summaryrefslogtreecommitdiff
path: root/source3/include/ntdomain.h
AgeCommit message (Collapse)AuthorFilesLines
2003-11-22Changes all over the shop, but all towards:Andrew Bartlett1-1/+1
- NTLM2 support in the server - KEY_EXCH support in the server - variable length session keys. In detail: - NTLM2 is an extension of NTLMv1, that is compatible with existing domain controllers (unlike NTLMv2, which requires a DC upgrade). * This is known as 'NTLMv2 session security' * (This is not yet implemented on the RPC pipes however, so there may well still be issues for PDC setups, particuarly around password changes. We do not fully understand the sign/seal implications of NTLM2 on RPC pipes.) This requires modifications to our authentication subsystem, as we must handle the 'challege' input into the challenge-response algorithm being changed. This also needs to be turned off for 'security=server', which does not support this. - KEY_EXCH is another 'security' mechanism, whereby the session key actually used by the server is sent by the client, rather than being the shared-secret directly or indirectly. - As both these methods change the session key, the auth subsystem needed to be changed, to 'override' session keys provided by the backend. - There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation. - The 'names blob' in NTLMSSP is always in unicode - never in ascii. Don't make an ascii version ever. - The other big change is to allow variable length session keys. We have always assumed that session keys are 16 bytes long - and padded to this length if shorter. However, Kerberos session keys are 8 bytes long, when the krb5 login uses DES. * This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. * - Add better DEBUG() messages to ntlm_auth, warning administrators of misconfigurations that prevent access to the privileged pipe. This should help reduce some of the 'it just doesn't work' issues. - Fix data_blob_talloc() to behave the same way data_blob() does when passed a NULL data pointer. (just allocate) REMEMBER to make clean after this commit - I have changed plenty of data structures... (This used to be commit f3bbc87b0dac63426cda6fac7a295d3aad810ecc)
2003-10-24Add initshutdown pipe commands to rpcclient. Second part of fix to bugJim McDonough1-0/+1
#534 (This used to be commit 4e86243ea1d4bbe96720caaaf02300f5e15bee5a)
2003-08-14Attempt at fixing bug #283. There however is no solution.Gerald Carter1-2/+18
There is a workaround documented in the bug report. This patch does: * add server support for the LSA_DS UUID on the lsarpc pipe * store a list of context_ids/api_structs in the pipe_struct so that we don't have to lookup the function table for a pipe. We just match the context_id. Note that a dce/rpc alter_context does not destroy the previous context so it is possible to have multiple bindings active on the same pipe. Observed from standalone win2k sp4 client. * added server code for DsROleGetPrimaryDOmainInfo() but disabled it since it causes problems enumerating users and groups from a 2ksp4 domain member in a Samba domain. (This used to be commit 96bc2abfcb0dd0912696fad76e43cb217b33e061)
2003-04-16Move PAC decoding over from HEAD.Jim McDonough1-0/+3
(This used to be commit b0fd4e5555dd93c584cd86eaac080663b9e4031f)
2003-04-14Merge of rpcecho pipe for testing large dcerpc requests and responses.Tim Potter1-0/+1
Only compiled in when --enable-developer argument passed to configure. (This used to be commit 017da9393bab276543d0d5c50df8c760780f2450)
2003-04-06Merge the TNG netlogon schannel from HEAD.Volker Lendecke1-0/+7
No more XP requiresignorseal anymore! Thanks again to Luke :-) Volker (This used to be commit 6b2b55901d66cab0c0c0c90bd0585c870be6e468)
2003-01-03Merge from HEAD - make Samba compile with -Wwrite-strings without additionalAndrew Bartlett1-2/+2
warnings. (Adds a lot of const). Andrew Bartlett (This used to be commit 3a7458f9472432ef12c43008414925fd1ce8ea0c)
