summaryrefslogtreecommitdiff
path: root/source3/rpc_server
AgeCommit message (Collapse)AuthorFilesLines
2003-11-22(merge from 3.0)Andrew Bartlett4-13/+42
Changes all over the shop, but all towards: - NTLM2 support in the server - KEY_EXCH support in the server - variable length session keys. In detail: - NTLM2 is an extension of NTLMv1, that is compatible with existing domain controllers (unlike NTLMv2, which requires a DC upgrade). * This is known as 'NTLMv2 session security' * (This is not yet implemented on the RPC pipes however, so there may well still be issues for PDC setups, particuarly around password changes. We do not fully understand the sign/seal implications of NTLM2 on RPC pipes.) This requires modifications to our authentication subsystem, as we must handle the 'challege' input into the challenge-response algorithm being changed. This also needs to be turned off for 'security=server', which does not support this. - KEY_EXCH is another 'security' mechanism, whereby the session key actually used by the server is sent by the client, rather than being the shared-secret directly or indirectly. - As both these methods change the session key, the auth subsystem needed to be changed, to 'override' session keys provided by the backend. - There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation. - The 'names blob' in NTLMSSP is always in unicode - never in ascii. Don't make an ascii version ever. - The other big change is to allow variable length session keys. We have always assumed that session keys are 16 bytes long - and padded to this length if shorter. However, Kerberos session keys are 8 bytes long, when the krb5 login uses DES. * This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. * - Add better DEBUG() messages to ntlm_auth, warning administrators of misconfigurations that prevent access to the privileged pipe. This should help reduce some of the 'it just doesn't work' issues. - Fix data_blob_talloc() to behave the same way data_blob() does when passed a NULL data pointer. (just allocate) REMEMBER to make clean after this commit - I have changed plenty of data structures... Andrew Bartlett (This used to be commit 57a895aaabacc0c9147344d097d333793b77c947)
2003-11-19Correct fix for '$' termination test.Jeremy Allison1-2/+1
Jeremy. (This used to be commit b93e44e01edb432e11b9ad6aeb4d4eea0f7fa433)
2003-11-18Fix to correct checking of '$' name termination.Rafal Szczesniak1-1/+1
Patch by metze. rafal (This used to be commit 7191186fc64eb0b8092a2f6f1e89b6b6a6df7627)
2003-11-17* make sure we only enumerate group mapping entriesGerald Carter1-135/+44
(not /etc/group) even when doing local aliases * remove "hide local users" parameter; we have this behavior built into 3.0 (This used to be commit 3b75e862dfba42c95e2279c300c06bb981f52993)
2003-11-09Merge from 3.0:Andrew Bartlett1-6/+0
source/passdb/pdb_get_set.c: I agree with vl's #if 0 here, and am not quite sure what I was thinking with regard to the original code. Let's keep samba simple, and just remove it. source/rpc_server/srv_netlog_nt.c: Remove compleatly wrong comments. (There were correct, 2 years ago...) source/intl/lang_tdb.c: Add newline to debug message Andrew Bartlett (This used to be commit 2a8dbe03690b60f3d9c83de3cf6ce873aa0657bc)
2003-11-07* only install swat html files onceGerald Carter1-3/+17
* revert the change that prevent the guest account from being added to a passdb backend since it broke the build farm. * apply patch from Alex Deiter to fix the "smbldap_open: cannot access when not root error" messages when looking up group information (bug 281) (This used to be commit 20bd309239199d85accb2b7aac6d4dd73e414f85)
2003-11-07Handle munged dial string. Patch from Aur?lien Degr?mont <adegremont@idealx.com>Jeremy Allison2-11/+86
with memory leak fixes by me. Jeremy. (This used to be commit daceed37387c517b3f0ab9c173f419215e3d676b)
