summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2011-07-20s3-auth Fix spellingAndrew Bartlett1-7/+7
2011-07-20s3-auth Remove pointless destructor in make_server_infoAndrew Bartlett1-10/+0
All the callers allocate ->info3 as a talloc child already. As regardes the TALLOC_ZERO(), I added this originally out of parinoia many years ago. We do not consistantly zero session keys in memory, and for NTLMv2 and Kerberos they are random for each sesssion, so breaking into smbd far enough to read an old session key isn't a particularly interesting attack, compared with (say) reading the keytab or the password database. (NTLM and LM session keys are fixed derivitives of the passwords however). Andrew Bartlett
2011-07-20s3-auth inline make_auth_session_info into only callerAndrew Bartlett3-25/+1
2011-07-20security.idl: Use gid_t for gid in security_unix_tokenAndrew Bartlett1-1/+1
2011-07-20s3-auth Remove seperate guest booleanAndrew Bartlett11-22/+31
Instead, we base our guest calculations on the presence or absense of the authenticated users group in the token, ensuring that we have only one canonical source of this important piece of authorization data Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20auth: Set NETLOGON_GUEST and use it to determine guest statusAndrew Bartlett2-1/+5
These additional measures should help ensure we do not accidentily upgrade a guest to an authenticated user in the future. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20selftest: Add tests to verify that the named pipe proxy works.Andrew Bartlett1-0/+7
This verifies that for NTLM authenticated connections, named pipe forwarding works as expected, including the session keys. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20selftest: Pass lsass and epmapper across the named pipe proxy to the AD serverAndrew Bartlett1-0/+2
Eventually we will have just one end point mapper, but for now we need to use the source4 one for the AD tests. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20auth: remove now unused auth3_session_info from auth.idlAndrew Bartlett1-11/+1
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20auth: Move make_user_info_SamBaseInfo() to talloc_strdup and out of memory ↵Andrew Bartlett1-9/+31
checking Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20auth: Split out make_user_info_SamBaseInfo and add authenticated argumentAndrew Bartlett7-45/+77
This will allow the source3 auth code to call this without needing to double-parse the SIDs Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-rpc_server remove per-element copies of auth_session_infoAndrew Bartlett2-44/+4
This is not required any more now that they are the same structure, and shows the value in having a common structure across the codebase. In particular, now any additional state that needs to be added to the auth_session_info will be transparently available across the named pipe proxy, without a need to modify the mapping layer. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Use the common auth_session_infoAndrew Bartlett42-228/+228
This patch finally has the same structure being used to describe the authorization data of a user across the whole codebase. This will allow of our session handling to be accomplished with common code. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth use auth_user_info not netr_SamInfo3 in auth3_session_infoAndrew Bartlett19-101/+84
This makes auth3_session_info identical to auth_session_info The logic to convert the info3 to a struct auth_user_info is essentially moved up the stack from the named pipe proxy in source3/rpc_server to create_local_token(). Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-rpc_server read and write the unix_token and unix_info across named_pipe_authAndrew Bartlett2-27/+42
This ensures that the exact same token is used on both sides of the pipe, when a full token is passed (ie, source3 to source3, but not yet source4 to to source3 as the unix info isn't calculated there yet). If we do not have unix_token, we fall back to the old behaviour and go via create_local_token(). (However, in this case the security_token is now overwritten, as it is better to have it match the rest of the session_info create_local_token() builds). Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth reimplement copy_session_info via NDR pull/pushAndrew Bartlett1-57/+23
This ensures we do not miss elements. Pattern copied from auth_netlogond. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20auth: use char * pointers in auth.idlAndrew Bartlett1-10/+10
We need to use this, and not utf8string because we need to transport NULL pointers correctly. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Remove pointless destructorAndrew Bartlett1-10/+0
All the users of this structure allocate info3 on the session_info Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth import auth3_session_info into IDLAndrew Bartlett2-25/+23
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Avoid redundant copies in create_local_token()Andrew Bartlett1-20/+20
These values were not read before being overwritten again. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Add comments to copy_session_info_serverinfo_guest()Andrew Bartlett1-2/+5
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth inline copy_serverinfo_session_info into only callerAndrew Bartlett1-72/+56
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth use a cached auth_serversupplied_info in make_server_info_guest()Andrew Bartlett1-11/+19
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth remove extra from auth3_session_infoAndrew Bartlett2-11/+5
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Clarify inputs and ouptuts by using elements from server_infoAndrew Bartlett1-5/+5
This allows us not the put all of these elements into the auth3_session_info if they are only used as inputs to these functions. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth assert that security_token is present in the copy, and explain why ↵Andrew Bartlett1-7/+16
nss_token can be skipped Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Remove unused nss_token variableAndrew Bartlett1-5/+0
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth: Remove unused lm_session_key from auth3_session_infoAndrew Bartlett2-11/+5
