summaryrefslogtreecommitdiff
path: root/source4/librpc/rpc/dcerpc_util.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r6028: A MAJOR update to intergrate the new credentails system fully withAndrew Bartlett1-3/+9
GENSEC, and to pull SCHANNEL into GENSEC, by making it less 'special'. GENSEC now no longer has it's own handling of 'set username' etc, instead it uses cli_credentials calls. In order to link the credentails code right though Samba, a lot of interfaces have changed to remove 'username, domain, password' arguments, and these have been replaced with a single 'struct cli_credentials'. In the session setup code, a new parameter 'workgroup' contains the client/server current workgroup, which seems unrelated to the authentication exchange (it was being filled in from the auth info). This allows in particular kerberos to only call back for passwords when it actually needs to perform the kinit. The kerberos code has been modified not to use the SPNEGO provided 'principal name' (in the mechListMIC), but to instead use the name the host was connected to as. This better matches Microsoft behaviour, is more secure and allows better use of standard kerberos functions. To achieve this, I made changes to our socket code so that the hostname (before name resolution) is now recorded on the socket. In schannel, most of the code from librpc/rpc/dcerpc_schannel.c is now in libcli/auth/schannel.c, and it looks much more like a standard GENSEC module. The actual sign/seal code moved to libcli/auth/schannel_sign.c in a previous commit. The schannel credentails structure is now merged with the rest of the credentails, as many of the values (username, workstation, domain) where already present there. This makes handling this in a generic manner much easier, as there is no longer a custom entry-point. The auth_domain module continues to be developed, but is now just as functional as auth_winbind. The changes here are consequential to the schannel changes. The only removed function at this point is the RPC-LOGIN test (simulating the load of a WinXP login), which needs much more work to clean it up (it contains copies of too much code from all over the torture suite, and I havn't been able to penetrate its 'structure'). Andrew Bartlett (This used to be commit 2301a4b38a21aa60917973451687063d83d18d66)
2007-10-10r5976: SIDs can't have more then 5 subauths (caught by [validate] andJelmer Vernooij1-0/+3
range()) (This used to be commit ec1eaa274b997197ca6996457229c802f1b76d56)
2007-10-10r5941: Commit this patch much earlier than I would normally prefer, but ↵Andrew Bartlett1-103/+88
metze needs a working tree... The main volume of this patch was what I started working on today: - Cleans up memory handling around DCE/RPC pipes, to have a parent talloc context. - Uses sepereate inner loops for some of the DCE/RPC tests The other and more important part of this patch fixes issues surrounding the new credentials framwork: This makes the struct cli_credentials always a talloc() structure, rather than on the stack. Parts of the cli_credentials code already assumed this. There were other issues, particularly in the DCERPC over SMB handling, as well as little things that had to be tidied up before test_w2k3.sh would start to pass. Andrew Bartlett (This used to be commit 0453f9d05d2e336fba1f85dbf2718d01fa2bf778)
2007-10-10r5932: Use cli_credentials somewhat more in the Gtk+ codeJelmer Vernooij1-6/+3
Support ncacn_spx in DCE/RPC bindings. (This used to be commit a0233a3a9a83176ae46873d3a25ed601758a1511)
2007-10-10r5930: Fix initialisation of dcerpc_binding->authserviceJelmer Vernooij1-0/+2
(This used to be commit f8cf161e0e59bd6b2a62135be8511403f4e9ca70)
2007-10-10r5929: Use cli_credentials for the SMB functions as well.Jelmer Vernooij1-6/+4
Fix a couple of bugs in the new cli_credentials code (This used to be commit 4ad481cfe5cde514d2ef9646147239f3faaa6173)
