summaryrefslogtreecommitdiff
path: root/source4/libcli
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r1342: When fixing _lsa_lookupsids in samba3 I wanted to find out the number ↵Volker Lendecke1-1/+1
of SIDs w2k3 can handle in a single request. With the samba3 client rpc libs I can do about 21000 SIDs in a single request. test_many_LookupSIDs with 10000 SIDs fails on the subsequent request with a NET_WRITE_FAULT. Maybe the Samba4 DCE people want to take a look at this -- I don't see the problem. Bug fix: SID components should be treated as unsigned when parsing Volker (This used to be commit 8c997a2ad2e89a640f854b556ef76a3d52c15963)
2007-10-10r1294: A nice, large, commit...Andrew Bartlett7-169/+813
This implements gensec for Samba's server side, and brings gensec up to the standards of a full subsystem. This means that use of the subsystem is by gensec_* functions, not function pointers in structures (this is internal). This causes changes in all the existing gensec users. Our RPC server no longer contains it's own generalised security scheme, and now calls gensec directly. Gensec has also taken over the role of auth/auth_ntlmssp.c An important part of gensec, is the output of the 'session_info' struct. This is now reference counted, so that we can correctly free it when a pipe is closed, no matter if it was inherited, or created by per-pipe authentication. The schannel code is reworked, to be in the same file for client and server. ntlm_auth is reworked to use gensec. The major problem with this code is the way it relies on subsystem auto-initialisation. The primary reason for this commit now.is to allow these problems to be looked at, and fixed. There are problems with the new code: - I've tested it with smbtorture, but currently don't have VMware and valgrind working (this I'll fix soon). - The SPNEGO code is client-only at this point. - We still do not do kerberos. Andrew Bartlett (This used to be commit 07fd885fd488fd1051eacc905a2d4962f8a018ec)
2007-10-10r1274: revert -r 1239 as discussed with abartletStefan Metzmacher5-159/+433
metze (This used to be commit 52e2d038252bd745d53c687d266ad3ad62efa6fc)
2007-10-10r1268: varient -> variantTim Potter2-2/+2
(This used to be commit de5984c95602ca67e8ac3139c3aa4330b74266e0)
2007-10-10r1239: move the old msrpc_<gen|parse>() functions to ↵Stefan Metzmacher5-433/+159
ndr_<push|pull>_format_blob() simular to ndr_<push|pull>_struct_blob() metze (This used to be commit b25dd341e0febd550a2936ca484b6fecce2ff8c2)
2007-10-10r1229: the name of the protocol should be in first place of a function nameStefan Metzmacher2-10/+10
rename <read|write|free>_spnego_data() into spnego_<read|write|free>_data metze (This used to be commit 3f57c8f596eb6ad31a024acaf60fefcfd28d8387)
2007-10-10r1200: Add 'gensec', our generic security layer.Andrew Bartlett9-277/+935
This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2007-10-10r1198: Merge the Samba 3.0 ntlm_auth, including the kerberos and SPENGO parts.Andrew Bartlett9-569/+1021
I have moved the SPNEGO and Kerberos code into libcli/auth, and intend to refactor them into the same format as NTLMSSP. Andrew Bartlett (This used to be commit 58da78a7460d5d0a4abee7d7b84799c228e6bc0b)
2007-10-10r1187: * Remove testing hack (actually check signatures on NTLM2).Andrew Bartlett1-5/+2
* Remove unreached counter increment * Print the correct NTLMSSP key. (This used to be commit b96700695479c19c7b2c190616420762409fdf0d)
2007-10-10r1170: Remove bogus part of previous commit - session keys, even in NTLMSSPAndrew Bartlett1-2/+4
are variable length. Remove extra casts Andrew Bartlett (This used to be commit 84f86b83f88cea5564347f3aa623be2d9feeb4b3)
2007-10-10r1169: Some more updates to the NTLMSSP NTLM2 code:Andrew Bartlett2-46/+48
