Age | Commit message (Collapse) | Author | Files | Lines |
|
fail if file exists and target is a directory. gentest.
Jeremy.
(This used to be commit 4b1262322995c8794cd73d84712f82d8c91abdc6)
|
|
(This used to be commit b9ae67a3a232875361d3056eef3b654e6b92c244)
|
|
Volker
(This used to be commit f1b66461ebce4e89eb65620a09c079ae9697537b)
|
|
Jeremy.
(This used to be commit a6cb7af9bad1610e802fa5cddbf68fb887bc2974)
|
|
on an initial open the desired_access field *must* contain DELETE_ACCESS,
simply having it map from a GENERIC_ALL won't do. Fixes delete on close test.
Jeremy.
(This used to be commit fb4249e7d12bee4589edff40f1e76f1a19a6ffaa)
|
|
(This used to be commit 90ae3667448be9b3445f401bcd9d7e3eba374215)
|
|
Jeremy.
(This used to be commit 4920f9bd660e22c8ac3ba1c389781f2efbcd1e78)
|
|
Jeremy.
(This used to be commit 35bbc818ad28c3591df9d5cb0a674802f3f29e1a)
|
|
Jeremy.
(This used to be commit e7a25c1e2ea2ff980f4aecf94f65563316976997)
|
|
Remove more unused portions of the 'password cache'.
Andrew Bartlett
(This used to be commit 33cdb2bd18daca31461bbc45251679f50fd3567f)
|
|
Remove more unused functions - this time parts of the 'password cache'.
Andrew Bartlett
(This used to be commit c29c28e4cfc0539eb5e02196dd6cdda7bd433f61)
|
|
Remove unused utility function.
Andrew Bartlett
(This used to be commit af8248e67bb0f83124dcd250fee5d06a12fe257b)
|
|
Make get_dc_list static - we only ask for a sorted list externally.
Andrew Bartlett
(This used to be commit 5335b9d5eb79dc431fb8e40e61a57370dd09486e)
|
|
Remove source_env handler (no longer used in any codepath).
Jeremy.
(This used to be commit be60768e64ae2061f220faa3943dcb0588393dbc)
|
|
This adds client-side support for the unicode/SAMR password change scheme.
As well as avoiding DOS charset issues, this scheme returns useful error
codes, that we can map back via the pam interface.
This patch also cleans up the interfaces used for password buffers, to
avoid duplication of code.
Andrew Bartlett
(This used to be commit 8063b8b6c2eb30cb116988e265fb289109d7c348)
|
|
Fix the initialisation vectors for NTLM2, so that they at least make sense,
even if they don't work yet.
Andrew Bartlett
(This used to be commit 40cc86d4b31efdee519cf2e2c9b62c4fdc885724)
|
|
Found by Fran Fabrizio <fran@cis.uab.edu>.
Add to the *start* of the list not the end of the list.
This ensures that the *last* send sequence with this mid
is returned by preference.
This can happen if the mid wraps and one of the early
mid numbers didn't get a reply and is still lurking on
the list.
Jeremy.
(This used to be commit b84d249e67315c153e0aa3c5c9adfcf6ca008f97)
|
|
- setup_logging() in smbclient to be interactive (remove the timestamps)
- Fix bad return value in pull_ucs2( needs more testing to make sure this
didn't break something else) that caused clistr_pull() to always read
the same string from the buffer (pull_usc2() could return -1 if the original
source length was given as -1)
- increment some debugging messages to avoid printing them out so often
(This used to be commit f452585073fbeeae3e3a0db644e381f94cb918f3)
|
|
names
* fix some a mispelled variable name
(This used to be commit 93fed3074f4384dc658cd0ec81ba2afbe8192417)
|
|
(This used to be commit c98399e3c9d74e19b7c9d806ca8028b48866931e)
|
|
code changes form 3.0
(This used to be commit 2279e98cb81faaf8a4e971fec339955f14c23858)
|
|
Andrew Bartlett
(This used to be commit f7d39c787771616ddb015bd77e3e6cd33f0c7a15)
|
|
Change our Domain controller lookup routines to more carefully seperate
DNS names (realms) from NetBIOS domain names.
Until now, we would experience delays as we broadcast lookups for DNS names
onto the local network segments.
Now if DNS comes back negative, we fall straight back to looking up the
short name.
Andrew Bartlett
(This used to be commit 4c3bd0a99e464198d243da302ff1868189b4dcff)
|
|
Even if the 'device type' is always an ascii string, use push_string to get
it out onto the wire. Avoids valgrind warnings because the fstrcpy() causes
part of the wire buffer to be 'marked'.
