fabe..ca59865 100644 --- a/samba.spec +++ b/samba.spec @@ -10,11 +10,11 @@ %define main_release 0 -%define samba_version 4.13.13 +%define samba_version 4.13.14 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.2.2 +%define ldb_version 2.2.3 # This should be rc1 or nil %define pre_release %nil @@ -1493,6 +1493,7 @@ fi %{_libdir}/samba/libcommon-auth-samba4.so %{_libdir}/samba/libctdb-event-client-samba4.so %{_libdir}/samba/libdbwrap-samba4.so +%{_libdir}/samba/libdcerpc-pkt-auth-samba4.so %{_libdir}/samba/libdcerpc-samba-samba4.so %{_libdir}/samba/libevents-samba4.so %{_libdir}/samba/libflag-mapping-samba4.so @@ -2305,6 +2306,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc %{python3_sitearch}/samba/tests/__pycache__/docs.*.pyc @@ -2323,6 +2325,8 @@ fi %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc @@ -2484,6 +2488,7 @@ fi %{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py +%{python3_sitearch}/samba/tests/dsdb_api.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py %{python3_sitearch}/samba/tests/docs.py @@ -2521,6 +2526,7 @@ fi %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ +%{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc @@ -2537,11 +2543,15 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/alias_tests.py %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py @@ -2558,14 +2568,18 @@ fi %{python3_sitearch}/samba/tests/krb5/s4u_tests.py %{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py +%{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py +%{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py %{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/xrealm_tests.py %{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_referrals.py +%{python3_sitearch}/samba/tests/ldap_spn.py +%{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py %{python3_sitearch}/samba/tests/lsa_string.py @@ -3660,6 +3674,17 @@ fi %endif %changelog +* Tue Nov 09 2021 Guenther Deschner - 4.13.14-0 +- Update to Samba 4.13.14 +- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 +- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 +- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 +- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 +- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 +- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 +- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 +- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 + * Fri Oct 29 2021 Guenther Deschner - 4.13.13-0 - Update to Samba 4.13.13 diff --git a/sources b/sources index 341dd17..8d0552d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.13.tar.xz) = dbc4f64a7a3d3d7566df3bcd6baa132bce6e13642fd283b22945db1431c2a3eaad1e9fc7f3b7907383561e63c4648129633aedc16e5f452c5747754143d9485c -SHA512 (samba-4.13.13.tar.asc) = 51b2d0c2f18a3a94bef08d825214e90708d1c4c273f54b33d83d8efdb3f77062147c225db64f077550b69378689c64675bf5e8b552769d89f4aecb33ddee0b17 +SHA512 (samba-4.13.14.tar.xz) = 9df1de1ef80010e83ac36239d4af7958fe4f44a0cad4c68cdde71d63d502372767dfe4e01f4743e3ab1d23fe3b65ac7571c14ef9614a3b6feba53c2295a7f28e +SHA512 (samba-4.13.14.tar.asc) = 525f0d8087076e39db3205d878a2aba8242ef79927bca253963b2df7f181439dc825efd5ed457103a06251f2870fda68811ed1395a6cb7a995630e8f193153e7 From 598cab6469cad108b48b9976d66837c6904912a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 14:45:45 +0100 Subject: [PATCH 29/30] Fix winbind trusted domain regression related: #2021716 Guenther --- ...a-4.13-fix-winbind-no-trusted-domain.patch | 41 +++++++++++++++++++ samba.spec | 7 +++- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 samba-4.13-fix-winbind-no-trusted-domain.patch diff --git a/samba-4.13-fix-winbind-no-trusted-domain.patch b/samba-4.13-fix-winbind-no-trusted-domain.patch new file mode 100644 index 0000000..4924872 --- /dev/null +++ b/samba-4.13-fix-winbind-no-trusted-domain.patch @@ -0,0 +1,41 @@ +From 2edaf32b4204b9fe363c441c25b6989fe76911a4 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Tue, 9 Nov 2021 20:50:20 +0100 +Subject: [PATCH] s3:winbindd: fix "allow trusted domains = no" regression + +add_trusted_domain() should only reject domains +based on is_allowed_domain(), which now also +checks "allow trusted domains = no", if we don't +have an explicit trust to the domain (SEC_CHAN_NULL). + +We use at least SEC_CHAN_LOCAL for local domains like +BUILTIN. