Age | Commit message (Collapse) | Author | Files | Lines |
|
Avoids converting a static string to GUID every time we check whether
a transfer syntax is equal to that of NDR.
(This used to be commit 8dcfcaf75ab8cf4a54cf5e56f6be25acc68e3989)
|
|
back and
forth between GUID structs and strings in several places.
(This used to be commit 3564e2f967ef72d6301b4f7e9a311cebcded4d75)
|
|
(This used to be commit 2188168209f07bd87d90d7ff94e8b542ced68249)
|
|
dcerpc_interface_table struct rather then a tuple of interface
name, UUID and version.
This removes the requirement for having a global list of DCE/RPC interfaces,
except for these parts of the code that use that list explicitly
(ndrdump and the scanner torture test).
This should also allow us to remove the hack that put the authservice parameter
in the dcerpc_binding struct as it can now be read directly from
dcerpc_interface_table.
I will now modify some of these functions to take a dcerpc_syntax_id
structure rather then a full dcerpc_interface_table.
(This used to be commit 8aae0f168e54c01d0866ad6e0da141dbd828574f)
|
|
the difference between these at all, and in the future the
fact that INIT_OBJ_FILES include smb_build.h will be sufficient to
have recompiles at the right time.
(This used to be commit b24f2583edee38abafa58578d8b5c4b43e517def)
|
|
rafal
(This used to be commit 02e79800346d232bb14c476f62a3e5ba30f79bd4)
|
|
rafal
(This used to be commit 2d69e4b13e547768a36e293a9164923e35da7334)
|
|
Completely untested, it's a bit difficult without having vista
around (yet), so - Andrew, please test it and let me know what's
wrong.
rafal
(This used to be commit b9e7522bd4b626402c51a69695bea0928f5baef7)
|
|
instead make the normal composite_done() and composite_error()
functions automatically trigger a delayed callback if the caller has
had no opportunity to setup a async callback
this removes one of the common mistakes in writing a composite function
(This used to be commit f9413ce792ded682e05134b66d433eeec293e6f1)
|
|
rafal
(This used to be commit 4a12711c310f3dc228ea7be539703fc3fc77444a)
|
|
metze
(This used to be commit dc664df873c208c57752e8288a82cef77bc61338)
|
|
that allocated the composite_context
metze
(This used to be commit 998a7f8572bb90b5d478f03f09fba9867a6d8bfa)
|
|
out how and when to use composite_error() and composite_trigger_error().
Spotted by Metze.
rafal
(This used to be commit 218db3ebc06f2d3e906f23a36bad088861b8e720)
|
|
and move migrated (async) code to a new file.
rafal
(This used to be commit 79b231bc534e10149d86a2c647a27c27ce524949)
|
|
It's going to contain async functions and ncacn_np is the
first.
rafal
(This used to be commit 3fe2df5fe3165972536c937620d770e763b0d5bb)
|
|
in sync version. This step makes it easer to move further to async
dcerpc connect routine.
rafal
(This used to be commit 87b016d55315190fa3f6083c75cb783ad45ddd0b)
|
|
it only appeared to be like a SMBtrans request as it was being called
with function 0x11c017 which is "named pipe read write"
I wonder if this means we could do DCE/RPC over SMB using ntioctl
calls as well?
(This used to be commit f2b8857797328be64b0b85e875ae6d108e2aeaaa)
|
|
being freed before being given to gensec_update()
(This used to be commit cf2cb4279e2b31989eee2fec848982b10fcc2136)
|
|
- while running dcerpc over SMB2, the server will occasionally send us
a oh-so-useful STATUS_PENDING result meaning "I don't have a result
for you yet, but I'm working on it". These can be discarded :-)
(This used to be commit 24588a9c499536299d7aaf5b56ff73fb255290ca)
|
|
flag 'smb2' in the dcerpc binding string. This gives a pretty good
test to the new SMB2 trans call.
