summaryrefslogtreecommitdiff
path: root/source3/rpc_client/cli_pipe.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r10801: Janitor for tpot - remember to keep 3.0 in sync.Jeremy Allison1-0/+4
Jeremy. (This used to be commit 92fa541f6e92c03a49372ff73f9790afa2c0151c)
2007-10-10r10780: Fix typo noticed by Volker.Jeremy Allison1-1/+1
Jeremy. (This used to be commit 76408ddd5bec22bbbee2236101bf65b407d2c664)
2007-10-10r10778: Allow schannel setup over NTLMSSP authenticated pipes.Jeremy Allison1-0/+106
Jeremy. (This used to be commit ed62720f897ebf10f5ae50a3e9cf7788c9570183)
2007-10-10r10747: Remove overparanoid check that broke RPC function calls with noJelmer Vernooij1-5/+0
[in] parameters. (This used to be commit 03a3caaddd5bf28a059d4edb5e55031f7e5de94a)
2007-10-10r10745: Fix artificial 1k restriction.Jeremy Allison1-1/+3
Jeremy. (This used to be commit bb1ba9a9089b38bf400d48b992f7977ce926aeaf)
2007-10-10r10656: BIG merge from trunk. Features not copied overGerald Carter1-1147/+2012
* \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck) (This used to be commit 939c3cb5d78e3a2236209b296aa8aba8bdce32d3)
2007-10-10r8805: Merge a duplicate struct. Get ready to support SPNEGO rpc binds.Jeremy Allison1-3/+4
Jeremy. (This used to be commit fd6e342746edfda2f25df1ae0067d359b756e0cd)
2007-10-10r7415: * big change -- volker's new async winbindd from trunkGerald Carter1-111/+214
(This used to be commit a0ac9a8ffd4af31a0ebc423b4acbb2f043d865b8)
2007-10-10r7385: Rewrite the RPC bind parsing functions to follow the spec. I haven't yetJeremy Allison1-5/+10
tested this so I may have screwed this up - however it now follows the DCE spec. valgrinded tests to follow.... Jeremy. (This used to be commit 877e0a61f5821c89149b1403d08675dd7db8039e)
2007-10-10r4570: Replace cli->nt_pipe_fnum with an array of NT file numbers, one for eachVolker Lendecke1-26/+26
supported pipe. Netlogon is still special, as we open that twice, one to do the auth2, the other one with schannel. The client interface is completely unchanged for those who only use a single pie. cli->pipe_idx is used as the index for everything except the "real" client rpc calls, which have been explicitly converted in my last commit. Next step is to get winbind to just use a single smb connection for multiple pipes. Volker (This used to be commit dc294c52e0216424236057ca6cd35e1ebf51d0da)
2007-10-10r4561: This looks a lot larger than it is, this is to reduce the clutter on ↵Volker Lendecke1-12/+12
future patches. Pass down the pipe_idx down to all functions in cli_pipe where nt_pipe_fnum is referenced. First step towards having multiple pipes on a cli_struct. The idea is to not have a single nt_pipe_fnum but an array for the pipes we support. Volker (This used to be commit 93eab050201d4e55096a8820226749f001597b5d)
2007-10-10r1380: adding debug message when encouting an ASU specific bug in an ↵Gerald Carter1-3/+5
rpc_bind reply (This used to be commit c6e73ff091b4d87111b33735400fdd10d4c8671c)
2007-10-10r991: Allow winbindd to use the domain trust account passwordGerald Carter1-3/+0
for setting up an schannel connection. This solves the problem of a Samba DC running winbind, trusting a native mode AD domain, and needing to enumerate AD users via wbinfo -u. (This used to be commit e9f109d1b38e0b0adec9b7e9a907f90a79d297ea)
2007-10-10r704: BUG 1315: fix for schannel client connections to server's that don't ↵Gerald Carter1-6/+18
support 128 bit encryption (This used to be commit 316ba5ad89ddfa445d44d28141c5901fc64aec90)
2004-03-27Ensure we correctly set cli->nt_pipe_fnum on failure to correctly open theAndrew Bartlett1-0/+2
NT session. Andrew Bartlett (This used to be commit 01fff20e6e0212e9f70a5a66c3e46f7079b342f1)
2004-03-22remove unused variableGerald Carter1-2/+0
(This used to be commit 170c443b19604c3ec997ae494954c473e356e59d)
2004-03-19missed some of Derrel's changesGerald Carter1-1/+1
(This used to be commit 3aac1e549eaf4693ded84be432a2c94b6331ef6d)
2004-03-17asu/syntax/pc_netlink doesn't fill in the pipe name in the rpc_bind response ↵Gerald Carter1-0/+2
so dont check for it (This used to be commit 4d68d3d5ddeda9589f2e3387144fdac616bb791f)
