summaryrefslogtreecommitdiff
path: root/source4/rpc_server/netlogon/dcerpc_netlogon.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r7633: this patch started as an attempt to make the dcerpc code use a givenAndrew Tridgell1-2/+4
event_context for the socket_connect() call, so that when things that use dcerpc are running alongside anything else it doesn't block the whole process during a connect. Then of course I needed to change any code that created a dcerpc connection (such as the auth code) to also take an event context, and anything that called that and so on .... thus the size of the patch. There were 3 places where I punted: - abartlet wanted me to add a gensec_set_event_context() call instead of adding it to the gensec init calls. Andrew, my apologies for not doing this. I didn't do it as adding a new parameter allowed me to catch all the callers with the compiler. Now that its done, we could go back and use gensec_set_event_context() - the ejs code calls auth initialisation, which means it should pass in the event context from the web server. I punted on that. Needs fixing. - I used a NULL event context in dcom_get_pipe(). This is equivalent to what we did already, but should be fixed to use a callers event context. Jelmer, can you think of a clean way to do that? I also cleaned up a couple of things: - libnet_context_destroy() makes no sense. I removed it. - removed some unused vars in various places (This used to be commit 3a3025485bdb8f600ab528c0b4b4eef0c65e3fc9)
2007-10-10r6544: Use common structures between SAMR, NETLGON and the Krb5 PAC.Andrew Bartlett1-2/+22
Fill out the group list for the SamLogon reply, so clients get the supplementary groups. Andrew Bartlett (This used to be commit d9c31e60a72c345e3a23a7eb742906bcfc18721c)
2007-10-10r6032: Fix up SetServerPassword2 on NETLOGON for [bigendian]. Clearly nobodyAndrew Bartlett1-3/+7
has the patience to run test_w2k3.sh to completion :-) It looks to me that the Windows server runs the RC4 over the C struct, not the NDR data. Andrew Bartlett (This used to be commit c324d974134c35b4c50c91d5a932a63c78b67046)
2007-10-10r5988: Fix the -P option (use machine account credentials) to use the Samba4Andrew Bartlett1-9/+9
secrets system, and not the old system from Samba3. This allowed the code from auth_domain to be shared - we now only lookup the secrets.ldb in lib/credentials.c. In order to link the resultant binary, samdb_search() has been moved from deep inside rpc_server into lib/gendb.c, along with the existing gendb_search_v(). The vast majority of this patch is the simple rename that followed, (Depending on the whole SAMDB for just this function seemed pointless, and brought in futher dependencies, such as smbencrypt.c). Andrew Bartlett (This used to be commit e13c671619bd290a8b3cae8555cb281a9a185ee0)
2007-10-10r5902: A rather large change...Andrew Bartlett1-0/+3
I wanted to add a simple 'workstation' argument to the DCERPC authenticated binding calls, but this patch kind of grew from there. With SCHANNEL, the 'workstation' name (the netbios name of the client) matters, as this is what ties the session between the NETLOGON ops and the SCHANNEL bind. This changes a lot of files, and these will again be changed when jelmer does the credentials work. I also correct some schannel IDL to distinguish between workstation names and account names. The distinction matters for domain trust accounts. Issues in handling this (issues with lifetime of talloc pointers) caused me to change the 'creds_CredentialsState' and 'struct dcerpc_binding' pointers to always be talloc()ed pointers. In the schannel DB, we now store both the domain and computername, and query on both. This should ensure we fault correctly when the domain is specified incorrectly in the SCHANNEL bind. In the RPC-SCHANNEL test, I finally fixed a bug that vl pointed out, where the comment claimed we re-used a connection, but in fact we made a new connection. This was achived by breaking apart some of the dcerpc_secondary_connection() logic. The addition of workstation handling was also propogated to NTLMSSP and GENSEC, for completeness. The RPC-SAMSYNC test has been cleaned up a little, using a loop over usernames/passwords rather than manually expanded tests. This will be expanded further (the code in #if 0 in this patch) to use a newly created user account for testing. In making this test pass test_rpc.sh, I found a bug in the RPC-ECHO server, caused by the removal of [ref] and the assoicated pointer from the IDL. This has been re-added, until the underlying pidl issues are solved. (This used to be commit 824289dcc20908ddec957a4a892a103eec2da9b9)
