summaryrefslogtreecommitdiff
path: root/source3/libsmb/clientgen.c
AgeCommit message (Collapse)AuthorFilesLines
2003-11-22(merge from 3.0)Andrew Bartlett1-2/+3
Changes all over the shop, but all towards: - NTLM2 support in the server - KEY_EXCH support in the server - variable length session keys. In detail: - NTLM2 is an extension of NTLMv1, that is compatible with existing domain controllers (unlike NTLMv2, which requires a DC upgrade). * This is known as 'NTLMv2 session security' * (This is not yet implemented on the RPC pipes however, so there may well still be issues for PDC setups, particuarly around password changes. We do not fully understand the sign/seal implications of NTLM2 on RPC pipes.) This requires modifications to our authentication subsystem, as we must handle the 'challege' input into the challenge-response algorithm being changed. This also needs to be turned off for 'security=server', which does not support this. - KEY_EXCH is another 'security' mechanism, whereby the session key actually used by the server is sent by the client, rather than being the shared-secret directly or indirectly. - As both these methods change the session key, the auth subsystem needed to be changed, to 'override' session keys provided by the backend. - There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation. - The 'names blob' in NTLMSSP is always in unicode - never in ascii. Don't make an ascii version ever. - The other big change is to allow variable length session keys. We have always assumed that session keys are 16 bytes long - and padded to this length if shorter. However, Kerberos session keys are 8 bytes long, when the krb5 login uses DES. * This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. * - Add better DEBUG() messages to ntlm_auth, warning administrators of misconfigurations that prevent access to the privileged pipe. This should help reduce some of the 'it just doesn't work' issues. - Fix data_blob_talloc() to behave the same way data_blob() does when passed a NULL data pointer. (just allocate) REMEMBER to make clean after this commit - I have changed plenty of data structures... Andrew Bartlett (This used to be commit 57a895aaabacc0c9147344d097d333793b77c947)
2003-10-21Patch from Stefan Metzmacher <metze@metzemix.de> to fix signing problemsJeremy Allison1-1/+1
when reverse connecting back to a client for printer notify. Jeremy. (This used to be commit 7fde193efeb856ec325d5d563f1e710c45dc65d7)
2003-09-09sync 3.0 into HEAD for the last timeGerald Carter1-1/+6
(This used to be commit c17a7dc9a190156a069da3e861c18fd3f81224ad)
2003-08-02port latest changes from SAMBA_3_0 treeSimo Sorce1-1/+26
(This used to be commit 3101c236b8241dc0183995ffceed551876427de4)
2003-07-16trying to get HEAD building again. If you want the codeGerald Carter1-5/+40
prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE (This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad)
2003-05-14spellingTim Potter1-1/+1
(This used to be commit 249a6974702d050644d6d61f33f0034ce2a689ee)
2003-04-09This is the netlogon schannel client code. Try aVolker Lendecke1-0/+1
rpcclient -S pdc -U% -c "samlogon user password" and it should work with the schannel. Needs testing platforms different from NT4SP6. Volker (This used to be commit ecd0ee4d248e750168597ccf79c389513bb0f740)
2003-04-06SMB signing updates - this gets NTLMSSP signing workin to the point where IAndrew Bartlett1-1/+4
