sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-13 13:18:06 +03:00
Code
5f9024c8a4
samba-mirror/source4/auth/gensec/config.mk

83 lines
2.7 KiB
Makefile
Raw Normal View History

r1450: Oops.. Missing files :-) (This used to be commit eaa2940ba039f59e13d44c6e2dda919ed8e388f5)
2004-07-11 16:38:27 +04:00
#################################
r13960: Generate makefile rules for installing/removing shared modules. (This used to be commit 2c746980328431ab04852dc668899e3eb042da99)
2006-03-07 19:41:04 +03:00
# Start SUBSYSTEM gensec
[LIBRARY::gensec]
r15207: Introduce PRIVATE_DEPENDENCIES and PUBLIC_DEPENDENCIES as replacement for REQUIRED_SUBSYSTEMS. (This used to be commit adc8a019b6da256f104abed1b82bfde6998a2ac9)
2006-04-24 19:47:59 +04:00
PUBLIC_DEPENDENCIES = \
s4:gensec: change gensec_update_send/recv to tevent_req metze
2009-12-22 18:24:44 +03:00
CREDENTIALS LIBSAMBA-UTIL LIBCRYPTO ASN1_UTIL samba_socket LIBPACKET LIBTSOCKET UTIL_TEVENT
r13960: Generate makefile rules for installing/removing shared modules. (This used to be commit 2c746980328431ab04852dc668899e3eb042da99)
2006-03-07 19:41:04 +03:00
# End SUBSYSTEM gensec
r1450: Oops.. Missing files :-) (This used to be commit eaa2940ba039f59e13d44c6e2dda919ed8e388f5)
2004-07-11 16:38:27 +04:00
#################################
Use variables for source directory in a couple more places. (This used to be commit 2860a7db5968c7007522cdb300eba390da929ab8)
2008-05-18 21:46:09 +04:00
PC_FILES += $(gensecsrcdir)/gensec.pc
Move SOVERSION, VERSION and PC_FILE out of smb_build but use make variables directly instead. (This used to be commit 9d0ae012b0b463278cd054d06788aa998acc2da2)
2008-04-15 04:25:16 +04:00
gensec_VERSION = 0.0.1
gensec_SOVERSION = 0
Use variables for source directory in a couple more places. (This used to be commit 2860a7db5968c7007522cdb300eba390da929ab8)
2008-05-18 21:46:09 +04:00
gensec_OBJ_FILES = $(addprefix $(gensecsrcdir)/, gensec.o socket.o)
Move object files lists to makefile rather than smb_build. (This used to be commit 5628d58990144463fd87f8c847c9384ac2193681)
2008-04-14 18:53:00 +04:00
Use variables for source directory in a couple more places. (This used to be commit 2860a7db5968c7007522cdb300eba390da929ab8)
2008-05-18 21:46:09 +04:00
PUBLIC_HEADERS += $(gensecsrcdir)/gensec.h
Move public header accumulation out of the perl code. Never install generated prototype files. It's easier to break the API when using them and they're not easily readable for 3rd party users. Conflicts: source/auth/config.mk source/auth/credentials/config.mk source/auth/gensec/config.mk source/build/smb_build/config_mk.pm source/build/smb_build/main.pl source/build/smb_build/makefile.pm source/dsdb/config.mk source/lib/charset/config.mk source/lib/tdr/config.mk source/lib/util/config.mk source/libcli/config.mk source/libcli/ldap/config.mk source/librpc/config.mk source/param/config.mk source/rpc_server/config.mk source/torture/config.mk (This used to be commit 6c659689ed4081f1d7a6253c538c7f01784197ba)
2008-02-29 16:23:38 +03:00
Fix a couple (well, little more than that..) of typos. (This used to be commit a6b52119940a900fb0de3864b8bca94e2965cc24)
2008-05-19 01:02:47 +04:00
$(eval $(call proto_header_template,$(gensecsrcdir)/gensec_proto.h,$(gensec_OBJ_FILES:.o=.c)))
Avoid smb_build for prototype headers in some places. (This used to be commit 4876c4efbbafb4e0afa3554cd9f748ab591a2927)
2008-05-18 23:09:04 +04:00
r1450: Oops.. Missing files :-) (This used to be commit eaa2940ba039f59e13d44c6e2dda919ed8e388f5)
2004-07-11 16:38:27 +04:00
################################################
# Start MODULE gensec_krb5
[MODULE::gensec_krb5]
r13960: Generate makefile rules for installing/removing shared modules. (This used to be commit 2c746980328431ab04852dc668899e3eb042da99)
2006-03-07 19:41:04 +03:00
SUBSYSTEM = gensec
r3586: Fix some of the issues with the module init functions. Both subsystems and modules can now have init functions, which can be specified in .mk files (INIT_FUNCTION = ...) The build system will define : - SUBSYSTEM_init_static_modules that calls the init functions of all statically compiled modules. Failing to load will generate an error which is not fatal - BINARY_init_subsystems that calls the init functions (if defined) for the subsystems the binary depends on This removes the hack with the "static bool Initialised = " and the "lazy_init" functions (This used to be commit 7a8244761bfdfdfb48f8264d76951ebdfbf7bd8a)
