summaryrefslogtreecommitdiff
path: root/source4/torture/auth/pac.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r23792: convert Samba4 to GPLv3Andrew Tridgell1-3/+2
There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-10-10r22969: fix some more places where we could end up with more than one eventAndrew Tridgell1-2/+5
context. We now have an event context on the torture_context, and we can also get one from the cli_credentials structure (This used to be commit c0f65eb6562e13530337c23e3447a6aa6eb8fc17)
2007-10-10r22184: On some hosts, parsing a compleatly invalid principal causes heimadalAndrew Bartlett1-2/+6
to try and figure out what realm the current host is in (by DNS lookup for it's full domain name). We don't want to do that for this test, just break the checksum. Andrew Bartlett (This used to be commit 791e87514505acc68c5a8ff71fe9a27efdc6a027)
2007-10-10r19649: Fix indentation.Andrew Bartlett1-65/+65
Andrew Bartlett (This used to be commit ffce0087759d45a8dff8647feffa3bedbf42023b)
2007-10-10r19604: This is a massive commit, and I appologise in advance for it's size.Andrew Bartlett1-3/+5
This merges Samba4 with lorikeet-heimdal, which itself has been tracking Heimdal CVS for the past couple of weeks. This is such a big change because Heimdal reorganised it's internal structures, with the mechglue merge, and because many of our 'wishes' have been granted: we now have DCE_STYLE GSSAPI, send_to_kdc hooks and many other features merged into the mainline code. We have adapted to upstream's choice of API in these cases. In gensec_gssapi and gensec_krb5, we either expect a valid PAC, or NO PAC. This matches windows behavour. We also have an option to require the PAC to be present (which allows us to automate the testing of this code). This also includes a restructure of how the kerberos dependencies are handled, due to the fallout of the merge. Andrew Bartlett (This used to be commit 4826f1735197c2a471d771495e6d4c1051b4c471)
2007-10-10r19507: Merge my DSO fixes branch. Building Samba's libraries as shared ↵Jelmer Vernooij1-1/+1
libraries works again now, by specifying --enable-dso to configure. (This used to be commit 7a01235067a4800b07b8919a6a475954bfb0b04c)
2007-10-10r19339: Merge my 4.0-unittest branch. This adds an API for more fine-grainedJelmer Vernooij1-158/+123
output in the testsuite rather than just True or False for a set of tests. The aim is to use this for: * known failure lists (run all tests and detect tests that started working or started failing). This would allow us to get rid of the RPC-SAMBA3-* tests * nicer torture output * simplification of the testsuite system * compatibility with other unit testing systems * easier usage of smbtorture (being able to run one test and automatically set up the environment for that) This is still a work-in-progress; expect more updates over the next couple of days. (This used to be commit 0eb6097305776325c75081356309115f445a7218)
2007-10-10r16331: Split out registering of multi fn tests, fix typo in name of pac suite.Jelmer Vernooij1-1/+1
(This used to be commit 9e8574ac6cd38d1ff388f0c9ff37d86b316a431e)
2007-10-10r16328: Wrap all existing tests in simple single-function testsuites.Jelmer Vernooij1-4/+3
(This used to be commit 7e811adf59841936b7e634fca4e95630f890c5af)
2007-10-10r16304: Improve testing UI API. This now allows registering the fullJelmer Vernooij1-43/+13
test suite tree, looks a bit more like other unit testing API's, fixes some memory responsibility issues, introduces testcases, and removes the need for tests to call torture_ok(). (This used to be commit 0445b1a56a02552f895f400960b9ced39244a144)
2007-10-10r16158: Convert to use UI APIJelmer Vernooij1-125/+129
(This used to be commit 18f9584a791a7984560cdf577f3dde1ef1765fb0)
2007-10-10r15328: Move some functions around, remove dependencies.Jelmer Vernooij1-1/+0
Remove some autogenerated headers (which had prototypes now autogenerated by pidl) Remove ndr_security.h from a few places - it's no longer necessary (This used to be commit c19c2b51d3e1ad347120b06a22bda5ec586c22e8)
2007-10-10r14860: create libcli/security/security.hStefan Metzmacher1-1/+1
metze (This used to be commit 9ec706238c173992dc938d537bdf1103bf519dbf)
2007-10-10r14720: Add torture_context argument to all torture testsJelmer Vernooij1-1/+2
(This used to be commit 3c7a5ce29108dd82210dc3e1f00414f545949e1d)
2007-10-10r14464: Don't include ndr_BASENAME.h files unless strictly required, insteadJelmer Vernooij1-0/+1
try to include just the BASENAME.h files (containing only structs) (This used to be commit 3dd477ca5147f28a962b8437e2611a8222d706bd)
2007-10-10r13924: Split more prototypes out of include/proto.h + initial work on headerJelmer Vernooij1-0/+1