(This used to be commit f99bef585d4c1e52becc06b581bd5aaa62cf9dd7)
|
|
after volker gently pointed out that I should be wearing a paper bag
over my head for the last attempt :-)
(This used to be commit 7e132761fce75f64d3e7d42f650c45a483e37e3e)
|
|
destroying the dcerpc pipe
(This used to be commit 0b91602fa4b9a8b40331d088bdaac76381eac7ef)
|
|
(This used to be commit 94591bdb6542d4a3096074b672e19142c9236211)
|
|
(This used to be commit 128b5ea7b369df6e7433609a24128f8bf623c4fe)
|
|
- removed the struct dcerpc_request_state as all the state
information is already available on the dcerpc_pipe structure, so just
use that
- added a single dcerpc_recv_data() handler for receiving packets
from the transport layer. This then does the initial decoding of
the dcerpc packet, and then looks at the packet type in order to
work out who to dispatch it to. This should allow in-flight async
rpc requests to still work while a new bind or alter context is
happening
- ensure that if the transport indicates the connection is dead that
any in-flight bind or alter context requests are given an error
- removed full_request_private and instead use separate bind_private
and alter_private pointers
- added a few comments for some bits I found hard to understand
(This used to be commit 938e372bffbee1982ad8268b83c43514fd2e5633)
|
|
revision 11809 had removed the change to the session key function
after authentication succeeds.
(This used to be commit c04c78d617b0d8c9f8fa724d475fefbe9e478ef7)
|
|
ncacn_ip_tcp/ncalrpc. The problem was that svn revision 11809 removed
the logic that forced the CONNECT auth type for authenticated binds
which don't have an explicit SIGN or SEAL flag set.
(This used to be commit e7a1f11e8bcba3839f74c7303bd82533a6acfbcd)
|
|
hack for the
winbind "bug" :-)
Volker
(This used to be commit fb9a3c7ef376f289288c71bc47d67f548ddb7194)
|
|
(This used to be commit e1bf1c326f297321a6c8fdf9679130dba102669e)
|
|
This also removes dcerpc_bind_auth_password, the only user of
dcerpc_bind_auth. And this was not only passwords anyway.
Andrew Bartlett, as usual: Please take a close look.
Thanks,
Volker
(This used to be commit 2ff2dae3d035af6cb0c131573cfd983fc9a58eee)
|
|
closely. Survives RPC-ALTERCONTEXT.
Volker
(This used to be commit 1875c4808f8c30a6f750b88e166d43a736d5edc7)
|
|
(This used to be commit e75080b26d76199a6006fb076cf816ac023254ee)
|
|
(This used to be commit 16bc6b64f9053df3d08a05e7b7cfe77be6580d2b)
|
|
Tridge et al, please take a close look at this. It survives my basic rpc-login
test as well as rpc-lsa, but this is critical I think.
Volker
(This used to be commit bf1a55f44c84d9bb8b2f83f5d25727550ca8fcf2)
|
|
enabling of packet serialisation
(This used to be commit 6a47cd65a8b588f9ddd375c57caaba08281e7cbb)
|
|
allowing it to specify the initial read size (thus preventing
over-reading) and to stop the recv process when needed. This is used
by the dcerpc socket code, which relies on not getting packets when it
isn't ready for them
(This used to be commit f869fd674ec4b148dc9a264e94d19ce79d35131d)
|
|
(This used to be commit 4ea66e6e80de0d70b53bf9cd16c1dfd1c400f57e)
|
|
(This used to be commit 3e4ab756f421acd747e9ea4c48b0f61d48dfa8fd)
|
|
(This used to be commit 558c29971d5855308a9d8dfd21e8ac7ec24abc01)
|
|
consistancy.
Andrew Bartlett
(This used to be commit 8787eb982f899c68a490fb9c71c21ec1d9ec0308)
|
|
requests. If it's
not there (it's not yet on *any* call... :-)), the rpc client strictly
sequences calls to an rpc pipe. Might need some more work on the exact
sequencing semantics when a pipe with both sync and async calls is actually
deployed, but I want it in for winbind simplification.