2004-02-28Add 'net rpc group [add|del]mem' for domain groups and aliases.Volker Lendecke1-0/+2
Volker (This used to be commit e597420421e085b17dcdc062c5900518d0d4e685)
2004-01-05Correctly handle per-pipe NTLMSSP inside a NULL session. Previously weAndrew Bartlett1-5/+12
would attempt to supply a password to the 'inside' NTLMSSP, which the remote side naturally rejected. Andrew Bartlett (This used to be commit da408e0d5aa29ca1505c2fd96b32deae9ed940c4)
2003-11-25Do not add NTLM2 to the NTLMSSP flags unconditionally - allow theAndrew Bartlett1-8/+4
defaults specified by the caller to prevail. Don't use NTLM2 for RPC pipes, until we know how it works in signing or sealing. Call ntlmssp_sign_init() unconditionally in the client - we setup the session key, why not setup the rest of the data. Andrew Bartlett (This used to be commit 48123f7e42c3fde85887de23c80ceee04c2f6281)
2003-11-24strequal() returns a BOOL, not an int like strcmp(); this fixes a bug in ↵Gerald Carter1-2/+2
check_bind_response() (This used to be commit 5e062f72baad6f7a70f1a3c8cf190535ccacc89e)
2003-11-22Changes all over the shop, but all towards:Andrew Bartlett1-14/+17
- NTLM2 support in the server - KEY_EXCH support in the server - variable length session keys. In detail: - NTLM2 is an extension of NTLMv1, that is compatible with existing domain controllers (unlike NTLMv2, which requires a DC upgrade). * This is known as 'NTLMv2 session security' * (This is not yet implemented on the RPC pipes however, so there may well still be issues for PDC setups, particuarly around password changes. We do not fully understand the sign/seal implications of NTLM2 on RPC pipes.) This requires modifications to our authentication subsystem, as we must handle the 'challege' input into the challenge-response algorithm being changed. This also needs to be turned off for 'security=server', which does not support this. - KEY_EXCH is another 'security' mechanism, whereby the session key actually used by the server is sent by the client, rather than being the shared-secret directly or indirectly. - As both these methods change the session key, the auth subsystem needed to be changed, to 'override' session keys provided by the backend. - There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation. - The 'names blob' in NTLMSSP is always in unicode - never in ascii. Don't make an ascii version ever. - The other big change is to allow variable length session keys. We have always assumed that session keys are 16 bytes long - and padded to this length if shorter. However, Kerberos session keys are 8 bytes long, when the krb5 login uses DES. * This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. * - Add better DEBUG() messages to ntlm_auth, warning administrators of misconfigurations that prevent access to the privileged pipe. This should help reduce some of the 'it just doesn't work' issues. - Fix data_blob_talloc() to behave the same way data_blob() does when passed a NULL data pointer. (just allocate) REMEMBER to make clean after this commit - I have changed plenty of data structures... (This used to be commit f3bbc87b0dac63426cda6fac7a295d3aad810ecc)
2003-11-17This fixes a bug when establishing trust against a german W2k3 AD server. InVolker Lendecke1-1/+2
the bind response to WKSSVC it does not send \PIPE\ntsvcs as NT4 (did not check w2k) but \PIPE\wkssvc. I'm not sure whether we should make this check at all, so making it a bit more liberal should hopefully not really hurt. Volker (This used to be commit 029dcb351bcfab70ed0afa4acf4bd64316bfd757)
2003-10-01commit sign only patch from Andrew; bug 167; tested using 2k & XP ↵Gerald Carter1-17/+12
clientspreviously joined to the Samba domain (This used to be commit 3802f5895ee18507c6f467bd11db0b1147a6fdfd)
2003-08-19- Fix the kerberos downgrade problem:Andrew Bartlett1-1/+5
- When connecting to the NETOGON pipe, we make a call to auth2, in order to verify our identity. This call was being made with negotiation flags of 0x1ff. This caused our account to be downgraded. If we instead make the call with flags > 1ff (such as 0x701ff), then this does not occour. - This is *not* related to the use of kerberos for the CIFS-level connection My theory is that Win2k has a test to see if we are sending *exactly* what NT4 sent - setting any other flags seems to cause us to remain intact. Also ensure that we only have 'setup schannel' code in a few places, not scattered around cmd_netlogon too. Andrew Bartlett (This used to be commit e10f0529fe9d8d245b3cd001cce6a9a86896679c)
