summaryrefslogtreecommitdiff
path: root/source3/rpc_client/cli_pipe.c
AgeCommit message (Collapse)AuthorFilesLines
2003-11-25Do not add NTLM2 to the NTLMSSP flags unconditionally - allow theAndrew Bartlett1-8/+4
defaults specified by the caller to prevail. Don't use NTLM2 for RPC pipes, until we know how it works in signing or sealing. Call ntlmssp_sign_init() unconditionally in the client - we setup the session key, why not setup the rest of the data. Andrew Bartlett (This used to be commit 48123f7e42c3fde85887de23c80ceee04c2f6281)
2003-11-24strequal() returns a BOOL, not an int like strcmp(); this fixes a bug in ↵Gerald Carter1-2/+2
check_bind_response() (This used to be commit 5e062f72baad6f7a70f1a3c8cf190535ccacc89e)
2003-11-22Changes all over the shop, but all towards:Andrew Bartlett1-14/+17
- NTLM2 support in the server - KEY_EXCH support in the server - variable length session keys. In detail: - NTLM2 is an extension of NTLMv1, that is compatible with existing domain controllers (unlike NTLMv2, which requires a DC upgrade). * This is known as 'NTLMv2 session security' * (This is not yet implemented on the RPC pipes however, so there may well still be issues for PDC setups, particuarly around password changes. We do not fully understand the sign/seal implications of NTLM2 on RPC pipes.) This requires modifications to our authentication subsystem, as we must handle the 'challege' input into the challenge-response algorithm being changed. This also needs to be turned off for 'security=server', which does not support this. - KEY_EXCH is another 'security' mechanism, whereby the session key actually used by the server is sent by the client, rather than being the shared-secret directly or indirectly. - As both these methods change the session key, the auth subsystem needed to be changed, to 'override' session keys provided by the backend. - There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation. - The 'names blob' in NTLMSSP is always in unicode - never in ascii. Don't make an ascii version ever. - The other big change is to allow variable length session keys. We have always assumed that session keys are 16 bytes long - and padded to this length if shorter. However, Kerberos session keys are 8 bytes long, when the krb5 login uses DES. * This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. * - Add better DEBUG() messages to ntlm_auth, warning administrators of misconfigurations that prevent access to the privileged pipe. This should help reduce some of the 'it just doesn't work' issues. - Fix data_blob_talloc() to behave the same way data_blob() does when passed a NULL data pointer. (just allocate) REMEMBER to make clean after this commit - I have changed plenty of data structures... (This used to be commit f3bbc87b0dac63426cda6fac7a295d3aad810ecc)
2003-11-17This fixes a bug when establishing trust against a german W2k3 AD server. InVolker Lendecke1-1/+2
the bind response to WKSSVC it does not send \PIPE\ntsvcs as NT4 (did not check w2k) but \PIPE\wkssvc. I'm not sure whether we should make this check at all, so making it a bit more liberal should hopefully not really hurt. Volker (This used to be commit 029dcb351bcfab70ed0afa4acf4bd64316bfd757)
2003-10-01commit sign only patch from Andrew; bug 167; tested using 2k & XP ↵Gerald Carter1-17/+12
clientspreviously joined to the Samba domain (This used to be commit 3802f5895ee18507c6f467bd11db0b1147a6fdfd)
2003-08-19- Fix the kerberos downgrade problem:Andrew Bartlett1-1/+5
- When connecting to the NETOGON pipe, we make a call to auth2, in order to verify our identity. This call was being made with negotiation flags of 0x1ff. This caused our account to be downgraded. If we instead make the call with flags > 1ff (such as 0x701ff), then this does not occour. - This is *not* related to the use of kerberos for the CIFS-level connection My theory is that Win2k has a test to see if we are sending *exactly* what NT4 sent - setting any other flags seems to cause us to remain intact. Also ensure that we only have 'setup schannel' code in a few places, not scattered around cmd_netlogon too. Andrew Bartlett (This used to be commit e10f0529fe9d8d245b3cd001cce6a9a86896679c)
