The branch, v4-18-stable has been updated
via 2613f2b288c VERSION: Disable GIT_SNAPSHOT for the 4.18.6 release.
via 87e193d9b7e WHATSNEW: Add release notes for Samba 4.18.6.
via 320d654041d s3: smbd: Add missing 'return;'s in exit paths in
reply_exit_done().
via 122afc37724 s3: torture: Add a test doing an SMB1 negotiate+exit.
via e6c0d4f122d s3: smbd: Ensure all callers to
srvstr_pull_req_talloc() pass a zeroed-out dest pointer.
via f025f51ac5c s3: smbd: Uncorrupt the pointer we were using to prove
a crash.
via 4c27dfe322c s3: smbd: Ensure srvstr_pull_req_talloc() always NULLs
out *dest.
via 6fef976770c s3: torture: Add SMB1-TRUNCATED-SESSSETUP test.
via 8e31fd2d599 s3: smbd: Deliberately currupt an uninitialized pointer.
via 9e5f1a30a49 mdssvc: Do an early talloc_free() in _mdssvc_open()
via cd866f5c4ce s3:smbd: fix multichannel connection passing race
via 4dcefc01054 s3:smbd: always clear filter_subreq in
smb2srv_client_mc_negprot_next()
via 28e68be9612 s4:torture/smb2: add smb2.multichannel.bugs.bug_15346
via 76c6234a0c9 s4:torture/smb2: make it possible to pass existing_conn
to smb2_connect_ext()
via 208bece139b s4:torture/smb2: let us have a common
torture_smb2_con_share()
via aec49671a31 s4:torture/smb2: let torture_smb2_con_sopt() use
smb2_connect()
via 1b3197ff477 dcerpc.idl: fix definitions for DCERPC_PKT_CO_CANCEL
and DCERPC_PKT_ORPHANED payload
via 30f317cfb09 librpc/rpc: let dcerpc_read_ncacn_packet_next_vector()
handle fragments without any payload
via f2604db12b0 s4:torture/ndr: add tests for DCERPC_PKT_CO_CANCEL and
DCERPC_PKT_ORPHANED
via bace04c3c5c vfs_aio_pthread: fix segfault if samba-tool ntacl get
via cf7a0c9d754 vfs_aio_pthread: don't crash without a pthreadpool
via e911424161d lib/cmdline: Also redact --newpassword in
samba_cmdline_burn()
via c11b6d6b6a4 lib/cmdline: Also burn the --password2 parameter if
given
via e724909ac06 samba-tool: Use samba.glue.get_burnt_cmdline rather
than regex
via 8c2c1b5413a python: Add glue.burn_commandline() method
via 534425ba2f6 python: Remove const from PyList_AsStringList()
via 2ed39136875 python: Move PyList_AsStringList to common code so we
can reuse
via 7f87d028516 lib/cmdline: Return if the commandline was redacted in
samba_cmdline_burn()
via c40f1619d96 s3/modules: Fix DFS links when widelinks = yes
via e949750d4f5 s3/modules: Add flag indicating if connected share is a
dfs share
via 5db858c1afd sefltest: Add new regression test dfs with widelinks =
yes
via e50f377b4ab selftest: Add new dfs share (with widelinks enabled)
via ed62f4fabaf dsdb: Use samdb_system_container_dn() in
pdb_samba_dsdb_*()
via da03582f30a dsdb: Use samdb_system_container_dn() in dsdb_trust_*()
via 5f908aef367 s4-rpc_server/backupkey: Use
samdb_system_container_dn() in get_lsa_secret()
via ae64a438b70 s4-rpc_server/backupkey: Use
samdb_system_container_dn() in set_lsa_secret()
via c35953103f3 s4-rpc_server/netlogon: Use samdb_system_container_dn()
in fill_trusted_domains_array()
via 3270419407d s4-rpc_server/lsa: Use samdb_system_container_dn() in
dcesrv_lsa_get_policy_state()
via 8e45b202cae dsdb: Use samdb_get_system_container_dn() to get
Password Settings Container
via 820752e3777 dsdb: Use samdb_system_container_dn() in samldb.c
