summaryrefslogtreecommitdiff
path: root/source4/librpc/rpc
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r6565: Cludge, cludge, cludge...Andrew Bartlett3-24/+9
We need to pass the 'secure channel type' to the NETLOGON layer, which must match the account type. (Yes, jelmer objects to this inclusion of the kitchen sink ;-) Andrew Bartlett (This used to be commit 8ee208a926d2b15fdc42753b1f9ee586564c6248)
2007-10-10r6526: Rename this RPC fault. Everybody else calls this ACCESS_DENIED, andAndrew Bartlett1-1/+1
it certainly doesn't make sense as LOGON_FAILURE. Andrew Bartlett (This used to be commit 4bec3d3f378ed8b988e00441c9bb5718b8548ba6)
2007-10-10r6272: For 'programmed' use of an anonymous account, we should useAndrew Bartlett1-2/+9
cli_credentials_set_conf(), not cli_credentials_guess(). Also, clarify why for particular flags, we don't do a DCERPC-level authentication. Andrew Bartlett (This used to be commit 838925761d004a1426107f4c5c84d0276fddb2c0)
2007-10-10r6229: Back out these changes ...Richard Sharpe1-15/+1
(This used to be commit 321fbae51267153102e47845736f2c3a5abfe0be)
2007-10-10r6219: This change allows us to fall back to authenticating withoutRichard Sharpe1-1/+15
DCERPC_SCHANNEL_128 if we fail. Thus, it allows us to work with Windows NT DCs ... (This used to be commit 3034b226705c4736d57c9bf4e9470c4d44c72e8e)
2007-10-10r6178: fix ncacn_np connection without sign or seal against NT4Stefan Metzmacher1-1/+4
metze (This used to be commit d92100fcc2066454df441a1ea2c7b9940fa19fa1)
2007-10-10r6028: A MAJOR update to intergrate the new credentails system fully withAndrew Bartlett3-427/+30
GENSEC, and to pull SCHANNEL into GENSEC, by making it less 'special'. GENSEC now no longer has it's own handling of 'set username' etc, instead it uses cli_credentials calls. In order to link the credentails code right though Samba, a lot of interfaces have changed to remove 'username, domain, password' arguments, and these have been replaced with a single 'struct cli_credentials'. In the session setup code, a new parameter 'workgroup' contains the client/server current workgroup, which seems unrelated to the authentication exchange (it was being filled in from the auth info). This allows in particular kerberos to only call back for passwords when it actually needs to perform the kinit. The kerberos code has been modified not to use the SPNEGO provided 'principal name' (in the mechListMIC), but to instead use the name the host was connected to as. This better matches Microsoft behaviour, is more secure and allows better use of standard kerberos functions. To achieve this, I made changes to our socket code so that the hostname (before name resolution) is now recorded on the socket. In schannel, most of the code from librpc/rpc/dcerpc_schannel.c is now in libcli/auth/schannel.c, and it looks much more like a standard GENSEC module. The actual sign/seal code moved to libcli/auth/schannel_sign.c in a previous commit. The schannel credentails structure is now merged with the rest of the credentails, as many of the values (username, workstation, domain) where already present there. This makes handling this in a generic manner much easier, as there is no longer a custom entry-point. The auth_domain module continues to be developed, but is now just as functional as auth_winbind. The changes here are consequential to the schannel changes. The only removed function at this point is the RPC-LOGIN test (simulating the load of a WinXP login), which needs much more work to clean it up (it contains copies of too much code from all over the torture suite, and I havn't been able to penetrate its 'structure'). Andrew Bartlett (This used to be commit 2301a4b38a21aa60917973451687063d83d18d66)
2007-10-10r5980: Fix double free after unexpected disconnect.Jelmer Vernooij1-1/+5