just need to get the verifiction code working - we get back a signiture from the server, and just can't verify it yet. This also brings the short-packet checks into common code, and breaks the connection if the server sends a signed reply, on an established connection, that fails the test. This breaks our read/write code at the moment, as we need to keep a list of outstanding packets. (signing is not enabled by default, unless the server demands it) Not for 3.0 till I fix the outstanding packet list. Andrew Barlett (This used to be commit 808d1fcf20153970d587cb631a08607beb09703a)
2003-03-22Use FUNCTION_MACRO, not __FUNCTION__Jelmer Vernooij1-2/+2
(This used to be commit 6df38e250af1a8e7213ad66342c71c52ce118a12)
2003-03-21Clobber the 'SAFETY_MARGIN' in libsmb.Andrew Bartlett1-3/+7
Andrew Bartlett (This used to be commit 05a63bd17e4c35979b3864b0969b2bfd945335d9)
2003-03-15Be parinoid, malloc an extra SAFETY_MARGIN on the client's inbuf and outbuf.Andrew Bartlett1-2/+2
Andrew Bartlett (This used to be commit 2effcae13f9dfbff40b34d32c7fd82118c3fd096)
2003-03-09Change the way we sign SMB packets, to a function pointer interface.Andrew Bartlett1-3/+5
The intention is to allow for NTLMSSP and kerberos signing of packets, but for now it's just what I call 'simple' signing. (aka SMB signing per the SNIA spec) Andrew Bartlett (This used to be commit b9cf95c3dc04a45de71fb16e85c1bfbae50e6d8f)
2003-03-08Make it clear that this is a fstrcpy().Andrew Bartlett1-2/+2
(This used to be commit c2a266b7b661d319e13982bfdbc3a86e8502b8a4)
2003-02-09(only for HEAD at the moment).Andrew Bartlett1-2/+2
Add NTLMv2 support to our client, used when so configured ('client use NTLMv2 = yes') and only when 'client use spengo = no'. (A new option to allow the client and server ends to chose spnego seperatly). NTLMv2 signing doesn't yet work, and NTLMv2 is not done for NTLMSSP yet. Also some parinoia checks in our input parsing. Andrew Bartlett (This used to be commit 85e9c060eab59c7692198f14a447ad59f05af437)
2003-02-02Add some return values, and don't attempt signing for NTLMSSP yet (it uses aAndrew Bartlett1-0/+2
different algorithm). Andrew Bartlett (This used to be commit e6f87c7ee5c61f03f81159a8017d31f439c4454a)
2003-02-02More signing updates - start checking that the server isn't being spoofed.Andrew Bartlett1-1/+4
Andrew Bartlett (This used to be commit b1c722e306533babeffeba9d8c7dcfa00e019423)
2003-02-01We now have client-side SMB signing support!Andrew Bartlett1-3/+4
This checking allows us to connect to Microsoft servers the use SMB signing, within a few restrictions: - I've not get the NTLMSSP stuff going - it appears to work, but if you break the sig - say by writing a zero in it - it still passes... - We don't currently verfiy the server's reply - It works against one of my test servers, but not the other... However, it provides an excellent basis to work from. Enable it with 'client signing' in your smb.conf. Doc to come (tomorrow) and this is not for 3.0, till we get it complete. The CIFS Spec is misleading - the session key (for NTLMv1 at least) is the standard session key, ie MD4(NT#). Thanks to jra for the early work on this. Andrew Bartlett (This used to be commit 1a2738937e3d80b378bd0ed33cd8d395fba2d3c3)
2003-01-02BIG patch...Andrew Bartlett1-1/+1
This patch makes Samba compile cleanly with -Wwrite-strings. - That is, all string literals are marked as 'const'. These strings are always read only, this just marks them as such for passing to other functions. What is most supprising is that I didn't need to change more than a few lines of code (all in 'net', which got a small cleanup of net.h and extern variables). The rest is just adding a lot of 'const'. As far as I can tell, I have not added any new warnings - apart from making all of tdbutil.c's function const (so they warn for adding that const string to struct). Andrew Bartlett (This used to be commit 92a777d0eaa4fb3a1c7835816f93c6bdd456816d)
