summaryrefslogtreecommitdiff
path: root/source3/libsmb
AgeCommit message (Collapse)AuthorFilesLines
2003-08-07Turns out I had my packet sequences wrong for oplock break code.Jeremy Allison1-46/+19
I was storing the mid of the oplock break - I should have been storing the mid from the open. There are thus 2 types of deferred packet sequence returns - ones that increment the sequence number (returns from oplock causing opens) and ones that don't (change notify returns etc). Running with signing forced on does lead to some interesting tests :-). Jeremy. (This used to be commit 85907f02cec566502d9e4adabbd414020a26064d)
2003-08-04Changes to make gss-spnego ntlmssp client work against W2k AD.Volker Lendecke1-1/+17
Now I know where the mechListMIC changes came from: Ethereal ;-) Volker (This used to be commit 4e9eed1273035d09ac3b427b9711327ba8c6ebfc)
2003-08-04Fix unused variable warning.Tim Potter1-1/+1
(This used to be commit 73d02e3a2b0f9e84ab6d8685e4ad6a03ef9249b2)
2003-08-03Fix oplock break detection code on incoming oplock break responses. ThisJeremy Allison1-7/+15
fixes signing for oplocks. Jeremy. (This used to be commit 69c56ee8bce122839a8fec4e59198f84b0757166)
2003-08-02Ensure we don't leak any sign records on cancel of pending requests.Jeremy Allison1-0/+27
Jeremy. (This used to be commit 9a8ffc239c0f1aada713de7e9e007066738d8874)
2003-08-02Only look for mid sign records on incoming packets for oplock break replies.Jeremy Allison1-20/+28
Otherwise we find spurious mid sign records on reply_ntcancel calls (they cancel by mid). That took a *lot* of tracking down. I still need to remove the mid records from the sign state on reply_ntcancel to avoid leaking memory.... Jeremy. (This used to be commit 270bf20fe3e226ab5cfc689bd20ed4c22b2fa7e6)
2003-08-02More fixes for client and server side signing. Ensure sequence numbersJeremy Allison2-32/+103
are updated correctly on returning an error for server trans streams. Ensure we turn off client trans streams on error. Jeremy. (This used to be commit 3a789cb7f01115c37404e5a696de363287cb0e5f)
2003-08-02Leave the packet sequence checkers enabled whilst I track down a smbclient ↵Jeremy Allison1-2/+2
-> smbd sequence number problem. Jeremy. (This used to be commit 844898dbd8e99837ef1621aa73024714aa819ce4)
2003-08-02Add the same signing code to the server. Ensure we use identical sessionJeremy Allison1-12/+64
numbers and MIDs when in trans/trans2/nttrans code. Jeremy. (This used to be commit 901544b29b4d815709b3dbad3012f1d2c419d904)
2003-08-02Correct fix (removed the earlier band-aid) for what I thought was a signingJeremy Allison4-4/+97
bug with w2k. Turns out that when we're doing a trans/trans2/nttrans call the MID and send_sequence_number and reply_sequence_number must remain constant. This was something we got very wrong in earlier versions of Samba. I can now get a directory listing from WINNT\SYSTEM32 with the older earlier parameters for clilist.c This still needs to be fixed for the server side of Samba, client appears to be working happily now (I'm doing a signed smbtar download of an entire W2K3 image to test this :-). Jeremy. (This used to be commit 2093a3130d4087d0659b497eebd580e7a66e5aa3)
2003-08-01Update my copyrights according to my agreement with IBMJim McDonough2-2/+2
(This used to be commit c9b209be2b17c2e4677cc30b46b1074f48878f43)
2003-08-01Final fix for the bug tridge found. Only push locks onto a blocking lockJeremy Allison1-0/+1
queue if the posix lock failed with EACCES or EAGAIN (this means another lock conflicts). Else return an error and don't queue the request. Jeremy. (This used to be commit 43fbc18fdc184bf29c15186c16bc99fb208de963)
2003-07-31Fix off-by-one found by valgrind.Volker Lendecke1-1/+1
Volker (This used to be commit bc39c9b57fa6258674e1ee44b3446f25bf63661e)
2003-07-31This fixes an error I must have made when playing with spnego.c foundVolker Lendecke1-14/+35