(This used to be commit 6149bd3702a0293fc1f798de7c399e3e6858416d)
2007-10-10r5976: SIDs can't have more then 5 subauths (caught by [validate] andJelmer Vernooij1-0/+3
range()) (This used to be commit ec1eaa274b997197ca6996457229c802f1b76d56)
2007-10-10r5941: Commit this patch much earlier than I would normally prefer, but ↵Andrew Bartlett3-127/+101
metze needs a working tree... The main volume of this patch was what I started working on today: - Cleans up memory handling around DCE/RPC pipes, to have a parent talloc context. - Uses sepereate inner loops for some of the DCE/RPC tests The other and more important part of this patch fixes issues surrounding the new credentials framwork: This makes the struct cli_credentials always a talloc() structure, rather than on the stack. Parts of the cli_credentials code already assumed this. There were other issues, particularly in the DCERPC over SMB handling, as well as little things that had to be tidied up before test_w2k3.sh would start to pass. Andrew Bartlett (This used to be commit 0453f9d05d2e336fba1f85dbf2718d01fa2bf778)
2007-10-10r5932: Use cli_credentials somewhat more in the Gtk+ codeJelmer Vernooij1-6/+3
Support ncacn_spx in DCE/RPC bindings. (This used to be commit a0233a3a9a83176ae46873d3a25ed601758a1511)
2007-10-10r5930: Fix initialisation of dcerpc_binding->authserviceJelmer Vernooij1-0/+2
(This used to be commit f8cf161e0e59bd6b2a62135be8511403f4e9ca70)
2007-10-10r5929: Use cli_credentials for the SMB functions as well.Jelmer Vernooij1-6/+4
Fix a couple of bugs in the new cli_credentials code (This used to be commit 4ad481cfe5cde514d2ef9646147239f3faaa6173)
2007-10-10r5928: Use cli_credentials in:Jelmer Vernooij3-68/+48
- gtk+ (returned by GtkHostBindingDialog as well now) - torture/ - librpc/ - lib/com/dcom/ (This used to be commit ccefd782335e01e8e6ecb2bcd28a4f999c53b1a6)
2007-10-10r5902: A rather large change...Andrew Bartlett4-162/+194
I wanted to add a simple 'workstation' argument to the DCERPC authenticated binding calls, but this patch kind of grew from there. With SCHANNEL, the 'workstation' name (the netbios name of the client) matters, as this is what ties the session between the NETLOGON ops and the SCHANNEL bind. This changes a lot of files, and these will again be changed when jelmer does the credentials work. I also correct some schannel IDL to distinguish between workstation names and account names. The distinction matters for domain trust accounts. Issues in handling this (issues with lifetime of talloc pointers) caused me to change the 'creds_CredentialsState' and 'struct dcerpc_binding' pointers to always be talloc()ed pointers. In the schannel DB, we now store both the domain and computername, and query on both. This should ensure we fault correctly when the domain is specified incorrectly in the SCHANNEL bind. In the RPC-SCHANNEL test, I finally fixed a bug that vl pointed out, where the comment claimed we re-used a connection, but in fact we made a new connection. This was achived by breaking apart some of the dcerpc_secondary_connection() logic. The addition of workstation handling was also propogated to NTLMSSP and GENSEC, for completeness. The RPC-SAMSYNC test has been cleaned up a little, using a loop over usernames/passwords rather than manually expanded tests. This will be expanded further (the code in #if 0 in this patch) to use a newly created user account for testing. In making this test pass test_rpc.sh, I found a bug in the RPC-ECHO server, caused by the removal of [ref] and the assoicated pointer from the IDL. This has been re-added, until the underlying pidl issues are solved. (This used to be commit 824289dcc20908ddec957a4a892a103eec2da9b9)
2007-10-10r5667: Move schannel state into libcli/auth (as it belongs with schannel,Andrew Bartlett1-7/+0
