1
0
mirror of https://github.com/samba-team/samba.git synced 2025-10-09 11:33:17 +03:00
Commit Graph

110 Commits

Author SHA1 Message Date
Jelmer Vernooij
4c32978d97 Remove smb_mkstemp() - libreplace will now provide a secure mkstemp() if
the system one is broken.
2009-04-20 23:58:26 +02:00
Andrew Bartlett
574a6a8c35 s3:kerberos Rework smb_krb5_unparse_name() to take a talloc context
Signed-off-by: Günther Deschner <gd@samba.org>
2009-04-07 13:25:36 +02:00
Günther Deschner
97190ae184 s3-krb5: Fix Coverity #762 (REVERSE_INULL).
Guenther
2009-03-20 11:11:04 +01:00
Günther Deschner
3accf9e80f s3: use pidl to pull a KRB5_EDATA_NTSTATUS.
Guenther
2009-02-06 10:32:49 +01:00
Michael Adam
0b87f210f1 s3:libads: use lock_path for creating paths to local krb5.conf files
instead of manually doing an asprintf with lp_lockdir()

Michael

squash
2009-01-16 01:02:22 +01:00
Michael Adam
37c77643f9 s3:libads: give create_local_private_krb5_conf_for_domain() a common exit point
Michael
2009-01-16 01:02:22 +01:00
Tim Prouty
1eb743ab8e s3: Change sockaddr util function names for consistency
Also eliminates name conflicts with OneFS system libraries
2008-12-03 10:40:20 -08:00
Jelmer Vernooij
d6a5476ee7 Use sockaddr_storage only where we rely on the size, use sockaddr
otherwise (to clarify we can also pass in structs smaller than
sockaddr_storage, such as sockaddr_in).
2008-10-23 19:53:15 +02:00
Günther Deschner
862ff66da9 kerberos: fix indent of enc type lines in generated krb5.conf files.
Guenther
(This used to be commit 18a26f08b6)
2008-09-04 15:17:57 +02:00
Günther Deschner
6b4b76c40e libads: add ADS_AUTH_USER_CREDS to avoid magic overwriting of usernames.
Guenther
(This used to be commit b5aaf5aa0f)
2008-06-24 23:37:40 +02:00
Jeremy Allison
d5d4a9511d Memory leak fixes from Chere Zhou <czhou@isilon.com>.
Jeremy.
(This used to be commit 201bcc8ed2)
2008-05-27 12:27:57 -07:00
root
fc3e6851d3 Fix some comments to match get_kdc_ip_string()'s behaviour
(This used to be commit 30956c784f)
2008-05-19 12:08:52 +02:00
Marc VanHeyningen
e06aa46b9f Coverity fixes
(This used to be commit 3fc85d2259)
2008-03-17 20:52:25 +01:00
Volker Lendecke
87805819f1 Fix Coverity ID 551
Correctly return if we can't create the temporary krb5.conf