2007-10-10r5928: Use cli_credentials in:Jelmer Vernooij1-39/+25
- gtk+ (returned by GtkHostBindingDialog as well now) - torture/ - librpc/ - lib/com/dcom/ (This used to be commit ccefd782335e01e8e6ecb2bcd28a4f999c53b1a6)
2007-10-10r5902: A rather large change...Andrew Bartlett1-112/+95
I wanted to add a simple 'workstation' argument to the DCERPC authenticated binding calls, but this patch kind of grew from there. With SCHANNEL, the 'workstation' name (the netbios name of the client) matters, as this is what ties the session between the NETLOGON ops and the SCHANNEL bind. This changes a lot of files, and these will again be changed when jelmer does the credentials work. I also correct some schannel IDL to distinguish between workstation names and account names. The distinction matters for domain trust accounts. Issues in handling this (issues with lifetime of talloc pointers) caused me to change the 'creds_CredentialsState' and 'struct dcerpc_binding' pointers to always be talloc()ed pointers. In the schannel DB, we now store both the domain and computername, and query on both. This should ensure we fault correctly when the domain is specified incorrectly in the SCHANNEL bind. In the RPC-SCHANNEL test, I finally fixed a bug that vl pointed out, where the comment claimed we re-used a connection, but in fact we made a new connection. This was achived by breaking apart some of the dcerpc_secondary_connection() logic. The addition of workstation handling was also propogated to NTLMSSP and GENSEC, for completeness. The RPC-SAMSYNC test has been cleaned up a little, using a loop over usernames/passwords rather than manually expanded tests. This will be expanded further (the code in #if 0 in this patch) to use a newly created user account for testing. In making this test pass test_rpc.sh, I found a bug in the RPC-ECHO server, caused by the removal of [ref] and the assoicated pointer from the IDL. This has been re-added, until the underlying pidl issues are solved. (This used to be commit 824289dcc20908ddec957a4a892a103eec2da9b9)
2007-10-10r5603: add "authservice()" property to the interface property listStefan Metzmacher1-4/+8
so we can specify allowed target service names in the idl file the default is "host" metze (This used to be commit bf40d5321f3257bf9354a42d31265f1a9b0d53ad)
2007-10-10r5302: fixed a compilation problem on solaris caused by the recent includeAndrew Tridgell1-1/+1
changes (This used to be commit e7e015f79b10c353848a17f31c91a0593790a560)
2007-10-10r5298: - got rid of pstring.h from includes.h. This at least makes it a bitAndrew Tridgell1-1/+1
less likely that anyone will use pstring for new code - got rid of winbind_client.h from includes.h. This one triggered a huge change, as winbind_client.h was including system/filesys.h and defining the old uint32 and uint16 types, as well as its own pstring and fstring. (This used to be commit 9db6c79e902ec538108d6b7d3324039aabe1704f)
2007-10-10r5291: fixed ncacn_ip_tcp against windowsAndrew Tridgell1-3/+2
(This used to be commit 8df8308f7f7c937ea8bcbb4336e98911824ece48)
2007-10-10r5286: Some first steps in making the pidl code somewhat more generic for theJelmer Vernooij1-2/+2
various data types: Add ndr_flags argument to all ndr push/pull scalar functions (This used to be commit ab490c0c882bb13de190546c50a0631ecb8255ad)
2007-10-10r5209: Fix the endpoint mapper to work with IPX endpoints (whichJelmer Vernooij1-9/+128
accidently have the same protocol id as UUID's) Before this, Samba would give NDR errors when contacting a remote server that has IPX support enabled. This one was on my long due bugs list. (This used to be commit 7b847de64f35b8e897b64ad047d8aea3813214f8)
2007-10-10r5155: define ipv4address as a based IDL type, mapped to a "const char *" inAndrew Tridgell1-29/+8
