Age | Commit message (Collapse) | Author | Files | Lines |
|
metze
|
|
metze
|
|
We think we have the bug fixed.
Andrew Bartlett
|
|
I tried hard to not change the program logic. Should fix bug #6439.
|
|
Jeremy.
|
|
This fixes two things in the TLS support for Samba4. The first is to
use a somewhat more correct hostname instead of 'Samba' when
generating the test certificates. That allows TLS test clients (such
as gnutls-cli) to connect to Samba4 using auto-generated certificates.
The second fix is to add a call to gcry_control() to tell gcrypt to
use /dev/urandom instead of /dev/random (on systems that support
that). That means that test certificate generation is now very fast,
which was previously an impediment to putting the TLS tests on the
build farm.
|
|
|
|
socket-tls backend.
|
|
list=""
list="$list event_context:tevent_context"
list="$list fd_event:tevent_fd"
list="$list timed_event:tevent_timer"
for s in $list; do
o=`echo $s | cut -d ':' -f1`
n=`echo $s | cut -d ':' -f2`
r=`git grep "struct $o" |cut -d ':' -f1 |sort -u`
files=`echo "$r" | grep -v source3 | grep -v nsswitch | grep -v packaging4`
for f in $files; do
cat $f | sed -e "s/struct $o/struct $n/g" > $f.tmp
mv $f.tmp $f
done
done
metze
|
|
warnings.
|
|
|
|
|
|
remove some unused functions.
|
|
|
|
until someone will finally decide to fix it.
(This used to be commit 0671dce355432a2a4c08ab010831eadd73e4561e)
|
|
(This used to be commit 6b6b2196a8a8d9e741f5c399185ded7a16938da0)
|
|
Conflicts:
source/auth/credentials/config.mk
source/auth/gensec/config.mk
source/build/smb_build/makefile.pm
source/heimdal_build/config.mk
source/lib/events/config.mk
source/lib/nss_wrapper/config.mk
source/lib/policy/config.mk
source/lib/registry/config.mk
source/lib/socket_wrapper/config.mk
source/lib/tdb/config.mk
source/lib/tls/config.mk
source/lib/util/config.mk
source/libcli/config.mk
source/libcli/ldap/config.mk
source/libnet/config.mk
source/librpc/config.mk
source/param/config.mk
source/rpc_server/config.mk
source/scripting/ejs/config.mk
source/smbd/process_model.mk
(This used to be commit 760378e0294dd0cd4523a83448328478632d7e3d)
|
|
(This used to be commit c46b7e90e347da76156ddcae4866adb88e9fec21)
|
|
(This used to be commit a7e6d2a1832db388fdafa1279f84c9a8bbfc87d6)
|
|
mkconfig.mk file.
(This used to be commit 4cc93a98f984d322e41f403169cfa4945b469935)
|
|
uses of global_loadparm.
(This used to be commit a33a5530545086b81a3b205aa109dff11c546926)
|
|
(This used to be commit 5e814287ba475e12f8cc934fdd09b199dcdfdb86)
|
|
2007-09-29 More higher-level passing around of lp_ctx.
2007-09-29 Fix warning.
2007-09-29 Pass loadparm contexts on a higher level.
2007-09-29 Avoid using global loadparm context.
(This used to be commit 3468952e771ab31f90b6c374ade01c5550810f42)
|
|
(This used to be commit 3fcc960839c6e5ca4de2c3c042f12f369ac5f238)
|
|
number in more places.
(This used to be commit df9cebcb97e20564359097148665bd519f31bc6f)
|
|
(This used to be commit d81bb09046a7ea65aa916be7fcfa94e86b6191f5)
|
|
(This used to be commit 5085c53fcfade614e83d21fc2c1a5bc43bb2a729)
|
|
(This used to be commit 1ce32673d960c8b05b6c1b1b99e1976a402417ae)
|
|
There are still a few tidyups of old FSF addresses to come (in both s3
and s4). More commits soon.
(This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
|
|
Re-enable TLS in the default configuration. We passed on the build
farm because we have an explicit diffie-hilliman parameters file set.
Andrew Bartlett
(This used to be commit d20ab6a5ed7f980cb653e965c4de3de8d058d9c4)
|
|
emacs compile mode (hint, paste to a file, and compile as "cat
filename").
This allowed me to fix nearly all the warnings for a IA_64 SuSE build
very quickly.
