summaryrefslogtreecommitdiff
path: root/source4/torture/auth
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r11968: More warning fixes. We're on track to getting to double digits forTim Potter1-1/+1
the number of warnings generated now. (This used to be commit d479f2d7607adc698d71c5ba26932c72a26dcaab)
2007-10-10r11543: A major upgrade to our KDC and PAC handling.Andrew Bartlett1-7/+8
We now put the PAC in the AS-REP, so that the client has it in the TGT. We then validate it (and re-sign it) on a TGS-REQ, ie when the client wants a ticket. This should also allow us to interop with windows KDCs. If we get an invalid PAC at the TGS stage, we just drop it. I'm slowly trying to move the application logic out of hdb-ldb.c, and back in with the rest of Samba's auth system, for consistancy. This continues that trend. Andrew Bartlett (This used to be commit 36973b1eef7db5983cce76ba241e54d5f925c69c)
2007-10-10r11282: Fix memory leak in LOCAL-PAC test.Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit c8bf7d32ebdc9bc795ce45a6d250a2378ac803aa)
2007-10-10r11277: fix compiler warningStefan Metzmacher1-1/+1
metze (This used to be commit 4d956b17c1f9e0d7a3c275b621380f1bc821b56e)
2007-10-10r11272: In trying to track down why Win2k3 is again rejecting our PAC, ensureAndrew Bartlett1-1/+80
we can round-trip all the way back to a server_info structure, not just a filled in PAC_DATA. (I was worried about generated fields being incorrect, or some other logical flaw). Andrew Bartlett (This used to be commit 11b1d78cc550c60201d12f8778ca8533712a5b1e)
2007-10-10r10146: Clarify which test is failing in error messages.Andrew Bartlett1-25/+29
Don't dump the pac to x.dat (accidental commit). Andrew Bartlett (This used to be commit a798d76a4ad6c0cb280d4e03e9819702acb16f55)
2007-10-10r10066: This is the second in my patches to work on Samba4's kerberos support,Andrew Bartlett1-9/+134
with an aim to make the code simpiler and more correct. Gone is the old (since the very early Samba 3.0 krb5 days) 'iterate over all keytypes)' code in gensec_krb5, we now follow the approach used in gensec_gssapi, and use a keytab. I have also done a lot of work in the GSSAPI code, to try and reduce the diff between us and upstream heimdal. It was becoming hard to track patches in this code, and I also want this patch (the DCE_STYLE support) to be in a 'manageable' state for when lha considers it for merging. (metze assures me it still has memory leak problems, but I've started to address some of that). This patch also includes a simple update of other code to current heimdal, as well as changes we need for better PAC verification. On the PAC side of things we now match windows member servers by checking the name and authtime on an incoming PAC. Not generating these right was the cause of the PAC pain, and so now both the main code and torture test validate this behaviour. One thing doesn't work with this patch: - the sealing of RPC pipes with kerberos, Samba -> Samba seems broken. I'm pretty sure this is related to AES, and the need to break apart the gss_wrap interface. Andrew Bartlett (This used to be commit a3aba57c00a9c5318f4706db55d03f64e8bea60c)
2007-10-10r9701: Provide correct parameters.Andrew Bartlett1-3/+3
Andrew Bartlett (This used to be commit 1cd62944f1387a3922e01dbee9bcf28f96f131ad)
2007-10-10r9681: We don't need the full smb_krb5_context here, so just pass the ↵Andrew Bartlett1-2/+2
krb5_context. Andrew Bartlett (This used to be commit 47699019dbb7aa48e7acd6bf8364e40917db8410)
2007-10-10r9649: missed a spot .....Andrew Tridgell1-0/+1
(This used to be commit d3b5d006717c24660244c6475ffc73cb0b56d021)
2007-10-10r9647: saved_pac is binary data, so prevent any possible portability ↵Andrew Tridgell1-1/+1
problems with signed chars (This used to be commit 4b3e3a9633bf7ce57f537b9897c0e9c613a99f7a)
2007-10-10r9608: don't validate the hard-coded sid for an external pac fileAndrew Tridgell1-1/+2
(This used to be commit 7e6957b906be760e7eb7e6ab6dbc86efeb0c42d2)
2007-10-10r9603: allow the LOCAL-PAC test to use keys and pac data from the command lineAndrew Tridgell1-10/+31
For example: bin/smbtorture //xx/y LOCAL-PAC --option 'torture:pac_file=x.dat' --option 'torture:pac_kdc_key=B286757148AF7FD252C53603A150B7E7' --option 'torture:pac_member_key=D217FAEAE5E6B5F95CCC94077AB8A5FC' (This used to be commit e0978ead23c493a802ce69ed7be871b2a9a54498)
2007-10-10r9234: Ensure we always change the end of the PAC, no matter what it is. FixAndrew Bartlett1-3/+3
typo in comment. Andrew Bartlett (This used to be commit c96f8594b16c6a5310e2e8727bb6975f2a193231)
