summaryrefslogtreecommitdiff
path: root/source4/auth
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r2051: switched the samdb over to using the new destructor and referenceAndrew Tridgell1-13/+1
count features of talloc, instead of re-implementing both those features inside of samdb (which is what we did before). This makes samdb considerably simpler, and also fixes some bugs, as I found some error paths that didn't call samdb_close(). Those are now handled by the fact that a talloc_free() will auto-close and destroy the samdb context, using a destructor. (This used to be commit da60987a92266734c33b81ee217081abdc4330f3)
2007-10-10r1983: a completely new implementation of tallocAndrew Tridgell1-1/+1
This version does the following: 1) talloc_free(), talloc_realloc() and talloc_steal() lose their (redundent) first arguments 2) you can use _any_ talloc pointer as a talloc context to allocate more memory. This allows you to create complex data structures where the top level structure is the logical parent of the next level down, and those are the parents of the level below that. Then destroy either the lot with a single talloc_free() or destroy any sub-part with a talloc_free() of that part 3) you can name any pointer. Use talloc_named() which is just like talloc() but takes the printf style name argument as well as the parent context and the size. The whole thing ends up being a very simple piece of code, although some of the pointer walking gets hairy. So far, I'm just using the new talloc() like the old one. The next step is to actually take advantage of the new interface properly. Expect some new commits soon that simplify some common coding styles in samba4 by using the new talloc(). (This used to be commit e35bb094c52e550b3105dd1638d8d90de71d854f)
2007-10-10r1982: i is not initialised or usedAndrew Tridgell1-2/+1
(This used to be commit db4bc88f9aeaa59f08b9b447a8b2256c9c9c5fb0)
2007-10-10r1654: rename cli_ -> smbcli_Stefan Metzmacher2-50/+50
rename CLI_ -> SMBCLI_ metze (This used to be commit 8441750fd9427dd6fe477f27e603821b4026f038)
2007-10-10r1518: check for ldb_search giving -1 (indicating db corruption)Andrew Tridgell1-0/+3
(This used to be commit 9af821c4dfa47d68be5e062028331c80df64f82b)
2007-10-10r1498: (merge from 3.0)Andrew Bartlett1-1/+1
Rework our random number generation system. On systems with /dev/urandom, this avoids a change to secrets.tdb for every fork(). For other systems, we now only re-seed after a fork, and on startup. No need to do it per-operation. This removes the 'need_reseed' parameter from generate_random_buffer(). This also requires that we start the secrets subsystem, as that is where the reseed value is stored, for systems without /dev/urandom. In order to aviod identical streams in forked children, the random state is re-initialised after the fork(), at the same point were we do that to the tdbs. Andrew Bartlett (This used to be commit b97d3cb2efd68310b1aea8a3ac40a64979c8cdae)
2007-10-10r1486: commit the start of the generic server infastructureStefan Metzmacher1-0/+5
the idea is to have services as modules (smb, dcerpc, swat, ...) the process_model don't know about the service it self anymore. TODO: - the smbsrv should use the smbsrv_send function - the service subsystem init should be done like for other modules - we need to have a generic socket subsystem, which handle stream, datagram, and virtuell other sockets( e.g. for the ntvfs_ipc module to connect to the dcerpc server , or for smb or dcerpc or whatever to connect to a server wide auth service) - and other fixes... NOTE: process model pthread seems to be broken( but also before this patch!) metze (This used to be commit bbe5e00715ca4013ff0dbc345aa97adc6b5c2458)
2007-10-10r1461: ntlm_check.c is a server-side peice of code, so it belongs in AUTH.Andrew Bartlett2-1/+449
Andrew Bartlett (This used to be commit 67ac9600664e93aa2fe9426127313b57ddaec2cf)
2007-10-10r1335: NT_STATUS_INTERNAL_DB_CORRUPTIONStefan Metzmacher1-2/+2
should cause DEBUG(0,(...)); metze (This used to be commit 80851e67783a9c3c8bdd7f2b52e0b46dd7b18d05)
2007-10-10r1334: remove unused stuffStefan Metzmacher1-11/+0