via c14fbf24d96 dsdb: Add new function samdb_system_container_dn()
via 364730e9dc6 Bug #9959: Don't search for CN=System
via 3b3b92f56bf For Bug #9959: local talloc frame for next commit
via 35573c04465 mdssvc: fix returning file modification date for older
Mac releases
via f4a3373585f mdssvc: fix date marshalling
via aa4db8a3cf8 mdssvc: prepare for returning timestamps with
sub-seconds granularity
via 590c91640bf mdssvc: reduce pagesize to 50
via 3036f3cb96f tests/mdssvc: match hits:total:value to be the actual
amount of entries in hits
via 39c2b556456 mdssvc: fix enforcement of "elasticsearch:max results"
via 60fdb3adbee mdssvc: add and use SL_PAGESIZE
via 7d5e9f5fc23 mdssvc: fix long running backend queries
via 160b7dc05dc mdssvc: set query state for continued queries to
SLQ_STATE_RUNNING
via c1c2a0ec80d s3:winbindd: Fix double close(fd)
via aa2af3c0c20 s3:rpc_server: Fix double blackslash issue in dfs path
via 19e110d7ac5 s3:rpc_server: Initialize consumedcnt to 0 in
_dfs_GetInfo()
via c052d8bdea8 s3:tests: Add rpcclient 'dfsgetinfo' test
via 14ce7756e7a python/samba: Adjust tarfile extraction filter
via 96793d42907 smbd: don't leak the fsp if close_file_smb() fails
via 5ac859e96e8 s3-net: no secrets access required when processing a
ODJ provisioning
via 9100d5ac2e2 VERSION: Bump version up to Samba 4.18.6...
via 108287320f5 Merge tag 'samba-4.18.5' into v4-18-test
via 9b25d901756 s3:winbindd: let winbind_samlogon_retry_loop() fallback
to NT_STATUS_NO_LOGON_SERVERS
via ddd6169918e s3:winbindd: make use of reset_cm_connection_on_error()
in winbind_samlogon_retry_loop()
via 12043529bc1 s3:winbindd: let winbind_samlogon_retry_loop() always
start with authoritative = 1
via 156bafb22e4 s3:winbindd: make use of reset_cm_connection_on_error()
for winbindd_lookup_{names,sids}()
via 3b2f3cf8a26 s3:winbindd: call reset_cm_connection_on_error() in
wb_cache_query_user_list()
via bdaf1b1c5c3 s3:libads: re-initialize num_requests to 0 for
cldap_ping_list retries
via 36bb9480604 smbd: call exit_server_cleanly() to avoid panicking
from 50a9b496556 VERSION: Disable GIT_SNAPSHOT for the 4.18.5 release.
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-18-stable
- Log -----------------------------------------------------------------
-----------------------------------------------------------------------
Summary of changes:
VERSION | 2 +-
WHATSNEW.txt | 83 ++++-
lib/cmdline/cmdline.c | 17 +-
lib/cmdline/cmdline.h | 4 +-
librpc/idl/dcerpc.idl | 2 -
librpc/rpc/dcerpc_util.c | 9 +-
python/modules.c | 35 ++
python/modules.h | 7 +
python/pyglue.c | 60 ++++
python/samba/getopt.py | 69 ++--
python/samba/safe_tarfile.py | 2 +-
python/samba/tests/blackbox/mdsearch.py | 2 +-
python/samba/tests/cred_opt.py | 14 +-
python/samba/tests/dcerpc/mdssvc.py | 6 +-
python/wscript | 1 +
selftest/target/Samba3.pm | 5 +
source3/libads/ldap.c | 1 +
source3/libnet/libnet_join.c | 8 +
source3/modules/vfs_aio_pthread.c | 10 +-
source3/modules/vfs_widelinks.c | 30 +-
source3/passdb/pdb_samba_dsdb.c | 12 +-
source3/rpc_server/dfs/srv_dfs_nt.c | 32 +-
source3/rpc_server/mdssvc/marshalling.c | 29 +-
source3/rpc_server/mdssvc/mdssvc.c | 21 +-
source3/rpc_server/mdssvc/mdssvc.h | 1 +
source3/rpc_server/mdssvc/mdssvc_es.c | 8 +-