2004-11-07 02:23:15 +03:00
INIT_FUNCTION = gensec_krb5_init
Push sam_get_server_info_principal into the auth subsystem This means it must be accessed via the supplied auth_context in the GENSEC server, and should remove the hard depenceny of GENSEC on the auth subsystem and ldb (allowing LDB not to rely on LDB is considered a good thing, apparently) Andrew Bartlett
2009-02-13 06:02:49 +03:00
PRIVATE_DEPENDENCIES = CREDENTIALS KERBEROS auth_session
r1450: Oops.. Missing files :-) (This used to be commit eaa2940ba039f59e13d44c6e2dda919ed8e388f5)
2004-07-11 16:38:27 +04:00
# End MODULE gensec_krb5
################################################
Use variables for source directory in a couple more places. (This used to be commit 2860a7db5968c7007522cdb300eba390da929ab8)
2008-05-18 21:46:09 +04:00
gensec_krb5_OBJ_FILES = $(addprefix $(gensecsrcdir)/, gensec_krb5.o)
Move object files lists to makefile rather than smb_build. (This used to be commit 5628d58990144463fd87f8c847c9384ac2193681)
2008-04-14 18:53:00 +04:00
r4460: Add a new GENSEC module: gensec_gssapi (disabled by default, set parametric option: gensec:gssapi=yes to enable). This module backs directly onto GSSAPI, and allows us to sign and seal GSSAPI/Krb5 connections in particular. This avoids me reinventing the entire GSSAPI wheel. Currently a lot of things are left as default - we will soon start specifiying OIDs as well as passwords (it uses the keytab only at the moment). Tested with our LDAP-* torture tests against Win2k3. My hope is to use this module to access the new SPNEGO implementation in Heimdal, to avoid having to standards-verify our own. Andrew Bartlett (This used to be commit 14b650c85db14a9bf97e24682b2643b63c51ff35)
2005-01-01 03:19:08 +03:00
################################################
# Start MODULE gensec_gssapi
[MODULE::gensec_gssapi]
r13960: Generate makefile rules for installing/removing shared modules. (This used to be commit 2c746980328431ab04852dc668899e3eb042da99)
2006-03-07 19:41:04 +03:00
SUBSYSTEM = gensec
r4460: Add a new GENSEC module: gensec_gssapi (disabled by default, set parametric option: gensec:gssapi=yes to enable). This module backs directly onto GSSAPI, and allows us to sign and seal GSSAPI/Krb5 connections in particular. This avoids me reinventing the entire GSSAPI wheel. Currently a lot of things are left as default - we will soon start specifiying OIDs as well as passwords (it uses the keytab only at the moment). Tested with our LDAP-* torture tests against Win2k3. My hope is to use this module to access the new SPNEGO implementation in Heimdal, to avoid having to standards-verify our own. Andrew Bartlett (This used to be commit 14b650c85db14a9bf97e24682b2643b63c51ff35)
2005-01-01 03:19:08 +03:00
INIT_FUNCTION = gensec_gssapi_init
r26483: Merge ldb module dependency fixes, fix auth python module. (This used to be commit 85eeecf997a071ca7e7ad0247e8d34d49b7ffcbb)
2007-12-17 06:22:44 +03:00
PRIVATE_DEPENDENCIES = HEIMDAL_GSSAPI CREDENTIALS KERBEROS
r4460: Add a new GENSEC module: gensec_gssapi (disabled by default, set parametric option: gensec:gssapi=yes to enable). This module backs directly onto GSSAPI, and allows us to sign and seal GSSAPI/Krb5 connections in particular. This avoids me reinventing the entire GSSAPI wheel. Currently a lot of things are left as default - we will soon start specifiying OIDs as well as passwords (it uses the keytab only at the moment). Tested with our LDAP-* torture tests against Win2k3. My hope is to use this module to access the new SPNEGO implementation in Heimdal, to avoid having to standards-verify our own. Andrew Bartlett (This used to be commit 14b650c85db14a9bf97e24682b2643b63c51ff35)
2005-01-01 03:19:08 +03:00
# End MODULE gensec_gssapi
################################################
Use variables for source directory in a couple more places. (This used to be commit 2860a7db5968c7007522cdb300eba390da929ab8)
2008-05-18 21:46:09 +04:00
gensec_gssapi_OBJ_FILES = $(addprefix $(gensecsrcdir)/, gensec_gssapi.o)
Move object files lists to makefile rather than smb_build. (This used to be commit 5628d58990144463fd87f8c847c9384ac2193681)
2008-04-14 18:53:00 +04:00
r18155: Add my work in progress, a module to link with Cyrus-SASL, for a DIGEST-MD5 implemenation in particular. However, I can't make this work: Cyrus-SASL isn't loading the mech... Andrew Bartlett (This used to be commit 0b193d28c896c9d212a536da7d87634543d971a5)
