summaryrefslogtreecommitdiff
path: root/source3/librpc/crypto
AgeCommit message (Collapse)AuthorFilesLines
2012-01-05s3-librpc store the sign/seal flags we got in the gssapi clientAndrew Bartlett1-1/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-05s3-libads Factor out a new routine ↵Andrew Bartlett1-3/+11
kerberos_get_principal_from_service_hostname() This is now used in the GSE GSSAPI client, so that when we connect to a target server at the CIFS level, we use the same name to connect at the DCE/RPC level. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-05s3-librpc Use gsskrb5_get_subkey() where available to get the session keyAndrew Bartlett1-0/+15
This allows gse_get_session_key() to work against Heimdal. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-12-22s3-auth rename auth_ntlmssp_state -> auth_generic_stateAndrew Bartlett1-1/+1
This structure handles more than NTLMSSP now, at least when we are an AD DC and so changing the name may avoid some confusion in the future. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-21s3-ntlmssp Remove references to auth_ntlmssp_context from the rpc codeAndrew Bartlett2-17/+20
We always dereferenced auth_ntlmssp_state->gensec_security, so now we do not bother passing around the whole auth_ntlmssp_state. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-21s3-ntlmssp Remove auth_ntlmssp_session_key()Andrew Bartlett1-2/+7
We now just call the gensec_session_key() directly. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-21s3-ntlmssp Remove auth_ntlmssp_want_feature()Andrew Bartlett1-4/+4
We now just call the gensec_want_feature() directly. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-21s3-ntlmssp use gensec_{seal,unseal,sign,check}_packetAndrew Bartlett1-22/+22
This avoids the indirection via the auth_ntlmsssp wrapper functions. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-21s3-ntlmssp Remove auth_ntlmssp_update wrapperAndrew Bartlett1-2/+3
We now just call gensec_update directly. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-18s3-ntlmssp split auth_ntlmssp_client_start() into two partsAndrew Bartlett1-4/+7
This will allow it to be a wrapper around a gensec module, which requires that they options be set on a context, but before the mechanism is started. This also simplfies the callers, by moving the lp_*() calls into one place. Andrew Bartlett
2011-10-18ntlmssp: Move ntlmssp code to auth/ntlmsspAndrew Bartlett1-1/+1
This brings in the code from both libcli/auth and source4/auth/ntlmssp. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-09-30s3: Remove an unused variableVolker Lendecke1-2/+0
2011-08-03s3-ntlmssp Remove auth_ntlmssp_and_flags()Andrew Bartlett1-7/+0
There is no need to mask out these flags as they simply are not set yet. The correct abstraction is to ask for NTLMSSP features. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-08-03s3-ntlmssp Remove auth_ntlmssp_or_flagsAndrew Bartlett1-5/+4
We now just use auth_ntlmssp_want_feature to get extra flags on the NTLMSSP context Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-08-03s3-ntlmssp Remove calls to auth_ntlmssp_and_flags from the serverAndrew Bartlett1-0/+1
This is changed so that the callers ask for the additional flags that they need, starting with no additional flags. This helps to create a proper abstraction layer in ntlmssp_wrap/auth_ntlmssp. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-08-03s3-ntlmssp Add mem_ctx argument to auth_ntlmssp_updateAndrew Bartlett1-1/+1
This clarifies the lifetime of the returned token. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-08-03s3-ntlmssp Add mem_ctx argument to auth_ntlmssp_get_session_key()Andrew Bartlett1-3/+2
2011-07-20s3-gse Work around the MIT 1.9 gss_krb5_import_credAndrew Bartlett1-6/+16
