summaryrefslogtreecommitdiff
path: root/source4/libcli/auth/gensec.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r2646: - use a talloc destructor to ensure that sockets from the new socketAndrew Tridgell1-2/+1
library are closed on abnormal termination - convert the service.h structures to the new talloc methods (This used to be commit 2dc334a3284858eb1c7190f9687c9b6c879ecc9d)
2007-10-10r2629: convert gensec to the new talloc modelAndrew Tridgell1-30/+26
by making our gensec structures a talloc child of the open connection we can be sure that it will be destroyed when the connection is dropped. (This used to be commit f12ee2f241aab1549bc1d9ca4c35a35a1ca0d09d)
2007-10-10r2377: added a more generic way of disabling gensec subsystems. For example,Andrew Tridgell1-0/+5
"gensec:ntlmssp=no" will disable ntlmssp. (This used to be commit 66f88c7d89154155b27bf8b7839c580fb1cd1e7c)
2007-10-10r2314: fix compiler warningStefan Metzmacher1-2/+2
metze (This used to be commit 75c3108955bab44ffda308406bae153e3a92cedf)
2007-10-10r2307: Fix the use of 'raw' NTLMSSP to hosts that support extended security,Andrew Bartlett1-0/+11
but do not support SPNEGO (such as XP, when not joined to a domain). This is triggered by the presense or lack of a security blob in the negprot reply. Andrew Bartlett (This used to be commit 99f7a38c077725b22475f2ba68d0955114879c24)
2007-10-10r2284: Thanks to some great detective work by tridge, NTLM2 signing now works.Andrew Bartlett1-7/+25
This means that 'require NTLMv2 session security' now works for RPC pipe signing. We don't yet have sealing, but it can't be much further. This is almost all tridge's code, munged into a form that can work with the GENSEC API. This commit also includes more lsakey fixes - that key is used for all DCE-RPC level authenticated connections, even over CIFS/ncacn_np. No doubt I missed something, but I'm going to get some sleep :-) Andrew Bartlett (This used to be commit a1fe175eec884280fb7e9ca8f528134cf4600beb)
2007-10-10r2053: All RPC sessions 'want' a session key. Of course, the key theyAndrew Bartlett1-0/+3
currently get it bougs, but anyway... Andrew Bartlett (This used to be commit 46864dd9d778c008c2f1a3a6701360d4ca64a664)
2007-10-10r2041: Fix NTLMSSP RPC sealing, client -> win2k3 server.Andrew Bartlett1-3/+38
The bug (found by tridge) is that Win2k3 is being tighter about the NTLMSSP flags. If we don't negotiate sealing, we can't use it. We now have a way to indicate to the GENSEC implementation mechanisms what things we want for a connection. Andrew Bartlett (This used to be commit 86f61568ea44c5719f9b583beeeefb12e0c26f4c)
2007-10-10r1737: don't segfault when a mech don't have a session_info hookStefan Metzmacher1-0/+3
metze (This used to be commit 68f3e538265b59ec818917b914678485585795a6)
2007-10-10r1724: Add a new function to return the list of available OIDs.Andrew Bartlett1-9/+39
(Used in our SPNEGO code). Andrew Bartlett (This used to be commit c91d6b6f9b53e64069fd5860f677bc1b4c250f0c)
2007-10-10r1685: Add the ability to lookup RPC auth types for the RPC-MGMT torture test.Andrew Bartlett1-0/+11
Andrew Bartlett (This used to be commit 0e4e3647e848605416fe79c742ac84d84dc4357c)
2007-10-10r1475: More kerberos workAndrew Bartlett1-8/+181
- We can now connect to hosts that follow the SPNEGO RFC, and *do not* give us their principal name in the mechListMIC. - The client code now remembers the hostname it connects to - We now kinit for a user, if there is not valid ticket already - Re-introduce clock skew compensation TODO: - See if the username in the ccache matches the username specified - Use a private ccache, rather then the global one, for a 'new' kinit - Determine 'default' usernames. - The default for Krb5 is the one in the ccache, then $USER - For NTLMSSP, it's just $USER Andrew Bartlett (This used to be commit de5da669397db4ac87c6da08d3533ca3030da2b0)
2007-10-10r1466: the name "oid" is taken by some silly system headers - avoid it in ↵Andrew Tridgell1-2/+2
our code (This used to be commit ea5659b051f95402441e69ba4ce5aea1ed6f5c86)
2007-10-10r1449: Use the config system somewhat better in libcli/authJelmer Vernooij1-7/+2
(This used to be commit 69de0d95c585c1a73072e921884cbd427c160176)
2007-10-10r1440: GENSEC improvements:Andrew Bartlett1-1/+57
- Infrustructure for kerberos - Don't segfault on un-implemented backend functions - Add comments. Andrew Bartlett (This used to be commit 1c31aa42710421917428d6ba86328ea5179751bd)
2007-10-10r1359: fix uninit var - found by valgrindStefan Metzmacher1-3/+1
metze (This used to be commit 264afea9ec3ada4df51e5f5de4c0b977024af40b)
2007-10-10r1357: Work on GENSEC:Andrew Bartlett1-5/+50
- Add the concept of a 'subcontext' into gensec, so that the spengo code doesn't have to figure out how to make one. (A subcontext inherits the username, domain, password (or callback) from the main context). - Add comments to some other routines, and explain a bit about what the various 'start' functions are for. Andrew Bartlett (This used to be commit 7aedbfbdd92b4ca93cbd0babff16e7526201ee88)
2007-10-10r1348: get gensec backend by OID instead of nameStefan Metzmacher1-11/+0
metze (This used to be commit 38e00f87191b86901b603e66aec1e7e71f74c29f)
2007-10-10r1344: add gensec_start_mech_by_name()Stefan Metzmacher1-0/+11
some gensec spnego fixes (NULL pointer and length checks) metze (This used to be commit 41ff6d0cd47f6295fe7fe1d31fec7306416ce199)
2007-10-10r1294: A nice, large, commit...Andrew Bartlett1-43/+362
This implements gensec for Samba's server side, and brings gensec up to the standards of a full subsystem. This means that use of the subsystem is by gensec_* functions, not function pointers in structures (this is internal). This causes changes in all the existing gensec users. Our RPC server no longer contains it's own generalised security scheme, and now calls gensec directly. Gensec has also taken over the role of auth/auth_ntlmssp.c An important part of gensec, is the output of the 'session_info' struct. This is now reference counted, so that we can correctly free it when a pipe is closed, no matter if it was inherited, or created by per-pipe authentication. The schannel code is reworked, to be in the same file for client and server. ntlm_auth is reworked to use gensec. The major problem with this code is the way it relies on subsystem auto-initialisation. The primary reason for this commit now.is to allow these problems to be looked at, and fixed. There are problems with the new code: - I've tested it with smbtorture, but currently don't have VMware and valgrind working (this I'll fix soon). - The SPNEGO code is client-only at this point. - We still do not do kerberos. Andrew Bartlett (This used to be commit 07fd885fd488fd1051eacc905a2d4962f8a018ec)
2007-10-10r1200: Add 'gensec', our generic security layer.Andrew Bartlett1-0/+104
This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
generated by cgit (git 2.34.1) at 2024-11-15 12:59:24 +0000