which will move in with the rest of GENSEC shortly). Add the RID as another element in the schannel state. Andrew Bartlett (This used to be commit 69114b4a8e1c937ab5ff12ca91dd22bd83fd9a3b)
2007-10-10r5603: add "authservice()" property to the interface property listStefan Metzmacher3-5/+26
so we can specify allowed target service names in the idl file the default is "host" metze (This used to be commit bf40d5321f3257bf9354a42d31265f1a9b0d53ad)
2007-10-10r5488: - let the request be a child of the pipe structStefan Metzmacher1-13/+19
to fix dcerpc_pipe_close() on a secondary connection, while the callers mem_ctx of a request is still valid - fix up some memory contexts TODO: split up output mem_ctx from ndr_pull context metze (This used to be commit 0bcbd694e903a3caeb0daa81b2f115ec8a1b93d5)
2007-10-10r5388: uppercase the server name on ncacn_ip_tcpAndrew Tridgell1-1/+1
(This used to be commit c47eb38593f63ffe68f6bd51b101ea989eb8ee8e)
2007-10-10r5304: removed lib/socket/socket.h from includes.hAndrew Tridgell1-0/+1
(This used to be commit b902ea546d2d1327b23f40ddaeeaa8e7e3662454)
2007-10-10r5302: fixed a compilation problem on solaris caused by the recent includeAndrew Tridgell1-1/+1
changes (This used to be commit e7e015f79b10c353848a17f31c91a0593790a560)
2007-10-10r5298: - got rid of pstring.h from includes.h. This at least makes it a bitAndrew Tridgell1-1/+1
less likely that anyone will use pstring for new code - got rid of winbind_client.h from includes.h. This one triggered a huge change, as winbind_client.h was including system/filesys.h and defining the old uint32 and uint16 types, as well as its own pstring and fstring. (This used to be commit 9db6c79e902ec538108d6b7d3324039aabe1704f)
2007-10-10r5291: fixed ncacn_ip_tcp against windowsAndrew Tridgell1-3/+2
(This used to be commit 8df8308f7f7c937ea8bcbb4336e98911824ece48)
2007-10-10r5286: Some first steps in making the pidl code somewhat more generic for theJelmer Vernooij1-2/+2
various data types: Add ndr_flags argument to all ndr push/pull scalar functions (This used to be commit ab490c0c882bb13de190546c50a0631ecb8255ad)
2007-10-10r5209: Fix the endpoint mapper to work with IPX endpoints (whichJelmer Vernooij2-10/+129
accidently have the same protocol id as UUID's) Before this, Samba would give NDR errors when contacting a remote server that has IPX support enabled. This one was on my long due bugs list. (This used to be commit 7b847de64f35b8e897b64ad047d8aea3813214f8)
2007-10-10r5197: moved events code to lib/events/ (suggestion from metze)Andrew Tridgell2-2/+2
(This used to be commit 7f54c8a339f36aa43c9340be70ab7f0067593ef2)
2007-10-10r5195: most events don't need the time of the event, so save a ↵Andrew Tridgell1-1/+1
gettimeofday() call and just use timeval_current() when its actually needed (This used to be commit 236403cc4dc2924ed6a898acae0bb44cc1688dcc)
2007-10-10r5185: make all the events data structures private to events.c. This willAndrew Tridgell2-14/+10
make it possible to add optimisations to the events code such as keeping the next timed event in a sorted list, and using epoll for file descriptor events. I also removed the loop events code, as it wasn't being used anywhere, and changed timed events to always be one-shot (as adding a new timed event in the event handler is so easy to do if needed) (This used to be commit d7b4b6de51342a65bf46fce772d313f92f8d73d3)
2007-10-10r5155: define ipv4address as a based IDL type, mapped to a "const char *" inAndrew Tridgell1-29/+8
the header, and defined on the wire as a 4 byte network byte order IP. This means the calling code doesn't have to worry about network byte order conversions. (This used to be commit 72048e37179dd5b9ada0c5280d2f0d8c23d1a17d)
2007-10-10r5148: use ipv4_addr also in epmapper idlStefan Metzmacher1-4/+4
metze (This used to be commit cbc1f172822363e1fc4495d27248464403748cae)