file dependencies (This used to be commit 122835876748a3eaf5e8d31ad1abddab9acb8781)
2007-10-10r12696: Reduce the size of include/structs.hJelmer Vernooij1-0/+1
(This used to be commit 63917616016133c623fc6ff59454bc313ee7dd8f)
2007-10-10r12608: Remove some unused #include lines.Jelmer Vernooij1-1/+0
(This used to be commit 70e7449318aa0e9d2639c76730a7d1683b2f4981)
2007-10-10r11968: More warning fixes. We're on track to getting to double digits forTim Potter1-1/+1
the number of warnings generated now. (This used to be commit d479f2d7607adc698d71c5ba26932c72a26dcaab)
2007-10-10r11543: A major upgrade to our KDC and PAC handling.Andrew Bartlett1-7/+8
We now put the PAC in the AS-REP, so that the client has it in the TGT. We then validate it (and re-sign it) on a TGS-REQ, ie when the client wants a ticket. This should also allow us to interop with windows KDCs. If we get an invalid PAC at the TGS stage, we just drop it. I'm slowly trying to move the application logic out of hdb-ldb.c, and back in with the rest of Samba's auth system, for consistancy. This continues that trend. Andrew Bartlett (This used to be commit 36973b1eef7db5983cce76ba241e54d5f925c69c)
2007-10-10r11282: Fix memory leak in LOCAL-PAC test.Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit c8bf7d32ebdc9bc795ce45a6d250a2378ac803aa)
2007-10-10r11277: fix compiler warningStefan Metzmacher1-1/+1
metze (This used to be commit 4d956b17c1f9e0d7a3c275b621380f1bc821b56e)
2007-10-10r11272: In trying to track down why Win2k3 is again rejecting our PAC, ensureAndrew Bartlett1-1/+80
we can round-trip all the way back to a server_info structure, not just a filled in PAC_DATA. (I was worried about generated fields being incorrect, or some other logical flaw). Andrew Bartlett (This used to be commit 11b1d78cc550c60201d12f8778ca8533712a5b1e)
2007-10-10r10146: Clarify which test is failing in error messages.Andrew Bartlett1-25/+29
Don't dump the pac to x.dat (accidental commit). Andrew Bartlett (This used to be commit a798d76a4ad6c0cb280d4e03e9819702acb16f55)
2007-10-10r10066: This is the second in my patches to work on Samba4's kerberos support,Andrew Bartlett1-9/+134
with an aim to make the code simpiler and more correct. Gone is the old (since the very early Samba 3.0 krb5 days) 'iterate over all keytypes)' code in gensec_krb5, we now follow the approach used in gensec_gssapi, and use a keytab. I have also done a lot of work in the GSSAPI code, to try and reduce the diff between us and upstream heimdal. It was becoming hard to track patches in this code, and I also want this patch (the DCE_STYLE support) to be in a 'manageable' state for when lha considers it for merging. (metze assures me it still has memory leak problems, but I've started to address some of that). This patch also includes a simple update of other code to current heimdal, as well as changes we need for better PAC verification. On the PAC side of things we now match windows member servers by checking the name and authtime on an incoming PAC. Not generating these right was the cause of the PAC pain, and so now both the main code and torture test validate this behaviour. One thing doesn't work with this patch: - the sealing of RPC pipes with kerberos, Samba -> Samba seems broken. I'm pretty sure this is related to AES, and the need to break apart the gss_wrap interface. Andrew Bartlett (This used to be commit a3aba57c00a9c5318f4706db55d03f64e8bea60c)
2007-10-10r9701: Provide correct parameters.Andrew Bartlett1-3/+3
Andrew Bartlett (This used to be commit 1cd62944f1387a3922e01dbee9bcf28f96f131ad)
2007-10-10r9681: We don't need the full smb_krb5_context here, so just pass the ↵Andrew Bartlett1-2/+2
krb5_context. Andrew Bartlett (This used to be commit 47699019dbb7aa48e7acd6bf8364e40917db8410)
2007-10-10r9649: missed a spot .....Andrew Tridgell1-0/+1
(This used to be commit d3b5d006717c24660244c6475ffc73cb0b56d021)
2007-10-10r9647: saved_pac is binary data, so prevent any possible portability ↵Andrew Tridgell1-1/+1
problems with signed chars (This used to be commit 4b3e3a9633bf7ce57f537b9897c0e9c613a99f7a)
2007-10-10r9608: don't validate the hard-coded sid for an external pac fileAndrew Tridgell1-1/+2
(This used to be commit 7e6957b906be760e7eb7e6ab6dbc86efeb0c42d2)
2007-10-10r9603: allow the LOCAL-PAC test to use keys and pac data from the command lineAndrew Tridgell1-10/+31
For example: bin/smbtorture //xx/y LOCAL-PAC --option 'torture:pac_file=x.dat' --option 'torture:pac_kdc_key=B286757148AF7FD252C53603A150B7E7' --option 'torture:pac_member_key=D217FAEAE5E6B5F95CCC94077AB8A5FC' (This used to be commit e0978ead23c493a802ce69ed7be871b2a9a54498)
