summaryrefslogtreecommitdiff
path: root/source4/auth/gensec/spnego.c
AgeCommit message (Collapse)AuthorFilesLines
2011-03-19source4/auth/gensec: Fix prototypes for all functions.Jelmer Vernooij1-0/+2
2010-12-21s4:auth/gensec/spnego.c - remove unused variable "principal"Matthias Dieter Wallnöfer1-1/+0
2010-12-14s4:gensec/spnego: only look at the optimistic token if we support the first mechStefan Metzmacher1-4/+20
As a server only try the mechs the client proposed and only call gensec_update() with the optimistic token for the first mech in the list. If the server doesn't support the first mech we pick the first one in the clients list we also support. That's how w2k8r2 works. metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Dec 14 16:50:50 CET 2010 on sn-devel-104
2010-12-09s4-spnego Match Windows 2008, and no longer supply a name in the CIFS NegprotAndrew Bartlett1-10/+1
Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Thu Dec 9 08:50:28 CET 2010 on sn-devel-104
2010-12-08s4-spnego use "not_defined_in_RFC4178@please_ignore" if no principal specifiedAndrew Bartlett1-0/+2
We need to make this the default, but for now just send it if we have not been given a target principal. Andrew Bartlett
2010-12-08libcli/auth bring ADS_IGNORE_PRINCIPAL in commonAndrew Bartlett1-1/+2
2010-11-08s4-auth Supply more useful error messages on Kerberos failureAndrew Bartlett1-0/+2
The practice of returning only NT_STATUS_INVALID_PARAMETER hasn't helped our users to debug problems effectivly, and so we now return more errors and try and give a more useful debug message when then happen. Andrew Bartlett
2010-09-14s4: Fix two typosVolker Lendecke1-2/+2
2010-07-16s4-loadparm: 2nd half of lp_ to lpcfg_ conversionAndrew Tridgell1-1/+1
this converts all callers that use the Samba4 loadparm lp_ calling convention to use the lpcfg_ prefix. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-05-14s4:gensec expose gensec_set_target_principal for use outside GENSECAndrew Bartlett1-1/+4
This allows for the rare case where the caller knows the target principal. The check for lp_client_use_spnego_principal() is moved to the spengo code to make this work. Andrew Bartlett
2009-09-26gensec: Avoid exposing lp_ctx on the API level.Jelmer Vernooij1-1/+1
2009-09-17spnego: Support ASN.1 BIT STRING and use it in SPNEGO.Kouhei Sutou1-2/+4
Signed-off-by: Günther Deschner <gd@samba.org>
2009-09-17spnego: share spnego_parse.Günther Deschner1-1/+1
Guenther
2009-07-28s4:gensec/spnego: only generate the mechListMic when the server expects itStefan Metzmacher1-1/+2
This fixes the ntvfs.cifs tests. metze
2009-07-24s4:gensec/spengo: make sure we send the blob with the micListMech signature ↵Stefan Metzmacher1-1/+1
to the peer We should even do this if the submech has no more data to send. metze
2008-11-02Fix the build.Jelmer Vernooij1-3/+4
2008-11-02Remove use of global_loadparm for disabled gensec backends.Jelmer Vernooij1-0/+4
2008-10-06s4:gensec: pass down want_features to the spnego backend mechStefan Metzmacher1-0/+15
metze
2008-08-12gensec: add support for new style spnego and correctly handle mechListMICStefan Metzmacher1-7/+102
metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-04-02Install public header files again and include required prototypes.Jelmer Vernooij1-0/+1
(This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-02-20Make more module init functions public, since they are compiled with ↵Jelmer Vernooij1-1/+1
-fvisibility=hidden. Not doing this causes failures on Mac OS X. (This used to be commit da1a9438bd89569077ef1eaa9dc977b5f9d62836)
2007-12-21r26385: Integrate gensec-socket into gensec.Jelmer Vernooij1-1/+0
(This used to be commit 78bb444b4b73df9a84f8702814f9b30b32ffd885)
2007-12-21r26260: Store loadparm context in gensec context.Jelmer Vernooij1-1/+1
(This used to be commit b9e3a4862e267be39d603fed8207a237c3d72081)
2007-12-21r26258: Use loadparm context in client_start function of gensec.Jelmer Vernooij1-2/+2
(This used to be commit bad1891cae2c688b17a6a2b932e754f51291035c)
2007-12-21r26231: Spell check: credentails -> credentials.Jelmer Vernooij1-1/+1
(This used to be commit 4b46888bd0195ab12190f76868719fc018baafd6)
2007-10-10r25552: Convert to standard bool type.Jelmer Vernooij1-12/+12
(This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-10r25000: Fix some more C++ compatibility warnings.Jelmer Vernooij1-16/+16
