Age | Commit message (Collapse) | Author | Files | Lines |
|
trying to set up the data parameters etc and not understanding what's going on.
in api_netlogTNP, added smb_io_rpc_hdr() call to decode the header received
(and in this instance, generated by do_lsa_req_chal()). and then noticed
that it's two bytes out. but i don't know how to do "byte parameters"
and it's not the same format as the LSA_REQCHAL received from nt workstations.
agh!
(This used to be commit 0cc8ce43e1d54b44237bb525f4cf6b77e7ca3ced)
|
|
and then send a LSA_REQ_CHAL down it.
(This used to be commit 473f21071fad603865358821b83df6b58c9a06a5)
|
|
send to \PIPE\ not \PIPE\NETLOGON.
ipc.c :
fstring name not being bzero'd caused problems when calling named_pipe().
(This used to be commit 2393c49b0509b8ce021f0acfba135219cd753cf9)
|
|
adding start of undocumented options to do NT domain logons, client-side.
starting with LSA_REQCHAL.
the code here happily crashes smbd: i'll investigate this further... :-)
smbparse.c pipeutil.c lsaparse.c :
moved some of the common make_xxxx() functions out of pipeutil.c
so that the make_xxxx and (smb/lsa)_io_xxxx functions now sit
together. makes sense, really...
added a make_q_req_chal() function.
restructured make_rpc_reply() and called it make_rpc_hdr(). created
functions create_rpc_reply() and create_rpc_response().
pipenetlog.c pipentlsa.c pipesrvsvc.c
calling new create_rpc_reply() function instead of old make_rpc_reply().
proto.h :
usual.
smb.h:
added enum for RPC_PACKET_TYPE
(This used to be commit b88ee3e16c6b671069f53ca2e9c5694ec8b1c030)
|
|
redid the split that i did a year ago, taking the functions in client.c
out into clientutil.c. guess what? we could now do encrypted password
NetServerEnum2 calls in nmbd, if we wanted to.
i can now use cli_call_api() to send to different pipes. i hope.
pipenetlog.c:
allow adding to users group _and_ to admin group. if adding to
guest group, don't allow adding to users or admin as well.
smb.h :
added some pipe #defines (\PIPE\NETLOGON \PIPE\srvsvc ...)
proto.h :
usual.
(This used to be commit 6ee065ce6e099acfc7e83ad399ef6e60b4c625c1)
|
|
added "domain other sids" parameter
pipenetlog.c :
using "domain other sids" parameter in SAM Logon response.
using new name_to_rid() function for r_uid and r_gid.
pipentlsa.c :
minor mods to do with new name_to_rid() function.
pipesrvsvc.c :
in the "net share enum" response, allocate some more space for the buffer.
there can be only 32 share entries in the response anyway. this needs
to be dealt with.
pipeutil.c :
modified name_to_rid() function to use new parameters "domain admin users"
and "domain guest users", but will otherwise do unix uid + 1000.
moved make_dom_gids() here.
proto.h:
the usual.
smb.h smbparse.c :
renamed sid_no to sid_rev_num in DOM_SID, and gid to r_gid in DOM_GID.
util.c :
moved make_dom_gids() from here.
created char *unistrn2(uint16* uni_buffer, int max_len)
(This used to be commit ec60e48d7982240b7755d246b2f1e8989467f66f)
|
|
shared memory implementation)
(This used to be commit 8d1993c71a5d5d32636f62ba9b9a9009ec74d730)
|
|
I realised this afternoon just how easy it is to add this, so I
thought I'd implement it while the idea was fresh.
nmbd forks at startup and uses a pipe to talk to its child. The child
does the DNS lookups and the file descriptor of the child is added to
the main select loop.
While I was doing this I discovered a bug in nmbd that explains why
the dns proxy option has been so expensive. The DNS cache entries in
the WINS list were never being checked, which means we always did a
DNS lookup even if we have done it before and it is in cache. I'm sure
this used to work (I tested the DNS cache when I added it) so someone
broke it :-(
Anyway, the async DNS gets rid of the problem completely. I'll commit
just the fix to the DNS cache bug to the 1.9.17 tree.
You can disable async DNS by adding -DSYNC_DNS to the compile flags.
