Age | Commit message (Collapse) | Author | Files | Lines |
|
(This used to be commit 8143de855c0b65346b2d8e59ecdb78952927de4a)
|
|
recover from inheriting an invalid skew from a ccache.
Andrew Bartlett
(This used to be commit 4881f0583dd42083bb2bc2eeca32316f890c4804)
|
|
(This used to be commit 160a59f0733a90db157ad48747c7fb72c2912829)
|
|
Andrew Bartlett
(This used to be commit 3a3c1040a97e1d7d64e9e151ea4e1af79dcb976e)
|
|
libraries
works again now, by specifying --enable-dso to configure.
(This used to be commit 7a01235067a4800b07b8919a6a475954bfb0b04c)
|
|
argument.
This is a pointer to an element pointer. If it is not null it will be
filled with the pointer of the manipulated element.
Will avoid double searches on the elements list in some cases.
(This used to be commit 0fa5d4bc225b83e9f63ac6d75bffc4c08eb6b620)
|
|
length, use the amount the wapped message expanded by.
This works, because GSSAPI doesn't do AEAD (signing of headers), and
so changing the signature length after the fact is valid.
Andrew Bartlett
(This used to be commit bd1e0f679c8f2b9755051b8d34114fa127a7cf26)
|
|
output in the testsuite rather than just True or False for a
set of tests.
The aim is to use this for:
* known failure lists (run all tests and detect tests that
started working or started failing). This
would allow us to get rid of the RPC-SAMBA3-* tests
* nicer torture output
* simplification of the testsuite system
* compatibility with other unit testing systems
* easier usage of smbtorture (being able to run one test
and automatically set up the environment for that)
This is still a work-in-progress; expect more updates over the next couple of
days.
(This used to be commit 0eb6097305776325c75081356309115f445a7218)
|
|
(This used to be commit 6fad80bb09113a60689061a2de67711c9924708b)
|
|
Andrew Bartlett
(This used to be commit c9c2e90e2e3937d05c58c681af187413b12d9220)
|
|
Andrew Bartlett
(This used to be commit 8357f8be45ef93bd1b648350c951bbe3b1bb5682)
|
|
(This used to be commit 449fab2c264aa50601f9a2d3310f1910ba97706b)
|
|
emacs compile mode (hint, paste to a file, and compile as "cat
filename").
This allowed me to fix nearly all the warnings for a IA_64 SuSE build
very quickly.
(This used to be commit eba6c84efff735bb0ca941ac4b755ce2b0591667)
|
|
this fixes a crash on IA_64 systems
(This used to be commit 22c39027621fb65663122b4959b171d328b549d4)
|
|
(This used to be commit a47d65fe17a0e84615ff235380eb2462579199f0)
|
|
Andrew Bartlett
(This used to be commit 8ae880b5019ab275fe0eca48120ab9e0fcca6293)
|
|
Andrew Bartlett
(This used to be commit 73fba185eba6b059d34790c95a30d49b296759f5)
|
|
Andrew Bartlett
(This used to be commit 2da948cb6ecc75e2b4b97c770c8ba13b7f831d6e)
|
|
Andrew Bartlett
(This used to be commit 0afb4d1992b3c93557dec1e1cdca467efc299853)
|
|
starts.
Andrew Bartlett
(This used to be commit 7dba525f5598199e89badbf15e0f5f09023c6cfa)
|
|
Andrew Bartlett
(This used to be commit 32d8a23d5499ef3d913240b5693b54eb2e78cd7d)
|
|
always at it as first private dependencies
metze
(This used to be commit 135d096776b53ae09ffc2b4f767dfbd18139570f)
|
|
These values are used by SASL at a later time, and must remain valid.
Make the password callback actually return the password.
Andrew Bartlett
(This used to be commit 8e12f92bbe3aa878292169f4699502e241ef6c0b)
|
|
metze
(This used to be commit 675541f24e4681161fcc85422c14f9ecbf30e048)
|
|
DIGEST-MD5 implemenation in particular.
However, I can't make this work: Cyrus-SASL isn't loading the mech...
Andrew Bartlett
(This used to be commit 0b193d28c896c9d212a536da7d87634543d971a5)
|
|
happier now
(This used to be commit 18542f184f75074e56a9793a9e3b6c6d747bb9e6)
|
|
backend (if it chooses to implement it), or the GENSEC socket code.
This is to allow us to handle DIGEST-MD5 across to cyrus-sasl.
Andrew Bartlett
(This used to be commit 0a098006b431f4aa48632a27ca08e9adca8d9609)
|
|
* Move dlinklist.h, smb.h to subsystem-specific directories
* Clean up ads.h and move what is left of it to dsdb/
(only place where it's used)
(This used to be commit f7afa1cb77f3cfa7020b57de12e6003db7cfcc42)
|
|
network. This helps where we are trying to talk to an LDAP server,
until we share a common SASL authentication scheme.
