1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Commit Graph

33 Commits

Author SHA1 Message Date
Andrew Bartlett
5a30cd8097 r10983: Another case were we want to avoid DNS for unqualified names.
Andrew Bartlett
(This used to be commit 1d7094b8df)
2007-10-10 13:39:50 -05:00
Andrew Bartlett
8407a1a866 r10561: This patch takes over KDC socket routines in Heimdal, and directs them
at the Samba4 socket layer.

The intention here is to ensure that other events may be processed while
heimdal is waiting on the KDC.  The interface is designed to be
sufficiently flexible, so that the plugin may choose how to time
communication with the KDC (ie multiple outstanding requests, looking
for a functional KDC).

I've hacked the socket layer out of cldap.c to handle this very
specific case of one udp packet and reply.  Likewise I also handle
TCP, stolen from the winbind code.

This same plugin system might also be useful for a self-contained
testing mode in Heimdal, in conjunction with libkdc.  I would suggest
using socket-wrapper instead however.

Andrew Bartlett
(This used to be commit 3b09f9e8f9)
2007-10-10 13:39:04 -05:00
Andrew Bartlett
3b7f8ddd9a r10398: Don't do DNS lookups on short names (no .).
Andrew Bartlett
(This used to be commit 77aca9619d)
2007-10-10 13:38:39 -05:00
Andrew Bartlett
c44efdaa22 r10386: Merge current lorikeet-heimdal into Samba4.
Andrew Bartlett
(This used to be commit 4d2a9a9bc4)
2007-10-10 13:38:38 -05:00
Andrew Bartlett
42f2519b50 r10382: In the absence of client support for the full KDC-side
canonicalisation code, I've hacked Heimdal to use the default realm if
no other realm can be determined for a given host.

Andrew Bartlett
(This used to be commit 0f0b0021b7)
2007-10-10 13:38:34 -05:00
Andrew Bartlett
f9263dd102 r10337: This grubby little hack is the implementation of a concept discussed
on the kerberos mailing lists a couple of weeks ago: Don't use DNS at
all for expanding short names into long names.

Using the 'override krb5_init_context' code already in the tree, this
removes the DNS lag on a kerberos session setup/connection.

Andrew Bartlett
(This used to be commit de3ceab3d0)
2007-10-10 13:38:29 -05:00
Andrew Bartlett
f3bce652c8 r10286: This patch is ugly and disgusting, but for now it works better than the other
ideas I have had.

When I get a full list of things I want to do to a krb5_context I'll
either add gsskrb5_ wrappers, or a way of speicfying the krb5 context
per gssapi context.

(I want to ensure that the only krb5_context variables created while
executing Samba4 are via our wrapper).

Andrew Bartlett
(This used to be commit 8a22d46e70)
2007-10-10 13:38:13 -05:00
Jelmer Vernooij
957d361cd1 r10191: Return the right error code in the case of a time skew. Windows will now
ignore Kerberos and fallback to NTLMSSP when joining. Thanks to Andrew Bartlett
for the assistence.
(This used to be commit 3b6bfbe8cf)
2007-10-10 13:38:07 -05:00
James Peach
0639375119 r10159: Dereference padsize before comparing to an int.
(This used to be commit 5767c05909)
2007-10-10 13:38:04 -05:00
Andrew Bartlett
5edbeca141 r10153: This patch adds a new parameter to gensec_sig_size(), the size of the
data to be signed/sealed.  We can use this to split the data from the
signature portion of the resultant wrapped packet.

This required merging the gsskrb5_wrap_size patch from
lorikeet-heimdal, and fixes AES encrption issues on DCE/RPC (we no
longer use a static 45 byte value).

This fixes one of the krb5 issues in my list.

Andrew Bartlett
(This used to be commit e4f2afc343)
2007-10-10 13:38:04 -05:00
Andrew Bartlett
cfdcc32f84 r10149: Update Samba4 to current lorikeet-heimdal.
Andrew Bartlett
(This used to be commit b9695d5e7c)
2007-10-10 13:38:03 -05:00
Andrew Bartlett
6a74a83151 r10072: Fix mismerge weridness in error handling.
Andrew Bartlett
(This used to be commit c17926b6fe)
2007-10-10 13:36:34 -05:00
Andrew Bartlett
1f2f470889 r10066: This is the second in my patches to work on Samba4's kerberos support,
with an aim to make the code simpiler and more correct.

Gone is the old (since the very early Samba 3.0 krb5 days) 'iterate over
all keytypes)' code in gensec_krb5, we now follow the approach used in
gensec_gssapi, and use a keytab.

I have also done a lot of work in the GSSAPI code, to try and reduce
the diff between us and upstream heimdal.  It was becoming hard to
track patches in this code, and I also want this patch (the DCE_STYLE
support) to be in a 'manageable' state for when lha considers it for
merging.  (metze assures me it still has memory leak problems, but
I've started to address some of that).

This patch also includes a simple update of other code to current
heimdal, as well as changes we need for better PAC verification.

On the PAC side of things we now match windows member servers by
checking the name and authtime on an incoming PAC.  Not generating these
right was the cause of the PAC pain, and so now both the main code and
torture test validate this behaviour.

One thing doesn't work with this patch:
 - the sealing of RPC pipes with kerberos, Samba -> Samba seems
broken.  I'm pretty sure this is related to AES, and the need to break
apart the gss_wrap interface.