2007-10-10r5667: Move schannel state into libcli/auth (as it belongs with schannel,Andrew Bartlett1-8/+3
which will move in with the rest of GENSEC shortly). Add the RID as another element in the schannel state. Andrew Bartlett (This used to be commit 69114b4a8e1c937ab5ff12ca91dd22bd83fd9a3b)
2007-10-10r5308: trimmed back a lot of the old macros from smb_macros.hAndrew Tridgell1-2/+2
(This used to be commit bf43c9bdcf9e654d123f6a2b29feb9189ca9e561)
2007-10-10r5298: - got rid of pstring.h from includes.h. This at least makes it a bitAndrew Tridgell1-2/+2
less likely that anyone will use pstring for new code - got rid of winbind_client.h from includes.h. This one triggered a huge change, as winbind_client.h was including system/filesys.h and defining the old uint32 and uint16 types, as well as its own pstring and fstring. (This used to be commit 9db6c79e902ec538108d6b7d3324039aabe1704f)
2007-10-10r5090: Fix up the IDL for LogonGetDomainInfo in NETLOGON.Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit e5afc3609382a7b534c9d845e809d135a0d4eb3a)
2007-10-10r5037: got rid of all of the TALLOC_DEPRECATED stuff. My apologies for theAndrew Tridgell1-7/+7
large commit. I thought this was worthwhile to get done for consistency. (This used to be commit ec32b22ed5ec224f6324f5e069d15e92e38e15c0)
2007-10-10r4707: w2k3 don't restict passwords onStefan Metzmacher1-2/+4
netr_ServerPasswordSet and netr_ServerPasswordSet2 so we do now I also add a torture test for this metze (This used to be commit d896ac603a5cf387a10b21e64e2c92ff2626bc4d)
2007-10-10r4702: implment idl, torture test and server code for netr_ServerPasswordSet2()Stefan Metzmacher1-5/+108
metze (This used to be commit 7d8ba92da2b8babe7165f105591fd3e5738b2319)
2007-10-10r4648: fix netr_ServerPasswordSet() bugsStefan Metzmacher1-22/+18
metze (This used to be commit 7feface9b77f2be4f592d04a6131348af761a8e8)
2007-10-10r4647: - use talloc_zero() instead of ZERO_STRUCTP()Stefan Metzmacher1-23/+20
- fix uninitialized memory bug found by valgrind metze (This used to be commit 1118a1b1bb09c9a369bb9600fbe8ad3523b7e36f)
2007-10-10r4641: Push a few more details into the schannel ldb, and into theAndrew Bartlett1-44/+18
credentials struct it maintains. Clearly much of this will be replaced with some system to pass and store the session_info, as that is the 'right way' to handle this. Andrew Bartlett (This used to be commit c6fcb33a887fbf0c0b42c3bc331df942a985128c)
2007-10-10r4640: first stage in the server side support for multiple context_ids on ↵Andrew Tridgell1-20/+16
one pipe this stage does the following: - simplifies the dcerpc_handle handling, and all the callers of it - split out the context_id depenent state into a linked list of established contexts - fixed some talloc handling in several rpc servers that i noticed while doing the above (This used to be commit fde042b3fc609c94e2c7eedcdd72ecdf489cf63b)
2007-10-10r4639: initialize all struct members!Stefan Metzmacher1-8/+7
tridge: sorry for making you such a pain... could you check if that fixes your bugs metze (This used to be commit c215372eb0916df1e532b77c8365f401a8c32a38)
2007-10-10r4620: - add interface functions to the auth subsystem so that callers ↵Stefan Metzmacher1-48/+41
doesn't need to use function pointers anymore - make the module init much easier - a lot of cleanups don't try to read the diff in auth/ better read the new files it passes test_echo.sh and test_rpc.sh abartlet: please fix spelling fixes metze (This used to be commit 3c0d16b8236451f2cfd38fc3db8ae2906106d847)