Andrew Bartlett
(This used to be commit f9d39dba41441cd5d06964ce0aebef9bcba40759)
|
|
(This used to be commit 09007b0907662a0d147e8eb21d5bdfc90dbffefc)
|
|
needed in searches
(This used to be commit a5ea749f0ac63bf495a55ee8d9d002208ab93572)
|
|
metze
(This used to be commit 2f4aa95f8d414262eb4d78060ee3a97a85ec5182)
|
|
to do
(This used to be commit ad75cf869550af66119d0293503024d41d834e02)
|
|
- also user_info->mapped is maybe uninitialized
in auth_password_check() as it we do the mapping in
auth_password_check_send()
that to Kai Blin <kai.blin@gmail.com> and valgrind to find
this bug
metze
(This used to be commit d88aabef64316cebca46037b67dd2df7cfd4d482)
|
|
and add a private_data for the backends.
metze
(This used to be commit 015a65e00187e684b3e4d1f4ca07edb9f022f61b)
|
|
(currently this uses the sync IRPC_CALL(), but when
auth_check_password will be async for the backend this will
change to IRPC_CALL_SEND()
the old module which uses the samba3 protocol against winbind
is still available as 'winbind_samba3'
metze
(This used to be commit 26efc732ab668bcb55fd0796818aabe45add2b25)
|
|
and gensec_server_start().
calling them with NULL for event context or messaging context
is no longer allowed!
metze
(This used to be commit 679ac74e71b111344f1097ab389c0b83a9247710)
|
|
(This used to be commit a2d614147663c4f9b80d6e383819e92ca45e013b)
|
|
metze
(This used to be commit c865aea260dd22b8b5d63e60fd917a52ed719993)
|
|
own function.
metze
(This used to be commit ee81ad57938a9f54533a0028b87fd84bde90db8d)
|
|
auth interface and implement the sync version as wrapper
to auth_check_password_send/recv()
as next all callers need to be converted to the async interface
and then the modules
metze
(This used to be commit ed40bb3c16279f9727be67e889270da5efb8ddb9)
|
|
metze
(This used to be commit c49e27d5d0289e3525f7f6197b031e7d300df81b)
|
|
request from the password checking. This will help to make
the password checking hook async later
metze
(This used to be commit 5b26cbc3428b4c186235cc08c9ace1c23f59dd7f)
|
|
- note this is still uses the sync update() hook of the gensec modules
but it allows me to fix the callers first
Later auth_check_password() will also get an async version,
so that we can later implement an async version of auth_winbind
using async IRPC to the winbind task.
metze
(This used to be commit d5638a4fafd1d60ccc4cd76e92a1b2b0093865a7)
|
|
without the agreement of the peer. This can cause problems, because
one side things sealing is disabled, while the other thinks it is
enabled.
Andrew Bartlett
(This used to be commit 68ddc4921f43252b3fba73e9d85cc38c359d599d)
|
|
routines to return an NTSTATUS. This should help track down errors.
Use a bit of talloc_steal and talloc_unlink to get the real socket to
be a child of the GENSEC or TLS socket.
Always return a new socket, even for the 'pass-though' case.
Andrew Bartlett
(This used to be commit 003e2ab93c87267ba28cd67bd85975bad62a8ea2)
|
|
contexts from the application layer into the socket layer.
This improves a number of correctness aspects, as we now allow LDAP
packets to cross multiple SASL packets. It should also make it much
easier to write async LDAP tests from windows clients, as they use SASL
by default. It is also vital to allowing OpenLDAP clients to use GSSAPI
against Samba4, as it negotiates a rather small SASL buffer size.
This patch mirrors the earlier work done to move TLS into the socket
layer.
Unusual in this pstch is the extra read callback argument I take. As
SASL is a layer on top of a socket, it is entirely possible for the
SASL layer to drain a socket dry, but for the caller not to have read
all the decrypted data. This would leave the system without an event
to restart the read (as the socket is dry).
As such, I re-invoke the read handler from a timed callback, which
should trigger on the next running of the event loop. I believe that
the TLS code does require a similar callback.
In trying to understand why this is required, imagine a SASL-encrypted
LDAP packet in the following formation:
+-----------------+---------------------+
| SASL Packet #1 | SASL Packet #2 |
----------------------------------------+
| LDAP Packet #1 | LDAP Packet #2 |
----------------------------------------+
In the old code, this was illegal, but it is perfectly standard
SASL-encrypted LDAP. Without the callback, we would read and process
the first LDAP packet, and the SASL code would have read the second SASL
packet (to decrypt enough data for the LDAP packet), and no data would
remain on the socket.
Without data on the socket, read events stop. That is why I add timed
events, until the SASL buffer is drained.
Another approach would be to add a hack to the event system, to have it
pretend there remained data to read off the network (but that is ugly).
In improving the code, to handle more real-world cases, I've been able
to remove almost all the special-cases in the testnonblock code. The
only special case is that we must use a deterministic partial packet
when calling send, rather than a random length. (1 + n/2). This is
needed because of the way the SASL and TLS code works, and the 'resend
on failure' requirements.
Andrew Bartlett
(This used to be commit 5d7c9c12cb2b39673172a357092b80cd814850b0)
|
|
to work (it broke it in the previous commit).
Andrew Bartlett
(This used to be commit e96638bc74f0752ce8af6626a04c92d48b917ffe)
|
|
and the maximum amount of user data that may be fitted into that.
This is used in the new SASL code, to correctly honour SASL buffer sizes.
Andrew Bartlett
(This used to be commit cbbe99d9c1f0262e67a495fb098cacc09fd78e05)
|
|
chasing down bad signatures that may be due to data truncation.
Andrew Bartlett
(This used to be commit d304760d3d909e55cbf2c744cdb2b4137f74b81b)
|