2003-08-15get rid of more compiler warningsHerb Lewis1-8/+8
(This used to be commit 398bd14fc6e2f8ab2f34211270e179b8928a6669)
2003-08-14Change Samba to always use extended security for it's guest logins, (ie,Andrew Bartlett1-1/+1
NTLMSSP with "" username, NULL password), and add --machine-pass (-P) to all of Samba's clients. When connecting to an Active Directory DC, you must initiate the CIFS level session setup with Kerberos, not a guest login. If you don't, your machine account is demoted to NT4. Andrew Bartlett (This used to be commit 3547cb3def45a90f99f67829a533eac1ccba5e77)
2003-08-04Memory leak fix for create_rpc_bind_req()Tim Potter1-0/+1
(This used to be commit 4d26feabd75d5b298276b0c5880b9765507bb6ae)
2003-07-30Save us from possibly uninitialised variable (caught by gcc).Jeremy Allison1-4/+4
Jeremy. (This used to be commit f3f29665bd2c396c4756cd23f603ac768fea66fd)
2003-07-25domain in schannel bind credentials must be the dest domain, not oursGerald Carter1-1/+3
(This used to be commit e12f6a8c13f27c3caea96b467cc4294e20dad341)
2003-07-25Schannel, once setup, may be used on *ANY* TCP/IP connection until theAndrew Bartlett1-3/+52
connection that set it up has been shut down. (Also, pipes still connected, and reconnections to the same pipe (eg SAMR) may continue to use that session key until their TCP/IP connection is shut down) Allow further testing by printing out the session key, and allowing it's input into rpcclient. Next step is automatic storage in a TDB. Andrew Bartlett (This used to be commit fa4d7be1619b51aacec37ddf995c940b8100aef9)
2003-07-17In the presense of RPC fragments, schannel is not strictly request/reply,Andrew Bartlett1-5/+0
so the shared sequence number will not be strictly odd/even. Andrew Bartlett (This used to be commit 77c3e69aef545d3f9b7cec9efdc366cbeb0c745e)
2003-07-16Fix up our auth_pipe code to always cope with fragmented datagrams,Andrew Bartlett1-64/+41
in both SCHANNEL and NTLMSSP. (Try not to deal with a general case as individual special cases...) Andrew Bartlett (This used to be commit 6ca77bd28f16f9f65ff40bf8996e39356de5b4f8)
2003-07-15fix schannel processing on fragmented PDUs. 'net rpc vampire' works again.Gerald Carter1-1/+1
(This used to be commit ff0c71148e405eeb49efbc51461325c7f2207433)
2003-07-14Fix compile error noticed by Ken Cross, use the utility function insteadAndrew Bartlett1-14/+4
of an inline replacement... Andrew Bartlett (This used to be commit d941255a97fc6d0d62eae1602075b1aa0481cde5)
2003-07-14Jeremy requested that I get my NTLMSSP patch into CVS. He didn't requestAndrew Bartlett1-564/+493
the schannel code, but I've included that anyway. :-) This patch revives the client-side NTLMSSP support for RPC named pipes in Samba, and cleans up the client and server schannel code. The use of the new code is enabled by the 'sign', 'seal' and 'schannel' commands in rpcclient. The aim was to prove that our separate NTLMSSP client library actually implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation, in the hope that knowing this will assist us in correctly implementing NTLMSSP signing for SMB packets. (Still not yet functional) This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with calls to libsmb/ntlmssp.c. In the process, we have gained the ability to use the more secure NT password, and the ability to sign-only, instead of having to seal the pipe connection. (Previously we were limited to sealing, and could only use the LM-password derived key). Our new client-side NTLMSSP code also needed alteration to cope with our comparatively simple server-side implementation. A future step is to replace it with calls to the same NTLMSSP library. Also included in this patch is the schannel 'sign only' patch I submitted to the team earlier. While not enabled (and not functional, at this stage) the work in this patch makes the code paths *much* easier to follow. I have