1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-07 17:18:11 +03:00
Commit Graph

23 Commits

Author SHA1 Message Date
Volker Lendecke
0baae61e42 lib: Give lib/util/util_file.c its own header file
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <mschwenke@ddn.com>
2024-04-16 23:51:45 +00:00
Andreas Schneider
ab3394f9f5 s4:tls: Fix generating TLS RSA certs with FIPS140-2
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2020-04-08 13:02:39 +00:00
Andreas Schneider
71816984c3 s4:lib:tls: Fix cert and privkey types
../../source4/lib/tls/tlscert.c:42:2: warning: ‘gnutls_x509_crt’ is
    deprecated [-Wdeprecated-declarations]
   42 |  gnutls_x509_crt cacrt, crt;
      |  ^~~~~~~~~~~~~~~
../../source4/lib/tls/tlscert.c:43:2: warning: ‘gnutls_x509_privkey’ is
    deprecated [-Wdeprecated-declarations]
   43 |  gnutls_x509_privkey key, cakey;
      |  ^~~~~~~~~~~~~~~~~~~

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 04:48:29 +00:00
Andreas Schneider
0e159b725e s4:lib: Remove gnutls_global_(de)init() from libtls
This is handled by the gnutls library constructor/destructor.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-14 08:01:44 +00:00
Andreas Schneider
daa128f81b s3:tls: Remove #ifdef for GnuTLS
This is a requirement now.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:26 +00:00
Andreas Schneider
788d9f31d5 s4:lib: Use #ifdef instead of #if for config.h definitions
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-11-28 23:19:24 +01:00
Stefan Metzmacher
09da62f1a3 s4:lib/tls: fix the developer build without gnutls support
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2018-01-10 01:01:24 +01:00
Andrew Bartlett
5bb341fb9c s4/lib/tls: Use SHA256 to sign the TLS certificates
The use of SHA-1 has been on the "do not" list for a while now, so make our
self-signed certificates use SHA256 using the new
gnutls_x509_crt_sign2 provided since GNUTLS 1.2.0

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12953
2017-08-15 08:07:10 +02:00
Stefan Metzmacher
b5681c4125 CVE-2016-2113: s4:lib/tls: create better certificates and sign the host cert with the ca cert
The generated ca cert (in ca.pem) was completely useless,
it could be replaced by cert.pem.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12 19:25:25 +02:00
Stefan Metzmacher
f074e271a1 s4:lib/tls: add tls_cert_generate() prototype to tls.h
This avoids compiler warnings...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-03-20 20:43:12 +01:00
Andrew Bartlett
61d962bdfd lib/tls: Fix behaviour of --disable-gnutls and remove link to gcrypt
We no longer link against gcrypt if gnutls > 3.0.0 is found, as these
versions use libnettle.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11135

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2015-03-12 22:24:07 +01:00
Björn Baumbach
e0248cde8d CVE-2013-4476: s4:libtls: Create tls private key file (key.pem) with mode 0600
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-11-11 11:14:36 +01:00
Matthias Dieter Wallnöfer
32c82fe69b s4:lib/tls - include GNUTLS headers consistently using <...>
These are system-specific.

Reviewed-by: Jelmer

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sat Feb 18 00:43:58 CET 2012 on sn-devel-104
2012-02-18 00:43:58 +01:00
Matthieu Patou
f8d49958b2 tls: Inform the user if the cert/ca/private key can't be saved
Most of the time this problem is due to a missing <private>/tls dir.
Should close bug 7640.

Autobuild-User: Matthieu Patou <mat@samba.org>
Autobuild-Date: Wed Oct 27 20:08:54 UTC 2010 on sn-devel-104
2010-10-27 20:08:54 +00:00
Andrew Tridgell
b1ff79dbb2 fixed some of the TLS problems
This fixes two things in the TLS support for Samba4. The first is to
use a somewhat more correct hostname instead of 'Samba' when
generating the test certificates. That allows TLS test clients (such
as gnutls-cli) to connect to Samba4 using auto-generated certificates.

The second fix is to add a call to gcry_control() to tell gcrypt to
use /dev/urandom instead of /dev/random (on systems that support
that). That means that test certificate generation is now very fast,
which was previously an impediment to putting the TLS tests on the
build farm.
2009-02-18 14:46:57 +11:00
Jelmer Vernooij
87ec1d2532 Make sure prototypes are always included, make some functions static and
remove some unused functions.
2008-10-20 18:59:51 +02:00
Jelmer Vernooij
98b57d5eb6 r25035: Fix some more warnings, use service pointer rather than service number in more places.
(This used to be commit df9cebcb97)
2007-10-10 15:05:43 -05:00
Andrew Tridgell
0479a2f1cb r23792: convert Samba4 to GPLv3
There are still a few tidyups of old FSF addresses to come (in both s3
and s4). More commits soon.
(This used to be commit fcf38a38ac)
2007-10-10 14:59:12 -05:00
Andrew Tridgell
714f3991a1 r17674: fixed a problem on with our configure logic on systems that have
libgnutls but not some of the crt functions
(This used to be commit 7a0264c52d)
2007-10-10 14:16:22 -05:00
Jelmer Vernooij
e0e8743baf r15363: Fix dependencies for shared library
(This used to be commit f2ca71f122)
2007-10-10 14:05:26 -05:00
Jelmer Vernooij
7eb440f2f7 r14806: Fix compiler warnings
(This used to be commit b38a834077)
2007-10-10 13:59:22 -05:00
Andrew Tridgell
7b8332369f r8482: gnutls_x509_crt_set_subject_key_id is not available in some versions
of gnutls. Thanks to ab for spotting this.
(This used to be commit 437c4057ae)
2007-10-10 13:23:08 -05:00
Andrew Tridgell
225d5a334f r7742: abstracted out the tls code from the web server, so that our other servers
can easily become tls enabled. This will be used to add support for ldaps
(This used to be commit 950500f603)
2007-10-10 13:18:29 -05:00