the header, and defined on the wire as a 4 byte network byte order IP. This means the calling code doesn't have to worry about network byte order conversions. (This used to be commit 72048e37179dd5b9ada0c5280d2f0d8c23d1a17d)
2007-10-10r5148: use ipv4_addr also in epmapper idlStefan Metzmacher1-4/+4
metze (This used to be commit cbc1f172822363e1fc4495d27248464403748cae)
2007-10-10r5037: got rid of all of the TALLOC_DEPRECATED stuff. My apologies for theAndrew Tridgell1-2/+2
large commit. I thought this was worthwhile to get done for consistency. (This used to be commit ec32b22ed5ec224f6324f5e069d15e92e38e15c0)
2007-10-10r4962: add infrastructure to use raw krb5 auth in dcerpc client codeStefan Metzmacher1-0/+3
Note this doesn't work currently because the gensec_modules are not ready for that yet metze (This used to be commit 7b09a3f725baca5d4483b7ec24a9cb6151557bb5)
2007-10-10r4758: - added async support to the session request codeAndrew Tridgell1-7/+6
- added async support to the negprot client code - removed two unused parameters from smbcli_full_connection() code - converted smbclient to use smbcli_full_connection() rather than reinventing everything itself (This used to be commit 71cbe2873473e039b4511511302cb63f1c50bce8)
2007-10-10r4635: Fix NTLMSSP to return NT_STATUS_OK when it has constructed the authAndrew Bartlett1-4/+10
token in the client (the final token in the negotiation). Consequential fixes in the SPNEGO code, which now uses the out.length as the indicator of 'I need to send something to the other side'. Merge the NTLM and SPNEGO DCE-RPC authentication routines in the client. Fix the RPC-MULTIBIND test consequent to this merge. Andrew Bartlett (This used to be commit 43e3516fc03008e97ebb4ad1a0cde464303f43c6)
2007-10-10r4630: for ncacn_np if we don't have an explicit request for one of theAndrew Tridgell1-0/+4
advanced auth types we should do a plain bind. This fixes rpc connections to ancient servers (like sun cascade) (This used to be commit 59a5a0b218f7182c541a06ffc4528c1160699033)
2007-10-10r4627: - simplified the dcerpc auth code using a common functionAndrew Tridgell1-66/+41
- added support for "spnego" in binding strings. This enables SPNEGO auth in the dcerpc client code, using as many allter_context calls as are needed To try SPNEGO do this: smbtorture ncacn_ip_tcp:SERVER[spnego,seal] -Uadministrator%password RPC-SAMR (This used to be commit 9c0a3423f03111c110d21c0d3910e16aa1a8bf87)
2007-10-10r4618: - tidied up the alter_context client code a bitAndrew Tridgell1-3/+3
- there is no alter_nak or alter_ack packet, its all done in an alter_response - auto-allocated the contex_ids - tried to fix up the dcom code to work again with alter_context. Jelmer, please take a look :) (This used to be commit dd1c54add8884376601f2f8a56c01bfb8add030c)
2007-10-10r4617: basic alter_context requests now work in our client library. The testAndrew Tridgell1-0/+47
just does a simple LSA/DSSETUP combo, which is what w2k does in the ACL editor rpc calls that triggered this work (This used to be commit 0129ec947aa1fa5a7104dc3a666af3cb9bd104f1)
2007-10-10r4616: the first phase in the addition of proper support forAndrew Tridgell1-126/+166
dcerpc_alter_context and multiple context_ids in the dcerpc client library. This stage does the following: - split "struct dcerpc_pipe" into two parts, the main part being "struct dcerpc_connection", which contains all the parts not dependent on the context, and "struct dcerpc_pipe" which has the context dependent part. This is similar to the layering in libcli_*() for SMB - disable the current dcerpc_alter code. I've used a #warning until i get the 2nd phase finished. I don't know how portable #warning is, but it won't be long before I add full alter context support anyway, so it won't last long - cleanup the allocation of dcerpc_pipe structures. The previous code was quite awkward. (This used to be commit 4004c69937be7e5dae56f9567ca607f982d395d3)