2002-10-04merge of working dsrolegetprimdominfo() client code from APP_HEADGerald Carter1-0/+1
(This used to be commit 028477e35208e76fedbc7c743426fd9be94b7cf0)
2002-07-15updated the 3.0 branch from the head branch - ready for alpha18Andrew Tridgell1-1/+0
(This used to be commit 03ac082dcb375b6f3ca3d810a6a6367542bc23ce)
2002-03-05Spelling fixes.Tim Potter1-1/+1
(This used to be commit a7fa0733badad66ae610eac5e01569cf264976f3)
2002-03-03Matching header files for the last netlogon cleanup.Andrew Bartlett1-0/+7
Andrew Bartlett (This used to be commit a9edcc1cb7c5f2692bc1931f0a2059a91891f178)
2002-01-30Removed version number from file header.Tim Potter1-2/+1
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2002-01-25Return correct RPC fault PDU on bad handle incoming.Jeremy Allison1-0/+6
Jeremy. (This used to be commit 0db93d8752197e213f0974edae53e2dafdd77b51)
2002-01-20Kill off another ugly wart from the side of the passdb subsystem.Andrew Bartlett1-0/+2
This time its the pdb_getsampwuid() function - which was only being used by the SAMR rpc subsystem to gain a 'user session key'. This 'user session key' is actually generated at login time, and the other changes here simply move that data around. This also means that (when I check some details) we will be able to use the user session key, even when we are not actually the DC, becouse its one of the components of the info3 struct returned on logon. Andrew Bartlett (This used to be commit 799ac01fe08a338e4e94289f5d6767ebf905c1fa)
2002-01-20This is the current patch from Luke Leighton <lckl@samba-tng.org> to add aAndrew Bartlett1-8/+85
degree of seperation betwen reading/writing the raw NamedPipe SMB packets and the matching operations inside smbd's RPC components. This patch is designed for no change in behaviour, and my tests hold that to be true. This patch does however allow for the future loadable modules interface to specify function pointers in replacement of the fixed state. The pipes_struct has been split into two peices, with smb_np_struct taking the information that should be generic to where the data ends up. Some other minor changes are made: we get another small helper function in util_sock.c and some of the original code has better failure debugs and variable use. (As per on-list comments). Andrew Bartlett (This used to be commit 8ef13cabdddf58b741886782297fb64b2fb7e489)
2001-09-14Removed CHECK_STRUCT macro - it isn't used anywhere.Tim Potter1-12/+0
(This used to be commit 06c619b395f212ec3122cf1c804b27afba04e79d)
2001-05-04Merge of struct acct_info from TNG.Tim Potter1-1/+2
(This used to be commit 2eb28b3d516325725678a67f8b0030aec8ec61d7)
2001-04-02include/ntdomain.h:Jeremy Allison1-1/+0
rpc_server/srv_lsa_hnd.c: Remove back pointer from policy handle list as the pipe that opened the handle may have been closed. We were dereferencing into something that had been closed. rpc_parse/parse_spoolss.c: Sync up with Gerald's changes in 2.2. lib/replace.c: Don't do proto on setlinebuf as it differs between systems. Jeremy. (This used to be commit 887ef3e12dc56b89b2284d42b16a81f03e15110b)
2001-03-13Move to a handle database per pipe name, not per pipe.Jeremy Allison1-3/+4
Jeremy. (This used to be commit a24b248a77ccac364832ff7d4df083d437caf9ed)
2001-03-11Moved cruft out of smb.h into ntdomain.h where it belongs. dc structJeremy Allison1-17/+16
now in pipe struct (where used) rather than user_struct. Secured machine account password changing in srv_netlog_nt.c - ensure that only the given machine can change its own password. May need to free this up later for NT admin tools, but this is a fail-safe secure position for now. Jeremy. (This used to be commit 46b12f2275dcd4b3114085160cd456441f9e921e)
2001-03-11Merge of new 2.2 code into HEAD (Gerald I hate you :-) :-). Allows new SAMRJeremy Allison1-4/+25
RPC code to merge with new passdb code. Currently rpcclient doesn't compile. I'm working on it... Jeremy. (This used to be commit 0be41d5158ea4e645e93e8cd30617c038416e549)