source3/rpc_server/mdssvc/srv_mdssvc_nt.c | 1 +
source3/script/tests/test_bug15435_widelink_dfs.sh | 28 ++
source3/script/tests/test_rpcclient_dfs.sh | 7 +
source3/selftest/tests.py | 32 ++
source3/smbd/scavenger.c | 2 +-
source3/smbd/smb1_ipc.c | 2 +-
source3/smbd/smb1_message.c | 2 +-
source3/smbd/smb1_reply.c | 2 +
source3/smbd/smb1_sesssetup.c | 4 +-
source3/smbd/smb2_close.c | 2 +
source3/smbd/smb2_reply.c | 1 +
source3/smbd/smbXsrv_client.c | 33 +-
source3/torture/torture.c | 362 +++++++++++++++++++++
source3/winbindd/winbindd_cache.c | 1 +
source3/winbindd/winbindd_cm.c | 10 +-
source3/winbindd/winbindd_msrpc.c | 10 +-
source3/winbindd/winbindd_pam.c | 67 ++--
source4/auth/pyauth.c | 38 +--
source4/auth/wscript_build | 4 +-
source4/dsdb/common/util.c | 19 ++
source4/dsdb/common/util_trusts.c | 21 +-
source4/dsdb/samdb/ldb_modules/operational.c | 22 +-
source4/dsdb/samdb/ldb_modules/samldb.c | 7 +-
source4/libcli/smb2/connect.c | 4 +-
source4/rpc_server/backupkey/dcesrv_backupkey.c | 54 ++-
source4/rpc_server/lsa/lsa_init.c | 7 +-
source4/rpc_server/netlogon/dcerpc_netlogon.c | 8 +-
source4/torture/ndr/dcerpc.c | 148 +++++++++
source4/torture/ndr/ndr.c | 1 +
source4/torture/smb2/acls.c | 34 --
source4/torture/smb2/multichannel.c | 315 ++++++++++++++++++
source4/torture/smb2/util.c | 55 ++--
source4/torture/vfs/acl_xattr.c | 34 --
source4/torture/wscript_build | 1 +
60 files changed, 1467 insertions(+), 341 deletions(-)
create mode 100755 source3/script/tests/test_bug15435_widelink_dfs.sh
create mode 100644 source4/torture/ndr/dcerpc.c
Changeset truncated at 500 lines:
diff --git a/VERSION b/VERSION
index 2f3d9198c1c..665cbe2cc9f 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
########################################################
SAMBA_VERSION_MAJOR=4
SAMBA_VERSION_MINOR=18
-SAMBA_VERSION_RELEASE=5
+SAMBA_VERSION_RELEASE=6
########################################################
# If a official release has a serious bug #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 2ad4ab1a0ee..1bb83f6ba4c 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,3 +1,83 @@
+ ==============================
+ Release Notes for Samba 4.18.6
+ August 16, 2023
+ ==============================
+
+
+This is the latest stable release of the Samba 4.18 release series.
+
+
+Changes since 4.18.5
+--------------------
+
+o Jeremy Allison <j...@samba.org>
+ * BUG 15420: reply_sesssetup_and_X() can dereference uninitialized tmp
+ pointer.
+ * BUG 15430: Missing return in reply_exit_done().
+
+o Andrew Bartlett <abart...@samba.org>
+ * BUG 15289: post-exec password redaction for samba-tool is more reliable
for
+ fully random passwords as it no longer uses regular expressions
+ containing the password value itself.
+ * BUG 9959: Windows client join fails if a second container CN=System exists
+ somewhere.
+
+o Ralph Boehme <s...@samba.org>
+ * BUG 15342: Spotlight sometimes returns no results on latest macOS.
+ * BUG 15417: Renaming results in NT_STATUS_SHARING_VIOLATION if previously
+ attempted to remove the destination.
+ * BUG 15427: Spotlight results return wrong date in result list.
+
+o Günther Deschner <g...@samba.org>
+ * BUG 15414: "net offlinejoin provision" does not work as non-root user.