2006-09-06 14:34:18 +04:00
################################################
# Start MODULE cyrus_sasl
[MODULE::cyrus_sasl]
SUBSYSTEM = gensec
INIT_FUNCTION = gensec_sasl_init
r26136: Attempt to fix dependencies for auth. (This used to be commit abf2600a044cdbab6c5d7880d18217bff3d15c39)
2007-11-27 04:04:38 +03:00
PRIVATE_DEPENDENCIES = CREDENTIALS SASL
r18155: Add my work in progress, a module to link with Cyrus-SASL, for a DIGEST-MD5 implemenation in particular. However, I can't make this work: Cyrus-SASL isn't loading the mech... Andrew Bartlett (This used to be commit 0b193d28c896c9d212a536da7d87634543d971a5)
2006-09-06 14:34:18 +04:00
# End MODULE cyrus_sasl
################################################
Use variables for source directory in a couple more places. (This used to be commit 2860a7db5968c7007522cdb300eba390da929ab8)
2008-05-18 21:46:09 +04:00
cyrus_sasl_OBJ_FILES = $(addprefix $(gensecsrcdir)/, cyrus_sasl.o)
Move object files lists to makefile rather than smb_build. (This used to be commit 5628d58990144463fd87f8c847c9384ac2193681)
2008-04-14 18:53:00 +04:00
r1450: Oops.. Missing files :-) (This used to be commit eaa2940ba039f59e13d44c6e2dda919ed8e388f5)
2004-07-11 16:38:27 +04:00
################################################
# Start MODULE gensec_spnego
[MODULE::gensec_spnego]
r13960: Generate makefile rules for installing/removing shared modules. (This used to be commit 2c746980328431ab04852dc668899e3eb042da99)
2006-03-07 19:41:04 +03:00
SUBSYSTEM = gensec
r3586: Fix some of the issues with the module init functions. Both subsystems and modules can now have init functions, which can be specified in .mk files (INIT_FUNCTION = ...) The build system will define : - SUBSYSTEM_init_static_modules that calls the init functions of all statically compiled modules. Failing to load will generate an error which is not fatal - BINARY_init_subsystems that calls the init functions (if defined) for the subsystems the binary depends on This removes the hack with the "static bool Initialised = " and the "lazy_init" functions (This used to be commit 7a8244761bfdfdfb48f8264d76951ebdfbf7bd8a)
2004-11-07 02:23:15 +03:00
INIT_FUNCTION = gensec_spnego_init
r26385: Integrate gensec-socket into gensec. (This used to be commit 78bb444b4b73df9a84f8702814f9b30b32ffd885)
2007-12-10 20:42:07 +03:00
PRIVATE_DEPENDENCIES = ASN1_UTIL CREDENTIALS
r1450: Oops.. Missing files :-) (This used to be commit eaa2940ba039f59e13d44c6e2dda919ed8e388f5)
2004-07-11 16:38:27 +04:00
# End MODULE gensec_spnego
################################################
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
gensec_spnego_OBJ_FILES = $(addprefix $(gensecsrcdir)/, spnego.o) ../libcli/auth/spnego_parse.o
Move object files lists to makefile rather than smb_build. (This used to be commit 5628d58990144463fd87f8c847c9384ac2193681)
2008-04-14 18:53:00 +04:00
Fix a couple (well, little more than that..) of typos. (This used to be commit a6b52119940a900fb0de3864b8bca94e2965cc24)
2008-05-19 01:02:47 +04:00
$(eval $(call proto_header_template,$(gensecsrcdir)/spnego_proto.h,$(gensec_spnego_OBJ_FILES:.o=.c)))
Avoid smb_build for prototype headers in some places. (This used to be commit 4876c4efbbafb4e0afa3554cd9f748ab591a2927)
2008-05-18 23:09:04 +04:00
r6028: A MAJOR update to intergrate the new credentails system fully with GENSEC, and to pull SCHANNEL into GENSEC, by making it less 'special'. GENSEC now no longer has it's own handling of 'set username' etc, instead it uses cli_credentials calls. In order to link the credentails code right though Samba, a lot of interfaces have changed to remove 'username, domain, password' arguments, and these have been replaced with a single 'struct cli_credentials'. In the session setup code, a new parameter 'workgroup' contains the client/server current workgroup, which seems unrelated to the authentication exchange (it was being filled in from the auth info). This allows in particular kerberos to only call back for passwords when it actually needs to perform the kinit. The kerberos code has been modified not to use the SPNEGO provided 'principal name' (in the mechListMIC), but to instead use the name the host was connected to as. This better matches Microsoft behaviour, is more secure and allows better use of standard kerberos functions. To achieve this, I made changes to our socket code so that the