(This used to be commit 178e27de0791c1ff3268cb456ed5c5efc9ac2a01)
|
|
(This used to be commit a5f52340a49bb2c4f2cdfa7b3c8b45cc5b0e9ec6)
|
|
server.c: int16 -> uint16 fix for port comparisons in oplock code.
Needed for Solaris.
version.h: Updated to alpha3.
Jeremy (jallison@whistle.com)
(This used to be commit 2d9645e99ba30a5cce4372ff80d1bd26c516ac34)
|
|
smb.conf.5: Added 'bind interfaces only' parameter.
version.h: Updated to 1.9.18alpha2.
Jeremy (jallison@whistle.com)
(This used to be commit 7221e19d5ef4a242ce29d3148957c3e481456934)
|
|
includes.h: SCO changes.
server.c: Added code in open_sockets to allow 'bind interfaces only' to
work as documented.
Jeremy (jallison@whistle.com)
(This used to be commit 46ac5928d9069af1dc60e9724f38e228dd578937)
|
|
added "domain admin users" parameter
added "domain guest users" parameter
these two complement the "domain groups" parameter. the "domain groups"
parameter should be for your own groups, and well-known aliases.
util.c :
added ability to do "domain groups = power_users admin_users backup_ops"
which are well-known RID aliases, not well-known RID groups.
pipenetlog.c :
combine the "domain admin users"; "domain guest users" and "domain groups"
parameters to give an array of RID groups to include in the SAM Logon
response.
ipc.c smb.h :
moved REALLOC() into smb.h
added RID #defines.
proto.h:
usual.
(This used to be commit f2554f231d1f59f30224adcc02b2b3ca4c24e0dd)
|
|
actually it's wrong in the linux man page for utime ...
(This used to be commit 267b56de10a20c25faee69cf4b6b6c02887ebe9c)
|
|
(This used to be commit afd7592ffd74fbc77f4b177b007291df95f418ef)
|
|
code. lp_alternate_permissions() is intended only to affect the
display of file permissions, not what you can actually do with the
files.
(This used to be commit 454802d5922bf2b2c6df1f084e183611937ee5fb)
|
|
was a harmless bug but left log entries
code cleanup in reply_lanman2()
(This used to be commit 8e90e1ef276c4cc362e32985c2845fc4c5108273)
|
|
(This used to be commit 2b976cb7ecf50c118bd15923f6500bb8d2e058b7)
|
|
I'm actually hoping to remove this module completely once we convert
nmbd to using the new (much cleaner) clientgen.c
smbclient now also reports if it connects as a guest user
(This used to be commit 3af8d855facfc436cb4b64fa58aca8c056a5348e)
|
|
interface
The new code uses a source netbios name equal to the Samba servers
name, not the client name. It also uses NetWkstaUserLogon to do a full
network logon. This means it will honour the servers logon
restrictions (such as login times etc).
(This used to be commit 11de90f972f6d83974425e80014f54e15d495413)
|
|
to fix the password server code, so I didn't use SMBlib. This code is
fairly generic and uses a "struct cli_state" to hold the client
state.
(This used to be commit 3a0b5f06f42efdb522f1c5d3d9a4b4afabe03b40)
|
|
(This used to be commit ed484d4501e855f467ce2b3cfa63855acfe5e516)
|
|
(This used to be commit b22fa0d7e3d1158112e03f93a22232e719fe6003)
|
|
'dos filetimes' parameter for UTIME fix.
locking_shm.c: Fixed typo (sorry Andrew :-).
namepacket.c: Changed lp_interfaces_only() to lp_bind_interfaces_only().
proto.h: The usual.
reply.c: Made filetime calls use new file_utime call (wrapper for sys_utime).
server.c: Made filetime calls use new file_utime call (wrapper for sys_utime).
system.c: Added Andrew's sanity checks to times in sys_utime().
time.c: Moved set_filetime() to server.c. Made null_mtime() global.
trans2.c: Made filetime calls use new file_utime call (wrapper for sys_utime).
Jeremy (jallison@whistle.com)
(This used to be commit 41a1d81c112a82ad2ae1b3c4ee81051f133ce1ed)
|
|
the user belongs to.
it would be nice to know exactly what the domain groups _are_....