by aliguori: NegTokenInit.mechListMIC is an Octet String. Second: add a free_spnego_data function. Both thanks to aliguori. Volker (This used to be commit 6c252440fba33eb69827d5515a95fbb3e8e9a653)
2003-07-31Turn the 'doing_signing' variable on - fix bug where it was only being setJeremy Allison1-1/+1
on when signing was mandatory. Jeremy. (This used to be commit 7c58673a103195435ca75ebb2684880d1f7242d3)
2003-07-30Add a command line option (-S on|off|required) to enable signing on clientJeremy Allison3-4/+28
connections. Overrides smb.conf parameter if set. Jeremy. (This used to be commit 879309671df6b530e0bff69559422a417da4a307)
2003-07-30Fix bug we discovered in W2K client signing on secondary trans2 packets.Jeremy Allison1-2/+3
Use W2K parameters. tpot please re-test smbclient with your problem directory. Jeremy. (This used to be commit 677d3a3c4ca0b67148e5e56fa876773a067679bd)
2003-07-30Eliminate valgrind error when client gets bad sig on list. Some reformatting.Jeremy Allison2-12/+25
Jeremy. (This used to be commit b8f6b836468b3a0ae75977dc65cae8400f74734c)
2003-07-29This adds gss-spnego to ntlm_auth. It contains some new spnego supportVolker Lendecke1-0/+292
from Jim McDonough. It is to enable cyrus sasl to provide the gss-spnego support. For a preliminary patch to cyrus sasl see http://samba.sernet.de/cyrus-gss-spnego.diff Volker (This used to be commit 45cef8f66e46abe4a25fd2b803a7d1051c1c6602)
2003-07-27Fix commentAndrew Bartlett1-1/+1
(This used to be commit 2c395a3904395c2743df9c3035459c6f3866232d)
2003-07-27Try again to fix up 'session request' name exchange. This time we actualyAndrew Bartlett1-3/+3
get the names... Andrew Bartlett (This used to be commit 7c9e204f7eb15139532f2cc522ed87d0ac34d118)
2003-07-27Some small fixes to our charset conversion code:Andrew Bartlett1-4/+8
- Treat the NMB names in the 'session request' packet as 'ASCII'. This means that we do not get invalid multibyte from the wire, even if we truncate in the conversion. (Otherwise we panic when we try to strupper_m it). - Remove acnv_uxu2(), as it was duplicated by push_ucs2_allocate() - Remove acnv_dosu2(), as it is not used. - In push_ucs2(), with the STR_UPPER flag, do the case conversion *after* the UCS2 conversion, when it we know that the length can't change. Also faster, as we don't need to do another 2 UCS2 conversions. Andrew Bartlett (This used to be commit 912035af1178424583d0bf887a391a0cac2acd87)
2003-07-25W00t! Client smb signing is now working correctly with krb5 and w2k server.Jeremy Allison4-16/+44
Server code *should* also work (I'll check shortly). May be the odd memory leak. Problem was we (a) weren't setting signing on in the client krb5 sessionsetup code (b) we need to ask for a subkey... (c). The client and server need to ask for local and remote subkeys respectively. Thanks to Paul Nelson @ Thursby for some sage advice on this :-). Jeremy. (This used to be commit 3f9e3b60709df5ab755045a093e642510d4cde00)
2003-07-25More printf portability fixes. Got caught out by some gcc'isms lastTim Potter2-3/+3
time. )-: (This used to be commit 59dae1da66a5eb7e128263bd578f167d8746e9f0)
2003-07-24More printf fixes - size_t is long on some architectures.Tim Potter2-2/+2
(This used to be commit ba4d334b822248d8ab929c9568533431603d967e)
2003-07-24Fix packet signing with asynchronous oplock breaks. Removed bad error messageJeremy Allison1-5/+67
due to w2k bug. I think this code is now working.... Need more testing of course but works on all the obvious cases I can think of. Jeremy. (This used to be commit a6e537f6611cc1357fffea0b69901fba7c9ad6ea)
2003-07-24SMB signing is now working with change notify. Need to fix the disconnectJeremy Allison1-18/+28
when bad signature received, plus check the oplock breaks.... Jermey. (This used to be commit dd83931a00ec0a2c4b78b939c54bc101ec82312f)
2003-07-24Server side NTLM signing works - until the first async packet. Working on thisJeremy Allison1-22/+114