(This used to be commit eba6c84efff735bb0ca941ac4b755ce2b0591667)
|
|
libgnutls but not some of the crt functions
(This used to be commit 7a0264c52dd8ab1b1bb321462f66955a866d90a9)
|
|
(This used to be commit 28238ad8f15b8bd3c49fb0b235becca25615cfe6)
|
|
(This used to be commit 8148534d9c9e566c4ecd9b29857fa96916cd9e3f)
|
|
(This used to be commit 300d6e724d1ce386ad53852c0645fa8de374625a)
|
|
Andrew Bartlett
(This used to be commit 798c0791d8e8d10dde41a6dbceb0866265f9a709)
|
|
testsuite.
Andrew Bartlett
(This used to be commit 23314c3953676124a2ad06e8b3a3b297c11f2800)
|
|
Adjust the web_server code to cope with this.
Andrew Bartlett
(This used to be commit 3043969708edbdab58ee57e2fbffa293b6406813)
|
|
routines to return an NTSTATUS. This should help track down errors.
Use a bit of talloc_steal and talloc_unlink to get the real socket to
be a child of the GENSEC or TLS socket.
Always return a new socket, even for the 'pass-though' case.
Andrew Bartlett
(This used to be commit 003e2ab93c87267ba28cd67bd85975bad62a8ea2)
|
|
contexts from the application layer into the socket layer.
This improves a number of correctness aspects, as we now allow LDAP
packets to cross multiple SASL packets. It should also make it much
easier to write async LDAP tests from windows clients, as they use SASL
by default. It is also vital to allowing OpenLDAP clients to use GSSAPI
against Samba4, as it negotiates a rather small SASL buffer size.
This patch mirrors the earlier work done to move TLS into the socket
layer.
Unusual in this pstch is the extra read callback argument I take. As
SASL is a layer on top of a socket, it is entirely possible for the
SASL layer to drain a socket dry, but for the caller not to have read
all the decrypted data. This would leave the system without an event
to restart the read (as the socket is dry).
As such, I re-invoke the read handler from a timed callback, which
should trigger on the next running of the event loop. I believe that
the TLS code does require a similar callback.
In trying to understand why this is required, imagine a SASL-encrypted
LDAP packet in the following formation:
+-----------------+---------------------+
| SASL Packet #1 | SASL Packet #2 |
----------------------------------------+
| LDAP Packet #1 | LDAP Packet #2 |
----------------------------------------+
In the old code, this was illegal, but it is perfectly standard
SASL-encrypted LDAP. Without the callback, we would read and process
the first LDAP packet, and the SASL code would have read the second SASL
packet (to decrypt enough data for the LDAP packet), and no data would
remain on the socket.
Without data on the socket, read events stop. That is why I add timed
events, until the SASL buffer is drained.
Another approach would be to add a hack to the event system, to have it
pretend there remained data to read off the network (but that is ugly).
In improving the code, to handle more real-world cases, I've been able
to remove almost all the special-cases in the testnonblock code. The
only special case is that we must use a deterministic partial packet
when calling send, rather than a random length. (1 + n/2). This is
needed because of the way the SASL and TLS code works, and the 'resend
on failure' requirements.
Andrew Bartlett
(This used to be commit 5d7c9c12cb2b39673172a357092b80cd814850b0)
|
|
Andrew Bartlett
(This used to be commit f3b6e57b2336f36416e25c3a5cd793aa036b5b40)
|
|
make the testnonblock skip some things. The socket *under* the tls
socket is still tested.
Andrew Bartlett
(This used to be commit 9c33c6a20a77e3f15eac3d62488117517afad940)
|
|
(This used to be commit 61c6100617589ac6df4f527877241464cacbf8b3)
|
|
this fixes a compiler warning
metze
(This used to be commit dbf82fff10f1b5c3894b9600d98f81ee10e3d876)
|
|
only fall back to manual tests if that can't be found (for systems
that have older versions of gnutls without the .pc file installed)
(This used to be commit d77ea8f9072070f47b2b44676facaf66ed40fd17)
|
|
This reduces caller complexity, because the TLS code is now called
just like any other socket. (A new socket context is returned by the
tls_init_server and tls_init_client routines).
When TLS is not available, the original socket is returned.
Andrew Bartlett
(This used to be commit 09b2f30dfa7a640f5187b4933204e9680be61497)
|
|
(This used to be commit f2ca71f1229f4c20296895116c09bacbd6a53b55)
|
|
Andrew Bartlett
(This used to be commit 2cd2e524e6e1acb2e2921e32c5551f528aa04bf4)
|
|
This is in preperation for making TLS a socket library.
Andrew Bartlett
(This used to be commit a312812b92f5ac7e6bd2c4af725dbbbc900d4452)
|
|
with local
(empty) libpopt.a overriding global one
(This used to be commit 2f06305e53478e5030c24550954f221a9a97c83f)
|