2007-10-10r4499: Almost make our Samba4 server pass the RPC-SAMLOGON torture test.Andrew Bartlett1-56/+84
I just need to fix a couple of NTLMv2 issues before we can fully pass, and put this in test_rpc.sh, as a 'should pass' test. Andrew Bartlett (This used to be commit 4b52409e385366d87724bb79f4fad4803e8ecfec)
2007-10-10r4321: objectClass trustedDomain uses "securityIdentifier" for the sidStefan Metzmacher1-11/+13
also explicit tell the fill_info code what kind of object the current result is. metze (This used to be commit 6d74d31e50cd8f9d37fca53ef32bd50952a3a759)
2007-10-10r4041: fix cut-n-paste typoStefan Metzmacher1-1/+1
metze (This used to be commit 54398aa889b5954c7c387b252dd1a9173eac36f0)
2007-10-10r3922: Add yet another NETLOGON RPC. This is another varient of SamLogon,Andrew Bartlett1-3/+3
that works only on SCHANNEL secured connections (as it needs the implicit credentials). Fix some of the IDL. Andrew Bartlett (This used to be commit 90cd7b34cc18e758e939e0183281b7a517d728f0)
2007-10-10r3914: add idl, torture test and simple server for netr_DrsGetDCNameEx2()Stefan Metzmacher1-4/+41
metze (This used to be commit 1ffabbaa667c7dec6657ec523f92f072a2a47a95)
2007-10-10r3783: - don't use make proto for ldb anymoreStefan Metzmacher1-0/+1
- split ldh.h out of samba's includes.h - make ldb_context and ldb_module private to the subsystem - use ltdb_ prefix for all ldb_tdb functions metze (This used to be commit f5ee40d6ce8224e280070975efc9911558fe675c)
2007-10-10r3599: fixed a couple of memory errors in the rpc netlogon serverAndrew Tridgell1-2/+3
(found with valgrind) (This used to be commit 151dd4593d30c703b70099cd240784134fdb4e0f)
2007-10-10r3468: split out dcerpc_server.hAndrew Tridgell1-0/+1
(This used to be commit 729e0026e4408f74f140375537d4fe48c1fc3242)
2007-10-10r3453: - split out the auth and popt includesAndrew Tridgell1-0/+2
- tidied up some of the system includes - moved a few more structures back from misc.idl to netlogon.idl and samr.idl now that pidl knows about inter-IDL dependencies (This used to be commit 7b7477ac42d96faac1b0ff361525d2c63cedfc64)
2007-10-10r3428: switched to using minimal includes for the auto-generated RPC code.Andrew Tridgell1-0/+1
The thing that finally convinced me that minimal includes was worth pursuing for rpc was a compiler (tcc) that failed to build Samba due to reaching internal limits of the size of include files. Also the fact that includes.h.gch was 16MB, which really seems excessive. This patch brings it back to 12M, which is still too large, but better. Note that this patch speeds up compile times for both the pch and non-pch case. This change also includes the addition iof a "depends()" option in our IDL files, allowing you to specify that one IDL file depends on another. This capability was needed for the auto-includes generation. (This used to be commit b8f5fa8ac8e8725f3d321004f0aedf4246fc6b49)
2007-10-10r3364: Add parameter to fix the compile.Andrew Bartlett1-0/+1
Andrew Bartlett (This used to be commit effd10883b7b9d879a3e96801ef37992bc93bc97)
2007-10-10r2669: convert make_user_info() and associated functions from malloc to tallocAndrew Tridgell1-2/+4
(This used to be commit 278cef77f083c002d17ecbbe18c20825a380eda3)
2007-10-10r2648: - use a destructor on struct server_connection to simplify theAndrew Tridgell1-2/+3
connection termination cleanup, and to ensure that the event contexts are properly removed for every process model - gave auth_context the new talloc treatment, which removes another source of memory leaks. (This used to be commit 230e1cd777b0fba82dffcbd656cfa23c155d0560)
2007-10-10r2635: mem_ctx cleanups on the lsa and netlogon pipes in the rpc serverAndrew Tridgell1-28/+10
(This used to be commit 1ee5ed4197f49f12372835f66160801f19ee35a6)
2007-10-10r2515: Fixes from smbtorture - these session keys are not individually ↵Andrew Bartlett1-4/+8
encrypted. Andrew Bartlett (This used to be commit 131420b45e88cb72090c9b28a53295edfa364cfe)
2007-10-10r2247: talloc_destroy -> talloc_freeTim Potter1-6/+6