2003-08-15get rid of more compiler warningsHerb Lewis1-8/+8
(This used to be commit 398bd14fc6e2f8ab2f34211270e179b8928a6669)
2003-08-14Change Samba to always use extended security for it's guest logins, (ie,Andrew Bartlett1-1/+1
NTLMSSP with "" username, NULL password), and add --machine-pass (-P) to all of Samba's clients. When connecting to an Active Directory DC, you must initiate the CIFS level session setup with Kerberos, not a guest login. If you don't, your machine account is demoted to NT4. Andrew Bartlett (This used to be commit 3547cb3def45a90f99f67829a533eac1ccba5e77)
2003-08-04Memory leak fix for create_rpc_bind_req()Tim Potter1-0/+1
(This used to be commit 4d26feabd75d5b298276b0c5880b9765507bb6ae)
2003-07-30Save us from possibly uninitialised variable (caught by gcc).Jeremy Allison1-4/+4
Jeremy. (This used to be commit f3f29665bd2c396c4756cd23f603ac768fea66fd)
2003-07-25domain in schannel bind credentials must be the dest domain, not oursGerald Carter1-1/+3
(This used to be commit e12f6a8c13f27c3caea96b467cc4294e20dad341)
2003-07-25Schannel, once setup, may be used on *ANY* TCP/IP connection until theAndrew Bartlett1-3/+52
connection that set it up has been shut down. (Also, pipes still connected, and reconnections to the same pipe (eg SAMR) may continue to use that session key until their TCP/IP connection is shut down) Allow further testing by printing out the session key, and allowing it's input into rpcclient. Next step is automatic storage in a TDB. Andrew Bartlett (This used to be commit fa4d7be1619b51aacec37ddf995c940b8100aef9)
2003-07-17In the presense of RPC fragments, schannel is not strictly request/reply,Andrew Bartlett1-5/+0
so the shared sequence number will not be strictly odd/even. Andrew Bartlett (This used to be commit 77c3e69aef545d3f9b7cec9efdc366cbeb0c745e)
2003-07-16Fix up our auth_pipe code to always cope with fragmented datagrams,Andrew Bartlett1-64/+41
in both SCHANNEL and NTLMSSP. (Try not to deal with a general case as individual special cases...) Andrew Bartlett (This used to be commit 6ca77bd28f16f9f65ff40bf8996e39356de5b4f8)
2003-07-15fix schannel processing on fragmented PDUs. 'net rpc vampire' works again.Gerald Carter1-1/+1
(This used to be commit ff0c71148e405eeb49efbc51461325c7f2207433)
2003-07-14Fix compile error noticed by Ken Cross, use the utility function insteadAndrew Bartlett1-14/+4
of an inline replacement... Andrew Bartlett (This used to be commit d941255a97fc6d0d62eae1602075b1aa0481cde5)
2003-07-14Jeremy requested that I get my NTLMSSP patch into CVS. He didn't requestAndrew Bartlett1-564/+493
the schannel code, but I've included that anyway. :-) This patch revives the client-side NTLMSSP support for RPC named pipes in Samba, and cleans up the client and server schannel code. The use of the new code is enabled by the 'sign', 'seal' and 'schannel' commands in rpcclient. The aim was to prove that our separate NTLMSSP client library actually implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation, in the hope that knowing this will assist us in correctly implementing NTLMSSP signing for SMB packets. (Still not yet functional) This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with calls to libsmb/ntlmssp.c. In the process, we have gained the ability to use the more secure NT password, and the ability to sign-only, instead of having to seal the pipe connection. (Previously we were limited to sealing, and could only use the LM-password derived key). Our new client-side NTLMSSP code also needed alteration to cope with our comparatively simple server-side implementation. A future step is to replace it with calls to the same