2007-10-10r5137: fix typesStefan Metzmacher3-3/+3
metze (This used to be commit add1c579375d08040f722946da31ee3862f9e7ac)
2007-10-10r5037: got rid of all of the TALLOC_DEPRECATED stuff. My apologies for theAndrew Tridgell5-16/+16
large commit. I thought this was worthwhile to get done for consistency. (This used to be commit ec32b22ed5ec224f6324f5e069d15e92e38e15c0)
2007-10-10r4962: add infrastructure to use raw krb5 auth in dcerpc client codeStefan Metzmacher2-1/+7
Note this doesn't work currently because the gensec_modules are not ready for that yet metze (This used to be commit 7b09a3f725baca5d4483b7ec24a9cb6151557bb5)
2007-10-10r4944: every event_add_*() caller was having to call talloc_steal() to takeAndrew Tridgell1-1/+1
control of the event, so instead build that into the function. If you pass NULL as mem_ctx then it leaves it as a child of the events structure. (This used to be commit 7f981b9ed96f39027cbfd500f41e0c2be64cbb50)
2007-10-10r4886: fixed two places where we process the send side of a socket after theAndrew Tridgell1-0/+1
recv side in the same event. That's a bad idea, as the first callback could decide to destroy the socket. (This used to be commit bf74ea34fc0e3c31e220c8f5a9217c95f3ca1d52)
2007-10-10r4758: - added async support to the session request codeAndrew Tridgell1-7/+6
- added async support to the negprot client code - removed two unused parameters from smbcli_full_connection() code - converted smbclient to use smbcli_full_connection() rather than reinventing everything itself (This used to be commit 71cbe2873473e039b4511511302cb63f1c50bce8)
2007-10-10r4757: added the ability of the clisocket level of libcli to handle asyncAndrew Tridgell1-1/+1
socket connections. This was complicated by a few factors: - it meant moving the event context from clitransport to clisocket, so lots of structures changed - we need to asynchronously handle connection to lists of port numbers, not just one port number. The code internally tries each port in the list in turn, without ever blocking - the man page on how connect() is supposed to work asynchronously doesn't work in practice (now why doesn't this surprise me?). The getsockopt() for SOL_ERROR is supposed to retrieve the error, but in fact the next (unrelated) connect() call on the same socket also gets an error, though not the right error. To work around this I need to tear down the whole socket between each attempted port. I hate posix. Note that clisocket.c still does a blocking name resolution call in smbcli_sock_connect_byname(). That will be fixed when we add the async NBT resolution code. Also note that I arranged things so that every SMB connection is now async internally, so using plain smbclient or smbtorture tests all the async features of this new code. (This used to be commit 468f8ebbfdbdf37c757fdc4863626aa9946a8870)
2007-10-10r4691: Make the DCE-RPC bind code compleatly generic to the number of passesAndrew Bartlett1-6/+14
that the GENSEC mechanism wishes to select. It is of course up to the GENSEC mech and the remote server to actually support this however... Andrew Bartlett (This used to be commit 7200a01545e14a8b0c90fadf3c27933dd1f4359f)
2007-10-10r4636: Per tridge's wish (and probably correct behaviour), don't key off aAndrew Bartlett1-1/+3
specific GENSEC mech type, but on the behaviour of the mech. Andrew Bartlett (This used to be commit f2bd7a5a699b91d99d7dc2a0b3b6c7006274a59c)
2007-10-10r4635: Fix NTLMSSP to return NT_STATUS_OK when it has constructed the authAndrew Bartlett4-198/+101
token in the client (the final token in the negotiation). Consequential fixes in the SPNEGO code, which now uses the out.length as the indicator of 'I need to send something to the other side'. Merge the NTLM and SPNEGO DCE-RPC authentication routines in the client. Fix the RPC-MULTIBIND test consequent to this merge. Andrew Bartlett (This used to be commit 43e3516fc03008e97ebb4ad1a0cde464303f43c6)