2003-11-05Merge of 64-bit printf warning fixes.Tim Potter2-3/+3
(This used to be commit a6cc763333943bc6e360bb7e78cf9bfb1bc936e8)
2003-10-30Another round of GUID->struct uuid.Jim McDonough1-3/+3
Takes care of the lsass pipe (This used to be commit 3dca3efa4b427fa3094a8cd392fe5744b5f6f6a8)
2003-10-30First round of merging various UUID structures.Jim McDonough3-5/+6
This eliminates RPC_UUID. It creates the following struct: struct uuid { uint32 time_low; uint16 time_mid; uint16 time_hi_and_version; uint8 clock_seq[2]; uint8 node[6]; }; which replaces RPC_UUID and various random struct uuid definitions and a flat version: #define UUID_FLAT_SIZE 16 typedef struct uuid_flat { uint8 info[UUID_FLAT_SIZE]; } UUID_FLAT; which pretty much looks like GUID (which I will start eliminating). I want us to use the FLAT one only on the wire (perhaps in files, too?), and I want it to be obvious to the coder that it is the FLAT version. This leaves a couple of compiler warnings, where GUID isn't completely replaced by FLAT_UUID yet...I'll get to those soon. (This used to be commit 1532b5d2e3c61df232b16394acedf6eac387588b)
2003-10-28Fix for bug #667. DFS filenames can now have arbitrary case.Jeremy Allison1-19/+39
Jeremy. (This used to be commit cbefb5c4f983ca49fcc563111d8704d3770daf81)
2003-10-21Patch from Stefan Metzmacher <metze@metzemix.de> to fix signing problemsJeremy Allison1-1/+2
when reverse connecting back to a client for printer notify. Jeremy. (This used to be commit 7fde193efeb856ec325d5d563f1e710c45dc65d7)
2003-10-21Add server side support for epmapper pipe. Currently only does a fixedJim McDonough3-0/+161
mapping, but this is the base for changes to come. (This used to be commit 73882e970a3aea1c3c9f34779b4220bbf28f6dad)
2003-10-17* fix some compile warnings in the gums codeGerald Carter2-1/+50
* add server support for DsEnumerateDomainTrusts() (This used to be commit 06bacf6e3434db5bd09b48f84206441712e69a63)
2003-10-06split some security related functions in their own files.Simo Sorce2-36/+36
(no need to include all of smbd files to use some basic sec functions) also minor compile fixes (This used to be commit 66074d3b097d8cf2a231bf08c7f4db62da68189d)
2003-10-02Portability fix from schmitz@hp.com (Joachim Schmitz) for bug #548.Jeremy Allison1-1/+1
Jeremy. (This used to be commit a0828a2a1ce04075f0a7cb4a201cea0781998237)
2003-10-01commit sign only patch from Andrew; bug 167; tested using 2k & XP ↵Gerald Carter1-11/+19
clientspreviously joined to the Samba domain (This used to be commit 9d2e585e5e6f9066c6901aa8d8308734f8667296)
2003-09-29Merge from 3.0:Tim Potter5-68/+58
>Fix for #480. Change the interface for init_unistr2 to not take a length >but a flags field. We were assuming that 2*strlen(mb_string) == length of ucs2-le string. >This is not the case. Count it after conversion. >Jeremy. (This used to be commit e2ab9e54cd0ec0002175cf18ff364f4aebaf85a0)
2003-09-19Ensure that dup_sec_desc copies the 'type' field correctly. This causedJeremy Allison3-6/+6
me to expose a type arguement to make_sec_desc(). We weren't copying the SE_DESC_DACL_AUTO_INHERITED flag which could cause errors on auto inherited checks. Jeremy. (This used to be commit 546b2271c08735ac1049a453abac996d794aa364)
2003-09-18The "unknown_5" 32 bit field in the user structs is actually 2 16-bitJeremy Allison1-8/+18
fields, bad_password_count and logon_count. Ensure this is stored/fetched in the various SAMs. As it replaces the unknown_5 field this fits exactly into the tdb SAM without any binary problems. It also is added to the LDAP SAM as two extra attributes. It breaks compatibility with the experimental SAMs xml and mysql. The maintainers of these SAMs must fix them so upgrades like this can be done transparently. I will insist on the "experimental" status until this is solved. Jeremy. (This used to be commit 71ecd10181cd35313b79f618c2928c2f45424812)
2003-09-15Merge from Samba 3.0:Tim Potter1-1/+1
