summaryrefslogtreecommitdiff
path: root/source3/rpc_parse/parse_net.c
AgeCommit message (Collapse)AuthorFilesLines
2003-12-05Janitor for tridge...Jeremy Allison1-4/+4
Jeremy. (This used to be commit d9790a76d88b8c46d665f2294878ee13d438b791)
2003-11-22(merge from 3.0)Andrew Bartlett1-3/+8
Changes all over the shop, but all towards: - NTLM2 support in the server - KEY_EXCH support in the server - variable length session keys. In detail: - NTLM2 is an extension of NTLMv1, that is compatible with existing domain controllers (unlike NTLMv2, which requires a DC upgrade). * This is known as 'NTLMv2 session security' * (This is not yet implemented on the RPC pipes however, so there may well still be issues for PDC setups, particuarly around password changes. We do not fully understand the sign/seal implications of NTLM2 on RPC pipes.) This requires modifications to our authentication subsystem, as we must handle the 'challege' input into the challenge-response algorithm being changed. This also needs to be turned off for 'security=server', which does not support this. - KEY_EXCH is another 'security' mechanism, whereby the session key actually used by the server is sent by the client, rather than being the shared-secret directly or indirectly. - As both these methods change the session key, the auth subsystem needed to be changed, to 'override' session keys provided by the backend. - There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation. - The 'names blob' in NTLMSSP is always in unicode - never in ascii. Don't make an ascii version ever. - The other big change is to allow variable length session keys. We have always assumed that session keys are 16 bytes long - and padded to this length if shorter. However, Kerberos session keys are 8 bytes long, when the krb5 login uses DES. * This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. * - Add better DEBUG() messages to ntlm_auth, warning administrators of misconfigurations that prevent access to the privileged pipe. This should help reduce some of the 'it just doesn't work' issues. - Fix data_blob_talloc() to behave the same way data_blob() does when passed a NULL data pointer. (just allocate) REMEMBER to make clean after this commit - I have changed plenty of data structures... Andrew Bartlett (This used to be commit 57a895aaabacc0c9147344d097d333793b77c947)
2003-09-29Merge from 3.0:Tim Potter1-68/+40
>Fix for #480. Change the interface for init_unistr2 to not take a length >but a flags field. We were assuming that 2*strlen(mb_string) == length of ucs2-le string. >This is not the case. Count it after conversion. >Jeremy. (This used to be commit e2ab9e54cd0ec0002175cf18ff364f4aebaf85a0)
2003-09-09sync 3.0 into HEAD for the last timeGerald Carter1-7/+15
(This used to be commit c17a7dc9a190156a069da3e861c18fd3f81224ad)
2003-07-16trying to get HEAD building again. If you want the codeGerald Carter1-17/+18
prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE (This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad)
2003-05-27Merge of secchan fix from 3.0 that was eaten by CVS yesterday. I thinkTim Potter1-1/+1
it was becuase I ran out of disk quota. (This used to be commit 10cbec05a7bfe2fab54940329c5b348d5e524f29)
2003-04-18Survive a samdump with an alias that has no descriptionVolker Lendecke1-3/+6
Volker (This used to be commit 408a94b64d4d799f256c11a2009e161b27553cbb)
2003-03-15Fix signed/unsigned issues - mostly 'i' counters.Andrew Bartlett1-11/+11
Fix an inconpatible poitner type that caused the IA64 not to build Andrew Bartlett (This used to be commit 37436b0aae108fceace3049d3868510e1ba592ac)
2003-02-18init_dom_sid2s: Check return code from string_to_sid. Skip tokensMartin Pool1-8/+12
that are not valid SIDs. (This used to be commit 5a597272782b74d28859ba98027fe9ff9c278086)
2003-02-14Ensure that only parse_prs.c access internal members of the prs_struct.Jeremy Allison1-14/+14
Needed to move to disk based i/o later. Jeremy. (This used to be commit 4c3ee228fcdb089eaeead95e79532a9cf6cb0de6)
2003-02-02Send the user's session key in the SAMLOGON reply, so that a member server canAndrew Bartlett1-2/+2
use smb signing. Andrew Bartlett (This used to be commit 574e8a8ab7c94ecd9113df42e395e83632980675)
2003-01-17reverted this patch till I sort out the craziness with UNIHDRAndrew Tridgell1-25/+26