(This used to be commit 6c1a72c5d667245b1eec94f58e68acd22dd720ce)
2007-10-10r2051: switched the samdb over to using the new destructor and referenceAndrew Tridgell1-22/+4
count features of talloc, instead of re-implementing both those features inside of samdb (which is what we did before). This makes samdb considerably simpler, and also fixes some bugs, as I found some error paths that didn't call samdb_close(). Those are now handled by the fact that a talloc_free() will auto-close and destroy the samdb context, using a destructor. (This used to be commit da60987a92266734c33b81ee217081abdc4330f3)
2007-10-10r1993: Allow WinXP domain logon to progress a bit further (it seems broken ↵Andrew Bartlett1-5/+8
for me). Fix indent, and add a few more useful debug messages. Send a fault, if the bind is not accepted - don't just leave the client hanging. Andrew Bartlett (This used to be commit 486215edc1148ad754632be37760dc0d38b0340d)
2007-10-10r1983: a completely new implementation of tallocAndrew Tridgell1-2/+2
This version does the following: 1) talloc_free(), talloc_realloc() and talloc_steal() lose their (redundent) first arguments 2) you can use _any_ talloc pointer as a talloc context to allocate more memory. This allows you to create complex data structures where the top level structure is the logical parent of the next level down, and those are the parents of the level below that. Then destroy either the lot with a single talloc_free() or destroy any sub-part with a talloc_free() of that part 3) you can name any pointer. Use talloc_named() which is just like talloc() but takes the printf style name argument as well as the parent context and the size. The whole thing ends up being a very simple piece of code, although some of the pointer walking gets hairy. So far, I'm just using the new talloc() like the old one. The next step is to actually take advantage of the new interface properly. Expect some new commits soon that simplify some common coding styles in samba4 by using the new talloc(). (This used to be commit e35bb094c52e550b3105dd1638d8d90de71d854f)
2007-10-10r1498: (merge from 3.0)Andrew Bartlett1-2/+1
Rework our random number generation system. On systems with /dev/urandom, this avoids a change to secrets.tdb for every fork(). For other systems, we now only re-seed after a fork, and on startup. No need to do it per-operation. This removes the 'need_reseed' parameter from generate_random_buffer(). This also requires that we start the secrets subsystem, as that is where the reseed value is stored, for systems without /dev/urandom. In order to aviod identical streams in forked children, the random state is re-initialised after the fork(), at the same point were we do that to the tdbs. Andrew Bartlett (This used to be commit b97d3cb2efd68310b1aea8a3ac40a64979c8cdae)
2007-10-10r1335: NT_STATUS_INTERNAL_DB_CORRUPTIONStefan Metzmacher1-4/+4
should cause DEBUG(0,(...)); metze (This used to be commit 80851e67783a9c3c8bdd7f2b52e0b46dd7b18d05)
2007-10-10r1294: A nice, large, commit...Andrew Bartlett1-10/+4
This implements gensec for Samba's server side, and brings gensec up to the standards of a full subsystem. This means that use of the subsystem is by gensec_* functions, not function pointers in structures (this is internal). This causes changes in all the existing gensec users. Our RPC server no longer contains it's own generalised security scheme, and now calls gensec directly. Gensec has also taken over the role of auth/auth_ntlmssp.c An important part of gensec, is the output of the 'session_info' struct. This is now reference counted, so that we can correctly free it when a pipe is closed, no matter if it was inherited, or created by per-pipe authentication. The schannel code is reworked, to be in the same file for client and server. ntlm_auth is reworked to use gensec. The major problem with this code is the way it relies on subsystem auto-initialisation. The primary reason for this commit now.is to allow these problems to be looked at, and fixed. There are problems with the new code: - I've tested it with smbtorture, but currently don't have VMware and valgrind working (this I'll fix soon). - The SPNEGO code is client-only at this point. - We still do not do kerberos. Andrew Bartlett (This used to be commit 07fd885fd488fd1051eacc905a2d4962f8a018ec)