2001-03-09Serious (and I *mean* serious) attempt to fix little/bigendian RPC issues.Jeremy Allison1-0/+11
We were reading the endainness in the RPC header and then never propagating it to the internal parse_structs used to parse the data. Also removed the "align" argument to prs_init as it was *always* set to 4, and if needed can be set differently on a case by case basis. Now ready for AS/U testing when Herb gets it set up :-). Jeremy. (This used to be commit 0cd37c831d79a12a10e479bf4fa89ffe64c1292a)
2000-07-27Ok - this is a *BIG* change - but it fixes the problems with static stringsJeremy Allison1-12/+14
in the RPC code. This change was prompted by trying to save a long (>256) character comment in the printer properties page. The new system associates a TALLOC_CTX with the pipe struct, and frees the pool on return of a complete PDU. A global TALLOC_CTX is used for the odd buffer allocated in the BUFFERxx code, and is freed in the main loop. This code works with insure, and seems to be free of memory leaks and crashes (so far) but there are probably the occasional problem with code that uses UNISTRxx structs on the stack and expects them to contain storage without doing a init_unistrXX(). This means that rpcclient will probably be horribly broken. A TALLOC_CTX also needed associating with the struct cli_state also, to make the prs_xx code there work. The main interface change is the addition of a TALLOC_CTX to the prs_init calls - used for dynamic allocation in the prs_XXX calls. Now this is in place it should make dynamic allocation of all RPC memory on unmarshall *much* easier to fix. Jeremy. (This used to be commit 0ff2ce543ee54f7364e6d839db6d06e7ef1edcf4)
2000-07-18Fixed some more client SPOOLSS functions. The followingGerald Carter1-21/+0
functions work now: - spoolenum - spoolopen - spoolgetprinter - spoolgetprinterdriver Items todo: - track down memory bug with spoolenumdata - fix spoolgetprinterdriverdir - fix spoolgetdata - fix display_job_info_ctr in spooljobs All part of the ongoing rpcclient work. Also included a new generic list ADT. Cleaner and simplier than the stuff in util_array.c i think (but then that's why I wrote it). --jerry (This used to be commit 381aba2c9a63faa53728f0520ac316478bc7a1c3)
2000-07-14make protoGerald Carter1-0/+11
and a few changes to ntdomain for rpcclient printing functions --jerry (This used to be commit eb3f545f54eabb8b2b9a735808ebf49808ea85eb)
2000-07-07More rpcclient merge issues:Gerald Carter1-0/+12
* fixes some readline bugs from the merge * first attempt at commands (spoolenum almost works) * no changes to existing functions in HEAD; only additions of new functions. I'll weed out what I can as I go. --jerry (This used to be commit 61d2aad5dc2b212b11c981f1eca47efa627e9fc8)
2000-07-06Moved authenticated pipe user details into a current_user struct.Tim Potter1-1/+1
(This used to be commit 3c4a5f624bfa69eb81d998530d9227e158edd109)
2000-07-03Some more sec_ctx changes. Modified some fields in the pipe_structTim Potter1-14/+14
structure so authenticated pipe users can have their unix groups set when become_authenticated_pipe_user() is called. (This used to be commit 55c9bf124dc661df43bfe582ef14b1297aeaf0fa)
2000-07-03first pass at merging rpcclient from TNG to HEAD. You can get aGerald Carter1-0/+22
semi-connection and a rpcclient prompt, but no functionality there yet. Will be a few more days on that. The changes to the header files were minor. A few struct's and a few additional fields to existing ones. No deletions. **minimal change necessary** :-) Well, maybe not minimal, but I tried. All other programs compile, link and run ok from what I can tell so I don;t think I broke anything. --jerry (This used to be commit cd7f0b0b91afd3331c0607ba2fcb3ccdd41ecebf)
2000-06-16Changed function prototype for pipe api functions to take a pipes_structTim Potter1-1/+1
instead of two prs_data pointers. (This used to be commit 73e4466fc30fee149f51a5aa45c26beb783306c5)