(This used to be commit e3d00fa47d38cd214f5e350e1d6b30d90ed8a52c)
2003-01-17This removes the 3rd argument from init_unistr2(). There were 240Andrew Tridgell1-26/+25
calls to init_unistr2() in the code and every one of them got the 3rd argument incorrect, so I thought it best just to remove the argument. The incorrect usage was caused by callers using strlen() to determine the length of the string. The 3rd argument to init_unistr2() was supposed to be the character length, not the byte length of the string, so for non-english this could come out wrong. I also removed the bogus 'always allocate at least 256 bytes' hack. There may be some code that relies on this, but if there is then the code is broken and needs fixing. (This used to be commit b9eff31b1433c81fbff733e194914a40f25e3bda)
2003-01-02BIG patch...Andrew Bartlett1-46/+46
This patch makes Samba compile cleanly with -Wwrite-strings. - That is, all string literals are marked as 'const'. These strings are always read only, this just marks them as such for passing to other functions. What is most supprising is that I didn't need to change more than a few lines of code (all in 'net', which got a small cleanup of net.h and extern variables). The rest is just adding a lot of 'const'. As far as I can tell, I have not added any new warnings - apart from making all of tdbutil.c's function const (so they warn for adding that const string to struct). Andrew Bartlett (This used to be commit 92a777d0eaa4fb3a1c7835816f93c6bdd456816d)
2002-11-12Removed global_myworkgroup, global_myname, global_myscope. Added liberalJeremy Allison1-14/+17
dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy. (This used to be commit 82b8f749a36b42e22186297482aad2abb04fab8a)
2002-09-22Change parsing of policy and privs delta to what Ethereal says.Volker Lendecke1-70/+66
Volker (This used to be commit 8c41b5cd1b8b0c2639def9552bd20b8aca39785c)
2002-08-30removed a debug lineAndrew Tridgell1-2/+0
(This used to be commit 5185f495d055cee609872db9e59edbe3220dc5bd)
2002-08-29There's more work to be done on samsync. Intermediate commit, nowVolker Lendecke1-1/+1
I get all the groups at least. Volker (This used to be commit 23a4f6991e93797afad0043689737a1b20c67f60)
2002-08-23some cleanup while working on the NETLOGON pipe.Jean-François Micouleau1-37/+4
smb_io_chal() did a prs_align() but a challenge is an array of bytes. and all code calling smb_io_chal() played with the alignment to not align ! I'm confident in my change, but I would *really* like if jeremy could look at that. J.F. (This used to be commit 23501ea971f8cc0799515e0d51ad8619221a31e1)
2002-08-22Added some new delta types discovered by Ronnie from ethereal"Tim Potter1-16/+23
- SAM_DELTA_RENAME{USER,GROUP,ALIAS} - SAM_DELTA_DELETE{USER,GROUP} Renamed some of the unknown delta types and their unmarshalling functions: - SAM_DELTA_TRUST_DOMS - SAM_DELTA_SECRET_INFO (This used to be commit 1f29276c2ff450c4ca3705c27fb0be71ddcda4ad)
2002-08-22added a 'net rpc samdump' command for dumping the whole sam viaAndrew Tridgell1-3/+6
samsync operations (as a BDC) (This used to be commit e4cb106d2e3e6a41529369545a7a6ce5fe6d8986)
2002-08-21NETLOGON NetServerAuthenticate3 include and parser fileJean-François Micouleau1-1/+80
J.F. (This used to be commit 2f68d6f5ec925f07a387f784db6de0cfbaa53278)
2002-07-31Winbind updates!Andrew Bartlett1-1/+1
This updates the 'winbind' authentication module and winbind's 'PAM' (actually netlogon) code to allow smbd to cache connections to the DC. This is particulary relevent when we need mutex locks already - there is no parallelism to be gained anyway. The winbind code authenticates the user, and if successful, passes back the 'info3' struct describing the user. smbd then interprets that in exactly the same way as an 'ntdomain' logon. Also, add parinoia to winbind about null termination. Andrew Bartlett (This used to be commit 167f122b670d4ef67d78e6f79a2bae3f6e8d67df)
2002-06-18more debug classess activatedSimo Sorce1-0/+3
(This used to be commit 897e64d2e0c1d04ab93441ccaffe369bf43be46e)
2002-06-14Add a touch of const to this - helps with some yet-to-be-commited changesAndrew Bartlett1-3/+3
(This used to be commit a2c791c0bbce1d505e5ef2150384ad5d54ae7117)