hostname (before name resolution) is now recorded on the socket. In schannel, most of the code from librpc/rpc/dcerpc_schannel.c is now in libcli/auth/schannel.c, and it looks much more like a standard GENSEC module. The actual sign/seal code moved to libcli/auth/schannel_sign.c in a previous commit. The schannel credentails structure is now merged with the rest of the credentails, as many of the values (username, workstation, domain) where already present there. This makes handling this in a generic manner much easier, as there is no longer a custom entry-point. The auth_domain module continues to be developed, but is now just as functional as auth_winbind. The changes here are consequential to the schannel changes. The only removed function at this point is the RPC-LOGIN test (simulating the load of a WinXP login), which needs much more work to clean it up (it contains copies of too much code from all over the torture suite, and I havn't been able to penetrate its 'structure'). Andrew Bartlett (This used to be commit 2301a4b38a21aa60917973451687063d83d18d66)
2005-03-24 07:14:06 +03:00
################################################
# Start MODULE gensec_schannel
[MODULE::gensec_schannel]
r13960: Generate makefile rules for installing/removing shared modules. (This used to be commit 2c746980328431ab04852dc668899e3eb042da99)
2006-03-07 19:41:04 +03:00
SUBSYSTEM = gensec
r6028: A MAJOR update to intergrate the new credentails system fully with GENSEC, and to pull SCHANNEL into GENSEC, by making it less 'special'. GENSEC now no longer has it's own handling of 'set username' etc, instead it uses cli_credentials calls. In order to link the credentails code right though Samba, a lot of interfaces have changed to remove 'username, domain, password' arguments, and these have been replaced with a single 'struct cli_credentials'. In the session setup code, a new parameter 'workgroup' contains the client/server current workgroup, which seems unrelated to the authentication exchange (it was being filled in from the auth info). This allows in particular kerberos to only call back for passwords when it actually needs to perform the kinit. The kerberos code has been modified not to use the SPNEGO provided 'principal name' (in the mechListMIC), but to instead use the name the host was connected to as. This better matches Microsoft behaviour, is more secure and allows better use of standard kerberos functions. To achieve this, I made changes to our socket code so that the hostname (before name resolution) is now recorded on the socket. In schannel, most of the code from librpc/rpc/dcerpc_schannel.c is now in libcli/auth/schannel.c, and it looks much more like a standard GENSEC module. The actual sign/seal code moved to libcli/auth/schannel_sign.c in a previous commit. The schannel credentails structure is now merged with the rest of the credentails, as many of the values (username, workstation, domain) where already present there. This makes handling this in a generic manner much easier, as there is no longer a custom entry-point. The auth_domain module continues to be developed, but is now just as functional as auth_winbind. The changes here are consequential to the schannel changes. The only removed function at this point is the RPC-LOGIN test (simulating the load of a WinXP login), which needs much more work to clean it up (it contains copies of too much code from all over the torture suite, and I havn't been able to penetrate its 'structure'). Andrew Bartlett (This used to be commit 2301a4b38a21aa60917973451687063d83d18d66)
2005-03-24 07:14:06 +03:00
INIT_FUNCTION = gensec_schannel_init
s4:schannel merge code with s3 After looking at the s4 side of the (s)channel :) I found out that it makes more sense to simply make it use the tdb based code than redo the same changes done to s3 to simplify the interface. Ldb is slow, to the point it needs haks to pre-open the db to speed it up, yet that does not solve the lookup speed, with ldb it is always going to be slower. Looking through the history it is evident that the schannel database doesn't really need greate expanadability. And lookups are always done with a single Key. This seem a perfet fit for tdb while ldb looks unnecessarily complicated. The schannel database is not really a persistent one. It can be discared during an upgrade without causing any real issue. all it contains is temproary session data.
