Age | Commit message (Collapse) | Author | Files | Lines |
|
|
|
This is the server side state for netlogon credential chaining
Andrew Bartlett
|
|
This means it must be accessed via the supplied auth_context in the
GENSEC server, and should remove the hard depenceny of GENSEC on the
auth subsystem and ldb (allowing LDB not to rely on LDB is considered
a good thing, apparently)
Andrew Bartlett
|
|
|
|
warnings.
|
|
This commit broke the build, because not all files (libreplace, popt)
were updated.
Andrew Bartlett
(This used to be commit 3faacf4351d68a10aea78b53768571d2059772ae)
|
|
(This used to be commit e2b71a0ecbf10a78a59a8ec6371bdee57b1bfa6c)
|
|
(This used to be commit a6b52119940a900fb0de3864b8bca94e2965cc24)
|
|
middle.
(This used to be commit f4a77b96f9c17d853348b70794026e5b9e384942)
|
|
(This used to be commit 4876c4efbbafb4e0afa3554cd9f748ab591a2927)
|
|
(This used to be commit 2860a7db5968c7007522cdb300eba390da929ab8)
|
|
This is so that gensec_krb5 does not depend on the NTLM authentication
code.
Andrew Bartlett
(This used to be commit 71ec5bfb3e973bd68649a598d006efcdda18f1b6)
|
|
directly instead.
(This used to be commit 9d0ae012b0b463278cd054d06788aa998acc2da2)
|
|
(This used to be commit 8573e828d1b68c47b3c1754e9be230b2e78d9d52)
|
|
(This used to be commit 92856d5054106894b65cd1a1b5119c0facfc4cff)
|
|
(This used to be commit 5628d58990144463fd87f8c847c9384ac2193681)
|
|
(This used to be commit 2243e24024f09ff9c9c7d0eb735c3b39c9d84424)
|
|
Never install generated prototype files. It's easier to break the
API when using them and they're not easily readable for 3rd party users.
Conflicts:
source/auth/config.mk
source/auth/credentials/config.mk
source/auth/gensec/config.mk
source/build/smb_build/config_mk.pm
source/build/smb_build/main.pl
source/build/smb_build/makefile.pm
source/dsdb/config.mk
source/lib/charset/config.mk
source/lib/tdr/config.mk
source/lib/util/config.mk
source/libcli/config.mk
source/libcli/ldap/config.mk
source/librpc/config.mk
source/param/config.mk
source/rpc_server/config.mk
source/torture/config.mk
(This used to be commit 6c659689ed4081f1d7a6253c538c7f01784197ba)
|
|
(This used to be commit 269cbf84d8b7dbf3bc88adc04ae283dc908af5ac)
|
|
(This used to be commit 91d7ba5202e6c375456a42c2c6861f63c7fcfc20)
|
|
(This used to be commit 96a5ac9db2399019518e134a00c564ec1066f536)
|
|
(This used to be commit 85eeecf997a071ca7e7ad0247e8d34d49b7ffcbb)
|
|
(This used to be commit 78bb444b4b73df9a84f8702814f9b30b32ffd885)
|
|
(This used to be commit b45093f01fc71714e14422a80a81cf1cc25df3e2)
|
|
(This used to be commit abf2600a044cdbab6c5d7880d18217bff3d15c39)
|
|
metze
(This used to be commit e0e35965d1eaab182941d17da744b70c4234ca52)
|
|
we need to make sure -Iheimdal/lib/gssapi comes before -I/usr/local/include
metze
(This used to be commit a6ba465fa8b0a4a0835593526d3f2670736c2c8e)
|
|
(This used to be commit 8768bec81f57131a0c9754e8121b345c0be4a5d0)
|
|
Break up auth/auth.h not to include the world.
Add credentials_krb5.h with the kerberos dependent prototypes.
Andrew Bartlett
(This used to be commit 2b569c42e0fbb596ea82484d0e1cb22e193037b9)
|
|
libraries
works again now, by specifying --enable-dso to configure.
(This used to be commit 7a01235067a4800b07b8919a6a475954bfb0b04c)
|
|
DIGEST-MD5 implemenation in particular.
However, I can't make this work: Cyrus-SASL isn't loading the mech...
Andrew Bartlett
(This used to be commit 0b193d28c896c9d212a536da7d87634543d971a5)
|
|
contexts from the application layer into the socket layer.