(This used to be commit c6e37d8db0cd89a84a54a0cedfeacf50fb3f7a4c)
|
|
(This used to be commit c59b8cee4721eeeb79f07f48ac17492530d4cdb1)
|
|
added automount_server() function which, if -DAUTOMOUNT is in use,
returns the server name of the NIS auto.map entry. otherwise,
it returns local_server.
added use of automount_server() for a new substitution %N for NIS
home server. this defaults, via automount_server(), to the same
functionality as %L if -DAUTOMOUNT is not used.
removed vuser->home_share. moved code that grabbed the servername
into the separate function automount_server().
loadparm.c :
created "logon drive" (default of "")
created "logon home" (default of "\\%N\%U")
changed default of "logon path" from NULL to "\\%N\%U\profile".
ipc.c pipenetlog.c :
use lp_logon_drive(), lp_logon_home() and lp_logon_path() in their
now easier-to-use form (don't have to check if *lp_logon_path() and
manually substitute a default of \\%L\%U and do a standard_sub_basic()
on the result, because the default automatically does this.
(This used to be commit c6c28a4c3c9010ff9d5eac4bad091189a786d5a0)
|
|
The shares modes code is now split into separate files. The shared
memory implementation is in locking_shm.c. The slow implementation is
in locking_slow.c
It is all controlled by a struct share_ops structure that has function
pointers to the implementation of all the functions needed by a share
modes implementation. An initialisation function sets up this
structure. This will make adding new implementations easy and clean.
This also allowed me to get rid of the ugly code in smbstatus. Now
status.c links to the locking code and calls methods in share_ops.
I also renamed some things and generally organised things in a much
cleaner fashion. Defines and structures specific to each
implementation have been moved to the appropriate file and out of
smb.h.
(This used to be commit 65ab9adaa0d356b8041ed8a507ea52117f2a284e)
|
|
(This used to be commit ab849a97821c9e1f199eea8ea2ec477687bed947)
|
|
upcoming 1.9.18alpha release. We can't release with this code in there
as it currently stands as it might breach ITAR export restrictions in
the US.
I've discussed ways around this with Jeremy and we can put the code
back in with appropriate modifications once it is needed.
Note that this code isn't actually used in Samba yet, so removing it
has no effect.
If anyone wants the code then look in ~samba-bugs/arcfour/ or grab it
from the CVS attic.
(This used to be commit 426cd6b2ded4725186a9262f13a327d8cf94364b)
|
|
(This used to be commit 9dfab27da3634539e99eb48c85dd5a64212e7005)
|
|
they have changed, otherwise we keep reading them again and again
(This used to be commit 38c07fa932488542dbb687f8e0eca192d5f38a8e)
|
|
issues. it works!
(This used to be commit 80523a3e83191c9e0b930fc71bd502a94a6f1b19)
|
|
(This used to be commit 0a191ee5047b2c81c7adb0554c39ec43d8690230)
|
|
added srvparse.o and pipesrvsvc.o
smb.h :
mods to the Net Share Enum stuff
srvparse.c :
Net Share Enum parsing support. more srvsvc pipe parsing to go here...
pipenetlog.c util.c:
modified standard_sub_basic() so that you can set a global boolean
and use a different string for the %U username substitution.
proto.h:
the usual.
(This used to be commit 22b86b6499b2680d16cb4180a736b4e750147409)
|
|
SH_INFO_1
SH_INFO_1_STR
SHARE_INFO_1_CTR
SRV_Q_NET_SHARE_ENUM
SRV_R_NET_SHARE_ENUM
the share info1 container can handle a maximum of 32 shares. the share info1
string structures contain two unicode strings, with 1024 uint16 characters
_each_. we're going to _have_ to dynamically allocate the unicode strings,
else we'll run out of stack space. rapidly.
(This used to be commit e8bedb18bf249d2f06834b0f151ea22df86e2602)
|
|
moved stub srvsvc pipe function into separate file, in preparation for
further work.
(This used to be commit 2f2d18cc9474e1b40765a67242659be7c63a9936)
|
|
whatever that means.
(This used to be commit ce54f3a7a965b0a9f888dc45d6f4633609d5ca08)
|
|
turns off the filtering on the broadcast socket by default.