Volker
(This used to be commit b8f324e4f000971b7dafc263c16dd4af958ee7f9)
|
|
within a callback on the pipe. This should fix a problem volker
encountered with winbind. The fix invoolves making the recv_data
handler free the memory for a packet, instead of having the transport
layer free it after calling recv_data. When the transport layer freed
it, it had no way of knowing if the callback had shutdown the pipe, so
it had no way of knowing if it could safely use the pointer.
Also changed the pipe shutdown hook for the smb transport to use an
async SMB close. This ensures that when you shutdown the pipe, you
don't block waiting for the server to ack the close of the pipe fnum.
(This used to be commit c87d7f580e39245db181605f50883de07dd9632e)
|
|
Tridge, if you have time, you might want to look at the segfault I was still
seeing. Now I store the handle to the netlogon pipe in the global winbind
state and free it on the next entry into check_machacc. The problem seems to
be that talloc_free()ing a pipe struct from within a callback function on that
pipe is not possible. I think I can live with that, but it has been not really
obvious. To reproduce the segfault you might want to look at putting a
talloc_free(state->getcreds->out.netlogon) into
wbsrv_samba3_check_machacc_receive_creds. This is called from a dcerpc
callback function.
In particular if the check failed it would be nice if I could delete the pipe
directly and not post a different event to some winbind queue.
I tried to delete the pipe from a timed event triggered immediately, but this
also fails because the inner loop seems to hit the same event again, calling
it twice.
Volker
(This used to be commit 5436d7764812bb632ba865e633005ed07923b57f)
|
|
Volker
(This used to be commit 42ff218ac98fab00bd58c4f50f11843ef32b4698)
|
|
I still have issues with Win2k3 SP1, and Samba4 doesn't pass it's own
test for the moment, but I'm working on these issues :-)
This required a change to the credentials API, so that the special
case for NTLM logins using a principal was indeed handled as a
special, not general case.
Also don't set the realm from a ccache, as then it overrides --option=realm=.
Andrew Bartlett
(This used to be commit 194e8f07c0cb4685797c5a7a074577c62dfdebe3)
|
|
field, instead put a zero address. Note that zero is correct (ie. we
shouldn't do the lookup) as in the client we want to send a zero for
the server to fill in. When we make this call from the server we fill
in a real IP.
(This used to be commit e54c8b5658761c33d50a1a557d2ec77229b07b47)
|
|
(This used to be commit aeb42a446b3c28c5cf6800606b3f9b70c49cb94b)
|
|
data to be signed/sealed. We can use this to split the data from the
signature portion of the resultant wrapped packet.
This required merging the gsskrb5_wrap_size patch from
lorikeet-heimdal, and fixes AES encrption issues on DCE/RPC (we no
longer use a static 45 byte value).
This fixes one of the krb5 issues in my list.
Andrew Bartlett
(This used to be commit e4f2afc34362953f56a026b66ae1aea81e9db104)
|
|
Kerberos CCACHE into the system.
This again allows the use of the system ccache when no username is
specified, and brings more code in common between gensec_krb5 and
gensec_gssapi.
It also has a side-effect that may (or may not) be expected: If there
is a ccache, even if it is not used (perhaps the remote server didn't
want kerberos), it will change the default username.
Andrew Bartlett
(This used to be commit 6202267f6ec1446d6bd11d1d37d05a977bc8d315)
|
|
requirements, and for better error reporting.
In particular, the composite session setup (extended security/SPNEGO)
code now returns errors, rather than NT_STATUS_NO_MEMORY. This is
seen particularly when GENSEC fails to start.
The tighter interface rules apply to NTLMSSP, which must be called
exactly the right number of times. This is to match some of our other
less-tested modules, where adding flexablity is harder. (and this is
security code, so let's just get it right). As such, the DCE/RPC and
LDAP clients have been updated.
Andrew Bartlett
(This used to be commit 134550cf752b9edad66c3368750bfb4bbd9d55d1)
|