metze (This used to be commit 7a8786269b4f9e4962b51dd734171adf04021c15)
2007-10-10r1294: A nice, large, commit...Andrew Bartlett5-252/+24
This implements gensec for Samba's server side, and brings gensec up to the standards of a full subsystem. This means that use of the subsystem is by gensec_* functions, not function pointers in structures (this is internal). This causes changes in all the existing gensec users. Our RPC server no longer contains it's own generalised security scheme, and now calls gensec directly. Gensec has also taken over the role of auth/auth_ntlmssp.c An important part of gensec, is the output of the 'session_info' struct. This is now reference counted, so that we can correctly free it when a pipe is closed, no matter if it was inherited, or created by per-pipe authentication. The schannel code is reworked, to be in the same file for client and server. ntlm_auth is reworked to use gensec. The major problem with this code is the way it relies on subsystem auto-initialisation. The primary reason for this commit now.is to allow these problems to be looked at, and fixed. There are problems with the new code: - I've tested it with smbtorture, but currently don't have VMware and valgrind working (this I'll fix soon). - The SPNEGO code is client-only at this point. - We still do not do kerberos. Andrew Bartlett (This used to be commit 07fd885fd488fd1051eacc905a2d4962f8a018ec)
2007-10-10r1292: Add const to the subsystem/module registration code.Andrew Bartlett1-2/+9
Add some 'multi init' code, until we get a better set of infrustructure. Andrew Bartlett (This used to be commit 982422b2d286335378531ae9523e74192340af3c)
2007-10-10r1151: fixed fill-in of force_password_change field in auth_samAndrew Tridgell1-1/+1
(This used to be commit 9135f14540ded30892dc1f944aec1e8979a476e1)
2007-10-10r1146: initially zero server infoAndrew Tridgell1-0/+1
(This used to be commit c1aeaf97b39e1769bd43b21225094bb5128eaab4)
2007-10-10r1143: fixed spelling of sAMAccountNameAndrew Tridgell1-1/+1
(This used to be commit aadfbcee76a9181a540620f3b0827a3268b63a0e)
2007-10-10r1142: I think this should fix the interactive logins for tridge - don't takeAndrew Bartlett1-4/+4
sizeof() a pointer... Andrew Bartlett (This used to be commit c1019e6df6aa4fcce7dc2ccbd404a4254ab5d1fb)
2007-10-10r1138: allow for a user in no groupsAndrew Tridgell1-1/+2
(This used to be commit f9c1e12594e58b7e663ca099929eab8867b82a0c)
2007-10-10r1136: - added IDL for netr_LogonGetDomainInfo()Andrew Tridgell2-0/+6
- added workstation to auth_session_info in rpc servers - added session key fetch hook in crypto backends in dcesrv - store and fetch seed as well as a session key in schannel ldb - when a client uses schannel to setup a netlogon pipe connection we also need to setup the credentials from the schannel negotiation so credentials chaining works - added server side netr_LogonGetDomainInfo() call (This used to be commit a35459387de3b6a422c5af6f658338fc7e4314b0)
2007-10-10r1078: the dxesrv_crypto_* implementations should now explicit setStefan Metzmacher1-1/+15
the dce_conn->auth_state.session_info ( the ntlmssp one works fine, but the schannel one isn't implemented yet) this is also set by the ntvfs_ipc backend on the endpoint connect. metze (This used to be commit ad3dd1789e9f124493519cb4731d9f5a563fd051)
2007-10-10r1067: fix compiler warningsStefan Metzmacher2-2/+2
metze (This used to be commit e5d338821e590c49947a18a5d5c361122571988d)
2007-10-10r1063: userdom_struct dies!Andrew Bartlett2-5/+0
(Cleanup unused header definitions) Andrew Bartlett (This used to be commit 5941873f558c2af6ab5ef64e468acc8fab96ac01)
2007-10-10r1058: The start of work on the SamLogon call for NETLOGON.Andrew Bartlett5-109/+149
This starts to store information about the user in the server_info struct - like the account name, the full name etc. Also, continue to make the names of the structure elements in the logon reply more consistant with those in the SAMR pipe. Andrew Bartlett (This used to be commit 3ccd96bd945e0fd95e42c69ad8ff07055af2e62b)
2007-10-10r1028: More consistancy fixes, which should also fix the build.Andrew Bartlett1-2/+2