Jeremy, please check!
(This used to be commit c2401811aa)
2008-03-08 23:48:12 +01:00
Volker Lendecke
3176392878 Fix some warnings
warning: ignoring return value of 'asprintf', declared with attribute warn_unused_result
(This used to be commit ad37b7b0ae)
2008-02-25 16:09:26 +01:00
Gerald W. Carter
c0c93dc2ba Restrict the enctypes in the generated krb5.conf files to Win2003 types.
This fixes the failure observed on FC8 when joining a Windows 2008 RC1
domain.  We currently do not handle user session keys correctly
when the KDC uses AES in the ticket replies.
(This used to be commit 8039a2518c)
2008-01-28 11:32:09 -06:00
Jeremy Allison
70426bdd30 Tidy up code and debug for non-default krb5 IPv6 port.
Jeremy.
(This used to be commit 79b7972de4)
2008-01-16 13:28:24 -08:00
Jeremy Allison
bd8abea49f Fix IPv6 bug #5204, which caused krb5 DNS lookups
for a name '[<ipv6 addr>'.
Jeremy.
(This used to be commit f2aa921505)
2008-01-16 13:21:46 -08:00
Günther Deschner
a32cca7f37 Print principal in debug statement in kerberos_kinit_password() as well.
Guenther
(This used to be commit 44d67e8462)
2008-01-14 18:39:08 +01:00
Simo Sorce
4869ccfed6 While 'data' is usually 0 terminated, nothing in the spec requires that. The correct way is to copy only 'length' bytes.
Simo.
(This used to be commit 814c1b0e00)
2007-12-17 15:26:08 -05:00
Jeremy Allison
8e86b7bb65 Doh, fix typo in error exit.
Jeremy.
(This used to be commit 44918f39c0)
2007-12-15 23:32:28 -08:00
Jeremy Allison
5dbc4a23bc Added patch originally by Andreas Schneider <anschneider@suse.de>
to cause us to behave like Vista when looking for remote
machine principal. Modified by me.
Jeremy.
(This used to be commit d0e33840fb)
2007-12-15 23:22:25 -08:00
Jeremy Allison
de51d3dd5f More pstring removal....
Jeremy.
(This used to be commit 809f5ab4c5)
2007-11-20 18:55:36 -08:00
Jeremy Allison
f88b7a076b This is a large patch (sorry). Migrate from struct in_addr
to struct sockaddr_storage in most places that matter (ie.
not the nmbd and NetBIOS lookups). This passes make test
on an IPv4 box, but I'll have to do more work/testing on
IPv6 enabled boxes. This should now give us a framework
for testing and finishing the IPv6 migration. It's at
the state where someone with a working IPv6 setup should
(theorecically) be able to type :
smbclient //ipv6-address/share
and have it work.
Jeremy.
(This used to be commit 98e154c312)
2007-10-24 14:16:54 -07:00
Jeremy Allison
30191d1a57 RIP BOOL. Convert BOOL -> bool. I found a few interesting
bugs in various places whilst doing this (places that assumed
BOOL == int). I also need to fix the Samba4 pidl generation
(next checkin).
Jeremy.
(This used to be commit f35a266b3c)
2007-10-18 17:40:25 -07:00
Lars Müller
9fa56b9ae9 r25030: ip_srv_nonsite and count_nonsite are initialized in get_kdc_list() in any
case.
(This used to be commit 287604a1c7)
2007-10-10 12:30:36 -05:00
Michael Adam
b202692875 r24836: Initialize some uninitialized variables.
This prevents a segfault when get_kdc_ip_string() is called
with sitename == NULL.

Michael
(This used to be commit 58d31e057b)
2007-10-10 12:30:26 -05:00
Andrew Tridgell
5e54558c6d r23784: use the GPLv3 boilerplate as recommended by the FSF and the license text
(This used to be commit b0132e94fc)
2007-10-10 12:28:22 -05:00
Jeremy Allison
d824b98f80 r23779: Change from v2 or later to v3 or later.
Jeremy.
(This used to be commit 407e6e695b)
2007-10-10 12:28:20 -05:00
Jeremy Allison
ad5ff1b809 r23147: Patch #4566 from jacob berkman <jberkman@novell.com>. Pass password data to krb5_prompter.
Jeremy.
(This used to be commit 232fc5d69d)
2007-10-10 12:22:48 -05:00
Günther Deschner
e468268335 r22666: Expand kerberos_kinit_password_ext() to return NTSTATUS codes and make
winbindd's kerberized pam_auth use that.

Guenther
(This used to be commit 0f436eab5b)
2007-10-10 12:19:54 -05:00
Günther Deschner
116c1532e7 r22664: When we have krb5_get_init_creds_opt_get_error() then try to get the NTSTATUS
codes directly out of the krb5_error edata.

Guenther
(This used to be commit dcd902f24a)
2007-10-10 12:19:53 -05:00
Günther Deschner
6288491e90 r22663: Restructure kerberos_kinit_password_ext() error path.
Guenther
(This used to be commit 997ded4e3f)
2007-10-10 12:19:53 -05:00
James Peach
98e58694ee r21779: I missd a call to krb5_get_init_creds_opt_alloc in r21778.
(This used to be commit 4f6c2826aa)
2007-10-10 12:18:32 -05:00
James Peach
3adeb42742 r21778: Wrap calls to krb5_get_init_creds_opt_free to handle the different
calling convention in the latest MIT changes.  Apparantly Heimdal
is also changing to this calling convention.
(This used to be commit c29c69d2df)
2007-10-10 12:18:32 -05:00
Günther Deschner
69cee2a3ec r21240: Fix longstanding Bug #4009.
For the winbind cached ADS LDAP connection handling
(ads_cached_connection()) we were (incorrectly) assuming that the
service ticket lifetime equaled the tgt lifetime. For setups where the
service ticket just lives 10 minutes, we were leaving hundreds of LDAP
connections in CLOSE_WAIT state, until we fail to service entirely with
"Too many open files".