Jeremy (jallison@whistle.com)
(This used to be commit db9aad07481f48c0fe2108d4ab0b2bc9b632816c)
|
|
interface.c: Added is_local_net().
locking.c: Added Fix for zero length share files from Gerald Werner <wernerg@mfldclin.edu>
plus a race condition fix for the fix.
nameannounce.c: Made function static.
namedbresp.c: extern int ClientDGRAM removed - not used.
namedbserver.c: extern int ClientDGRAM removed - not used.
namedbsubnet.c: Added code to make sockets per subnet.
namepacket.c: Added code to read from all sockets & filter.
nameresp.c: extern int ClientDGRAM removed - not used.
nameserv.c: Indentation tidyup :-).
nameserv.h: Added sockets to struct subnet.
nameservresp.c: Improved debug message.
nmbd.c: Changed to terminte on listen_for_packets exiting.
nmbsync.c: extern int ClientDGRAM & ClientNMB removed - not used.
proto.h: The usual.
util.c: Fixed debug message.
Jeremy (jallison@whistle.com)
(This used to be commit 6904c2de080b2a9702800e9e4126386ced20569d)
|
|
includes.h. More consistent with current practice.
(This used to be commit cb51c860b352fb9d07fb3298d0317274ba6c9925)
|
|
(This used to be commit 4c99a083b9555b1ccf16faf0d4c1fba8f52bbb6a)
|
|
SAM logon sorting. too many buffer pointers. added in the missing
switch value (value of 3). dealing with the buffer pointers to the
user info structure in a slightly different way.
(This used to be commit 7993e17c9a1edddae6407d3f12790c461def705a)
|
|
uni_max_len and uni_str_len are the other way round, in UNIHDR.
util.c :
increased the show_msg() data size from 256 bytes to 512 bytes:
the LSA SAM Logon response can be about 500 bytes long.
pipenetlog.c :
forgot to set the authoritative field to 1.
(This used to be commit 71c6678cd7ffe30a5da27766cf99147e1921feae)
|
|
nt got confused and thought that the server password had been set instead
of refused. this is for the SRV_PWSET response.
(This used to be commit f9fbcad42ec20da56466054e1984e391d03b3204)
|
|
WINS server did not respond to name registration!
this messages should only be produced when we are trying to register
our own names, not when we are the one with the name database and we
are doing a NAME_REGISTER_CHALLENGE on behalf of another host (for
secured wins registration)
(This used to be commit 42cb21d7259acfca124e5310894fb4fb8df4ad0c)
|
|
packets with no answer section in general.
The fix has 2 parts:
1) set ans_name to the name we queried if nmb->answers == NULL
2) check for nmb->answers == NULL in several other places where we
currently check for nmb->answers->data
While doing this, I noticed there are lots of places in our nmbd code
where we make assumptions about the packets being well formed. Someone
could easily implement a denial of service attack on nmbd by sending a
packet that causes a null pointer dereference. Does anyone feel like
going through the code and adding checks? Probably the best solution
is to have a single function that "validates" a packet, making sure
that all the required fields are there. This will be a bit tricky as
what fields are required varies a lot between packets. A first pass
would be a function that prints "SUSPECT PACKET" when it hits a packet
that it suspects does not have a required field (or the field is badly
formatted), then we could use this on a live system to find any cases
we've missed.
Any takers?
(This used to be commit e02c21b0b8e3ed6f2d294458160c4f632af67ed3)
|
|
(This used to be commit 4b7d51ffb8cf23662e0e58a785620a0652da5a7c)
|
|
id_info_1 has a pointer at the front of it. so does return credentials,
and so does the client credentials. these are all from the sam logon.
auth_level is 16 bytes not 32 and is actually called a switch_level.
smbparse.c :
smb_io_unihdr() - uni_max_len and uni_str_len are 16 bytes not 32.
this may have a knock-on effect on smb_in_unihdr2() but we'll see...
(This used to be commit ce36bfb3e4ad4b72a9f9759a3c49d2a73175d249)
|
|
deal_with_credentials() by moving important code to the beginning
of the function :-) :-) :-).
the new seed (old_cred + time + 1) was getting corrupted.
(This used to be commit dab35ce5d61d53bce6ede44e56d9393645c0d67e)
|