2007-10-10r4630: for ncacn_np if we don't have an explicit request for one of theAndrew Tridgell2-2/+6
advanced auth types we should do a plain bind. This fixes rpc connections to ancient servers (like sun cascade) (This used to be commit 59a5a0b218f7182c541a06ffc4528c1160699033)
2007-10-10r4627: - simplified the dcerpc auth code using a common functionAndrew Tridgell6-118/+93
- added support for "spnego" in binding strings. This enables SPNEGO auth in the dcerpc client code, using as many allter_context calls as are needed To try SPNEGO do this: smbtorture ncacn_ip_tcp:SERVER[spnego,seal] -Uadministrator%password RPC-SAMR (This used to be commit 9c0a3423f03111c110d21c0d3910e16aa1a8bf87)
2007-10-10r4620: - add interface functions to the auth subsystem so that callers ↵Stefan Metzmacher1-14/+3
doesn't need to use function pointers anymore - make the module init much easier - a lot of cleanups don't try to read the diff in auth/ better read the new files it passes test_echo.sh and test_rpc.sh abartlet: please fix spelling fixes metze (This used to be commit 3c0d16b8236451f2cfd38fc3db8ae2906106d847)
2007-10-10r4619: Remove extern declaration of dcerpc_pipes, which is now staticJelmer Vernooij1-3/+0
(This used to be commit 95e849bf94160ae4807a54b28e351539c1119215)
2007-10-10r4618: - tidied up the alter_context client code a bitAndrew Tridgell5-103/+35
- there is no alter_nak or alter_ack packet, its all done in an alter_response - auto-allocated the contex_ids - tried to fix up the dcom code to work again with alter_context. Jelmer, please take a look :) (This used to be commit dd1c54add8884376601f2f8a56c01bfb8add030c)
2007-10-10r4617: basic alter_context requests now work in our client library. The testAndrew Tridgell2-4/+127
just does a simple LSA/DSSETUP combo, which is what w2k does in the ACL editor rpc calls that triggered this work (This used to be commit 0129ec947aa1fa5a7104dc3a666af3cb9bd104f1)
2007-10-10r4616: the first phase in the addition of proper support forAndrew Tridgell9-525/+560
dcerpc_alter_context and multiple context_ids in the dcerpc client library. This stage does the following: - split "struct dcerpc_pipe" into two parts, the main part being "struct dcerpc_connection", which contains all the parts not dependent on the context, and "struct dcerpc_pipe" which has the context dependent part. This is similar to the layering in libcli_*() for SMB - disable the current dcerpc_alter code. I've used a #warning until i get the 2nd phase finished. I don't know how portable #warning is, but it won't be long before I add full alter context support anyway, so it won't last long - cleanup the allocation of dcerpc_pipe structures. The previous code was quite awkward. (This used to be commit 4004c69937be7e5dae56f9567ca607f982d395d3)
2007-10-10r4591: - converted the other _p talloc functions to not need _pAndrew Tridgell3-2/+3
- added #if TALLOC_DEPRECATED around the _p functions - fixes the code that broke from the above while doing this I fixed quite a number of places that were incorrectly using the non type-safe talloc functions to use the type safe ones. Some were even doing multiplies for array allocation, which is potentially unsafe. (This used to be commit 6e7754abd0c225527fb38363996a6e241b87b37e)
2007-10-10r4588: fixed the double bind in ncalrpc with dcerpc_secondary_connection()Andrew Tridgell1-1/+1
(This used to be commit b65a95c11778fd778ad3c013664aea7d038e16ae)
2007-10-10r4587: fixed dcerpc_secondary_connection() for ncacn_ip_tcpAndrew Tridgell1-3/+1
this fixes RPC-SAMLOGON and some other tests on ncacn_ip_tcp (This used to be commit 244370d62424ab3c0f9d6689b0e674d057b3fc09)
generated by cgit (git 2.34.1) at 2024-11-19 03:32:56 +0000