+
+o Pavel Filipenský <pfilipen...@samba.org>
+ * BUG 15400: rpcserver no longer accepts double backslash in dfs pathname.
+ * BUG 15433: cm_prepare_connection() calls close(fd) for the second time.
+
+o Stefan Metzmacher <me...@samba.org>
+ * BUG 15346: 2-3min delays at reconnect with smb2_validate_sequence_number:
+ bad message_id 2.
+ * BUG 15441: samba-tool ntacl get segfault if aio_pthread appended.
+ * BUG 15446: DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed.
+
+o Noel Power <noel.po...@suse.com>
+ * BUG 15390: Python tarfile extraction needs change to avoid a warning
+ (CVE-2007-4559 mitigation).
+ * BUG 15435: Regression DFS not working with widelinks = true.
+
+o Arvid Requate <requ...@univention.de>
+ * BUG 9959: Windows client join fails if a second container CN=System exists
+ somewhere.
+
+o Jones Syue <joness...@qnap.com>
+ * BUG 15441: samba-tool ntacl get segfault if aio_pthread appended.
+ * BUG 15449: mdssvc: Do an early talloc_free() in _mdssvc_open().
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical:matrix.org matrix room, or
+#samba-technical IRC channel on irc.libera.chat.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 4.1 and newer product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
==============================
Release Notes for Samba 4.18.5
July 19, 2023
@@ -70,8 +150,7 @@ database (https://bugzilla.samba.org/).
======================================================================
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
==============================
Release Notes for Samba 4.18.4
July 05, 2023
diff --git a/lib/cmdline/cmdline.c b/lib/cmdline/cmdline.c
index 9f4e964f289..aade4ca365e 100644
--- a/lib/cmdline/cmdline.c
+++ b/lib/cmdline/cmdline.c
@@ -134,8 +134,9 @@ void samba_cmdline_set_machine_account_fn(
cli_credentials_set_machine_account_fn = fn;
}
-void samba_cmdline_burn(int argc, char *argv[])
+bool samba_cmdline_burn(int argc, char *argv[])
{
+ bool burnt = false;
bool found = false;
bool is_user = false;
char *p = NULL;
@@ -145,9 +146,13 @@ void samba_cmdline_burn(int argc, char *argv[])
for (i = 0; i < argc; i++) {
p = argv[i];
if (p == NULL) {
- return;
+ return false;
}
+ /*
+ * Take care that this list must be in longest-match
+ * first order
+ */
if (strncmp(p, "-U", 2) == 0) {
ulen = 2;
found = true;
@@ -156,9 +161,15 @@ void samba_cmdline_burn(int argc, char *argv[])
ulen = 6;
found = true;
is_user = true;
+ } else if (strncmp(p, "--password2", 11) == 0) {
+ ulen = 11;
+ found = true;
} else if (strncmp(p, "--password", 10) == 0) {
ulen = 10;
found = true;
+ } else if (strncmp(p, "--newpassword", 13) == 0) {
+ ulen = 13;
+ found = true;
}
if (found) {
@@ -180,8 +191,10 @@ void samba_cmdline_burn(int argc, char *argv[])
memset_s(p, strlen(p), '\0', strlen(p));
found = false;
is_user = false;
+ burnt = true;
}
}
+ return burnt;
}
static bool is_popt_table_end(const struct poptOption *o)
diff --git a/lib/cmdline/cmdline.h b/lib/cmdline/cmdline.h
index e254a1db5c3..b9cb4764bea 100644
--- a/lib/cmdline/cmdline.h
+++ b/lib/cmdline/cmdline.h
@@ -147,8 +147,10 @@ void samba_cmdline_set_machine_account_fn(
* @param[in] argc The number of arguments.
*
* @param[in] argv[] The argument array we should remove secrets from.
+ *
+ * @return true if a password was removed, false otherwise.