2002-05-17Make non-static for some later work (pushing the info3 across the winbindAndrew Bartlett1-2/+3
pipe for smbd to decode), and fix up the debug. (At least I assume it is wrong, can an expert care to comment?) (This used to be commit e5b4331ffa99d769b062053d6afc4772355fa5b2)
2002-03-02And a little more const.Andrew Bartlett1-3/+3
(This used to be commit 044391b5973f6070abf6ac185c74ffd713e933c5)
2002-01-30Removed version number from file header.Tim Potter1-2/+1
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2002-01-26Try to move towards slightly sane linking for Samba by removing some pdb_...()Andrew Bartlett1-17/+32
calls from rpc_parse/parse_net.c - instead these values are passed as a paramater. Unfortunetly some there is still some samr work to be done before this is actually useful. Andrew Bartlett (This used to be commit 4fc9e16ad7a77cf2e37b27640c0dec2052e9cda0)
2001-12-31more irix -64 portability fixesAndrew Tridgell1-1/+1
(This used to be commit 65e857b36e170e3ecd78bf6695ae73342e9c04cd)
2001-12-18fixing bug I introduced.Jean-François Micouleau1-1/+1
J.F. (This used to be commit 49764852c516a22fba84d6289c93bed0e5da1c7e)
2001-12-13update the ldap support code. it compiles.Jean-François Micouleau1-5/+8
Ignacio you can update your howto ;-) samsync: a small patch to try chaning challenges. J.F. (This used to be commit c99bc305599698f2291efbfe20024355cb2bcde0)
2001-12-12decoded SAM_DELTA 0x0e and 0x12.Jean-François Micouleau1-0/+144
One is an entry for the trusted domains The other is an entry for the trusting domains They are pretty basic, I'll improve them. J.F. (This used to be commit 8d359e62138aa327cb00875dc446234ce4be6f02)
2001-12-12a ugly decoder for SAM_DELTA_DOM_INFO (0x0d)Jean-François Micouleau1-39/+203
a correct decoder for SAM_PRIVS_INFO (0x10) this code is totally useless right now, it's just fun to decode those and will save tpot some time. J.F. (This used to be commit 314b675ed9ebacba9db25938c43cfa304462ebe2)
2001-12-06again an intrusive patch:Jean-François Micouleau1-26/+20
- removed the ugly as hell sam_logon_in_ssb variable, I changed a bit the definition of standard_sub_basic() to cope with that. - removed the smb.conf: 'domain admin group' and 'domain guest group' parameters ! We're not playing anymore with the user's group RIDs ! - in get_domain_user_groups(), if the user's gid is a group, put it first in the group RID list. I just have to write an HOWTO now ;-) J.F. (This used to be commit fef52c4b96c987115fb1818c00c2352c67790e50)
2001-12-05OK. Smbpasswd -j is DEAD.Andrew Bartlett1-2/+7
This moves the rest of the functionality into the 'net rpc join' code. Futhermore, this moves that entire area over to the libsmb codebase, rather than the crufty old rpc_client stuff. I have also fixed up the smbpasswd -a -m bug in the process. We also have a new 'net rpc changetrustpw' that can be called from a cron-job to regularly change the trust account password, for sites that run winbind but not smbd. With a little more work, we can kill rpc_client from smbd entirly! (It is mostly the domain auth stuff - which I can rework - and the spoolss stuff that sombody else will need to look over). Andrew Bartlett (This used to be commit 575897e879fc175ba702adf245384033342c903d)
2001-11-21samr_querydom_info level 1: found the meaning of the unknow fields. AndJean-François Micouleau1-2/+2
discovered that our reply is short by 4 bytes since day 1 of this code. Added a decode function to rpcclient too. splitted the STRING2 fields filling while trying to understand the win9x userlist bug. (didn't fix the bug, but the reply looks closer to NT). J.F. (This used to be commit bfbe7f377e5fcb09e87bfc866196dfc51a8fe64d)
2001-11-04get the string lengths right in domain logonsAndrew Tridgell1-2/+2
Andrew, this fixes domain logons in head. Please look at the change, as I think you may have misunderstood the max_str_len field (which is badly named) (This used to be commit fd3a657b440a61c0c146947bb62d2b83c1689b87)
2001-11-01Various post AuthRewrite cleanups, fixups and tidyups.Andrew Bartlett1-3/+3