2007-10-10r9167: Further PAC parionia: ensure the checksum fails if we modify it.Andrew Bartlett1-6/+45
Andrew Bartlett (This used to be commit ea4cc6bcbed4f26855d2f67d914c73453c524406)
2007-10-10r9166: This checks more of auth subsystem in the PAC test.Andrew Bartlett1-17/+117
Andrew Bartlett (This used to be commit 1fa87223eb66825ef2dd93966652fa84de6b0b2f)
2007-10-10r9084: 'resign' the sample PAC for the validation of the signature algorithms.Andrew Bartlett1-34/+22
If we ever get problems with the kerberos code, it should show up as a different signature in this PAC. This involved returning more data from the pac functions, so changed some callers and split up some functions. Andrew Bartlett (This used to be commit d514a7491208afa0533bf9e99601147eb69e08c9)
2007-10-10r8792: Clarify commentsAndrew Bartlett1-4/+6
(This used to be commit 6174cf826fac8288b6604d9140b741aab2156cb3)
2007-10-10r8520: fixed a pile of warnings from the build farm gcc -Wall output onAndrew Tridgell2-4/+6
S390. This is an attempt to avoid the panic we're seeing in the automatic builds. The main fixes are: - assumptions that sizeof(size_t) == sizeof(int), mostly in printf formats - use of NULL format statements to perform dn searches. - assumption that sizeof() returns an int (This used to be commit a58ea6b3854973b694d2b1e22323ed7eb00e3a3f)
2007-10-10r8252: Steal metze's thunder, and prove that with a few small tweaks, we canAndrew Bartlett1-1/+8
now push/pull a sample PAC, and still have the same byte buffer. (Metze set up the string code, and probably already has a similar patch). Unfortunetly win2k3 still doesn't like what we provide, but every step helps. Also use data_blob_const() when we are just wrapping data for API reasons. Andrew Bartlett (This used to be commit e7c8076fc1459ff2ccefdaf0b091d04ee6137957)
2007-10-10r8250: More PAC work. We now sucessfully verify the KDC signature from my DCAndrew Bartlett1-4/+35
(I have included the krbtgt key from my test network). It turns out the krbtgt signature is over the 16 (or whatever, enc-type dependent) bytes of the signature, not the entire structure. Also do not even try to use Kerberos or GSSAPI on an IP address, it will only fail. Andrew Bartlett (This used to be commit 3b9558e82fdebb58f240d43f6a594d676eb04daf)
2007-10-10r8156: I found out that the unknown[2] field of the unknown[4] array is a ↵Stefan Metzmacher1-3/+3
length too, it's always 16 bytes smaller than the size in the PAC_BUFFER we now dump the blob's on LOCAL-PAC with -d 10 metze (This used to be commit 4ef721ce53539ac56ca8ac4d601f512149ca7283)
2007-10-10r8154: - fix some mem_lealsStefan Metzmacher1-0/+14
- check if the buffer length of the original and created buffer are equal metze (This used to be commit 84ff2d87e28df3e2b3c1495a9ea48f40221b96ae)
2007-10-10r8148: - make the PAC generation code a bit more readable and add some outof ↵Stefan Metzmacher1-2/+26
memory checks - move to handmodified pull/push code for PAC_BUFFER to get the _ndr_size field and the subcontext size right - after looking closely to the sample w2k3 PAC in our torture test (and some more in my archive) I found out that the first uint32 before the netr_SamInfo3 was also a pointer, (and we passed a NULL pointer there before, so I think that was the reason why the windows clients doesn't want our PAC) w2k3 uses this for unique pointers: ptr = ndr->ptr_count * 4; ptr |= 0x00020000; ndr->ptr_count; - do one more pull/push round with the sample PAC metze (This used to be commit 0eee17941595e9842a264bf89ac73ca66cea7ed5)
2007-10-10r8112: Remove extra headers, and add #ifdef to allow the 'not yet usingAndrew Bartlett1-3/+13
Heimdal' case. Andrew Bartlett (This used to be commit b7c3c2f67188d8c8478d93e6890a81fa7d468061)
2007-10-10r8110: More PAC work. I still can't get WinXP to accept the PAC, but we areAndrew Bartlett1-0/+253
much closer. This changes PIDL to allow a subcontext to have a pad8 flag, saying to pad behind to an 8 byte boundary. This is the only way I can explain the 4 trainling zeros in the signature struct. Far more importantly, the PAC code is now under self-test, both in creating/parsing our own PAC, but also a PAC from my win2k3 server. This required changing auth_anonymous, because I wanted to reuse the anonymous 'server_info' generation code. I'm still having trouble with PIDL, particulary as surrounds value(), but I'll follow up on the list. Andrew Bartlett (This used to be commit 50a54bf4e9bf04d2a8e0aebb3482a2ff655c8bbb)
2007-10-10r7633: this patch started as an attempt to make the dcerpc code use a givenAndrew Tridgell1-2/+2