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14899 + +Signed-off-by: Stefan Metzmacher + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Wed Nov 10 11:21:31 UTC 2021 on sn-devel-184 + +(cherry picked from commit a7f6c60cb037b4bc9eee276236539b8282213935) +--- + source3/winbindd/winbindd_util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c +index 42ddbfd2f44..9d54e462c42 100644 +--- a/source3/winbindd/winbindd_util.c ++++ b/source3/winbindd/winbindd_util.c +@@ -134,7 +134,7 @@ static NTSTATUS add_trusted_domain(const char *domain_name, + return NT_STATUS_INVALID_PARAMETER; + } + +- if (!is_allowed_domain(domain_name)) { ++ if (secure_channel_type == SEC_CHAN_NULL && !is_allowed_domain(domain_name)) { + return NT_STATUS_NO_SUCH_DOMAIN; + } + +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index ca59865..5d09a31 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.13.14 %define talloc_version 2.3.1 @@ -136,6 +136,7 @@ Patch1: samba-s4u.patch # # Generate the patchset using: git format-patch -l1 --stdout -N > samba-4.13-redhat.patch Patch2: samba-4.13-redhat.patch +Patch3: samba-4.13-fix-winbind-no-trusted-domain.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3674,6 +3675,10 @@ fi %endif %changelog +* Thu Nov 11 2021 Guenther Deschner - 4.13.14-1 +- Fix winbind trusted domain regression +- related: #2021716 + * Tue Nov 09 2021 Guenther Deschner - 4.13.14-0 - Update to Samba 4.13.14 - resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 From d2806fa77ce6b881afaed1c3426b0e34d0e7e9d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 13 Nov 2021 00:15:32 +0100 Subject: [PATCH 30/30] Fix IPA DC schannel support Guenther --- samba-4.13-ipa-dc-schannel.patch | 45 ++++++++++++++++++++++++++++++++ samba.spec | 6 ++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 samba-4.13-ipa-dc-schannel.patch diff --git a/samba-4.13-ipa-dc-schannel.patch b/samba-4.13-ipa-dc-schannel.patch new file mode 100644 index 0000000..d315a5d --- /dev/null +++ b/samba-4.13-ipa-dc-schannel.patch @@ -0,0 +1,45 @@ +From 3fc4d1d3998f3956a84c855cb60a9dcb335e1f59 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Fri, 12 Nov 2021 19:06:01 +0200 +Subject: [PATCH] IPA DC: add missing checks + +When introducing FreeIPA support, two places were forgotten: + + - schannel gensec module needs to be aware of IPA DC + - _lsa_QueryInfoPolicy should treat IPA DC as PDC + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903 + +Signed-off-by: Alexander Bokovoy +--- + auth/gensec/schannel.c | 1 + + source3/rpc_server/lsa/srv_lsa_nt.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c +index 0cdae141ead..6ebbe8f3179 100644 +--- a/auth/gensec/schannel.c ++++ b/auth/gensec/schannel.c +@@ -1080,6 +1080,7 @@ static NTSTATUS schannel_server_start(struct gensec_security *gensec_security) + case ROLE_DOMAIN_BDC: + case ROLE_DOMAIN_PDC: + case ROLE_ACTIVE_DIRECTORY_DC: ++ case ROLE_IPA_DC: + return NT_STATUS_OK; + default: + return NT_STATUS_NOT_IMPLEMENTED; +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index 8d71b5252ab..ea92a22cbc9 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -683,6 +683,7 @@ NTSTATUS _lsa_QueryInfoPolicy(struct pipes_struct *p, + switch (lp_server_role()) { + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: ++ case ROLE_IPA_DC: + name = get_global_sam_name(); + sid = dom_sid_dup(p->mem_ctx, get_global_sam_sid()); + if (!sid) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 5d09a31..f3b678a 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 2 %define samba_version 4.13.14 %define talloc_version 2.3.1 @@ -137,6 +137,7 @@ Patch1: samba-s4u.patch # Generate the patchset using: git format-patch -l1 --stdout -N > samba-4.13-redhat.patch Patch2: samba-4.13-redhat.patch Patch3: samba-4.13-fix-winbind-no-trusted-domain.patch +Patch4: samba-4.13-ipa-dc-schannel.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3675,6 +3676,9 @@ fi %endif %changelog +* Sat Nov 13 2021 Guenther Deschner - 4.13.14-2 +- Fix IPA DC schannel support + * Thu Nov 11 2021 Guenther Deschner - 4.13.14-1 - Fix winbind trusted domain regression - related: #2021716