We detect this function at configure time, but it currently fails to operate the way we need - that is, when the principal is not specified, it gives this error. When the principal is specified we get 'wrong principal in request' in the GSS acceptor, so for now the best option is to fall back to the alternate approach. Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Wed Jul 20 06:35:05 CEST 2011 on sn-devel-104
2011-07-20s3-gse Allow printing the partial error stringAndrew Bartlett1-6/+6
We may not be able to obtain the full error string, so print what we can get. This is required when the error is the the GSSAPI layer, not the mechanism. Andrew Bartlett
2011-07-04s3-auth: Added remote_address to ntlmssp server.Andreas Schneider1-0/+2
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2011-06-09s3-param Remove special case for global_myname(), rename to lp_netbios_name()Andrew Bartlett2-2/+2
There is no reason this can't be a normal constant string in the loadparm system, now that we have lp_set_cmdline() to handle overrides correctly. Andrew Bartlett
2011-05-10s3:librpc: remove unneded gssapi includes from source3/librpc/crypto/gse.cMichael Adam1-6/+0
These come in via the smb_krb5.h include (and lib/replace/system/kerberos.h) in the end. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Autobuild-User: Michael Adam <obnox@samba.org> Autobuild-Date: Tue May 10 23:12:31 CEST 2011 on sn-devel-104
2011-05-05Fix many const compiler warnings.Jeremy Allison1-21/+23
2011-04-27s3-rpc_server Fix compile without kerberosAndrew Bartlett1-1/+2
Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Wed Apr 27 23:08:48 CEST 2011 on sn-devel-104
2011-04-27s3-gse: Don't release the mech OID from gss_accept_security_contextAndrew Bartlett1-4/+31
This is constant data according to the man pages I find for this fucntion, and causes a segfault to free() when linked to Heimdal. I am advised that while it is constant for gss_mech_krb5, it may not be for other mechanisms, so an assert will ensure this is dealt with by the programmer who extends this code in future. Andrew Bartlett
2011-04-27auth/kerberos: Create common helper to get the verified PAC from GSSAPIAndrew Bartlett2-43/+7
This only works for Heimdal and MIT Krb5 1.8, other versions will get an ACCESS_DEINED error. We no longer manually verify any details of the PAC in Samba for GSSAPI logins, as we never had the information to do it properly, and it is better to have the GSSAPI library handle it. Andrew Bartlett
2011-04-20s3-gse: Allow the GSSAPI wrapper to load a keytab using gss_krb5_import_cred()Andrew Bartlett2-22/+29
This Heimdal function does not set the global state, and allows the GSSAPI server to progress further when compiled against Heimdal (such as in the top level build). The ability to specify a keytab has been removed from the API as it is unused, and and the Heimdal function (avoiding setting global variables) works with an open keytab. Andrew Bartlett
2011-04-16s3-gse Allow GSSAPI wrapper to compile against HeimdalAndrew Bartlett1-1/+3
2011-04-06s3-librpc Fix creation of in-memory keytab for previous passwordAndrew Bartlett1-1/+1
We set the current password twice, rather than the current and old password. Andrew Bartlett
2010-09-23s3-dcerpc: add spnego server helpersSimo Sorce2-1/+110
squashed: add michlistMIC signature checks Signed-off-by: Günther Deschner <gd@samba.org>
2010-09-23spnego: make spnego_context publicSimo Sorce2-21/+19
Signed-off-by: Günther Deschner <gd@samba.org>
2010-09-23s3-dcerpc: move client spnego stuff in /librpc/cryptoSimo Sorce2-0/+430
Signed-off-by: Günther Deschner <gd@samba.org>
2010-09-23gssapi: remove unused function argumentSimo Sorce2-3/+0
Signed-off-by: Günther Deschner <gd@samba.org>
2010-09-23gssapi: avoid explicit dependency on dcerpc specific structuresSimo Sorce2-37/+12
Signed-off-by: Günther Deschner <gd@samba.org>
2010-09-23s3-dcerpc: move crypto stuff in /librpc/cryptoSimo Sorce4-0/+1529
Signed-off-by: Günther Deschner <gd@samba.org>
generated by cgit (git 2.34.1) at 2024-07-01 07:17:45 +0000