also included similar hooks in rpccleint to allow the use of schannel on *any* pipe. rpcclient now defaults to not using schannel (or any other extra per-pipe authenticiation) for any connection. The 'schannel' command enables schannel for all pipes until disabled. This code is also much more secure than the previous code, as changes to our cli_pipe routines ensure that the authentication footer cannot be removed by an attacker, and more error states are correctly handled. (The same needs to be done to our server) Andrew Bartlett (This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-03Removed strupper/strlower macros that automatically map to ↵Jeremy Allison1-3/+3
strupper_m/strlower_m. I really want people to think about when they're using multibyte strings. Jeremy. (This used to be commit ff222716a08af65d26ad842ce4c2841cc6540959)
2003-05-16Clarify a comment: The secure channel connection must be opened on theTim Potter1-4/+4
same session (TCP connection) as the one the challenge was requested from. (This used to be commit 5cb9b99f0f5dad589ac7def667e354d6f92f8822)
2003-05-12Fix two bugs that were stopping net rpc vampire from working over secureTim Potter1-2/+10
channel: - If the domain name passed to create_rpc_bind_req() is empty, use lp_workgroup() - Correctly set the auth_padding field when the send_size is a multiple of 8 bytes I've tested with nt4sp6 and win2ksp0 and it seems to work, although there are no password hashes transferred from win2k. The empty passwords are being protected by the secure channel encryption though. (This used to be commit a8c11e855611c91e94787387c62ac629232cacfa)
2003-05-11Ok, this is a hack. On a netsec bind reply I did not see anythingVolker Lendecke1-0/+20
useful in the auth verifier yet. So this patch ignores it. Really checking this would be a lot more intrusive: in rpc_api_pipe we would have to distinguish between binds and normal requests, or have more state in the netsec info of cli_state, which is also somewhat hackish. Volker (This used to be commit 8de04fcf680a9bc5054965577eb500e0541ffe66)
2003-05-08This puts real netlogon connection caching to winbind. This becomesVolker Lendecke1-20/+10
important once we start doing schannel, as there would be a lot more roundtrips for the second PIPE open and bind. With this patch logging in to a member server is a matter of two (three if you count the ack...) packets between us and the DC. Volker (This used to be commit 5b3cb7725a974629d0bd8b707bc2940c36b8745e)
2003-04-28Fixes from Ronan Waide <waider@waider.ie> for large RPC writes.Jeremy Allison1-2/+2
Jeremy. (This used to be commit a330bf170eb8e78200367c90833cbc90255642cb)
2003-04-16Fixes for multi-PDU schannel - based on Volker's code. This code needsJeremy Allison1-9/+36
tidying up. Samsync still doesn't work due to bad parsing of net_io_sam_alias_info with a blank description. Still working on this.... Jeremy. (This used to be commit 942fede9a57a9319cf67388004dd45fa8a045f41)
2003-04-16Fixes to make SCHANNEL work in 3.0 against a W2K DC. Still need to fixJeremy Allison1-13/+24
multi-PDU encode/decode with SCHANNEL. Also need to test against WNT DC. Jeremy. (This used to be commit ff66d4097088409205b6bad5124a78ef9946010d)
2003-04-14Merge: remove unused variables.Tim Potter1-2/+0
(This used to be commit dfa9412da567d2477ee5b1e6ecdc96b8dea3c21d)
2003-04-09This is the netlogon schannel client code. Try aVolker Lendecke1-18/+305
rpcclient -S pdc -U% -c "samlogon user password" and it should work with the schannel. Needs testing against platforms different from NT4SP6. Volker (This used to be commit eaef0d8aeff1aa5a067679be3f17e08d7434e1e8)
2003-01-22Merge: remove dead function.Tim Potter1-10/+0
(This used to be commit 648307ab3d16cb557cead27d6799a741a266c0d5)
2003-01-15merging some rpcclient and net functionality from HEADGerald Carter1-3/+5
(This used to be commit 7a4c87484237308cb3ad0d671687da7e0f6e733b)
2003-01-03Merge from HEAD - make Samba compile with -Wwrite-strings without additionalAndrew Bartlett1-1/+1
warnings. (Adds a lot of const). Andrew Bartlett (This used to be commit 3a7458f9472432ef12c43008414925fd1ce8ea0c)
generated by cgit (git 2.34.1) at 2024-12-25 23:45:49 +0000