NTLMSSP library. Also included in this patch is the schannel 'sign only' patch I submitted to the team earlier. While not enabled (and not functional, at this stage) the work in this patch makes the code paths *much* easier to follow. I have also included similar hooks in rpccleint to allow the use of schannel on *any* pipe. rpcclient now defaults to not using schannel (or any other extra per-pipe authenticiation) for any connection. The 'schannel' command enables schannel for all pipes until disabled. This code is also much more secure than the previous code, as changes to our cli_pipe routines ensure that the authentication footer cannot be removed by an attacker, and more error states are correctly handled. (The same needs to be done to our server) Andrew Bartlett (This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-03Removed strupper/strlower macros that automatically map to ↵Jeremy Allison1-3/+3
strupper_m/strlower_m. I really want people to think about when they're using multibyte strings. Jeremy. (This used to be commit ff222716a08af65d26ad842ce4c2841cc6540959)
2003-05-16Clarify a comment: The secure channel connection must be opened on theTim Potter1-4/+4
same session (TCP connection) as the one the challenge was requested from. (This used to be commit 5cb9b99f0f5dad589ac7def667e354d6f92f8822)
2003-05-12Fix two bugs that were stopping net rpc vampire from working over secureTim Potter1-2/+10
channel: - If the domain name passed to create_rpc_bind_req() is empty, use lp_workgroup() - Correctly set the auth_padding field when the send_size is a multiple of 8 bytes I've tested with nt4sp6 and win2ksp0 and it seems to work, although there are no password hashes transferred from win2k. The empty passwords are being protected by the secure channel encryption though. (This used to be commit a8c11e855611c91e94787387c62ac629232cacfa)
2003-05-11Ok, this is a hack. On a netsec bind reply I did not see anythingVolker Lendecke1-0/+20
useful in the auth verifier yet. So this patch ignores it. Really checking this would be a lot more intrusive: in rpc_api_pipe we would have to distinguish between binds and normal requests, or have more state in the netsec info of cli_state, which is also somewhat hackish. Volker (This used to be commit 8de04fcf680a9bc5054965577eb500e0541ffe66)
2003-05-08This puts real netlogon connection caching to winbind. This becomesVolker Lendecke1-20/+10
important once we start doing schannel, as there would be a lot more roundtrips for the second PIPE open and bind. With this patch logging in to a member server is a matter of two (three if you count the ack...) packets between us and the DC. Volker (This used to be commit 5b3cb7725a974629d0bd8b707bc2940c36b8745e)
2003-04-28Fixes from Ronan Waide <waider@waider.ie> for large RPC writes.Jeremy Allison1-2/+2
Jeremy. (This used to be commit a330bf170eb8e78200367c90833cbc90255642cb)
2003-04-16Fixes for multi-PDU schannel - based on Volker's code. This code needsJeremy Allison1-9/+36
tidying up. Samsync still doesn't work due to bad parsing of net_io_sam_alias_info with a blank description. Still working on this.... Jeremy. (This used to be commit 942fede9a57a9319cf67388004dd45fa8a045f41)
2003-04-16Fixes to make SCHANNEL work in 3.0 against a W2K DC. Still need to fixJeremy Allison1-13/+24
multi-PDU encode/decode with SCHANNEL. Also need to test against WNT DC. Jeremy. (This used to be commit ff66d4097088409205b6bad5124a78ef9946010d)
2003-04-14Merge: remove unused variables.Tim Potter1-2/+0
(This used to be commit dfa9412da567d2477ee5b1e6ecdc96b8dea3c21d)
2003-04-09This is the netlogon schannel client code. Try aVolker Lendecke1-18/+305
rpcclient -S pdc -U% -c "samlogon user password" and it should work with the schannel. Needs testing against platforms different from NT4SP6. Volker (This used to be commit eaef0d8aeff1aa5a067679be3f17e08d7434e1e8)
2003-01-22Merge: remove dead function.Tim Potter1-10/+0