2000-05-18Added the NETDFS pipe to allow remote administration of the msdfs symlinksShirish Kalele1-0/+1
on the samba server. (This used to be commit 15e7d8f6c5cddf6ce409ee2505744250d181ec34)
2000-05-15addd grow_size to prs_struct so we know how much data is actually inAndrew Tridgell1-1/+2
the buffer (This used to be commit 725889869ca2eb66000efe8a77cde52d9737a814)
2000-05-10more mergingAndrew Tridgell1-0/+1
it is now at the stage that winbindd can compile in the head branch, but not link (This used to be commit d178c00aae77710ae6ff20a7f54a30e3bd8232bb)
2000-05-09the beginnings of a new scheme I've working on to allow an easierAndrew Tridgell1-0/+4
head/tng merge. It goes something like this: - headers from tng get copied over one at a time - the old headers get renamed to *_old.h - server side code that used the old headers gets a #define OLD_NTDOMAIN 1 #undef OLD_NTDOMAIN at the start and end of the code - mkproto.awk recognises these special defines and does magic stuff so that each .c file sees the right headers - we start moving the rpc client libraries from tng to head. if this goes OK then, in theory, we should be able to move the client side rpc code from tng to head without disturbing the existing head server side code. Then when that works we can consider merging the server side. it remains to be seen if this scheme will work. So far I've moved rpc_samr.h and don't seem to have broken anything. Note this this is still a very delicate operation, as at every step of the way I want to keep head fully functional. Please don't take part unless you discuss it with me first. (This used to be commit f76c037255a6a79d11bec65e863e009a41a4f0fd)
2000-04-04Removed unused parameter vuid from rpc_server api_* calls. For the very fewTim Potter1-1/+1
functions that need to access the vuid, it can be obtained from the current_user global. Did some whitespace cleanup. (This used to be commit 738b307bd7053ede369431da7b1349befaa523d9)
2000-03-10Fixups for compiles with gcc flags -Wall -Wshadow -Wstrict-prototypes ↵Jeremy Allison1-0/+17
-Wpointer-arith -Wcast-qual Partially implemented rpc daemon redirect (needs more work). Jeremy. (This used to be commit a462191698fa589ceac4afd14c652adf699eccad)
2000-03-09Big update moving the multi-pdu support from 2.0.x into HEAD for JFJeremy Allison1-32/+52
and the printer functions. Also tidied up some header includes and got the order right so you can now do a : make proto make clean make Jeremy. (This used to be commit 833cd9fba92e4ad5297b235d108dd2be8c17079b)
2000-02-23lib/system.c: Fixed gcc warnings.Jeremy Allison1-14/+52
nmbd/nmbd_processlogon.c: Use "True" and "False" instead of 1 and 0. Others - preparing for multiple pdu write code. Jeremy. (This used to be commit 9f879ec396230deba34fbe5e82d8a65f92137c54)
2000-02-07spoolss include definitionsJean-François Micouleau1-13/+13
J.F. (This used to be commit 853a1a3027dde7608027dc78f6e15789d5fc9152)
2000-01-03simple mods to add msrpc pipe redirection. default behaviour: fall backLuke Leighton1-0/+4
to using internal msrpc code in smbd. (This used to be commit 8976e26d46cb991710bc77463f7f928ac00dd4d8)
1999-12-13first pass at updating head branch to be to be the same as the SAMBA_2_0 branchAndrew Tridgell1-147/+67
(This used to be commit 453a822a76780063dff23526c35408866d0c0154)
1999-12-12delineation between smb and msrpc more marked. smbd now constructsLuke Leighton1-14/+35