>Patch from Gregory Hinton Nietsky <gregory@networksentry.co.za>, >ensure the desired access is read from the incoming RPC request. >Jeremy. (This used to be commit a556637d0bc56aeb980c422c4d1da44311956c3b)
2003-09-09sync 3.0 into HEAD for the last timeGerald Carter18-172/+624
(This used to be commit c17a7dc9a190156a069da3e861c18fd3f81224ad)
2003-08-02port latest changes from SAMBA_3_0 treeSimo Sorce14-51/+52
(This used to be commit 3101c236b8241dc0183995ffceed551876427de4)
2003-07-16trying to get HEAD building again. If you want the codeGerald Carter10-493/+345
prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE (This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad)
2003-06-03* set winbind cache time to 5 minutesGerald Carter1-0/+1
* quit obsessing over the sequence number so much * share the updated sequence number between parent and child winbindd processes in dual mode (This used to be commit 6fb5bdb30e2b1341ba600ce0dfd397394f7a831c)
2003-05-22fixes bugs 85 & 99 (XP domain logons); don't enable the lsa_query_info2 ↵Gerald Carter1-2/+15
unless we are trying to be an ADS DC (This used to be commit 689576c242dd24349265973bded36ef6a239cebc)
2003-05-16Patch from "Esh, Andrew" <Andrew_Esh@adaptec.com> to fix core dump bugJeremy Allison1-1/+14
in add groupmem code. Jeremy. (This used to be commit 7e7077e9e363f46cea93767f0463581dbec87063)
2003-05-15Ensure sys_adminlog code won't coredump with incorrect client params.Jeremy Allison1-4/+11
Jeremy. (This used to be commit 0f7f762a1e1aa86afc2a740dcce83c8384d8d53b)
2003-05-12Fix compiler warnings.Jeremy Allison1-1/+0
Jeremy. (This used to be commit e12934c67b6aea9e3e449009e159ce6814dcbd11)
2003-05-01*id_to_*id call reshape to return NTSTATUS errorsSimo Sorce2-2/+2
plus internal fixes 1st stage (This used to be commit 6d036761e565bc93964bb3c939d5b7d78d5778a3)
2003-04-29This is a nice rewrite:Simo Sorce3-29/+14
SAM_ACCOUNT does not have anymore uid and gid fields all the code that used them has been fixed to use the proper idmap calls fix to idmap_tdb for first time idmap.tdb initialization. auth_serversupplied_info structure has now an uid and gid field few other fixes to make the system behave correctly with idmap tested only with tdbsam, but smbpasswd and nisplus should be ok have not tested ldap ! (This used to be commit 6a6f6032467e55aa9b76390e035623976477ba42)
2003-04-29Merge 3.0's change to how we add users onto HEAD, including a few other bitsAndrew Bartlett1-57/+12
of sync-up for the rpc_server/srv_samr_nt.c Andrew Bartlett (This used to be commit 3c867aedd9abc29389f5d049dbc94ada6738d1b0)
2003-04-29only call the add_script if the getpwnam_alloc() failsGerald Carter1-22/+27
(This used to be commit ba1e654a15fa800e56732fe005afd7479c18324b)
2003-04-28Use NTSTATUS as return value for smb_register_*() functions and init_module()Jelmer Vernooij10-22/+40
function. Patch by metze with some minor modifications. (This used to be commit f4576757d1d52a8f1b96894c869bb76450003fd1)
2003-04-26A RID can never be zeroSimo Sorce1-5/+12
(This used to be commit e2d757aed27ede67cf904c01e8f23e436d764108)
2003-04-22Setting the credentials for the netsec netlogon pipe connect upon eachVolker Lendecke2-8/+5
samlogon call certainly breaks the credential chain. Do it once during the bind response. Volker (This used to be commit 616b6dd60fe621a968fef34e66550f86b7b735bc)
2003-04-22Merge from 3.0 - try harder to get our real DNS domain name, and send thisAndrew Bartlett1-2/+10
to the client when it asks for our DNS name and forest name. (needed for win2k to trust us as a trusted domain). Andrew Bartlett (This used to be commit 2a1015eb57da7b69caafd1221b871b6bff1af2fb)
2003-04-22wrap pdb_enum_group_mapping() in [un]become_root() so LDAP queries can get ↵Gerald Carter1-0/+5
the credentials from secrets.tdb (This used to be commit cf6af44a2464cf1d9bea909dbc0e20829bdc2665)