Andrew Bartlett (This used to be commit 0d2ae66d3a82134d86084f63c05214e03dfcb48b)
2007-10-10r1027: More rename:Andrew Bartlett1-48/+48
pwd -> password (should fix the build). Andrew Bartlett (This used to be commit f9280f956eef19ad1a39e120cb3ed0e3982fe7d5)
2007-10-10r1026: Spelling.Tim Potter1-1/+1
(This used to be commit b7fe73613acf5423b77fd91c56849351bf386960)
2007-10-10r1025: Rename (across the samr and netlogon pipes, so far)Andrew Bartlett1-2/+3
pwd -> password passwd -> password username -> account_name Also work on consistant structure feild names between these two pipes, and fix up some callers to use samr_Password for the netlogon credential code. Andrew Bartlett (This used to be commit 4e35418c2776f7b79be5b358ffd077754685d1ac)
2007-10-10r1023: Prepare the auth subsystem interfaces for netlogon SamLogon to use.Andrew Bartlett1-8/+20
Andrew Bartlett (This used to be commit b5fa2baaa9e110aa93107b13744e1fc5a64adbb5)
2007-10-10r1021: Because auth_serversupplied_info is not reference counted, this mayAndrew Bartlett1-0/+2
only be called once per authentication. Andrew Bartlett (This used to be commit 9a5de8de952a4e5c3eadccf42d034fa7cfd55171)
2007-10-10r1020: Add an (untested, until the other end is hooked in) method forAndrew Bartlett1-0/+28
obtaining the session_info from an NTLMSSP authenticated user. Andrew Bartlett (This used to be commit 7961f1a18d67a6a0cf2c61bcc1c3b42ed06176f7)
2007-10-10r1019: Push the auth subsystem away from using typedef, and over to the 'allAndrew Bartlett6-86/+117
goodness and light' struct ;-) Break apart the auth subsystem's return strucutres, into the parts that a netlogon call cares about, and the parts that are for a local session. This is the 'struct session_info' and it will almost completly replace the current information stored on a vuid, but be generic to all login methods (RPC over TCP, for example). Andrew Bartlett (This used to be commit d199697014d9562f9439a30b950fda798c5ef419)
2007-10-10r1001: in samba4 we don't(shouldn't) use typedef's anymore...Stefan Metzmacher2-11/+11
metze (This used to be commit ac5f6f7e511a730448012c8a709887827aea2281)
2007-10-10r995: - renamed many of our crypto routines to use the industry standardAndrew Tridgell1-2/+2
names rather than our crazy naming scheme. So DES is now called des_crypt() rather than smbhash() - added the code from the solution of the ADS crypto challenge that allows Samba to correctly handle a 128 bit session key in all of the netr_ServerAuthenticateX() varients. A huge thanks to Luke Howard from PADL for solving this one! - restructured the server side rpc authentication to allow for other than NTLMSSP sign and seal. This commit just adds the structure, the next commit will add schannel server side support. - added 128 bit session key support to our client side code, and testing against w2k3 with smbtorture. Works well. (This used to be commit 729b2f41c924a0b435d44a14209e6dacc2304cee)
2007-10-10r961: convert 'uchar' to 'uint8_t'Stefan Metzmacher3-14/+14
metze (This used to be commit 9f914e4af99e18b469d4cf9d8b1514a2bd28ddec)
2007-10-10r943: change samba4 to use 'uint8_t' instead of 'unsigned char'Stefan Metzmacher4-18/+18
metze (This used to be commit b5378803fdcb3b3afe7c2932a38828e83470f61a)
2007-10-10r924: got rid of the global well-known SIDs, instead using const defines in ↵Andrew Tridgell1-14/+10
misc.idl (This used to be commit ce7920a5fac0dbccb01402129c341b410a032e60)
2007-10-10r904: - fixed account expiry testing in auth_samAndrew Tridgell1-2/+1
- added printf style format attribute checking to samdb varargs fns - fix nt_time_to_unix() for zero and -1 times (This used to be commit 41f9b144f9fe77e92f960bd11b1df397a63fd2d5)
2007-10-10r890: convert samba4 to use [u]int8_t instead of [u]int8Stefan Metzmacher6-7/+7
metze (This used to be commit 2986c5f08c8f0c26a2ea7b6ce20aae025183109f)
2007-10-10r889: convert samba4 to use [u]int16_t instead of [u]int16Stefan Metzmacher2-7/+7
metze (This used to be commit af6f1f8a01bebbecd99bc8c066519e89966e65e3)
2007-10-10r884: convert samba4 to use [u]int32_t instead of [u]int32Stefan Metzmacher1-1/+1