*/
-void samba_cmdline_burn(int argc, char *argv[]);
+bool samba_cmdline_burn(int argc, char *argv[]);
/**
* @brief Sanity check the command line options.
diff --git a/librpc/idl/dcerpc.idl b/librpc/idl/dcerpc.idl
index bbb17f0b8c4..1850526042c 100644
--- a/librpc/idl/dcerpc.idl
+++ b/librpc/idl/dcerpc.idl
@@ -276,12 +276,10 @@ interface dcerpc
} dcerpc_auth3;
typedef [public] struct {
- [value(0)] uint32 _pad;
[flag(NDR_REMAINING)] DATA_BLOB auth_info;
} dcerpc_orphaned;
typedef [public] struct {
- [value(0)] uint32 _pad;
[flag(NDR_REMAINING)] DATA_BLOB auth_info;
} dcerpc_co_cancel;
diff --git a/librpc/rpc/dcerpc_util.c b/librpc/rpc/dcerpc_util.c
index c3997eb1b19..e3c81b6194a 100644
--- a/librpc/rpc/dcerpc_util.c
+++ b/librpc/rpc/dcerpc_util.c
@@ -565,9 +565,14 @@ static int dcerpc_read_ncacn_packet_next_vector(struct
tstream_context *stream,
ofs = state->buffer.length;
- if (frag_len < ofs) {
+ if (frag_len <= ofs) {
/*
- * something is wrong, let the caller deal with it
+ * With frag_len == ofs, we are done, this is likely
+ * a DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED
+ * without any payload.
+ *
+ * Otherwise it's a broken packet and we
+ * let the caller deal with it.
*/
*_vector = NULL;
*_count = 0;
diff --git a/python/modules.c b/python/modules.c
index d8b330b6b28..ca563ff07d2 100644
--- a/python/modules.c
+++ b/python/modules.c
@@ -71,3 +71,38 @@ error:
Py_XDECREF(mod_sys);
return false;
}
+
+char **PyList_AsStringList(TALLOC_CTX *mem_ctx, PyObject *list,
+ const char *paramname)
+{
+ char **ret;
+ Py_ssize_t i;
+ if (!PyList_Check(list)) {
+ PyErr_Format(PyExc_TypeError, "%s is not a list", paramname);
+ return NULL;
+ }
+ ret = talloc_array(NULL, char *, PyList_Size(list)+1);
+ if (ret == NULL) {
+ PyErr_NoMemory();
+ return NULL;
+ }
+
+ for (i = 0; i < PyList_Size(list); i++) {
+ const char *value;
+ Py_ssize_t size;
+ PyObject *item = PyList_GetItem(list, i);
+ if (!PyUnicode_Check(item)) {
+ PyErr_Format(PyExc_TypeError, "%s should be strings",
paramname);
+ return NULL;
+ }
+ value = PyUnicode_AsUTF8AndSize(item, &size);
+ if (value == NULL) {
+ talloc_free(ret);
+ return NULL;
+ }
+ ret[i] = talloc_strndup(ret, value, size);
+ }
+ ret[i] = NULL;
+ return ret;
+}
+
diff --git a/python/modules.h b/python/modules.h
index 75108d77907..356937d71f9 100644
--- a/python/modules.h
+++ b/python/modules.h
@@ -20,7 +20,14 @@
#ifndef __SAMBA_PYTHON_MODULES_H__
#define __SAMBA_PYTHON_MODULES_H__
+#include <talloc.h>
+
bool py_update_path(void);
/* discard signature of 'func' in favour of 'target_sig' */
#define PY_DISCARD_FUNC_SIG(target_sig, func) (target_sig)(void(*)(void))func
+
+char **PyList_AsStringList(TALLOC_CTX *mem_ctx, PyObject *list,
+ const char *paramname);
+
#endif /* __SAMBA_PYTHON_MODULES_H__ */
+
diff --git a/python/pyglue.c b/python/pyglue.c
index 64be7389b70..8378aa797d4 100644
--- a/python/pyglue.c
+++ b/python/pyglue.c
@@ -20,11 +20,13 @@
#include <Python.h>
#include "python/py3compat.h"
#include "includes.h"
+#include "python/modules.h"
#include "version.h"
#include "param/pyparam.h"
#include "lib/socket/netif.h"
#include "lib/util/debug.h"
#include "librpc/ndr/ndr_private.h"
+#include "lib/cmdline/cmdline.h"
void init_glue(void);
static PyObject *PyExc_NTSTATUSError;