2007-10-10r4588: fixed the double bind in ncalrpc with dcerpc_secondary_connection()Andrew Tridgell1-1/+1
(This used to be commit b65a95c11778fd778ad3c013664aea7d038e16ae)
2007-10-10r4587: fixed dcerpc_secondary_connection() for ncacn_ip_tcpAndrew Tridgell1-3/+1
this fixes RPC-SAMLOGON and some other tests on ncacn_ip_tcp (This used to be commit 244370d62424ab3c0f9d6689b0e674d057b3fc09)
2007-10-10r4526: - much simpler (and more accurate!) ndr_size_*() code generation. ItAndrew Tridgell1-2/+10
is less efficient, but I really doubt that matters. - use enum in epmapper.idl for protocol type - added support for "enum8bit" flag, used in epmapper.idl (This used to be commit 1a24a50384b7f588844cd012f1218ca242ca4507)
2007-10-10r4037: fixed a bunch of "might be uninitialised" warnings after enabling -O1 ↵Andrew Tridgell1-1/+1
in my compile (This used to be commit 0928b1f5b68c858922c3ea6c27ed03b5091c6221)
2007-10-10r3972: use GUID_* naming context and move GUID_* functions to one placeStefan Metzmacher1-1/+1
metze (This used to be commit 523e6acf4fec5d4946fa7c0c89f40d7d712c9f3a)
2007-10-10r3792: improved the posix -> nt error mapping, so we get things likeAndrew Tridgell1-1/+2
NT_STATUS_HOST_UNREACHABLE instead of NT_STATUS_UNSUCCESSFUL (This used to be commit f2a488e5668ab5d262269f1bab1b33a63265cbe9)
2007-10-10r3790: use a registration function that is called from dcerpc_*_init functionsJelmer Vernooij1-20/+18
rather then a large table in librpc/gen_ndr/tables.c. This will allow us to only link in only the required gen_ndr files (speeds up linking quite a bit, makes binaries smaller). Each gen_ndr_* file now has a init function that calls the init functions of the interfaces it contains. I did it this way to keep pidl's code simple, though it might hurt startup time a bit. I'd be happy to change it if people like one function better. (This used to be commit 3c436590ae95b58ad6d00e72d6fdd08a4d80f208)
2007-10-10r3611: DCOM client support works!!Jelmer Vernooij1-0/+4
The torture test DCOM-SIMPLE now successfully does an IStream_Read and a IStream_Write call. This test can now be run successfully against the "Simple DCOM" Visual Studio example. (You have to quote out line 337 in pidl. pidl complains if the variable that contains the array size follows the array. I still need to fix this properly) Next goals: - Clean up code - Server side support - Support custom marshalling - Support DCOM interfaces in files other then dcom.idl (This used to be commit 8693344772a9b700533179f4bacfe27ec27dfcfe)
2007-10-10r3602: Add looking up transport by endpoint protocolJelmer Vernooij1-0/+16
(This used to be commit 76c02ecbe8581fbf07bb59dd22ba88eb97b4fd04)
2007-10-10r3600: fixed two debug typosAndrew Tridgell1-2/+2
(This used to be commit d0149b173f70cf012e6ed2382394985fb4950af6)
2007-10-10r3542: Re-indent, and fix a use-after-free by doing the talloc_destroy just aAndrew Bartlett1-4/+4
little later. Andrew Bartlett (This used to be commit b7c2a4fc34ef09b177508dcf475055523b84587c)
2007-10-10r3516: dcerpc_epm_map_binding now checks the endpoints it nows firstJelmer Vernooij1-37/+24
and then possibly does a epm_Map call(). ncacn_np now also uses dcerpc_epm_map_binding() (This used to be commit 77eec3fa18dbbf4d774ccf04c7a38b0887f26ca6)
2007-10-10r3515: Fix RemoteActivation correctly this time (-:Jelmer Vernooij1-1/+7
Thanks to tridge for some help on this one! (This used to be commit 1104667190aa144e2c7d79ece9a55502b98d0351)
2007-10-10r3497: removed some include cruft, and split out librpc/gen_ndr/tables.hAndrew Tridgell1-0/+1
(This used to be commit 7dd3a5a6dadb0edc4fad56deba84f24b1e6dd2bc)
2007-10-10r3457: s_addr is a macro on solaris, so we can't use it in structure names. ↵Andrew Tridgell1-1/+1