- implement key weakening - don't create large 'hashes' when we only want a key (signing subkeys) - make more useful debugs. NTLM2 is still off by default, till I figure out how to do NTLM2 signing. Andrew Bartlett (This used to be commit 079c2654851536b0a7918d408ac9597abbab8fd2)
2007-10-10r1134: added a TODO regarding schannel credentialsAndrew Tridgell1-1/+2
(This used to be commit 17dacf494ac25bb6d9f6dea8cb81968ea2b84c55)
2007-10-10r1131: remove an error msg for failing to open unexpected.tdbAndrew Tridgell1-1/+0
(This used to be commit ae393c2ed6b6039d28bb02d5e5104a6d25368ce6)
2007-10-10r1129: Remove unused function.Andrew Bartlett1-30/+0
Andrew Bartlett (This used to be commit 4d23b9e039872273f3ef433d94d24759bcb87c30)
2007-10-10r1091: Added in timing tests for deferred opens. Added extra debug info to ↵Jeremy Allison1-1/+1
signing mistakes. Jeremy. (This used to be commit 5c3a2417cfe1bdbdfb35d933d49f77f6696790b3)
2007-10-10r1080: Make sure to initialise all the returned elements in the SamLogonAndrew Bartlett1-10/+13
reply also initialise the LM session key, when we have it (was failing because the auth code was setting it's length wrong). Andrew Bartlett (This used to be commit de97d9df224f769953e850a276515923a830839c)
2007-10-10r1061: The start of the SamLogon call for the NETLOGON pipe.Andrew Bartlett1-0/+33
Changes: - Check for a valid 'pipe_state' in netr_ServerAuthenticate3 before we dereference it - removes the expansionroom[7] in the netr_SamInfo* structs to 7 individual elements. - renames netr_SamInfo -> netr_SamInfo2 netr_SamInfo2 -> netr_SamInfo3 - Having the thing we always called an 'info3' being 'netr_SamInfo2' was just too confusing. - Expand and fill in extra details about users from the SAM, into the server_info, for processing into the SamLogon reply. - Add a dum_sid_dup() function to duplicate a struct dom_sid The SamLogon code currently does not return supplementary groups, and is only tested with Samba4 smbtorture. Andrew Bartlett (This used to be commit 6c92563b7961f15fc74b02601e105d5e1d04f04d)
2007-10-10r1043: allocate signature from the right mem_ctx. Samba4 now passes the ↵Andrew Tridgell1-2/+2
schannel torture test. (This used to be commit 95599e3ef79bf5cafb556121c99ffc5c3a8f3314)
2007-10-10r1041: - pulled the domain join code out of the netlogon test and made it a ↵Andrew Tridgell1-1/+1
separate utility function, to allow multiple torture tests to temporarily join a domain - fixed a session key size problem - added a schannel test suite - allow schannel to work with ncacn_ip_tcp (This used to be commit 36f05e4d575099fcb957b8a55781c38dcd2e1177)
2007-10-10r1028: More consistancy fixes, which should also fix the build.Andrew Bartlett1-10/+10
Andrew Bartlett (This used to be commit 0d2ae66d3a82134d86084f63c05214e03dfcb48b)
2007-10-10r1024: Use samr_Password for the machine password here - this ensures we canAndrew Bartlett1-8/+8
never pass in something of the wrong length. Andrew Bartlett (This used to be commit d6999ea9c07d8652b0d63147e7294bc35e7063fe)
2007-10-10r1009: Make all users of NT and LM passwords use the samr_Password structure.Andrew Bartlett1-6/+6
This includes the netlogon pipe, for the machine account password change system. Andrew Bartlett (This used to be commit 49d545a82057ee8b60d50aa55e908efe59875150)
2007-10-10r1001: in samba4 we don't(shouldn't) use typedef's anymore...Stefan Metzmacher3-27/+23
metze (This used to be commit ac5f6f7e511a730448012c8a709887827aea2281)
2007-10-10r995: - renamed many of our crypto routines to use the industry standardAndrew Tridgell6-70/+131