@@ -461,6 +463,62 @@ static PyObject *py_strstr_m(PyObject *self, PyObject
*args)
return result;
}
+static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args)
+{
+ PyObject *cmdline_as_list, *ret;
+ char *burnt_cmdline = NULL;
+ Py_ssize_t i, argc;
+ char **argv = NULL;
+ TALLOC_CTX *frame = talloc_stackframe();
+ bool burnt;
+
+ if (!PyArg_ParseTuple(args, "O!", &PyList_Type, &cmdline_as_list))
+ {
+ TALLOC_FREE(frame);
+ return NULL;
+ }
+
+ argc = PyList_GET_SIZE(cmdline_as_list);
+
+ if (argc == 0) {
+ TALLOC_FREE(frame);
+ Py_RETURN_NONE;
+ }
+
+ argv = PyList_AsStringList(frame, cmdline_as_list, "sys.argv");
+ if (argv == NULL) {
+ return NULL;
+ }
+
+ burnt = samba_cmdline_burn(argc, argv);
+ if (!burnt) {
+ TALLOC_FREE(frame);
+ Py_RETURN_NONE;
+ }
+
+ for (i = 0; i < argc; i++) {
+ if (i == 0) {
+ burnt_cmdline = talloc_strdup(frame,
+ argv[i]);
+ } else {
+ burnt_cmdline
+ = talloc_asprintf_append(burnt_cmdline,
+ " %s",
+ argv[i]);
+ }
+ if (burnt_cmdline == NULL) {
+ PyErr_NoMemory();
+ TALLOC_FREE(frame);
+ return NULL;
+ }
+ }
+
+ ret = PyUnicode_FromString(burnt_cmdline);
+ TALLOC_FREE(frame);
+
+ return ret;
+}
+
static PyMethodDef py_misc_methods[] = {
{ "generate_random_str", (PyCFunction)py_generate_random_str,
METH_VARARGS,
"generate_random_str(len) -> string\n"
@@ -520,6 +578,8 @@ static PyMethodDef py_misc_methods[] = {
METH_NOARGS, "is Samba built with selftest enabled?" },
{ "ndr_token_max_list_size", (PyCFunction)py_ndr_token_max_list_size,
METH_NOARGS, "How many NDR internal tokens is too many for this
build?" },
+ { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline,
+ METH_VARARGS, "Return a redacted commandline to feed to
setproctitle (None if no redaction required)" },
{0}
};
diff --git a/python/samba/getopt.py b/python/samba/getopt.py
index ff8aead3f8d..e9ff3de5b34 100644
--- a/python/samba/getopt.py
+++ b/python/samba/getopt.py
@@ -29,7 +29,7 @@ from samba.credentials import (
MUST_USE_KERBEROS,
)
import sys
-
+from samba._glue import get_burnt_commandline
OptionError = optparse.OptionValueError
@@ -40,6 +40,25 @@ class SambaOptions(optparse.OptionGroup):
def __init__(self, parser):
from samba import fault_setup
fault_setup()
+
+ # This removes passwords from the commandline via
+ # setproctitle() but makes no change to python sys.argv so we
+ # can continue to process as normal
+ #
+ # get_burnt_commandline returns None if no change is needed
+ new_proctitle = get_burnt_commandline(sys.argv)
+ if new_proctitle is not None:
+ try:
+ import setproctitle
+ setproctitle.setproctitle(new_proctitle)
+
+ except ModuleNotFoundError:
+ msg = ("WARNING: Using passwords on command line is insecure. "
+ "Installing the setproctitle python module will hide "
+ "these from shortly after program start.\n")
+ sys.stderr.write(msg)
+ sys.stderr.flush()
+
from samba.param import LoadParm
optparse.OptionGroup.__init__(self, parser, "Samba Common Options")
self.add_option("-s", "--configfile", action="callback",
@@ -203,53 +222,6 @@ class CredentialsOptions(optparse.OptionGroup):
help="DEPRECATED: Migrate to --use-kerberos",
callback=self._set_kerberos_legacy)
self.creds = Credentials()
- def _ensure_secure_proctitle(self, opt_str, secret_data,
data_type="password"):
- """ Make sure no sensitive data (e.g. password) resides in proctitle.