Andrew Bartlett
(This used to be commit 326becbde23c8039e1f0f00930bcab094bf91ed2)
|
|
auth/auth_util.c:
- Fill in the 'backup' idea of a domain, if the DC didn't supply one. This
doesn't seem to occour in reality, hence why we missed the typo.
lib/charcnv.c:
lib/smbldap.c:
libads/ldap.c:
libsmb/libsmbclient.c:
printing/nt_printing.c:
- all the callers to pull_utf8_allocate() pass a char ** as the first
parammeter, so don't make them all cast it to a void **
nsswitch/winbind_util.c:
- Allow for a more 'correct' view of when usernames should be qualified
in winbindd. If we are a PDC, or have 'winbind trusted domains only',
then for the authentication returns stip the domain portion.
- Fix valgrind warning about use of free()ed name when looking up our
local domain. lp_workgroup() is maniplated inside a procedure that
uses it's former value. Instead, use the fact that our local domain is
always the first in the list.
--
Jerry rightly complained that we can't assume that the first domain is
our primary domain - new domains are added to the front of the list. :-(
Use a much more reliable 'flag test' instead. (note: changes winbind
structures, make clean).
--
Forgot to commit this for the 'get our primary domain' change.
Andrew Bartlett
(This used to be commit acacd27ba25f7ebfec40bfa66d34ece543569e23)
|
|
Move our basic password checking code from inside the authentication
subsystem into a seperate file - ntlm_check.c.
This allows us to call these routines from ntlm_auth. The purpose of this
exercise is to allow ntlm_auth (when operating as an NTLMSSP server) to
avoid talking to winbind. This should allow for easier debugging.
ntlm_auth itself has been reorgainised, so as to share more code between
the SPNEGO-wrapped and 'raw' NTLMSSP modes. A new 'client' NTLMSSP mode
has been added, for use with a Cyrus-SASL module I am writing (based on vl's
work)
Andrew Bartlett
(This used to be commit 2f196bb31ac83cf7922583063c74a5f679ca5be7)
|
|
Shutting down the connection closes outstanding sessions, so we don't need
to do it twice...
Amdrew Bartlett
(This used to be commit 77b3515981ebe972a4c78e14b205d0c70a34b69f)
|
|
solves the problem for me here, I can still successfully set up signing using
NTLMSSP against w2k3 and it does not show a signing error anymoe when the
password was wrong.
Jeremy, you might want to take a further look at it as this is not
particularly elegant.
Volker
(This used to be commit 8a82060e3aee6d5ef38b1448035d865f9bce63a7)
|
|
all there is.
Jeremy.
(This used to be commit 3e6abeffe176cdba43d251f55f3b7aecd8fa55b1)
|
|
Jeremy
(This used to be commit 6cd0f6e7c0a28ddccf55acb1e411e5ed5bd3cf47)
|
|
This fixes a problem joining a Samba domain from a
vanilla win2k client that doesn't set the
NTLMSSP_NEGOTIATE_NTLM2 flag.
Reported on samba ml as "decode_pw: incorrect password length"
when handling a samr_set_userinfo(23 or 24) RPC.
(This used to be commit 14558c942beb05cd12c0e40c1bb30c3dcde8ce48)
|
|
Jeremy.
(This used to be commit 08b6b1e43ce354cfb77701c8953565e1163ff76b)
|
|
source/libsmb/ntlmssp.c:
Picked up by the build farm - despite all my efforts, security=server was
broken by my NTLM2 commit. This should correctly cause the NTLM2 case
not to be negotiated when 'security=server' is in effect.
testsuide/build_farm/runlist:
Without 'non unix accounts' we can't test security=domain on the build farm.
source/rpc_server/srv_samr_nt.c:
Match Win2k and return 'invalid parameter' for creating of a new account with
account flags of 0.
Andrew Bartlett
(This used to be commit e97f1eb62ae01b5259d7ecfab9b55b07103379c7)
|
|
they're easy to miss.
Jeremy.
(This used to be commit b5f32a0869017a3ce457bf45e4aa2c1b621162c6)
|
|
Jeremy.
(This used to be commit fd71acd1ffb3d3c2f2f82395c86512124769d592)
|
|
does this.
Jeremy.
(This used to be commit e5bb3fdf4c8b2bb5b098bfbc0b4b80d947aeac6c)
|
|
state info each packet.
Jeremy.
(This used to be commit c662e2dbc4d953b3718f69fef4517a3e7539151e)
|
|
packet is the one that matters for checking the signing replies. Need to
check the server code does this correctly too....