2002-12-20Forward port the change to talloc_init() to make all talloc contextsJeremy Allison1-1/+1
named. Ensure we can query them. Jeremy. (This used to be commit 842e08e52a665ae678eea239759bb2de1a0d7b33)
2002-11-01Revert that stupid one line change.Richard Sharpe1-1/+0
(This used to be commit 095af10ff2e549b82c646df5ed20cf05352a3994)
2002-11-01Add more code to the profiles program and add Makefile.in support.Richard Sharpe1-0/+1
(This used to be commit daefe52a56a7b977b8e561f8f668c42183de413b)
2002-10-15Added cli_set_timeout() call.Jeremy Allison1-0/+11
Jeremy. (This used to be commit 94a5c589945ffd4719f7509c162cf994f7914312)
2002-10-01Cope with rw errors and timeout to peer.Jeremy Allison1-2/+3
Jeremy. (This used to be commit 736a7bab487d7e217eed452e2089adb6b4164ad5)
2002-10-01Tidy up client error processing.Jeremy Allison1-16/+15
Jeremy. (This used to be commit 983e6d137eaada5cea1235e0cf051bc314b6f9d8)
2002-10-01Fixed typo.Jeremy Allison1-1/+1
Jeremy. (This used to be commit e2d66c5d238a057175d9316b4491ca26066f34fe)
2002-10-01Added error string for server timeout on client call.Jeremy Allison1-0/+2
Jeremy. (This used to be commit abeebf33c132c4975ac5dadde57c22176ddc9fda)
2002-09-22Small, long overdue, fix for libsmbclient.Richard Sharpe1-0/+19
(This used to be commit 40aea3fe94b68ce284e2f21e57f086212936c049)
2002-09-09Merged Volkers (correct) fix from 2.2 for crash on unable to connect.Jeremy Allison1-4/+6
Jeremy. (This used to be commit 05e2aba52f9b027bbab7c65cc02fd5c83d3c61aa)
2002-09-03Formatting tidyup and additon of cli_close_connection() before bugfix.Jeremy Allison1-49/+55
Jeremy. (This used to be commit 3b71529c694b5b1093d99b7ef80835e72b1f8436)
2002-08-26Updates!Andrew Bartlett1-1/+6
- Don't print an uninitialised buffer in service.c - Change some charcnv.c functions to take smb_ucs2_t ** instead of void ** - Update NTLMv2 code to use dynamic buffers - Update experimental SMB signing code - still more work to do - Move sys_getgrouplist() to SAFE_FREE() and do a DEBUG() on initgroups() failure. Andrew Bartlett (This used to be commit de1964f7fa855022258a84556b266100b917444b)
2002-08-22don't use spnego in the client unless enabled in smb.confAndrew Tridgell1-1/+3
(This used to be commit c00388de6cf5d0527505bfe4edfe2f0269c5a4c8)
2002-06-16Fix up some of the SMB signing code:Andrew Bartlett1-2/+1
The problem was that *all* packets were being signed, even packets before signing was set up. (This broke the session request). This fixes it to be an 'opt in' measure - that is, we only attempt to sign things after we have got a valid, non-guest session setup as per the CIFS spec. I've not tested this against an MS server, becouse my VMware is down, but at least it doesn't break the build farm any more. Andrew Bartlett (This used to be commit 1dc5a8765876c1ca822e454651f8fd4a551965e9)
2002-06-14Fix spelling typo.Jeremy Allison1-2/+2
Jeremy. (This used to be commit 0e7e8d44627ad9645a90e96001f8550b68b67a62)
2002-06-14More of SMB signing for client - not yet finished (should be harmless).Jeremy Allison1-9/+14
Jeremy. (This used to be commit c1b20db4bb4bb1ba485466f50b9795470027327c)
2002-05-18Move client_receive_smb to clientgen.c as a static, as proposed by Elrond.Andrew Bartlett1-0/+35
(only function that used it was unused, and this helps bring TNG and HEAD closer) Its also cleaner. Andrew Bartlett (This used to be commit 78f47c83332a6408a718a3dee45645935638b364)
2002-05-17This removes --with-ssl from Samba.Andrew Bartlett1-4/+0
