samba - Unnamed repository; edit this file 'description' to name the repository.

Age	Commit message (Collapse)	Author	Files	Lines
2007-10-10	r16235: Don't update minor_status when cleaning up on error. This restores	Andrew Bartlett	1	-2/+2
	sensible log messages to gensec_gssapi. Andrew Bartlett (This used to be commit df2e4f061f3bc82930dfcdbb75b775939ae8832e)
2007-10-10	r15993: don't use u_int32_t, as the main heimdal code also don't use	Stefan Metzmacher	1	-1/+1
	it anymore metze (This used to be commit e1842c9b55ffd0792fea2cff37b812d319c76f1f)
2007-10-10	r15491: Always initialise is_cfx (found by Valgrind)	Andrew Bartlett	1	-1/+3
	Always remember to free the crypto context (found by Luke Howard) (This used to be commit 4b44355d42592f4acaae459c6ae09dd928f083b7)
2007-10-10	r15484: Make accept_security_context() more compatible with how Samba3 (and	Andrew Bartlett	1	-9/+42
	similarly built clients) behave. This is better than just ignoring the checksum, if it isn't the GSSAPI checksum. (Samba4 clients in Samba3 mode use more than just the MD5 checksum, and will use a signed AES checksum if available. Actual samba3 may well do the same in future, against a suitable KDC). Also a change for easier debugging of checksum issues. Andrew Bartlett (This used to be commit 120374f5f9e9af0653a26e0308e4bfdabbcaa3f3)
2007-10-10	r15192: Update Samba4 to use current lorikeet-heimdal.	Andrew Bartlett	1	-1/+0
	Andrew Bartlett (This used to be commit f0e538126c5cb29ca14ad0d8281eaa0a715ed94f)
2007-10-10	r14707: Initialise default value (the rest of this function sets it to 1 if	Andrew Bartlett	1	-0/+1
	this is CFX). Caught by Valgrind. Andrew Bartlett (This used to be commit bdb55ce2b57adf3b7c6eb1455c3775d013c72e5d)
2007-10-10	r11995: A big kerberos-related update.	Andrew Bartlett	1	-74/+32
	This merges Samba4 up to current lorikeet-heimdal, which includes a replacement for some Samba-specific hacks. In particular, the credentials system now supplies GSS client and server credentials. These are imported into GSS with gss_krb5_import_creds(). Unfortunetly this can't take an MEMORY keytab, so we now create a FILE based keytab as provision and join time. Because the keytab is now created in advance, we don't spend .4s at negprot doing sha1 s2k calls. Also, because the keytab is read in real time, any change in the server key will be correctly picked up by the the krb5 code. To mark entries in the secrets which should be exported to a keytab, there is a new kerberosSecret objectClass. The new routine cli_credentials_update_all_keytabs() searches for these, and updates the keytabs. This is called in the provision.js via the ejs wrapper credentials_update_all_keytabs(). We can now (in theory) use a system-provided /etc/krb5.keytab, if krb5Keytab: FILE:/etc/krb5.keytab is added to the secrets.ldb record. By default the attribute privateKeytab: secrets.keytab is set, pointing to allow the whole private directory to be moved without breaking the internal links. (This used to be commit 6b75573df49c6210e1b9d71e108a9490976bd41d)
2007-10-10	r11452: Update Heimdal to current lorikeet, including removing the ccache side	Andrew Bartlett	1	-15/+23
	of the gsskrb5_acquire_cred hack. Add support for delegated credentials into the auth and credentials subsystem, and specifically into gensec_gssapi. Add the CIFS NTVFS handler as a consumer of delegated credentials, when no user/domain/password is specified. Andrew Bartlett (This used to be commit 55b89899adb692d90e63873ccdf80b9f94a6b448)
2007-10-10	r10072: Fix mismerge weridness in error handling.	Andrew Bartlett	1	-7/+12
	Andrew Bartlett (This used to be commit c17926b6fe278fd757862885f82fd342b755167c)
2007-10-10	r10066: This is the second in my patches to work on Samba4's kerberos support,	Andrew Bartlett	1	-307/+360
	with an aim to make the code simpiler and more correct. Gone is the old (since the very early Samba 3.0 krb5 days) 'iterate over all keytypes)' code in gensec_krb5, we now follow the approach used in gensec_gssapi, and use a keytab. I have also done a lot of work in the GSSAPI code, to try and reduce the diff between us and upstream heimdal. It was becoming hard to track patches in this code, and I also want this patch (the DCE_STYLE support) to be in a 'manageable' state for when lha considers it for merging. (metze assures me it still has memory leak problems, but I've started to address some of that). This patch also includes a simple update of other code to current heimdal, as well as changes we need for better PAC verification. On the PAC side of things we now match windows member servers by checking the name and authtime on an incoming PAC. Not generating these right was the cause of the PAC pain, and so now both the main code and torture test validate this behaviour. One thing doesn't work with this patch: - the sealing of RPC pipes with kerberos, Samba -> Samba seems broken. I'm pretty sure this is related to AES, and the need to break apart the gss_wrap interface. Andrew Bartlett (This used to be commit a3aba57c00a9c5318f4706db55d03f64e8bea60c)
2007-10-10	r9221: Try to merge Heimdal across from lorikeet-heimdal to samba4.	Andrew Bartlett	1	-25/+24
	This is my first attempt at this, so there may be a few rough edges. Andrew Bartlett (This used to be commit 9a1d2f2fec67930975da856a2d365345cec46216)
2007-10-10	r8302: import mini HEIMDAL into the tree	Heimdal Import User	1	-0/+1118
	(This used to be commit 118be28a7aef233799956615a99d1a2a74dac175)