(This used to be commit 648307ab3d16cb557cead27d6799a741a266c0d5)
2003-01-15merging some rpcclient and net functionality from HEADGerald Carter1-3/+5
(This used to be commit 7a4c87484237308cb3ad0d671687da7e0f6e733b)
2003-01-03Merge from HEAD - make Samba compile with -Wwrite-strings without additionalAndrew Bartlett1-1/+1
warnings. (Adds a lot of const). Andrew Bartlett (This used to be commit 3a7458f9472432ef12c43008414925fd1ce8ea0c)
2002-12-02Ensure callid is not used uninitialized.Jeremy Allison1-1/+1
Jeremy. (This used to be commit ddd70995951c072a02fc3bddd7a94ccbf301f62c)
2002-11-12Removed global_myworkgroup, global_myname, global_myscope. Added liberalJeremy Allison1-10/+8
dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy. (This used to be commit f755711df8f74f9b8e8c1a2b0d07d02a931eeb89)
2002-11-07Merge Jim's new rpc client code to 3.0.Jeremy Allison1-110/+145
Jeremy. (This used to be commit 121c456d4347bbefd9b2ce0141e3f53a21f37066)
2002-11-02Display pipe name in rpc bind failure debug.Tim Potter1-1/+2
(This used to be commit 70838b33a61a10e9bd1622611a6be3b0cac08479)
2002-11-01Tidyup of some DCERPC pipe connection debugs. The new LSA_DS stuffTim Potter1-4/+3
generates some errors we haven't seen before which are inappropriately logged at level 0. (This used to be commit 40d5112048ab0943caef7149b7a0d9dee5256b87)
2002-10-17Merge of SMB_ASSERT.Tim Potter1-2/+3
(This used to be commit 1094e1ffde09b0393b11d2cce148b6da893348c1)
2002-10-08merge from APP_HEAD of winbindd's domain local group fixGerald Carter1-0/+16
(This used to be commit 09c6f6329d6ae9327b7ef06de0ea78d24d805456)
2002-10-04* merge native_mode flag in winbindd_domain struct from app-headGerald Carter1-31/+11
* add some files missing from a previous commit (This used to be commit 29159c97371c75327e377f9d13406dad46095568)
2002-10-04merge of working dsrolegetprimdominfo() client code from APP_HEADGerald Carter1-1/+1
(This used to be commit 028477e35208e76fedbc7c743426fd9be94b7cf0)
2002-10-04merge of new client side support the Win2k LSARPC UUID in rpcbindGerald Carter1-29/+78
from APP_HEAD (This used to be commit 1cfd2ee433305e91e87804dd55d10e025d30a69e)
2002-09-25sync'ing up for 3.0alpha20 releaseGerald Carter1-1/+1
(This used to be commit 65e7b5273bb58802bf0c389b77f7fcae0a1f6139)
2002-07-15updated the 3.0 branch from the head branch - ready for alpha18Andrew Tridgell1-0/+3
(This used to be commit 03ac082dcb375b6f3ca3d810a6a6367542bc23ce)
2002-01-30Removed version number from file header.Tim Potter1-2/+1
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2002-01-02Add prs_dump_before to dump everything from the start of the prsMartin Pool1-1/+1
buffer up to the current position, and use this to dump pipe buffers just before parsing. (This used to be commit 92a3ab274e6cf09a8ba39b91f8bbacba6de40b37)
2002-01-02Also capture received dataMartin Pool1-0/+5
(This used to be commit 93fadcd1118b390605d2504bee63a1e8b6373ac5)
2002-01-02struct cli_state remembers the pipe name that it's talking to, if any,Martin Pool1-3/+22
so that we can print it in later debug messages. Call prs_dump to dump out requests sent by the client at sufficiently high debug levels. (This used to be commit 9973b22b34dc2a88a20b821d4e69f39d2a6aa6a3)
2001-11-03Added NT_USER_TOKEN into server_info to fix extra groups problem.Jeremy Allison1-7/+7
Got "medieval on our ass" about const warnings (as many as I could :-). Jeremy. (This used to be commit ee5e7ca547eff016818ba5c43b8ea0c9fa69b808)
2001-10-02Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter1-1/+0
(This used to be commit 2d0922b0eabfdc0aaf1d0797482fef47ed7fde8e)
2001-09-17move to SAFE_FREE()Simo Sorce1-8/+3
(This used to be commit 549fe42bd48b3418e63ba4872bc5992dae46d514)
2001-08-10Use new client error api.Tim Potter1-12/+13
(This used to be commit b196a52483a6e4ac1e4c311ff43d3c07fca031df)
generated by cgit (git 2.34.1) at 2024-11-30 00:50:55 +0000