This option was badly maintained, useless and confused our users and distirbutors. (its SSL, therfore it must be good...) No windows client uses this protocol without help from an SSL tunnel. I can't see any reason why setting up a unix-side SSL wrapper would be any more difficult than the > 10 config options this mess added to samba in any case. On the Samba client end, I think the LIBSMB_PROG hack should be sufficient to start stunnel on the unix side. We might extend this to take %i and %p (IP and port) if there is demand. Andrew Bartlett (This used to be commit b04561d3fd3ee732877790fb4193b20ad72a75f8)
2002-03-01Another comment fix for mirmirAndrew Bartlett1-1/+1
(This used to be commit 7412890adc8f3dfddfabba545003715816e262bc)
2002-01-30Removed version number from file header.Tim Potter1-2/+1
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2002-01-28Name another talloc.Andrew Bartlett1-1/+1
(This used to be commit 9d62f25f5d3c25d71d8b87801084d42ae9b66f8c)
2002-01-11Same fix as went into 2.2 (I'm waiting for jerry to finish some code).Jeremy Allison1-1/+1
Jeremy. (This used to be commit 01ff6ce4963e1daff019f2b936cef218e1c93f67)
2001-11-27prevent a memory leak of cli structuresAndrew Tridgell1-1/+7
(This used to be commit 911c57403bd116405876e73913ad73efd15f659b)
2001-11-25Add a new torture test to extract a NT->DOS error map from an NT member of aAndrew Bartlett1-0/+7
samba domain. The PDC must be running a special authenticaion module that spits out NT errors based on username. Andrew Bartlett (This used to be commit adc7a6048c13342b79b6228beafb5142c50f318d)
2001-11-21One more patch from Tom Jansen. Hope I didn't break the tree :-)Richard Sharpe1-0/+7
(This used to be commit 6d7c0f0bb4cbfdcd9a83416345432e07556f6cfc)
2001-11-14Close the socket and set the file descriptor to -1 if there was a socketTim Potter1-0/+9
error in cli_receive_smb() and cli_send_smb(). (This used to be commit bedd9c821521dad46df50e8b31e4a58bb0a9a604)
2001-11-14Removed the "reestablish" code. Tridge - scream if this was needed....Jeremy Allison1-9/+2
Jeremy. (This used to be commit e6afe40f85d7dbe79322c82dac735d901e7e71df)
2001-10-31Parionia to ensure people don't install libsmb based programs setuid root.Andrew Bartlett1-0/+6
libsmb has not been written to be setuid, with things like LIBSMB_PROG allowing all sort of fun and games. Andrew Bartlett (This used to be commit 0c8e9339d8238de92e9146d04091694b62874c33)
2001-10-22a quick fix to get rpcclient working again. This just disablesAndrew Tridgell1-1/+4
NTLMSSP in cli_establish_connection() What we really need to do is kill off the pwd_cache code. It is horrible, and assumes the challenge comes in the negprot reply. (This used to be commit 3f919b4360b3bfcc133f7d88bc5177e9d93f2db2)
2001-10-17added basic NTLMSSP support in smbd. This is still quite rough, andAndrew Tridgell1-1/+1
loses things like username mapping. I wanted to get this in then discuss it a bit to see how we want to split up the existing session setup code (This used to be commit b74fda69bf23207c26d8b2af23910d8f2eb89875)
2001-10-12added NTLMSSP authentication to libsmb. It seems to work well so I have ↵Andrew Tridgell1-4/+1
enabled it by default if the server supports it. Let me know if this breaks anything. Choose kerberos with the -k flag to smbclient, otherwise it will use SPNEGO/NTLMSSP/NTLM (This used to be commit 076aa97bee54d182288d9e93ae160ae22a5f7757)
2001-10-11initial kerberos/ADS/SPNEGO support in libsmb and smbclient. ToAndrew Tridgell1-3/+9
activate you need to: - install krb5 libraries - run configure - build smbclient - run kinit to get a TGT - run smbclient with the -k option to choose kerberos auth (This used to be commit d33057585644e1337bac743e25ed7653bfb39eef)
generated by cgit (git 2.34.1) at 2024-09-21 21:33:21 +0000