names rather than our crazy naming scheme. So DES is now called des_crypt() rather than smbhash() - added the code from the solution of the ADS crypto challenge that allows Samba to correctly handle a 128 bit session key in all of the netr_ServerAuthenticateX() varients. A huge thanks to Luke Howard from PADL for solving this one! - restructured the server side rpc authentication to allow for other than NTLMSSP sign and seal. This commit just adds the structure, the next commit will add schannel server side support. - added 128 bit session key support to our client side code, and testing against w2k3 with smbtorture. Works well. (This used to be commit 729b2f41c924a0b435d44a14209e6dacc2304cee)
2007-10-10r975: slight improvemet to nt_errstr(), still needs to be fixed properlyAndrew Tridgell1-2/+2
(getting rid of the static buffer) (This used to be commit 86a6236c2ad14fe94f5d7c488bfdbfb329d2a0bb)
2007-10-10r962: convert 'unsigned' and 'unsigned int' to uint_tStefan Metzmacher7-27/+25
metze (This used to be commit 57151e80eb1090281401930c8fe25b20a8cf3a38)
2007-10-10r961: convert 'uchar' to 'uint8_t'Stefan Metzmacher10-130/+130
metze (This used to be commit 9f914e4af99e18b469d4cf9d8b1514a2bd28ddec)
2007-10-10r960: convert 'unsigned int' to uint_t in the most placesStefan Metzmacher6-8/+8
metze (This used to be commit 18062d2ed9fc9224c43143c10efbf2f6f1f5bbe0)
2007-10-10r950: - added netr_ServerAuthenticate3(). This is used by WinXP clients who ↵Andrew Tridgell1-0/+3
try to login to Samba4, as WinXP sees us as an ADS server. Unfortunately WinXP also uses a set of negotiate_flags that we don't support yet. Some crypto work needed. (This used to be commit 2d740b65706fb5b4ebc138587472a885d680517f)
2007-10-10r943: change samba4 to use 'uint8_t' instead of 'unsigned char'Stefan Metzmacher7-55/+55
metze (This used to be commit b5378803fdcb3b3afe7c2932a38828e83470f61a)
2007-10-10r917: - added the start of a LSA server to samba4.Andrew Tridgell1-1/+1
- added start of QueryDomainInfo in samr server "net rpc info" from samba3 now works against a samba4 server. I suspect join will work fairly soon. (This used to be commit 0a2c6a1062d0e364356853001f5f39bdb542f453)
2007-10-10r898: - remove some unused macrosAndrew Tridgell1-0/+7
- remove unused lib/smbpasswd.c - don't set the pkt size twice when doing SMB signing (This used to be commit 69a2942f7987647a32d43c71f41ac1a82a82ccda)
2007-10-10r893: a few more _t conversionsAndrew Tridgell1-1/+1
(This used to be commit 66eb46dbb1486c5916194bf6b303cf16373a272a)
2007-10-10r891: fix compileGerald Carter1-2/+2
(This used to be commit 8b6c048a02b4be0ba9c67ed82973041dccdd5c51)
2007-10-10r890: convert samba4 to use [u]int8_t instead of [u]int8Stefan Metzmacher21-70/+70
metze (This used to be commit 2986c5f08c8f0c26a2ea7b6ce20aae025183109f)
2007-10-10r889: convert samba4 to use [u]int16_t instead of [u]int16Stefan Metzmacher23-66/+66
metze (This used to be commit af6f1f8a01bebbecd99bc8c066519e89966e65e3)
2007-10-10r884: convert samba4 to use [u]int32_t instead of [u]int32Stefan Metzmacher18-50/+50
metze (This used to be commit 0e5517d937a2eb7cf707991d1c7498c1ab456095)
2007-10-10r874: This patch is a pile of work on NTLMSSP:Andrew Bartlett6-199/+294
Samba's NTLMSSP code is now fully talloc based, which should go a long way to cleaning up the memory leaks in this code. This also avoids a lot of extra copies of data, as we now allocate the 'return' blobs on a caller-supplied context. I have also been doing a lot of work towards NTLM2 signing and sealing. I have this working for sealing, but not for the verifier (MD5 integrity check on the stream) which is still incorrect. (I can aim a rpcecho sinkdata from a Win2k3 box to my server, and the data arrives intact, but the signature check fails. It does however match the test values I have...). The new torture test is cludged in - when we get a unit test suite back, I'll happliy put it in the 'right' place.... Andrew Bartlett (This used to be commit 399e2e2b1149b8d1c070aa7f0d5131c0b577d2b9)
2007-10-10r873: converted samba4 to use real 64 bit integers instead ofAndrew Tridgell8-39/+35