2010-02-18 23:11:25 +03:00
PRIVATE_DEPENDENCIES = COMMON_SCHANNELDB NDR_SCHANNEL CREDENTIALS LIBNDR auth_session
Get rid of 'INTEGRATED' build of modules - now replaced by 'MERGED_OBJ' (This used to be commit 269cbf84d8b7dbf3bc88adc04ae283dc908af5ac)
2008-02-18 21:06:17 +03:00
OUTPUT_TYPE = MERGED_OBJ
r6458: Split up NTLMSSP into a new directory, and into seperate files for the client and server logic code. In future, this may allow us to build only the NTLMSSP client, and not the server, but in the short-term, it allows me greater sainity in moving around these files. Andrew Bartlett (This used to be commit 2f22841c6753e3d5816c12bd463b71f74e1d8796)
2005-04-25 09:03:50 +04:00
# End MODULE gensec_schannel
r6028: A MAJOR update to intergrate the new credentails system fully with GENSEC, and to pull SCHANNEL into GENSEC, by making it less 'special'. GENSEC now no longer has it's own handling of 'set username' etc, instead it uses cli_credentials calls. In order to link the credentails code right though Samba, a lot of interfaces have changed to remove 'username, domain, password' arguments, and these have been replaced with a single 'struct cli_credentials'. In the session setup code, a new parameter 'workgroup' contains the client/server current workgroup, which seems unrelated to the authentication exchange (it was being filled in from the auth info). This allows in particular kerberos to only call back for passwords when it actually needs to perform the kinit. The kerberos code has been modified not to use the SPNEGO provided 'principal name' (in the mechListMIC), but to instead use the name the host was connected to as. This better matches Microsoft behaviour, is more secure and allows better use of standard kerberos functions. To achieve this, I made changes to our socket code so that the hostname (before name resolution) is now recorded on the socket. In schannel, most of the code from librpc/rpc/dcerpc_schannel.c is now in libcli/auth/schannel.c, and it looks much more like a standard GENSEC module. The actual sign/seal code moved to libcli/auth/schannel_sign.c in a previous commit. The schannel credentails structure is now merged with the rest of the credentails, as many of the values (username, workstation, domain) where already present there. This makes handling this in a generic manner much easier, as there is no longer a custom entry-point. The auth_domain module continues to be developed, but is now just as functional as auth_winbind. The changes here are consequential to the schannel changes. The only removed function at this point is the RPC-LOGIN test (simulating the load of a WinXP login), which needs much more work to clean it up (it contains copies of too much code from all over the torture suite, and I havn't been able to penetrate its 'structure'). Andrew Bartlett (This used to be commit 2301a4b38a21aa60917973451687063d83d18d66)
2005-03-24 07:14:06 +03:00
################################################
schannel: move schannel_sign to main directory. Guenther
2009-09-15 20:29:10 +04:00
gensec_schannel_OBJ_FILES = $(addprefix $(gensecsrcdir)/, schannel.o) ../libcli/auth/schannel_sign.o
Fix a couple (well, little more than that..) of typos. (This used to be commit a6b52119940a900fb0de3864b8bca94e2965cc24)
2008-05-19 01:02:47 +04:00
$(eval $(call proto_header_template,$(gensecsrcdir)/schannel_proto.h,$(gensec_schannel_OBJ_FILES:.o=.c)))
Move object files lists to makefile rather than smb_build. (This used to be commit 5628d58990144463fd87f8c847c9384ac2193681)
2008-04-14 18:53:00 +04:00
pygensec: Add initial work on a gensec Python module.
2009-09-26 21:41:59 +04:00
[PYTHON::pygensec]
s4-pygensec: a bit closer to working I'll need help from Andrew on how to get gensec to initialise it's ops element
2009-10-02 12:50:59 +04:00
PRIVATE_DEPENDENCIES = gensec PYTALLOC pyparam_util
pygensec: Add initial work on a gensec Python module.
2009-09-26 21:41:59 +04:00
LIBRARY_REALNAME = samba/gensec.$(SHLIBEXT)
pygensec_OBJ_FILES = $(gensecsrcdir)/pygensec.o
Copy Permalink