(This used to be commit 08bb1ef643ab906f1645cf6f32763dc73b1884e4)
2007-10-10r23792: convert Samba4 to GPLv3Andrew Tridgell1-3/+2
There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-10-10r23030: finally fixed up our asn1 code to use better memory allocation. ThisAndrew Tridgell1-4/+4
should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-10-10r22966: Make sure to return LOGON_FAILURE if the user's kerberos password isAndrew Bartlett1-1/+1
incorrect. Andrew Bartlett (This used to be commit 9dc6f36e43170bc5bf4f94d893b5a3689460d237)
2007-10-10r22293: Try to make it more clear what failed to parse.Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit 144ab7294d76397a5e6662d344105a0d59c9f423)
2007-10-10r20107: don't segfault when the server didn't send a supportedMech in a ↵Stefan Metzmacher1-0/+1
negTokenTarg this happens because we send 1.2.840.113554.1.2.2 before 1.2.840.48018.1.2.2 in the negTokenInit. And w2k's spnego code redirects us to use 1.2.840.48018.1.2.2 and then we start the our spnego engine with 1.2.840.48018.1.2.2 and in the then following negTokenTarg w2k don't send the supportedMech (which means it aggrees in what we've choosen) metze (This used to be commit 5af5488593991ab4a2a8e17d38501ad9ec539020)
2007-10-10r19598: Ahead of a merge to current lorikeet-heimdal:Andrew Bartlett1-3/+3
Break up auth/auth.h not to include the world. Add credentials_krb5.h with the kerberos dependent prototypes. Andrew Bartlett (This used to be commit 2b569c42e0fbb596ea82484d0e1cb22e193037b9)
2007-10-10r18257: Order the GENSEC modules, with unknown modules last.Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit 8ae880b5019ab275fe0eca48120ab9e0fcca6293)
2007-10-10r18250: Add an ordering of GENSEC modules, so we do preferred modules first.Andrew Bartlett1-0/+1
Andrew Bartlett (This used to be commit 0afb4d1992b3c93557dec1e1cdca467efc299853)
2007-10-10r18068: This splits the handling of multiple SASL packets between the GENSECAndrew Bartlett1-0/+58
backend (if it chooses to implement it), or the GENSEC socket code. This is to allow us to handle DIGEST-MD5 across to cyrus-sasl. Andrew Bartlett (This used to be commit 0a098006b431f4aa48632a27ca08e9adca8d9609)
2007-10-10r17197: This patch moves the encryption of bulk data on SASL negotiated securityAndrew Bartlett1-18/+44
contexts from the application layer into the socket layer. This improves a number of correctness aspects, as we now allow LDAP packets to cross multiple SASL packets. It should also make it much easier to write async LDAP tests from windows clients, as they use SASL by default. It is also vital to allowing OpenLDAP clients to use GSSAPI against Samba4, as it negotiates a rather small SASL buffer size. This patch mirrors the earlier work done to move TLS into the socket layer. Unusual in this pstch is the extra read callback argument I take. As SASL is a layer on top of a socket, it is entirely possible for the SASL layer to drain a socket dry, but for the caller not to have read all the decrypted data. This would leave the system without an event to restart the read (as the socket is dry). As such, I re-invoke the read handler from a timed callback, which should trigger on the next running of the event loop. I believe that the TLS code does require a similar callback. In trying to understand why this is required, imagine a SASL-encrypted LDAP packet in the following formation: +-----------------+---------------------+ | SASL Packet #1 | SASL Packet #2 | ----------------------------------------+ | LDAP Packet #1 | LDAP Packet #2 | ----------------------------------------+ In the old code, this was illegal, but it is perfectly standard SASL-encrypted LDAP. Without the callback, we would read and process the first LDAP packet, and the SASL code would have read the second SASL packet (to decrypt enough data for the LDAP packet), and no data would remain on the socket. Without data on the socket, read events stop. That is why I add timed events, until the SASL buffer is drained. Another approach would be to add a hack to the event system, to have it pretend there remained data to read off the network (but that is ugly). In improving the code, to handle more real-world cases, I've been able to remove almost all the special-cases in the testnonblock code. The only special case is that we must use a deterministic partial packet when calling send, rather than a random length. (1 + n/2). This is needed because of the way the SASL and TLS code works, and the 'resend on failure' requirements. Andrew Bartlett (This used to be commit 5d7c9c12cb2b39673172a357092b80cd814850b0)