structures. This was suggested by metze recently. I checked on the build farm and all the machines we have support 64 bit ints, and support the LL suffix for 64 bit constants. I suspect some won't support strtoll() and related functions, so we will probably need replacements for those. (This used to be commit 9a9244a1c66654c12abe4379661cba83a73c4c21)
2007-10-10r754: Implement the SetPassword operation on the netlogon pipe.Andrew Bartlett1-16/+45
This involves allowing the password set code in samdb to take an already hashed password, and some fixes to our torture code. Andrew Bartlett (This used to be commit f9f581b5804a20785df06cde157b23c952edc2ce)
2007-10-10r743: Start on a NETLOGON server in Samba4.Andrew Bartlett2-3/+52
Currently this only authentiates the machine, not real users. As a consequence of running the Samba4 NETLOGON test against Samba4, I found a number of issues in the SAMR server, which I have addressed. There are more templates in the provison.ldif for this reason. I also added some debug to our credentials code, and fixed some bugs in the auth_sam module. The static buffer in generate_random_string() bit me badly, so I removed it in favor of a talloc based system. Andrew Bartlett (This used to be commit 94624e519b66def97758b8a48a01ffe9029176f0)
2007-10-10r719: Follow the trend - remove more unused functions.Andrew Bartlett1-22/+0
Andrew Bartlett (This used to be commit 62eef851fd79b2739b93b4ed7829514a3dcbf1d0)
2007-10-10r718: removed some more unused code, and two source filesAndrew Tridgell2-73/+0
(This used to be commit a9768c25fd32e76514c837f343f2b52bf0f0824d)
2007-10-10r708: Clean up copyright headers, to reflect code that has come and goneAndrew Bartlett1-4/+3
over time. Andrew Bartlett (This used to be commit 1a53e5c8296a7c09563abde1eb4a66ce9cf45473)
2007-10-10r702: fix krb5 linkingStefan Metzmacher1-1/+6
metze (This used to be commit d0145cec9f757d8867d54b1019a3060995a95072)
2007-10-10r697: make use of SMB_EXT_LIB for LDAP and KRB5Stefan Metzmacher1-1/+2
metze (This used to be commit b054f7d4906d1d2b96b352af09c6bdcf96553c2a)
2007-10-10r665: merge over the new build system from my tmp branchStefan Metzmacher2-35/+55
to the main SAMBA_4_0 tree. NOTE: that it's not completely ready, but it's functional:-) metze (This used to be commit c78a2ddb28ec50d6570a83b1f66f18a5c3621731)
2007-10-10r611: Fix breakage from my last commit:Andrew Bartlett1-6/+6
Now that all session keys are DATA_BLOBs, fix the callers. This assumes some things about the behaviour of certain crypto algorithms, without the ability to test it on session keys != 16 bytes in length. We will just need to retest when we get the KRB5 support in (DES keys are 8 bytes). Andrew Bartlett (This used to be commit e4355a7ec1eba92bdecef8cc478272897276dbae)
2007-10-10r610: - Merge the Samba3 'ntlm_auth --diagnostics' testsuite to Samba4.Andrew Bartlett9-51/+101
- This required using NETLOGON_NEG_AUTH2_FLAGS for the SetupCredentials2 negotiation flags, which is what Samba3 does, because otherwise the server uses different crypto. - This tests the returned session keys, which we decrypt. - Update the Samba4 notion of a 'session key' to be a DATA_BLOB in most places. - Fix session key code to return NT_STATUS_NO_SESSION_KEY if none is available. - Remove a useless argument to SMBsesskeygen_ntv1 - move netr_CredentialState from the .idl to the new credentials.h Andrew Bartlett (This used to be commit 44f8b5b53e6abd4de8a676f78d729988fadff320)
2007-10-10r451: More NTLMSSP work.Andrew Bartlett3-90/+167
The work here is trying to get the LM_KEY option for NLTMSSP operating, however until that functions properly, it is now controlled by some new smb.conf options, defaulting off. Andrew Bartlett (This used to be commit c63eb35b45c6db6e4c5302d1832bb5cef49a14f6)
generated by cgit (git 2.34.1) at 2024-11-15 04:19:02 +0000