Age | Commit message (Collapse) | Author | Files | Lines |
|
make x_fwrite() match fwrite() in returning a size_t.
Andrew Bartlett
(This used to be commit 2943c695787b742e9a96b2eefe2d75f681bacf7c)
|
|
modules/developer.c: init_module() should return an int
(This used to be commit 7f59703550378ff2333e3c851bf1a77037510abd)
|
|
(This used to be commit 762b072efb0d6801775a874494cb19ea3d61fa97)
|
|
what I use in Midgard for past few years, modified for Samba needs.
(This used to be commit 747d2d70a9eb4d9222d7b63e5fcec269eda76672)
|
|
(According to the manpages, you cannot put a stack variable into putenv()).
Yes, this leaks memory.
Andrew Bartlett
(This used to be commit 50bced1e26434ecc7474964062746e2831e5f433)
|
|
sucked into proto.h?
(This used to be commit 7e84497882df5bf933ab7ae7fe9af3728393202c)
|
|
- Provide generic functions for
- get valid encryption types
- free encryption types
- Add encryption type parm to generic function create_kerberos_key_from_string()
- Try to merge the two versions (between HEAD and SAMBA_3_0) of kerberos_verify.c
I think this should work for both MIT and heimdal, in HEAD. If all goes smooth,
I'll move it over to 3.0 soon...
(This used to be commit 45e409fc8da9f26cf888e13d004392660d7c55d4)
|
|
it can be used for 'net rpc join'.
Also fix a bug in our server-side NTLMSSP code - a client without any domain
trust links to us may calculate the NTLMv2 response with "" as the domain.
Andrew Bartlett
(This used to be commit ddaa42423bc952e59b95362f5f5aa7cca10d1ad4)
|
|
* never save a pointer to an automatic variable (they go away)
implement a deep copy for SPOOLSS_NOTIFY_MSG to correct
messages being sent that have junk for strings;
fix in response to changes for CR 1504
(This used to be commit 043b9dff22e909fc290c34d879cad8b4c980fc13)
|
|
relitivly useful external lib from this code, and to remove the dupicate
NTLMSSP code elsewhere in samba (RPC pipes, LDAP client).
The code I've replaced this with in cliconnect.c is relitivly ugly, and
I hope to replace it with a more general SPENGO layer at some later date.
Andrew Bartlett
(This used to be commit b2b66909ac2e251f8189e0696b6075dbf748521a)
|
|
(This used to be commit 28653989cfe5d705b99a4888c0c3fb79d1f89162)
|
|
users w/o full administrative access on computer accounts to join a
computer into AD domain.
The patch and detailed changelog is available at:
http://www.itcollege.ee/~aandreim/samba
This is a list of changes in general:
1. When creating machine account do not fail if SD cannot be changed.
setting SD is not mandatory and join will work perfectly without it.
2. Implement KPASSWD CHANGEPW protocol for changing trust password so
machine account does not need to have reset password right for itself.
3. Command line utilities no longer interfere with user's existing
kerberos ticket cache.
4. Command line utilities can do kerberos authentication even if
username is specified (-U). Initial TGT will be requested in this case.
I've modified the patch to share the kinit code, rather than copying it,
and updated it to current CVS. The other change included in the original patch
(local realms) has been left out for now.
Andrew Bartlett
(This used to be commit ce52f1c2ed4d3ddafe8ae6258c90b90fa434fe43)
|
|
(This used to be commit 5492fc1144abac74959b7e0938ce1bb387fa7429)
|
|
Rafal
(This used to be commit 16a66cf17a544a214b7c5b483c81c7568a18a779)
|
|
to lookup what SIDs have a particular privilege (that is how
privileges are stored).
(This used to be commit 3ddb5fb0dd33992b7db54a661752551a3fefc0b4)
|
|
- Don't use pstrcpy into an allocated string - use safe_strcpy() directly
instead.
- Keep a copy of the 'server_info' attached to the vuid. In future use this
for things like the session key, homedir and full name instead of current
copies.