arrgh. (This used to be commit 7842b23d01c53009259a2461600bd01159cecebf)
2007-10-10r3444: Don't use random data as endpoint if no default endpoint is known and noJelmer Vernooij1-1/+6
endpoint was specified for ncacn_np. (This used to be commit 5f47bf1187fbd07fd8eb88da2a1fea2b0e9addf8)
2007-10-10r3443: the next stage in the include files re-organisation.Andrew Tridgell1-2/+3
I have created the include/system/ directory, which will contain the wrappers for the system includes for logical subsystems. So far I have created include/system/kerberos.h and include/system/network.h, which contain all the system includes for kerberos code and networking code. These are the included in subsystems that need kerberos or networking respectively. Note that this method avoids the mess of #ifdef HAVE_XXX_H in every C file, instead each C module includes the include/system/XXX.h file for the logical system support it needs, and the details are kept isolated in include/system/ This patch also creates a "struct ipv4_addr" which replaces "struct in_addr" in our code. That avoids every C file needing to import all the system networking headers. (This used to be commit 2e25c71853f8996f73755277e448e7d670810349)
2007-10-10r3434: Fix memleakVolker Lendecke1-2/+3
(This used to be commit 0a12cc4cadf7c1e97282a0d8ab2f486536987a77)
2007-10-10r3428: switched to using minimal includes for the auto-generated RPC code.Andrew Tridgell1-1/+1
The thing that finally convinced me that minimal includes was worth pursuing for rpc was a compiler (tcc) that failed to build Samba due to reaching internal limits of the size of include files. Also the fact that includes.h.gch was 16MB, which really seems excessive. This patch brings it back to 12M, which is still too large, but better. Note that this patch speeds up compile times for both the pch and non-pch case. This change also includes the addition iof a "depends()" option in our IDL files, allowing you to specify that one IDL file depends on another. This capability was needed for the auto-includes generation. (This used to be commit b8f5fa8ac8e8725f3d321004f0aedf4246fc6b49)
2007-10-10r3412: Add NCACN_SPX and NCADG_IPX transportsJelmer Vernooij1-0/+6
(This used to be commit ff2f2b4273ce9a49599b385d32fbbd5e8f0d4c23)
2007-10-10r3392: fixed schannel over ncalrpcAndrew Tridgell1-0/+10
(This used to be commit 0b93be9f5f89ef17f94e8e98c3a405495e04e235)
2007-10-10r3391: fixed some memory leaks in the schannel codeAndrew Tridgell1-0/+2
(This used to be commit eb3366d3667ddddf7ab5eae5d1fbc5de86c41072)
2007-10-10r3388: when doing schannel use a anonymous session setup (as the machine acctAndrew Tridgell1-1/+2
isn't allowed to login on a share) (This used to be commit 8c0be60d8d59863f0bcdd17012dce923c139ce09)
2007-10-10r3280: fixed byte order of rhs IPAndrew Tridgell1-1/+1
(This used to be commit 29fab12d0b1649046ab2abb08b51f9845c8f8116)
2007-10-10r3278: - rewrote the client side rpc connection code to use lib/socket/Andrew Tridgell1-4/+5
rather than doing everything itself. This greatly simplifies the code, although I really don't like the socket_recv() interface (it always allocates memory for you, which means an extra memcpy in this code) - fixed several bugs in the socket_ipv4.c code, in particular client side code used a non-blocking connect but didn't handle EINPROGRESS, so it had no chance of working. Also fixed the error codes, using map_nt_error_from_unix() - cleaned up and expanded map_nt_error_from_unix() - changed interpret_addr2() to not take a mem_ctx. It makes absolutely no sense to allocate a fixed size 4 byte structure like this. Dozens of places in the code were also using interpret_addr2() incorrectly (precisely because the allocation made no sense) (This used to be commit 7f2c771b0e0e98c5c9e5cf662592d64d34ff1205)
generated by cgit (git 2.34.1) at 2024-12-02 04:07:07 +0000