metze (This used to be commit 0e5517d937a2eb7cf707991d1c7498c1ab456095)
2007-10-10r874: This patch is a pile of work on NTLMSSP:Andrew Bartlett1-3/+18
Samba's NTLMSSP code is now fully talloc based, which should go a long way to cleaning up the memory leaks in this code. This also avoids a lot of extra copies of data, as we now allocate the 'return' blobs on a caller-supplied context. I have also been doing a lot of work towards NTLM2 signing and sealing. I have this working for sealing, but not for the verifier (MD5 integrity check on the stream) which is still incorrect. (I can aim a rpcecho sinkdata from a Win2k3 box to my server, and the data arrives intact, but the signature check fails. It does however match the test values I have...). The new torture test is cludged in - when we get a unit test suite back, I'll happliy put it in the 'right' place.... Andrew Bartlett (This used to be commit 399e2e2b1149b8d1c070aa7f0d5131c0b577d2b9)
2007-10-10r873: converted samba4 to use real 64 bit integers instead ofAndrew Tridgell1-5/+5
structures. This was suggested by metze recently. I checked on the build farm and all the machines we have support 64 bit ints, and support the LL suffix for 64 bit constants. I suspect some won't support strtoll() and related functions, so we will probably need replacements for those. (This used to be commit 9a9244a1c66654c12abe4379661cba83a73c4c21)
2007-10-10r850: convert SUBSYSTEM AUTH to a config.mk fileStefan Metzmacher2-7/+33
metze (This used to be commit b29414bd23385ba2502763ed33676a42d176eaf9)
2007-10-10r816: - Make use of tridge's new samdb_result_sid_prefix() helper function.Andrew Bartlett2-11/+17
- Remove legacy sid_to_string (which contained a memleak) - Remove some unused parts of lib/util_sid.c Andrew Bartlett (This used to be commit 7c69a85984e47c004ddfd9bb5eadcb3191b56f9d)
2007-10-10r751: Fix debug message to print the right variable.Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit aa4b56a8736fb16134fae48165fe608912725895)
2007-10-10r743: Start on a NETLOGON server in Samba4.Andrew Bartlett1-41/+6
Currently this only authentiates the machine, not real users. As a consequence of running the Samba4 NETLOGON test against Samba4, I found a number of issues in the SAMR server, which I have addressed. There are more templates in the provison.ldif for this reason. I also added some debug to our credentials code, and fixed some bugs in the auth_sam module. The static buffer in generate_random_string() bit me badly, so I removed it in favor of a talloc based system. Andrew Bartlett (This used to be commit 94624e519b66def97758b8a48a01ffe9029176f0)
2007-10-10r719: Follow the trend - remove more unused functions.Andrew Bartlett2-18/+0
Andrew Bartlett (This used to be commit 62eef851fd79b2739b93b4ed7829514a3dcbf1d0)
2007-10-10r715: Finish the ldb conversion for the auth_sam module.Andrew Bartlett1-29/+100
Andrew Bartlett (This used to be commit 099151cdabd40e724b36482c0ffc169d231146d2)
2007-10-10r708: Clean up copyright headers, to reflect code that has come and goneAndrew Bartlett1-4/+2
over time. Andrew Bartlett (This used to be commit 1a53e5c8296a7c09563abde1eb4a66ce9cf45473)
2007-10-10r685: The SAM is dead! Long live the new SAM! ;-)Andrew Bartlett4-225/+207
This commit kills passdb, which was only hosting the auth subsystem. With the work tridge has done on Samba4's SAM backend, this can (and now is) all hosted on ldb. The auth_sam.c file now references this backend. You will need to assign your users passwords in ldb - adding a new line: unicodePwd: myPass to a record, using ldbedit, should be sufficient. Naturally, this assumes you have had your personal SAMR provisioning tutorial from tridge. Everybody else can still use the anonymous logins. Andrew Bartlett (This used to be commit 2aa0b55fb86648731d5f2201fa5a6aa993b7ca48)
2007-10-10r665: merge over the new build system from my tmp branchStefan Metzmacher1-2/+4
to the main SAMBA_4_0 tree. NOTE: that it's not completely ready, but it's functional:-) metze (This used to be commit c78a2ddb28ec50d6570a83b1f66f18a5c3621731)
generated by cgit (git 2.34.1) at 2024-11-14 20:48:08 +0000