- Try to avoid memory leak/segfault on Realloc failure
- clear up #endif comments
Andrew Bartlett
(This used to be commit 162477bb086827950b6cb71afa9bef62c2753c2e)
|
|
Add NTLMv2 support to our client, used when so configured ('client use NTLMv2 =
yes') and only when 'client use spengo = no'. (A new option to allow the
client and server ends to chose spnego seperatly).
NTLMv2 signing doesn't yet work, and NTLMv2 is not done for NTLMSSP yet.
Also some parinoia checks in our input parsing.
Andrew Bartlett
(This used to be commit 85e9c060eab59c7692198f14a447ad59f05af437)
|
|
(This used to be commit 830423abd843dd20535755f910bc1e9563a0774f)
|
|
configure and config.h.in is now regenerated by the 'autogen.sh' script.
However, samba.org will run autoconf and autoheader to keep the anonyomous
rsync 'unpacked' areas intact (helping the build farm), and released will ship
with the genereated files.
Andrew Bartlett
(This used to be commit 15bba73dea51a6394294fc627933d026d6002091)
|
|
what was requested.
(This used to be commit 64ac6c2bcb729c4658de48e929cc792681903ecc)
|
|
This checking allows us to connect to Microsoft servers the use SMB signing,
within a few restrictions:
- I've not get the NTLMSSP stuff going - it appears to work, but if you break
the sig - say by writing a zero in it - it still passes...
- We don't currently verfiy the server's reply
- It works against one of my test servers, but not the other...
However, it provides an excellent basis to work from. Enable it with 'client
signing' in your smb.conf.
Doc to come (tomorrow) and this is not for 3.0, till we get it complete.
The CIFS Spec is misleading - the session key (for NTLMv1 at least) is the
standard session key, ie MD4(NT#).
Thanks to jra for the early work on this.
Andrew Bartlett
(This used to be commit 1a2738937e3d80b378bd0ed33cd8d395fba2d3c3)
|
|
(This used to be commit 8f495e8634a1777c4b03d3ec07c76f905ff2fb98)
|
|
Jeremy.
(This used to be commit 371f4aca9204f3c093af622ec6c9ea7c5145bf85)
|
|
Jeremy
(This used to be commit d63849db6d02b1a9430072e6e15a67e1c526e5e7)
|
|
level 2 and a request for open with no oplock is received then the
smbd should send *synchronous* break messages, not asynchronous,
otherwise it spins very rapidly, releasing the lock, sending the
'break to none' messages and then re-acquiring the lock before
any other process has a chance to get the lock and remove it's own
oplock (at least on linux).
Jeremy.
(This used to be commit d1e8991a76a57b7d96dd7db3c1d9bbf5b28da88e)
|
|
this now gives us complete remove privileges control in the client
libs, so we are in good shape for starting on the server side.
(This used to be commit bf99440398db86f46233eb2f5adddffb61280a1b)
|
|
lsa_add_acct_rights function.
This allows us to add privileges remotely to accounts using rpcclient.
(This used to be commit 2e5e659e095a94b0716d97f673f993f0af99aabe)
|
|
The idea here is to seperate, as much as possible, the SPNEGO layer from the
NTLMSSP layer. This not only helps us with protocol correctness, but also
should allow further mechinisms to be added with relitive ease. I indend to
make the kerberos code use this shortly.
I've never seen the 'zero length blob' form of the anonymous login, so I've
removed that case.
Andrew Bartlett
(This used to be commit a8773c9f825539c5bc17e4200b16d7ebbe0b7620)
|
|
(This used to be commit fdd449fe7b4e858765f485cbbe2cc1b91a4e0c53)
|
|
getdirentries. We would also detect getdents if present. This has some
rudimentary support already.
(This used to be commit 916c8784d21f566a1fb048301c3e78a9ecc52ea8)
|
|
if no kerberos selected. Noticed by Metze.
Jeremy.
(This used to be commit 1684719695acb7168115b032fc1ec672509239ea)
|
|
Jeremy.
(This used to be commit 193cc4f4fc876c66e97ea6b82bae431d0247c1fa)
|
|
to add a function without an explicit #ifdef HEIMDAL which I'm trying
to avoid.
Jeremy.
(This used to be commit 77aeb262ef7c7cd3d206afe2d5445caaca943dfd)
|
|
for instructions.
(This used to be commit d51e12df78ff8fc721d693fedbd1c633f39edd49)
|
|
Jeremy.