Also sequence_number() in winbindd_ads.c needs to delete the cached LDAP
connection after the ads_do_search_retry() has failed to submit the
search request (although the bind succeeded (returning an expired
service ticket that we cannot delete from the memory cred cache - this
will get fixed later)).

Guenther
(This used to be commit 7e1a84b722)
2007-10-10 12:17:50 -05:00
Günther Deschner
aad88ee34f r21238: Fix tab indent in self-written krb5.confs.
Guenther
(This used to be commit 4df582fa10)
2007-10-10 12:17:50 -05:00
Günther Deschner
1898eaddb8 r21110: Fix kinit with Heimdal (Bug #4226).
Guenther
(This used to be commit ea38e1f836)
2007-10-10 12:17:38 -05:00
Günther Deschner
f3ad8bb00a r20860: Adding some small tweaks. When we have no sitename, there is no need to
ask for the list of DCs twice.

Guenther
(This used to be commit a9baf27e13)
2007-10-10 12:17:14 -05:00
Jeremy Allison
bfd099e148 r20857: Silence gives assent :-). Checking in the fix for
site support in a network where many DC's are down.
I heard via Volker there is still a bug w.r.t the
wrong site being chosen with trusted domains but
we'll have to layer that fix on top of this.
Gd - complain if this doesn't work for you.
Jeremy.
(This used to be commit 97e248f89a)
2007-10-10 12:17:14 -05:00
Günther Deschner
2ad8c705b2 r18512: Add krb5conf file environment to debug statement.
Guenther
(This used to be commit 398f368c8a)
2007-10-10 11:51:45 -05:00
Jeremy Allison
6cfe7be80e r18241: If replacing the krb5.conf, ensure it's readable.
Jeremy.
(This used to be commit dfd93a3031)
2007-10-10 11:51:18 -05:00
Jeremy Allison
34a25efad2 r18226: Ensure we only do this evil thing if it's our realm.
Jeremy.
(This used to be commit 0a89b37b1a)
2007-10-10 11:51:16 -05:00
Jeremy Allison
80052bcf13 r18225: If we're going to overwrite krb5.conf, at least
be polite enough to make a backup.
Jeremy.
(This used to be commit c82aac594f)
2007-10-10 11:51:16 -05:00
Jeremy Allison
253c01f29e r18201: Make explicit what's going on here.
Jeremy.
(This used to be commit 38b8a2b527)
2007-10-10 11:51:16 -05:00
Jeremy Allison
6d4c7b1345 r18200: Experimental code to allow system /etc/krb5.conf to be
overwritten by winbindd. Don't enable this :-).
Jeremy.
(This used to be commit 88e11ee91a)
2007-10-10 11:51:16 -05:00
Jeremy Allison
fea5d59b84 r18010: Ensure we don't timeout twice to the same
server in winbindd when it's down and listed
in the -ve connection cache. Fix memory leak,
reduce timeout for cldap calls - minimum 3 secs.
Jeremy.
(This used to be commit 10b32cb6de)
2007-10-10 11:39:48 -05:00
Jeremy Allison
0f1bc28744 r18006: Actually a smaller change than it looks. Leverage
the get_dc_list code to get the _kerberos. names
for site support. This way we don't depend on one
KDC to do ticket refresh. Even though we know it's
up when we add it, it may go down when we're trying
to refresh.
Jeremy.
(This used to be commit 77fe2a3d74)
2007-10-10 11:39:47 -05:00
Jeremy Allison
d0bbe3751a r18004: If you're writing out a krb5.conf, at least
get the syntax right... :-).
Jeremy.
(This used to be commit ecca467e46)
2007-10-10 11:39:46 -05:00
Jeremy Allison
b05c81a184 r18003: Creating a directory and getting EEXIST isn't an error.
Jeremy.
(This used to be commit 515f86167b)
2007-10-10 11:39:46 -05:00