2003-04-16Fixes to make SCHANNEL work against a W2K DC. Still need to fixJeremy Allison1-2/+10
multi-PDU encode/decode with SCHANNEL. Also need to test against WNT DC. Jeremy. (This used to be commit ec82e8e9f4a6bf807a91ac265af39a516c7ab631)
2003-04-15Typo in comment.Tim Potter1-1/+1
(This used to be commit 0a87d668a07b840c2e0ac9f6caad04e542422d40)
2003-04-14Fix typosJelmer Vernooij1-2/+2
(This used to be commit 7bd80376cc6aa70996a61882e1376cb6a0679836)
2003-04-11* We must return 0x2 as the majorversion for nt4 to upload driversGerald Carter1-1/+11
* fix bug found by clobber_region() (This used to be commit ad2765bb5e0c1c4d8f12583e49df5b1bc7ffc389)
2003-04-11simple fix to hopefully speed up srv_spoolss_replyopenprinter().Gerald Carter1-22/+36
Use the client address from the pipe->conn->client_address instead of trying to resolve the name in the _spoolss_rffpcn() request. Should make us more robust as well when the clients are not registered in DNS or WINS. (This used to be commit 78b2c1be7d9923716841627044c4e1578a5b9546)
2003-04-11A new RPC pipe! The \pipe\echo named pipe is for testing large RPCTim Potter2-0/+215
requests and responses and is only compiled in when --enable-developer is passed to configure. It includes server and client side code for generating and responding to functions on this pipe. The functions are: - AddOne: add one to the uint32 argument and return ig - EchoData: echo back a variable sized char array to the caller - SourceData: request a variable sized char array - SinkData: send a variable sized char array and throw it away There's a win32 implementation of the client and server in the junkcode CVS repository in the rpcecho-win32 subdirectory. (This used to be commit 4ccd34ef836eba05f81dc2da73fd7cfaac201798)
2003-04-10Ensure we're not filtering our essential delete messages.Jeremy Allison1-2/+2
Added jobid debug when unpacking message. Jeremy. (This used to be commit 8bab6e32069e1636a52efa31ca55b49f1b3fa768)
2003-04-09Put the core schannel functions to parse_prs.c. They are also used byVolker Lendecke1-187/+2
schannel clients. Volker (This used to be commit 41e92409e1c6912db05acc80b6c0d5dccd51859b)
2003-04-09another forgotten merge sitting on my laptop from app_head; only stall ↵Gerald Carter1-3/+6
open_printer when 2k client opens with admin privs & fix reply for ChangeId printer data reply (This used to be commit c7c3d42cd5954b040ee7027886ea8d9d0f2da9a5)
2003-04-09forgotten merge left on disk; remove extra SAFE_FREE()Gerald Carter1-2/+0
(This used to be commit 4d42067cb89220a1b275bc8408c9c1ba2ef7766a)
2003-04-04This is a merge of the NETLOGON schannel server code from SambaVolker Lendecke3-33/+438
TNG. Actually, it exists in the main Samba cvs tree in APPLIANCE_TNG as I found out later :-) It adds a new parameter: server schannel = yes/auto/no defaulting to auto. What does this mean to the user: No requireSignOrSeal registry patch for XP anymore. Many thanks for this code to Luke Leighton, Elrond and anybody else I forgot to mention. My next thing will be to see if this applies cleanly to 3_0. Please test and comment! Volker (This used to be commit e1f953241eb020f19fe657f29afdae28dcf5a03b)
2003-04-02THE Idmap patch :-)Simo Sorce2-2/+2
includes a --with-idmap=no switch to disable idmap usage if you find problems. cosmetic fixes and param aliases to separate winbind from idamp roles. A temporarily remote idmap winbind compatibility backend. As I have time I will further change code to not call directly winbind (partly done but not tested) and a specilized module will be built in place for the current glue hack. The patch has been tested locally in my limited time, the patch is simple and clear and should not reserve problems, if any just disable it. As usual, comments and fisex are welcome :-) Simo. (This used to be commit 02781320476ed1b7ee5d943fa36f9a66ab67f208)
generated by cgit (git 2.34.1) at 2024-12-17 23:25:46 +0000