event_context for the socket_connect() call, so that when things that use dcerpc are running alongside anything else it doesn't block the whole process during a connect. Then of course I needed to change any code that created a dcerpc connection (such as the auth code) to also take an event context, and anything that called that and so on .... thus the size of the patch. There were 3 places where I punted: - abartlet wanted me to add a gensec_set_event_context() call instead of adding it to the gensec init calls. Andrew, my apologies for not doing this. I didn't do it as adding a new parameter allowed me to catch all the callers with the compiler. Now that its done, we could go back and use gensec_set_event_context() - the ejs code calls auth initialisation, which means it should pass in the event context from the web server. I punted on that. Needs fixing. - I used a NULL event context in dcom_get_pipe(). This is equivalent to what we did already, but should be fixed to use a callers event context. Jelmer, can you think of a clean way to do that? I also cleaned up a couple of things: - libnet_context_destroy() makes no sense. I removed it. - removed some unused vars in various places (This used to be commit 3a3025485bdb8f600ab528c0b4b4eef0c65e3fc9)
2007-10-10r6799: Remove a rudundent variable from the context structure - we can figureAndrew Bartlett1-4/+10
this out by asking GENSEC, just like everybody else. Andrew Bartlett (This used to be commit 0268d6c46b73bf2097247639df2532b5e8591531)
2007-10-10r6468: Fix LOCAL-NTLMSSP test with new NTLMSSP structure.Andrew Bartlett1-15/+12
Andrew Bartlett (This used to be commit 8d503fb153c25580c06dd13ca83df47f9e434c7a)
2007-10-10r6458: Split up NTLMSSP into a new directory, and into seperate files for theAndrew Bartlett1-0/+1
client and server logic code. In future, this may allow us to build only the NTLMSSP client, and not the server, but in the short-term, it allows me greater sainity in moving around these files. Andrew Bartlett (This used to be commit 2f22841c6753e3d5816c12bd463b71f74e1d8796)
2007-10-10r6454: Start to migrate NTLMSSP away from it's own API to just use GENSEC.Andrew Bartlett1-7/+38
The aim here is to remove the extra layer of abstraction, and to then use the credentials code directly in the NTLMSSP layer. Andrew Bartlett (This used to be commit b14c530dfd3e56975dea7e30aa8d62d4f2827700)
2007-10-10r3453: - split out the auth and popt includesAndrew Tridgell1-0/+1
- tidied up some of the system includes - moved a few more structures back from misc.idl to netlogon.idl and samr.idl now that pidl knows about inter-IDL dependencies (This used to be commit 7b7477ac42d96faac1b0ff361525d2c63cedfc64)
2007-10-10r3324: made the smbtorture code completely warning freeAndrew Tridgell1-1/+1
(This used to be commit 7067bb9b52223cafa28470f264f0b60646a07a01)
2007-10-10r2645: converted the NTLMSSP code to the new style of tallocAndrew Tridgell1-4/+4
(This used to be commit b378aae95d4001c4cf4e6e59ed80ee1bd55382ee)
2007-10-10r2284: Thanks to some great detective work by tridge, NTLM2 signing now works.Andrew Bartlett1-2/+2
This means that 'require NTLMv2 session security' now works for RPC pipe signing. We don't yet have sealing, but it can't be much further. This is almost all tridge's code, munged into a form that can work with the GENSEC API. This commit also includes more lsakey fixes - that key is used for all DCE-RPC level authenticated connections, even over CIFS/ncacn_np. No doubt I missed something, but I'm going to get some sleep :-) Andrew Bartlett (This used to be commit a1fe175eec884280fb7e9ca8f528134cf4600beb)
2007-10-10r2098: The first 8 bytes of this sig is not used in the 'is it correct' ↵Andrew Bartlett1-1/+1
calculation. Andrew Bartlett (This used to be commit 16ef31a79ed959e80904b84b0230cadb1a7dd8d1)
2007-10-10r1992: Make the NTLMSSP torture test show more detail, and return failure etc.Andrew Bartlett1-4/+22
Andrew Bartlett (This used to be commit a8e76085a7414068aa96b6544b28afc1e1e1010c)
2007-10-10r1161: Include a few more self-check NTLMSSP examples.Andrew Bartlett1-0/+28
Andrew Bartlett (This used to be commit 81678f8dc6fc7ef7218c7fad2b2766355927f21c)
2007-10-10r1005: there was one NTLMSSP_STATE left in:-(Stefan Metzmacher1-1/+1
...fix the build metze (This used to be commit 49118189444e020b4d3159b6edbc6f7559dbb1a6)
2007-10-10r892: Actually add the NTLMSSP self-check torture code this time...Andrew Bartlett1-0/+57
Andrew Bartlett (This used to be commit 9df5cbbd7694202c17a7c47ed0469d6f80412c54)
generated by cgit (git 2.34.1) at 2024-11-11 19:30:55 +0000