Bug #832 reported by Volker.
Jeremy.
(This used to be commit 315f25fc1710e20051414bbf084cb5648129c3bb)
|
|
- NTLM2 fixes, don't force NTLM2
- Don't use NTLM2 for RPC, it doesn't work yet
- Add comments to winbindd_pam.c
- Merge 64 bit fixes and better debug messages in winbindd.c
Andrew Bartlett
(This used to be commit ba94e4a1ab6dc3335bbb29686ca6795d0ffad5b0)
|
|
it fails later. Only turn it off automatically if it fails at the start.
Jeremy.
(This used to be commit 2a00d538da61253455db1734b74ef1debaea24ea)
|
|
ignore it. Only fail if signing is set to "required".
Jeremy.
(This used to be commit ab5db8873e2882900baa1c74706bb907baaff7fd)
|
|
Add support for variable-length session keys in our client code.
This means that we now support 'net rpc join' with KRB5 (des based)
logins. Now, you need to hack 'net' to do that, but the principal is
important...
When we add kerberos to 'net rpc', it should be possible to still do
user management and the like over RPC.
-
Add server-side support for variable-length session keys (as used by
DES based krb5 logins).
Andrew Bartlett
(This used to be commit 1287cf5f921327c9ea758de46220c4e2dedc485c)
|
|
Changes all over the shop, but all towards:
- NTLM2 support in the server
- KEY_EXCH support in the server
- variable length session keys.
In detail:
- NTLM2 is an extension of NTLMv1, that is compatible with existing
domain controllers (unlike NTLMv2, which requires a DC upgrade).
* This is known as 'NTLMv2 session security' *
(This is not yet implemented on the RPC pipes however, so there may
well still be issues for PDC setups, particuarly around password
changes. We do not fully understand the sign/seal implications of
NTLM2 on RPC pipes.)
This requires modifications to our authentication subsystem, as we
must handle the 'challege' input into the challenge-response algorithm
being changed. This also needs to be turned off for
'security=server', which does not support this.
- KEY_EXCH is another 'security' mechanism, whereby the session key
actually used by the server is sent by the client, rather than being
the shared-secret directly or indirectly.
- As both these methods change the session key, the auth subsystem
needed to be changed, to 'override' session keys provided by the
backend.
- There has also been a major overhaul of the NTLMSSP subsystem, to
merge the 'client' and 'server' functions, so they both operate on a
single structure. This should help the SPNEGO implementation.
- The 'names blob' in NTLMSSP is always in unicode - never in ascii.
Don't make an ascii version ever.
- The other big change is to allow variable length session keys. We
have always assumed that session keys are 16 bytes long - and padded
to this length if shorter. However, Kerberos session keys are 8 bytes
long, when the krb5 login uses DES.
* This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. *
- Add better DEBUG() messages to ntlm_auth, warning administrators of
misconfigurations that prevent access to the privileged pipe. This
should help reduce some of the 'it just doesn't work' issues.
- Fix data_blob_talloc() to behave the same way data_blob() does when
passed a NULL data pointer. (just allocate)
REMEMBER to make clean after this commit - I have changed plenty of
data structures...
Andrew Bartlett
(This used to be commit 57a895aaabacc0c9147344d097d333793b77c947)
|
|
(This used to be commit 52c1973f39f4c4161097843fcf395e0102531575)
|
|
(This used to be commit a6cc763333943bc6e360bb7e78cf9bfb1bc936e8)
|
|
Jeremy.
(This used to be commit 13d32f561b23f2d69daf103a971acbdae547703d)
|
|
Revision 1.50.2.12:
Put in a work-around for ENOTSUP not being defined on OpenBSD.
Revision 1.50.2.10-11
Apply latest of Derrell Lippman's changes to libsmbclient.
Commit Derrell's changes to libsmbclient plus a small change to
configure.in to see if SGI and other platforms will build.
(This used to be commit e32826980eefeb501e4ae19c689d83153d9fe5e6)
|
|
Revision 1.2.2.5:
Remove some unused variables uncovered by the build farm.
(This used to be commit c0585399ac3b6adb22b514478ba44e3c8a96b050)
|
|
Jeremy.
(This used to be commit 124a8ddae63adff4f601242a8e6d05abcaf4d9bf)
|
|
According to Ethereal we have a 32-Bit quantity here. And with SSVAL valgrind
reports an unitialized read which is obviously correct. And I hate valgrind
errors ;-)
Volker
(This used to be commit 73fc6da6cf2b52f65c3dbfb7705899e6cbea447a)
|