pdus, and then feeds them over either a "local" function call or a "remote" function call to an msrpc service. the "remote" msrpc daemon, on the other side of a unix socket, then calls the same "local" function that smbd would, if the msrpc service were being run from inside smbd. this allows a transition from local msrpc services (inside the same smbd process) to remote (over a unix socket). removed reference to pipes_struct in msrpc services. all msrpc processing functions take rpcsrv_struct which is a structure containing state info for the msrpc functions to decode and create pdus. created become_vuser() which does everything not related to connection_struct that become_user() does. removed, as best i could, connection_struct dependencies from the nt spoolss printing code. todo: remove dcinfo from rpcsrv_struct because this stores NETLOGON-specific info on a per-connection basis, and if the connection dies then so does the info, and that's a fairly serious problem. had to put pretty much everything that is in user_struct into parse_creds.c to feed unix user info over to the msrpc daemons. why? because it's expensive to do unix password/group database lookups, and it's definitely expensive to do nt user profile lookups, not to mention pretty difficult and if you did either of these it would introduce a complication / unnecessary interdependency. so, send uid/gid/num_groups/gid_t* + SID+num_rids+domain_group_rids* + unix username + nt username + nt domain + user session key etc. this is the MINIMUM info identified so far that's actually implemented. missing bits include the called and calling netbios names etc. (basically, anything that can be loaded into standard_sub() and standard_sub_basic()...) (This used to be commit aa3c659a8dba0437c17c60055a6ed30fdfecdb6d)
1999-12-06the first independent msrpc daemon - lsarpcd.Luke Leighton1-0/+2
one horrible cut / paste job from smbd, plus a code split of shared components between the two. the job is not _yet_ complete, as i need to be able to do a become_user() call for security reasons. i picked lsarpcd first because you don't _need_ security on it (microsoft botched so badly on this one, it's not real. at least they fixed this in nt5 with restrictanonymous=0x2). fixing this involves sending the current smb and unix credentials down the unix pipe so that the daemon it eventually goes to can pick them up at the other end. i can't believe this all worked!!! (This used to be commit 2245b0c6d13c7c5886e81f9137b05df883598c26)
1999-12-02improved enumdomains added -i option.Luke Leighton1-0/+2
(This used to be commit 50dc709fa95e86ebe2b3132176241cb3a2cc4e36)
1999-11-26whoa. _major_ restructure of rpcclient. fixed some buuugs, created a few.Luke Leighton1-0/+4
found out that getopt() _must_ have optind set to 0 before reuse. still haven't decided what to do with the net* api yet... (This used to be commit 29c480085e786905bfd92ea3cd93658f94e96e47)
1999-11-19added \PIPE\browser plus experimental brsinfo command. you wouldn'tLuke Leighton1-0/+1
believe the XXXX that MIGHT be involved in getting nt5rc2 to join a samba domain... (This used to be commit 569babb3935950c1b64396955541abf276cc1d92)
1999-11-15added rpcclient "enumdomains" command. enumerates names of domainsLuke Leighton1-0/+3
for which a PDC is responsible. typical answers are: <Name of Domain> plus <Builtin>. against a hierarchical, down-level-compatible NT5 PDC, there's likely to be more than these two entries!!!!! (This used to be commit 3146aa6b6049a0d996e9abbe7dbee8526550e7e0)
1999-11-15- added DCE/RPC "fault" PDU support.Luke Leighton1-5/+7
- disabled (AGAIN) the GETDC "if (MAILSLOT\NTLOGON)" code that will get NT5rc2 to work but WILL break win95 (AGAIN). this needs _not_ to be re-enabled but to be replaced with a better mechanism. - added SMBwrite support (note: SMBwriteX already existed) as NT5rc2 is sending DCE/RPC over SMBwrite not SMBwriteX. (This used to be commit 25c70e3c984c4fed19763ed405741e83fe14f87e)
1999-11-09debugging rpcclient spoolenum and spooljobs commands. oh, did i forgetLuke Leighton1-0/+2
to mention, there's a spooljobs <printer name> command, and it uses command-line completion? prints out NT print jobs really nicely, too. (This used to be commit e6e5caf16c8d120f0c11fa63061f2786098e3357)
1999-11-08const feeding frenzyLuke Leighton1-22/+44
(This used to be commit e0eb390ab3e2a0cce191e78ea4ff90d088a8895c)
generated by cgit (git 2.34.1) at 2024-12-15 20:58:29 +0000