"""
- import re
- try:
- import setproctitle
- except ModuleNotFoundError:
- msg = ("WARNING: Using %s on command line is insecure. "
- "Please install the setproctitle python module.\n"
- % data_type)
- sys.stderr.write(msg)
- sys.stderr.flush()
- return False
- # Regex to search and replace secret data + option with.
- # .*[ ]+ -> Before the option must be one or more spaces.
- # [= ] -> The option and the secret data might be separated by
space
- # or equal sign.
- # [ ]*.* -> After the secret data might be one, many or no space.
- pass_opt_re_str = "(.*[ ]+)(%s[= ]%s)([ ]*.*)" % (opt_str, secret_data)
- pass_opt_re = re.compile(pass_opt_re_str)
- # Get current proctitle.
- cur_proctitle = setproctitle.getproctitle()
- # Make sure we build the correct regex.
- if not pass_opt_re.match(cur_proctitle):
- msg = ("Unable to hide %s in proctitle. This is most likely "
- "a bug!\n" % data_type)
- sys.stderr.write(msg)
- sys.stderr.flush()
- return False
- # String to replace secret data with.
- secret_data_replacer = "xxx"
- # Build string to replace secret data and option with. And as we dont
- # want to change anything else than the secret data within the
proctitle
- # we have to check if the option was passed with space or equal sign as
- # separator.
- opt_pass_with_eq = "%s=%s" % (opt_str, secret_data)
- opt_pass_part = re.sub(pass_opt_re_str, r'\2', cur_proctitle)
- if opt_pass_part == opt_pass_with_eq:
- replace_str = "%s=%s" % (opt_str, secret_data_replacer)
- else:
- replace_str = "%s %s" % (opt_str, secret_data_replacer)
- # Build new proctitle:
- new_proctitle = re.sub(pass_opt_re_str,
- r'\1' + replace_str + r'\3',
- cur_proctitle)
- # Set new proctitle.
- setproctitle.setproctitle(new_proctitle)
-
def _add_option(self, *args1, **kwargs):
if self.special_name is None:
return self.add_option(*args1, **kwargs)
@@ -269,7 +241,6 @@ class CredentialsOptions(optparse.OptionGroup):
self.creds.set_domain(arg)
def _set_password(self, option, opt_str, arg, parser):
- self._ensure_secure_proctitle(opt_str, arg, "password")
self.creds.set_password(arg)
self.ask_for_password = False
self.machine_pass = False
diff --git a/python/samba/safe_tarfile.py b/python/samba/safe_tarfile.py
index 7a2b0382a79..21366178475 100644
--- a/python/samba/safe_tarfile.py
+++ b/python/samba/safe_tarfile.py
@@ -31,7 +31,7 @@ class TarFile(UnsafeTarFile):
# New in version 3.11.4 (also has been backported)
#
https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extraction_filter
# https://peps.python.org/pep-0706/
- extraction_filter = staticmethod(tarfile.data_filter)
+ extraction_filter = staticmethod(tarfile.tar_filter)
except AttributeError:
def extract(self, member, path="", set_attrs=True, *,
numeric_owner=False):
diff --git a/python/samba/tests/blackbox/mdsearch.py
b/python/samba/tests/blackbox/mdsearch.py
index c8e75661f15..46af6f94624 100644
--- a/python/samba/tests/blackbox/mdsearch.py
+++ b/python/samba/tests/blackbox/mdsearch.py
@@ -100,7 +100,7 @@ class MdfindBlackboxTests(BlackboxTestCase):
config = os.environ["SMB_CONF_PATH"]
json_in = r'''{
- "from": 0, "size": 100, "_source": ["path.real"],
+ "from": 0, "size": 50, "_source": ["path.real"],
"query": {
"query_string": {
--
Samba Shared Repository