(This used to be commit 3d04872499332ef2d8e7479b924afc8fc1ac29d7)
|
|
of the SWAT code, and adding a base64 encoder.
The main purpose of this patch is to add NTLMSSP support to 'ntlm_auth', for
use with Squid. Unfortunetly the squid side doesn't quite support what we need
yet.
Changes to winbind to get us the info we need, and a couple of consequential
changes/cleanups in the rest of the code.
Andrew Bartlett
(This used to be commit fe50ca8f54ded2e119bde08831785fbe0db2ee99)
|
|
Jeremy.
(This used to be commit c3544c119e4cafb817479b4c5dfae178c3de000b)
|
|
detect for now, I still have vague hopes of hiding the differences
between MIT and Heimdal with a compatibility layer....
Jeremy.
(This used to be commit a776fbef3244ae82a17c57a7f62de115fd023c86)
|
|
(This used to be commit 9ac196dad4893b0ceef13281a140be5d85391e6c)
|
|
eliminate the dependency on the auth subsystem. The next step is to add
the required code to 'ntlm_auth', for export to Squid etc.
Andrew Bartlett
(This used to be commit 9e48ab86da40e4c1cafa70c04fb9ebdcce23dfab)
|
|
principal similar to the existing cli_lsa_enum_privsaccount() call,
except that cli_lsa_enum_account_rights() doesn't require a call to
open_account first. There is also the minor matter that
cli_lsa_enum_account_rights() works whereas
cli_lsa_enum_privsaccount() doesn't!
this call can be used to find what privileges an account or group
has. This is a first step towards proper privileges support in Samba.
(This used to be commit 65bac11d716f873dcdbda528313c33634c26a072)
|
|
(This used to be commit 82e4bb598c9fc26eaa090687d0daa6505fa0d550)
|
|
We need to fix some 'overmalloc' cases before it can be enabled by default.
Andrew Bartlett
(This used to be commit 2c2c52a18be1bd0a5ae1f4a48b1d9e18f4887dda)
|
|
This tries to extract our server-side code out of sessetup.c, and into a more
general lib. I hope this is only a temporay resting place - I indend to
refactor it again into an auth-subsystem independent lib, using callbacks.
Move some of our our NTLMSSP #defines into a new file, and add two that I found
in the COMsource docs - we seem to have a double-up, but I've verified from
traces that the NTLMSSP_TARGET_TYPE_{DOMAIN,SERVER} is real.
This code also copes with ASCII clients - not that we will ever see any here,
but I hope to use this for HTTP, were we can get them. Win2k authenticates
fine under forced ASCII, btw.
Tested with Win2k, NTLMv2 and Samba's smbclient.
Andrew Bartlett
(This used to be commit b6641badcbb2fb3bfec9d00a6466318203ea33e1)
|
|
becouse that is what it's input (reply_tcon_and_x) uses, and becouse we really
don't want supprises for service names.
Also remove a legacy #define, in favor of the lp_ equiv.
Andrew Bartlett
(This used to be commit 7854a439ac601d3c23703b115cd5a8d4257c7717)
|
|
Jeremy.
(This used to be commit 6e0cfec16594ade6e6c499f521781348fee25040)
|
|
compiler-based argument checking.
(This used to be commit 16fe928e68623a878b125910ff83df500a29d0ce)
|
|
This patch makes Samba compile cleanly with -Wwrite-strings.
- That is, all string literals are marked as 'const'. These strings are
always read only, this just marks them as such for passing to other functions.
What is most supprising is that I didn't need to change more than a few lines of code (all
in 'net', which got a small cleanup of net.h and extern variables). The rest
is just adding a lot of 'const'.
As far as I can tell, I have not added any new warnings - apart from making all
of tdbutil.c's function const (so they warn for adding that const string to
struct).
Andrew Bartlett
(This used to be commit 92a777d0eaa4fb3a1c7835816f93c6bdd456816d)
|
|
(This used to be commit 1a1c746c9fde965d2ad3f8fb9c1b0263754745e8)
|
|
Check return in ldap.
Jeremy.
(This used to be commit e789edbb287319f52f49f2999917a610565144d9)
|