next.... Jeremy. (This used to be commit eff74a1fcc597497a4c70589a44c1b70e93ab549)
2003-07-23convert snprintf() calls using pstrings & fstringsGerald Carter3-5/+5
to pstr_sprintf() and fstr_sprintf() to try to standardize. lots of snprintf() calls were using len-1; some were using len. At least this helps to be consistent. (This used to be commit 9f835b85dd38cbe655eb19021ff763f31886ac00)
2003-07-23fixed segv in calls to pstrcpy() in cliprint.cAndrew Tridgell1-6/+6
(This used to be commit 36bc2b99b4fec2c14f8471d89381b2d6c2f9d339)
2003-07-23Don't check in two places for signing turned off...Jeremy Allison1-3/+0
Jeremy. (This used to be commit f4b02e52e25556e5b101d493e2e6404563bf96dd)
2003-07-18Signing so far... the client code fails on a SMBtrans2 secondary transactionJeremy Allison1-50/+114
I think (my changes haven't affected this I believe). Initial support on the server side for smbclient. Still doesn't work for w2k clients I think... Work in progress..... (don't change). Jeremy. (This used to be commit e5714edc233424c2f74edb6d658f32f8e0ec9275)
2003-07-17Correctly toggle the signing state to what it was previosly when sendingJeremy Allison1-12/+5
an oplock break. Jeremy. (This used to be commit 9515de83a864250c417cf490b7be714c8e1e127e)
2003-07-17Putting the framework for server signing in place. Ensure we don't useJeremy Allison1-5/+67
sendfile when signing (I need to add this for readbraw/writebraw too...). Jeremy. (This used to be commit f2e84f1ba67b13ff29e24a38099b559d9033a680)
2003-07-16Refactor signing code to remove most dependencies on 'struct cli'.Jeremy Allison2-92/+118
Ensure a server can't do a downgrade attack if client signing is mandatory. Add a lp_server_signing() function and a 'server signing' parameter that will act as the client one does. Jeremy (This used to be commit 203e4bf0bfb66fd9239e9a0656438a71280113cb)
2003-07-16Add API framework for server SMB signing.Jeremy Allison1-0/+21
Jeremy. (This used to be commit 61fc9a7b2eafdf8cbed1f8d9aae016b828c91a08)
2003-07-16Add krb5_princ_component to Heimdal. Remove cli_ from mark packet signed.Jeremy Allison2-5/+18
Jeremy. (This used to be commit dd46f8b22d6e8411081a1279e1cd32929e40370b)
2003-07-16Spelling.Tim Potter5-12/+12
(This used to be commit 2750418752e491c5e87f0f2adf253291e31ee4c2)
2003-07-16fix typo in debug logGerald Carter1-1/+1
(This used to be commit 074da426708555de082d0c2e5ae3a5cddaadcdf4)
2003-07-15Added the "required" keyword to the "client signing" parameter to force itJeremy Allison3-5/+19
on. Fail if missmatch. Small format tidyups in smbd/sesssetup.c. Preparing to add signing on server side. Jeremy. (This used to be commit c390b3e4cd68cfc233ddf14d139e25d40f050f27)
2003-07-15Add a cli_ prefix to a few functions to ensure everything that takes a ↵Jeremy Allison1-10/+10
struct cli_state is so marked. Jeremy (This used to be commit 0b8724ed65799f94f2af5d1dbb9ba20f1bac53a7)
2003-07-14Fix SMB signing when using NTLMSSP...Andrew Bartlett2-93/+8
It's so simple now I know how it works - and it has nothing to do with NTLMSSP (it's just a slightly different use of the old algorithm). :-). Note: This is actually less secure then the non-NTLMSSP code, as there is no per-session random data included for NTLM logins. (NTLMv2 is better, fortunetly). Andrew Bartlett (This used to be commit 95ec8317d4c6817d192bcd52eec44a22286e10ee)
2003-07-14Jeremy requested that I get my NTLMSSP patch into CVS. He didn't requestAndrew Bartlett7-96/+385