2007-10-10r1235: as the pidl code init all output data.Stefan Metzmacher1-2/+2
we should do it manualy too. metze (This used to be commit d3b80fd40a07575c18593523070986b7aed6de92)
2007-10-10r1234: valgrind found this uninitialised var...Stefan Metzmacher1-1/+8
But I don't know how to fix this correct, so maybe this needs to be fixed (tridge: can you please look at this) metze (This used to be commit b8b4d0d5bf037c79102709ea995ad8b8d6a9caff)
2007-10-10r1150: - fixed interactive sam logon in the rpc serverAndrew Tridgell1-8/+5
- added a torture test for interactive login in smbtorture These changes allow winxp to perform an interactive login (a login on the winxp console) against a Samba4 DC. Our netlogon server code is still filling in many of the fields incorrectly, but it fills in enough that winxp can login. (This used to be commit db9ea488b047b5f0f7538fd75fb7dde8277eb06b)
2007-10-10r1145: added server support for logon level 5 in sam logonAndrew Tridgell1-0/+1
(This used to be commit cb3d3b5e51dc9d52854c922b0c50686284ac8f1b)
2007-10-10r1141: - consolidated the netr_SamInfo structures using a netr_SamBaseInfoAndrew Tridgell1-62/+24
structure (andrew, this is the type of structure consolidation I think you were asking about. It's possible here in NDR as it isn't in the top level fn code) - added validation level 6 in sam logon With these changes I can successfully authentication smbclient to a winxp server, with the winxp server using a Samba4 ADS DC for account auth (This used to be commit 705205083a6e2430c420f44436a1d1ff8826bc73)
2007-10-10r1139: added IDL and server code for netr_LogonSamLogonWithFlags()Andrew Tridgell1-16/+33
(This used to be commit 4eac7340d8d7a109bed8fe7bb7cf663d6e7f0a56)
2007-10-10r1136: - added IDL for netr_LogonGetDomainInfo()Andrew Tridgell1-4/+168
- added workstation to auth_session_info in rpc servers - added session key fetch hook in crypto backends in dcesrv - store and fetch seed as well as a session key in schannel ldb - when a client uses schannel to setup a netlogon pipe connection we also need to setup the credentials from the schannel negotiation so credentials chaining works - added server side netr_LogonGetDomainInfo() call (This used to be commit a35459387de3b6a422c5af6f658338fc7e4314b0)
2007-10-10r1080: Make sure to initialise all the returned elements in the SamLogonAndrew Bartlett1-7/+14
reply also initialise the LM session key, when we have it (was failing because the auth code was setting it's length wrong). Andrew Bartlett (This used to be commit de97d9df224f769953e850a276515923a830839c)
2007-10-10r1061: The start of the SamLogon call for the NETLOGON pipe.Andrew Bartlett1-50/+135
Changes: - Check for a valid 'pipe_state' in netr_ServerAuthenticate3 before we dereference it - removes the expansionroom[7] in the netr_SamInfo* structs to 7 individual elements. - renames netr_SamInfo -> netr_SamInfo2 netr_SamInfo2 -> netr_SamInfo3 - Having the thing we always called an 'info3' being 'netr_SamInfo2' was just too confusing. - Expand and fill in extra details about users from the SAM, into the server_info, for processing into the SamLogon reply. - Add a dum_sid_dup() function to duplicate a struct dom_sid The SamLogon code currently does not return supplementary groups, and is only tested with Samba4 smbtorture. Andrew Bartlett (This used to be commit 6c92563b7961f15fc74b02601e105d5e1d04f04d)
2007-10-10r1058: The start of work on the SamLogon call for NETLOGON.Andrew Bartlett1-3/+130
This starts to store information about the user in the server_info struct - like the account name, the full name etc. Also, continue to make the names of the structure elements in the logon reply more consistant with those in the SAMR pipe. Andrew Bartlett (This used to be commit 3ccd96bd945e0fd95e42c69ad8ff07055af2e62b)
generated by cgit (git 2.34.1) at 2024-11-11 23:26:28 +0000