This improves a number of correctness aspects, as we now allow LDAP
packets to cross multiple SASL packets. It should also make it much
easier to write async LDAP tests from windows clients, as they use SASL
by default. It is also vital to allowing OpenLDAP clients to use GSSAPI
against Samba4, as it negotiates a rather small SASL buffer size.
This patch mirrors the earlier work done to move TLS into the socket
layer.
Unusual in this pstch is the extra read callback argument I take. As
SASL is a layer on top of a socket, it is entirely possible for the
SASL layer to drain a socket dry, but for the caller not to have read
all the decrypted data. This would leave the system without an event
to restart the read (as the socket is dry).
As such, I re-invoke the read handler from a timed callback, which
should trigger on the next running of the event loop. I believe that
the TLS code does require a similar callback.
In trying to understand why this is required, imagine a SASL-encrypted
LDAP packet in the following formation:
+-----------------+---------------------+
| SASL Packet #1 | SASL Packet #2 |
----------------------------------------+
| LDAP Packet #1 | LDAP Packet #2 |
----------------------------------------+
In the old code, this was illegal, but it is perfectly standard
SASL-encrypted LDAP. Without the callback, we would read and process
the first LDAP packet, and the SASL code would have read the second SASL
packet (to decrypt enough data for the LDAP packet), and no data would
remain on the socket.
Without data on the socket, read events stop. That is why I add timed
events, until the SASL buffer is drained.
Another approach would be to add a hack to the event system, to have it
pretend there remained data to read off the network (but that is ugly).
In improving the code, to handle more real-world cases, I've been able
to remove almost all the special-cases in the testnonblock code. The
only special case is that we must use a deterministic partial packet
when calling send, rather than a random length. (1 + n/2). This is
needed because of the way the SASL and TLS code works, and the 'resend
on failure' requirements.
Andrew Bartlett
(This used to be commit 5d7c9c12cb2b39673172a357092b80cd814850b0)
|
|
(This used to be commit f2ca71f1229f4c20296895116c09bacbd6a53b55)
|
|
(This used to be commit 3ef9326386ba1c210166302cbcf02d2ed3f19944)
|
|
Recursive dependencies are now forbidden (the build system
will bail out if there are any).
I've split up auth_sam.c into auth_sam.c and sam.c. Andrew,
please rename sam.c / move its contents to whatever/wherever you think suits
best.
(This used to be commit 6646384aaf3e7fa2aa798c3e564b94b0617ec4d0)
|
|
for REQUIRED_SUBSYSTEMS.
(This used to be commit adc8a019b6da256f104abed1b82bfde6998a2ac9)
|
|
subsystems in case a library doesn't make sense.
(This used to be commit ed382873fd01457a53e0a1e1f5ba6753dfbc0646)
|
|
(This used to be commit c74fc55831ca24819ae7f5e0920d0351e2b46a08)
|
|
(This used to be commit 4682bc5ce047d81586447b9df82c91ed1fe677cf)
|
|
(This used to be commit 430c6516d383bfd7f27287394bf8eef9f174b3e6)
|
|
- VERSION: should contain the current version. Will be made part of the filename.
- SO_VERSION: should contain the latest version that this on is compatible to. Will be used for setting the soname of the shared library.
Fix sonames and use them on platforms that support them
Remove symlinking code. ldconfig will take care of creating the symlinks now
that we set the soname.
(This used to be commit 7871b07e21c85c63d0ecac4c31b98dc112d18af5)
|
|
metze
(This used to be commit 91a3a0b795ebe73d29b69bb40ae9e67b40f90212)
|
|
(This used to be commit 2c746980328431ab04852dc668899e3eb042da99)
|
|
(This used to be commit 2d655f05285a86bb1bbb882e4dd843def15c9dfa)
|
|
default.
(This used to be commit c80a8f1102caf744b66c13bebde38fba74983dc4)
|
|
Re-introduce and use the OUTPUT_TYPE property for MODULEs to force
specific modules to always be included
(This used to be commit f9eede3d40098eddc3618ee48f9253cdddb94a6f)
|
|
(This used to be commit 7ff1ecdc6fa9e360dedf9737da6ce1941ad5033e)
|
|
(This used to be commit ca8db1a0cd77682ac2c6dc4718f5d753a4fcc4db)
|
|
(This used to be commit 0aca5fd5130d980d07398f3291d294202aefe3c2)
|
|
the difference between these at all, and in the future the
fact that INIT_OBJ_FILES include smb_build.h will be sufficient to
have recompiles at the right time.
(This used to be commit b24f2583edee38abafa58578d8b5c4b43e517def)
|