2007-10-10r14542: Remove librpc, libndr and libnbt from includes.hJelmer Vernooij1-0/+1
(This used to be commit 51b4270513752d2eafbe77f9de598de16ef84a1f)
2007-10-10r13903: Don't generate prototypes for modules and binaries in include/proto.h byJelmer Vernooij1-0/+1
default. (This used to be commit c80a8f1102caf744b66c13bebde38fba74983dc4)
2007-10-10r13584: Another try at SPNEGO stuff. I need to write a better testsuite for ↵Andrew Bartlett1-0/+23
this. This tries to ensure that when we are a client, we cope with mechs (like GSSAPI) that only abort (unknown server) at first runtime. Andrew Bartlett (This used to be commit cb5d18c6190fa1809478aeb60e352cb93c4214f6)
2007-10-10r13206: This patch finally re-adds a -k option that works reasonably.Andrew Bartlett1-4/+5
From here we can add tests to Samba for kerberos, forcing it on and off. In the process, I also remove the dependency of credentials on GENSEC. This also picks up on the idea of bringing 'set_boolean' into general code from jpeach's cifsdd patch. Andrew Bartlett (This used to be commit 1ac7976ea6e3ad6184c911de5df624c44e7c5228)
2007-10-10r12439: No need to keep walking this list if we find the match.Andrew Bartlett1-0/+1
Andrew Bartlett (This used to be commit cf1883c3cc1feecf3ddd7f36dbbca3bdf068bee2)
2007-10-10r12436: Fix Samba4 as a server to Win2000 for the domain join.Andrew Bartlett1-46/+74
We still have Win2000 issues, but now we correctly handle the case where NTLMSSP is chosen as an authentication mech, but the OID list still contains Kerberos as a later option. Andrew Bartlett (This used to be commit dc2b2c33f89b84bd221c9009750a22ff42fc462d)
2007-10-10r12060: Work towards allowing the credentials system to allow/deny certainAndrew Bartlett1-6/+9
GENSEC mechansims. This will allow a machine join to an NT4 domain to avoid even trying kerberos, or a sensitive operation to require it. Andrew Bartlett (This used to be commit 11c7a89e523f85afd728d5e5f03bb084dc620244)
2007-10-10r11226: Cope with Samba3's behaviour on LDAP with GSS-SPNEGO.Andrew Bartlett1-2/+3
Andrew Bartlett (This used to be commit 4d9667f5a037eb15f6f0e4329314a37f148e9db7)
2007-10-10r11219: Now that we have the credentials hooked in here, we have a much moreAndrew Bartlett1-1/+10
reasonable value to fill in for the mechListMIC. Andrew Bartlett (This used to be commit 51d78de2b79f4ab75c86c3255c23a478c6822a0e)
2007-10-10r11196: Clean up memory leaks (pointed out by vl), and handle the case whereAndrew Bartlett1-11/+47
the client doesn't guess correctly on the mech to use. It must back off and try the mech the server selected from the list. I'm not particularly attached to our SPNEGO parser, so while I can't easily use the SPNEGO application logic in Heimdal, I'm going to look closely at using the asn1 routines to avoid some pain here. Andrew Bartlett (This used to be commit 929217387449270b60c3f825dca3b3cae5a4f9d1)
2007-10-10r10291: The patch optionally (off by default, not available in all cases) allowsAndrew Bartlett1-1/+2
Samba to use the target principal name supplied in the mechTokenMIC of an SPNEGO negTokenInit. This isn't a great idea for security reasons, but is how Samba3 behaves, and allows kerberos to function more often in some environments. It is only available for CIFS session setups, due to the ordering of the exchange. Andrew Bartlett (This used to be commit f6a645644127ae695a9f7288e0a469f2eb7f3066)
2007-10-10r10153: This patch adds a new parameter to gensec_sig_size(), the size of theAndrew Bartlett1-2/+2
data to be signed/sealed. We can use this to split the data from the signature portion of the resultant wrapped packet. This required merging the gsskrb5_wrap_size patch from lorikeet-heimdal, and fixes AES encrption issues on DCE/RPC (we no longer use a static 45 byte value). This fixes one of the krb5 issues in my list. Andrew Bartlett (This used to be commit e4f2afc34362953f56a026b66ae1aea81e9db104)
2007-10-10r9927: Extend copyright for all the hard work I've done this year.Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit b50e546eb4d5d9171d4ae5e9c9bebd8c7c878bd8)
generated by cgit (git 2.34.1) at 2024-11-08 20:07:52 +0000