Zero out some of the plaintext passwords for paranoia Fix up some of the other passdb backends with the change to *uid_t rather than uid_t. Make some of the code in srv_netlog_nt.c clearer, is passing an array around, so pass its lenght in is definition, not as a seperate paramater. Use sizeof() rather than magic numbers, it makes things easier to read. Cope with a PAM authenticated user who is not in /etc/passwd - currently by saying NO_SUCH_USER, but this can change in future. Andrew Bartlett (This used to be commit 514c91b16baca639bb04638042bf9894d881172a)
2001-10-31This is a farily large patch (3300 lines) and reworks most of the AuthRewriteAndrew Bartlett1-1/+1
code. In particular this assists tpot in some of his work, becouse it provides the connection between the authenticaion and the vuid generation. Major Changes: - Fully malloc'ed structures. - Massive rework of the code so that all structures are made and destroyed using malloc and free, rather than hanging around on the stack. - SAM_ACCOUNT unix uids and gids are now pointers to the same, to allow them to be declared 'invalid' without the chance that people might get ROOT by default. - kill off some of the "DOMAIN\user" lookups. These can be readded at a more appropriate place (probably domain_client_validate.c) in the future. They don't belong in session setups. - Massive introduction of DATA_BLOB structures, particularly for passwords. - Use NTLMSSP flags to tell the backend what its getting, rather than magic lenghths. - Fix winbind back up again, but tpot is redoing this soon anyway. - Abstract much of the work in srv_netlog_nt back into auth helper functions. This is a LARGE change, and any assistance is testing it is appriciated. Domain logons are still broken (as far as I can tell) but other functionality seems intact. Needs testing with a wide variety of MS clients. Andrew Bartlett (This used to be commit f70fb819b2f57bd57232b51808345e2319d52f6c)
2001-10-31This one's a doozy. A cut&paste bug incorrectly sets the max string lengthTim Potter1-1/+1
of the lm challenge/response header in the NET_ID_INFO_2 structure included in a network logon request. It seems Windows 2000 is the only OS that cares about this. (This used to be commit 0f6207f45567a8af0a125a838a5ed68ea6c22283)
2001-10-30Removed confusing comment.Tim Potter1-1/+1
(This used to be commit b496936634a4b676aa2df973e64c91aa0da5d7d5)
2001-10-29This commit is number 4 of 4.Andrew Bartlett1-6/+6
In particular this commit focuses on: Actually adding the 'const' to the passdb interface, and the flow-on changes. Also kill off the 'disp_info' stuff, as its no longer used. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes introduces a large dose of 'const' to the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username --- This finishes this line of commits off, your tree should now compile again :-) Andrew Bartlett (This used to be commit c95f5aeb9327347674589ae313b75bee3bf8e317)
2001-10-02Fixed the bug with member servers in a Samba PDC hosted domain not allowingJeremy Allison1-6/+7
other access. Problem was max time was being set to 0xffffffff, instead of 0x7fffffff. Jeremy. (This used to be commit 94403d841710391ec26539e4b4157439d5778ff7)
2001-10-02Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter1-2/+0
(This used to be commit 2d0922b0eabfdc0aaf1d0797482fef47ed7fde8e)
2001-09-22These are RIDs not Unix UIDs so make this clear in the feild names.Andrew Bartlett1-5/+5
Andrew Bartlett (This used to be commit d1bc778301b31d77fdc3837ec3cff24ce37adcd7)
2001-09-14Decode 68-byte password blocks using sam replication password key (whichTim Potter1-2/+4
is actually the user session key). (This used to be commit 0f041597f8afa378fc3177264f1e52e014e6cf00)
2001-09-04it now all compiles - so try enabling it by default and see what explodes on ↵Andrew Tridgell1-3/+3
the build farm (This used to be commit 5bb7e4f0f65edf1db20245f403cbe81833134240)
2001-09-04Welcome to tpot's exploit world!Tim Potter1-253/+413
- put in checks for return values in rpc parsing routines - replace a bunch of stupid &(foo->bar) with &foo->bar - fixed bug in net_io_sam_alias_mem_info where there are zero members in the alias (This used to be commit eecdba2b015ed48d7dd88daea2af466f28cd2ff7)
2001-09-04the next stage in the NTSTATUS/WERROR change. smbd and nmbd now compile, but ↵Andrew Tridgell1-14/+14
the client code still needs some work (This used to be commit dcd6e735f709a9231860ceb9682db40ff26c9a66)
generated by cgit (git 2.34.1) at 2024-12-22 08:53:14 +0000