2007-10-10r9234: Ensure we always change the end of the PAC, no matter what it is. FixAndrew Bartlett1-3/+3
typo in comment. Andrew Bartlett (This used to be commit c96f8594b16c6a5310e2e8727bb6975f2a193231)
2007-10-10r9167: Further PAC parionia: ensure the checksum fails if we modify it.Andrew Bartlett1-6/+45
Andrew Bartlett (This used to be commit ea4cc6bcbed4f26855d2f67d914c73453c524406)
2007-10-10r9166: This checks more of auth subsystem in the PAC test.Andrew Bartlett1-17/+117
Andrew Bartlett (This used to be commit 1fa87223eb66825ef2dd93966652fa84de6b0b2f)
2007-10-10r9084: 'resign' the sample PAC for the validation of the signature algorithms.Andrew Bartlett1-34/+22
If we ever get problems with the kerberos code, it should show up as a different signature in this PAC. This involved returning more data from the pac functions, so changed some callers and split up some functions. Andrew Bartlett (This used to be commit d514a7491208afa0533bf9e99601147eb69e08c9)
2007-10-10r8792: Clarify commentsAndrew Bartlett1-4/+6
(This used to be commit 6174cf826fac8288b6604d9140b741aab2156cb3)
2007-10-10r8520: fixed a pile of warnings from the build farm gcc -Wall output onAndrew Tridgell1-2/+2
S390. This is an attempt to avoid the panic we're seeing in the automatic builds. The main fixes are: - assumptions that sizeof(size_t) == sizeof(int), mostly in printf formats - use of NULL format statements to perform dn searches. - assumption that sizeof() returns an int (This used to be commit a58ea6b3854973b694d2b1e22323ed7eb00e3a3f)
2007-10-10r8252: Steal metze's thunder, and prove that with a few small tweaks, we canAndrew Bartlett1-1/+8
now push/pull a sample PAC, and still have the same byte buffer. (Metze set up the string code, and probably already has a similar patch). Unfortunetly win2k3 still doesn't like what we provide, but every step helps. Also use data_blob_const() when we are just wrapping data for API reasons. Andrew Bartlett (This used to be commit e7c8076fc1459ff2ccefdaf0b091d04ee6137957)
2007-10-10r8250: More PAC work. We now sucessfully verify the KDC signature from my DCAndrew Bartlett1-4/+35
(I have included the krbtgt key from my test network). It turns out the krbtgt signature is over the 16 (or whatever, enc-type dependent) bytes of the signature, not the entire structure. Also do not even try to use Kerberos or GSSAPI on an IP address, it will only fail. Andrew Bartlett (This used to be commit 3b9558e82fdebb58f240d43f6a594d676eb04daf)
2007-10-10r8156: I found out that the unknown[2] field of the unknown[4] array is a ↵Stefan Metzmacher1-3/+3
length too, it's always 16 bytes smaller than the size in the PAC_BUFFER we now dump the blob's on LOCAL-PAC with -d 10 metze (This used to be commit 4ef721ce53539ac56ca8ac4d601f512149ca7283)
2007-10-10r8154: - fix some mem_lealsStefan Metzmacher1-0/+14
- check if the buffer length of the original and created buffer are equal metze (This used to be commit 84ff2d87e28df3e2b3c1495a9ea48f40221b96ae)
2007-10-10r8148: - make the PAC generation code a bit more readable and add some outof ↵Stefan Metzmacher1-2/+26
memory checks - move to handmodified pull/push code for PAC_BUFFER to get the _ndr_size field and the subcontext size right - after looking closely to the sample w2k3 PAC in our torture test (and some more in my archive) I found out that the first uint32 before the netr_SamInfo3 was also a pointer, (and we passed a NULL pointer there before, so I think that was the reason why the windows clients doesn't want our PAC) w2k3 uses this for unique pointers: ptr = ndr->ptr_count * 4; ptr |= 0x00020000; ndr->ptr_count; - do one more pull/push round with the sample PAC metze (This used to be commit 0eee17941595e9842a264bf89ac73ca66cea7ed5)
2007-10-10r8112: Remove extra headers, and add #ifdef to allow the 'not yet usingAndrew Bartlett1-3/+13
Heimdal' case. Andrew Bartlett (This used to be commit b7c3c2f67188d8c8478d93e6890a81fa7d468061)
2007-10-10r8110: More PAC work. I still can't get WinXP to accept the PAC, but we areAndrew Bartlett1-0/+253
much closer. This changes PIDL to allow a subcontext to have a pad8 flag, saying to pad behind to an 8 byte boundary. This is the only way I can explain the 4 trainling zeros in the signature struct. Far more importantly, the PAC code is now under self-test, both in creating/parsing our own PAC, but also a PAC from my win2k3 server. This required changing auth_anonymous, because I wanted to reuse the anonymous 'server_info' generation code. I'm still having trouble with PIDL, particulary as surrounds value(), but I'll follow up on the list. Andrew Bartlett (This used to be commit 50a54bf4e9bf04d2a8e0aebb3482a2ff655c8bbb)
generated by cgit (git 2.34.1) at 2024-12-26 14:34:24 +0000