the schannel code, but I've included that anyway. :-) This patch revives the client-side NTLMSSP support for RPC named pipes in Samba, and cleans up the client and server schannel code. The use of the new code is enabled by the 'sign', 'seal' and 'schannel' commands in rpcclient. The aim was to prove that our separate NTLMSSP client library actually implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation, in the hope that knowing this will assist us in correctly implementing NTLMSSP signing for SMB packets. (Still not yet functional) This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with calls to libsmb/ntlmssp.c. In the process, we have gained the ability to use the more secure NT password, and the ability to sign-only, instead of having to seal the pipe connection. (Previously we were limited to sealing, and could only use the LM-password derived key). Our new client-side NTLMSSP code also needed alteration to cope with our comparatively simple server-side implementation. A future step is to replace it with calls to the same NTLMSSP library. Also included in this patch is the schannel 'sign only' patch I submitted to the team earlier. While not enabled (and not functional, at this stage) the work in this patch makes the code paths *much* easier to follow. I have also included similar hooks in rpccleint to allow the use of schannel on *any* pipe. rpcclient now defaults to not using schannel (or any other extra per-pipe authenticiation) for any connection. The 'schannel' command enables schannel for all pipes until disabled. This code is also much more secure than the previous code, as changes to our cli_pipe routines ensure that the authentication footer cannot be removed by an attacker, and more error states are correctly handled. (The same needs to be done to our server) Andrew Bartlett (This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14Delete obsolete comment.Tim Potter1-1/+0
(This used to be commit 5416c51133297e866210ec0d8454e04c25541d91)
2003-07-10i guess i'm the only one this ever annyoed...Gerald Carter1-1/+1
fix the confusion when we tdb_lock_bystring() but we retrieve an entry using tdb_fetch_by_string. It's now always tdb.*bystring() (This used to be commit 66359531b89368939f0e8f584a45844b5f2f99e7)
2003-07-03Removed strupper/strlower macros that automatically map to ↵Jeremy Allison5-8/+8
strupper_m/strlower_m. I really want people to think about when they're using multibyte strings. Jeremy. (This used to be commit ff222716a08af65d26ad842ce4c2841cc6540959)
2003-07-03fix bug #190; WINS server was getting marked as dead when it was not.Gerald Carter1-2/+14
(This used to be commit fa354f3ceefe53bdfd4f543559041d337b75613f)
2003-07-01* fixed volker's wbinfo -a lockup again. This one was my fault.Gerald Carter1-60/+19
It was caused by the winbind_ping() call in is_trusted_domain() o if we are a DC then we check our own direct trust relationships we have to rely on winbindd to update the truatdom_cache o if we are a domain member, then we can update the trustdom_cache ourselves if winbindd is not there (This used to be commit 22dfcafb37f7109dc455f4fb6323a25ba4f097bc)
2003-07-01* fix the trustdom_cache to work when winbindd is not running.Gerald Carter2-22/+202
smbd will update the trustdom_cache periodically after locking the timestamp key (This used to be commit 7bc4b65b91f98271089335cc301146d5f0c76c3a)
2003-06-30* cleanup more DC name resolution issues in check_*domain_security()Gerald Carter2-2/+79
* is_trusted_domain() is broken without winbind. Still working on this. * get_global_sam_name() should return the workgroup name unless we are a standalone server (verified by volker) * Get_Pwnam() should always fall back to the username (minus domain name) even if it is not our workgroup so that TRUSTEDOMAIN\user can logon if 'user' exists in the local list of accounts (on domain members w/o winbind) Tested using Samba PDC with trusts (running winbindd) and a Samba 3.0 domain member not running winbindd. notes: make_user_info_map() is slightly broken now due to the fact that is_trusted_domain() only works with winbindd. disabled checks temporarily until I can sort this out. (This used to be commit e1d6094d066d4c16ab73075caba40a1ae6c56b1e)
generated by cgit (git 2.34.1) at 2024-12-27 03:31:44 +0000