The long term authorization state needs only the final, negotiated session key, and not the original LM key that may possibly have been an input. The special case of the guest account simply needs both values filled back in with the zeros to avoid changing behaviour in the cached server_info. Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth remove unused copy_serverinfoAndrew Bartlett2-61/+0
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Use system boolean in auth_user_info_unixAndrew Bartlett3-9/+5
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Use guest boolean in auth_user_info_unixAndrew Bartlett10-24/+26
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20auth: Put 'guest' and 'system' booleans into auth_user_info_unixAndrew Bartlett1-0/+6
This will allow a transformation of auth3_session_info into auth_session_info by substitution. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Use struct auth_user_info_unix for unix_name and sanitized_usernameAndrew Bartlett26-100/+109
This is closer to the layout of struct auth_session_info in auth.idl Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20auth: include auth.idl structures into common_auth.hAndrew Bartlett1-0/+2
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Use *unix_token rather than utok in struct auth3_session_infoAndrew Bartlett26-142/+174
This brings this structure one step closer to the struct auth_session_info. A few SMB_ASSERT calls are added in some key places to ensure that this pointer is initialised, to make tracing any bugs here easier in future. NOTE: Many of the users of this structure should be reviewed, as unix and NT access checks are mixed in a way that should just be done using the NT ACL. This patch has not changed this behaviour however. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Use struct auth3_session_info outside the auth subsystemAndrew Bartlett41-223/+263
This seperation between the structure used inside the auth modules and in the wider codebase allows for a gradual migration from struct auth_serversupplied_info -> struct auth_session_info (from auth.idl) The idea here is that we keep a clear seperation between the structure before and after the local groups, local user lookup and the session key modifications have been processed, as the lack of this seperation has caused issues in the past. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Add struct auth3_session_info to aid transition to auth_session infoAndrew Bartlett4-0/+266
This will allow a gradual conversion of the required elements from the current struct auth_serversupplied_info. This commit adds the structure definition and some helper functions to copy between the two structures. At this stage these structures and functions are IDENTICAL to the existing code, and so show the past history of that code. The plan is to slowly modify them over the course of the patch series, so that the changes being made a clear. By using a seperate structure to auth_serversupplied_info we can remove elements that are not needed after the authentication, and we can choose a layout that best reflects the needs of runtime users, rather than the internals of the authentication subsystem. By eventually using the auth_session_info from auth.idl, we will gain a single session authorization structure across the whole codebase, allowing more code to be shared, and a much more transparent process for forwarding authorization credentials over the named pipe proxy. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Add const to indicate input elementsAndrew Bartlett2-4/+4
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20auth: Preserve guest flag on transition via netr_SamInfo3Andrew Bartlett2-0/+5
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s3-auth Restore nss_token behaviour by reading from server_infoAndrew Bartlett1-1/+1
The implementation of copy_serverinfo(), used to copy server_info into session_info never copied the nss_token variable, and so 17d8f0ad30847bb940f645ee1817d782ddaaee74 introduced this regression. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20Add my copyrightAndrew Bartlett4-2/+4
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20s4-param Handle P_CHAR and P_BOOLREV in pyparamAndrew Bartlett1-0/+4
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20debug: log early messages to stdout, and keep it openAndrew Bartlett5-3/+22
The --log-stdout option was compromised by the log file descriptors being closed once the file process forked. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-20lib/util Change debug priority order: DEBUG_STDOUT now overrides DEBUG_FILEAndrew Bartlett1-1/+1
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-19Second part of fix for bug 8310 - toupper_ascii() is broken on big-endian ↵Jeremy Allison4-2/+14
systems. Re-add: smb_ucs2_t toupper_w(smb_ucs2_t v); and ensure it is called whenever we are operating on smb_ucs2_t variables. I'd like to make the definition of smb_ucs2_t incompatible with int and codepoint_t so they can't be mixed, but that's a patch for another time. Autobuild-User: Jeremy Allison <jra@samba.org> Autobuild-Date: Tue Jul 19 23:48:05 CEST 2011 on sn-devel-104
2011-07-19First part of fix for bug 8310 - toupper_ascii() is broken on big-endian systemsJeremy Allison12-66/+24
Remove int toupper_ascii(int c); int tolower_ascii(int c); int isupper_ascii(int c); int islower_ascii(int c); and replace with their _m equivalents, as they are identical.
2011-07-19s3-libsmb: remove unused cli_lock()Björn Baumbach2-18/+0
Replaced with cli_lock32() Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Jul 19 00:43:03 CEST 2011 on sn-devel-104
2011-07-18s3-torture: run_locktest5(): replace cli_lock() with cli_lock32()Björn Baumbach1-11/+15
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-07-18s3-torture: run_locktest4(): replace cli_lock() with cli_lock32()Björn Baumbach1-37/+44
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-07-18s3-torture: run_oplock2(): replace cli_lock() with cli_lock32()Björn Baumbach1-5/+6
Signed-off-by: Stefan Metzmacher <metze@samba.org>
generated by cgit (git 2.34.1) at 2024-11-06 12:40:31 +0000