Andrew Bartlett
(This used to be commit a3aba57c00)
2007-10-10 13:36:33 -05:00
Andrew Bartlett
6b14ffe271 r10035: This patch removes the need for the special case hack
'MEMORY_WILDCARD' keytab type. (part of this checking is in effect a
merge from lorikeet-heimdal, where I removed this)

This is achieved by correctly using the GSSAPI gsskrb5_acquire_cred()
function, as this allows us to specify the target principal, regardless
of which alias the client may use.

This patch also tries to simplify some principal handling and fixes some
error cases.

Posted to samba-technical, reviewed by metze, and looked over by lha on IRC.

Andrew Bartlett
(This used to be commit 506a7b67ae)
2007-10-10 13:36:31 -05:00
Andrew Bartlett
52d9dbe75c r10022: Merge tpot's fix for IRIX and AIX_rea build problems from lorikeet-heimdal
to Samba4.

Andrew Bartlett
(This used to be commit 6835e42790)
2007-10-10 13:36:30 -05:00
Andrew Bartlett
ad14812b8f r9931: Make use of new 'norealm' parsing functions rather than strchr(p '@').
Merge these norealm functions from lorikeet-heimdal.

Andrew Bartlett
(This used to be commit 6aef275efd)
2007-10-10 13:36:23 -05:00
Andrew Bartlett
92a652c2a4 r9877: Merge from lorikeet-heimdal, to try and fix build failures.
Andrew Bartlett
(This used to be commit 53f2bf3b91)
2007-10-10 13:36:19 -05:00
Andrew Bartlett
1478781603 r9859: Enable (blocking) KDC resolution with DNS.
To enable, set:

[libdefaults]
 dns_lookup_realm = true
 dns_lookup_kdc = true

in your /etc/krb5.conf.

In the future I may override the krb5.conf and set this on by default
in Samba4.

Andrew Bartlett
(This used to be commit 32fb50d025)
2007-10-10 13:36:18 -05:00
Andrew Bartlett
3c265c7986 r9696: Update prototypes for new name of short parsing function.
Andrew Bartlett
(This used to be commit cc35cd5ee2)
2007-10-10 13:34:42 -05:00
Andrew Bartlett
08730652fb r9680: Update Heimdal to current lorikeet-heimdal (which was itself updated
to Heimdal CVS as of 2005-08-27).

Andrew Bartlett
(This used to be commit 913924a499)
2007-10-10 13:34:39 -05:00
Andrew Tridgell
b8f4e0796d r9648: this fixes the krb5 based login with the pac. The key to this whole saga was
that the logon_time field in the pac must match the authtime field in the ticket we
gave the client in the AS-REP (and thus also the authtime field in the ticket we get
back in the TGS-REQ).

Many thanks to Andrew Bartlett for his patience in showing me the
basic ropes of all this code! This was a joint effort.
(This used to be commit 7bee374b3f)
2007-10-10 13:34:37 -05:00
Andrew Bartlett
55f5453bc8 r9413: Bring Samba4 back up to date with lorikeet-heimdal.
Delete test_crypto_wrapping.c, previously included but unbuilt.

Andrew Bartlett
(This used to be commit d5fb30fb0c)
2007-10-10 13:33:35 -05:00
Andrew Bartlett
65ec408473 r9305: Use the check-var.m4 from roken to really, really detect h_errno correctly.
This fixes the build on Fedora Core 4.

Andrew Bartlett
(This used to be commit aa36b2adad)
2007-10-10 13:33:23 -05:00
Andrew Bartlett
c0e8144c5d r9221: Try to merge Heimdal across from lorikeet-heimdal to samba4.
This is my first attempt at this, so there may be a few rough edges.

Andrew Bartlett
(This used to be commit 9a1d2f2fec)
2007-10-10 13:31:33 -05:00
Stefan Metzmacher
918b1b3251 r9151: reverting to return char * again
metze
(This used to be commit 60e2d58685)
2007-10-10 13:31:24 -05:00
Stefan Metzmacher
40448834a0 r9107: try to get the build on solaris going...
metze
(This used to be commit 1008459a98)
2007-10-10 13:31:17 -05:00
Stefan Metzmacher
2624d8f096 r9105: match the prototype of netdb.h
this should fix the build on solaris 10

lha can that be merged to the main heimdal if that apears to not break
the build on other platforms

metze
(This used to be commit cb02596279)
2007-10-10 13:31:17 -05:00
Andrew Tridgell
10cb617904 r8464: the last few functions needed by irix 6.4.
(This used to be commit 903d963ca8)
2007-10-10 13:23:06 -05:00
Andrew Tridgell
d0e3452a61 r8463: more irix fixes. This one adds some missing addrinfo functions
(This used to be commit 87f7098ee3)
2007-10-10 13:23:06 -05:00
Andrew Tridgell
2ea372afd9 r8420: slowly getting my way through some more heimdal portability fixes
(This used to be commit 59c3de6ca8)
2007-10-10 13:23:01 -05:00
Andrew Tridgell
8c018ff786 r8310: replace the heimdal networking interface scanning code with glue code that uses the Samba
interfaces list. This makes heimdal obey the 'interfaces=' smb.conf option, and should also
fix the portability problems with the heimdal code
(This used to be commit ba621d1c55)
2007-10-10 13:20:04 -05:00
Andrew Tridgell
14fb42204b r8307: try to cope with flex and bison not being installed, in a similar fashion to yapp for pidl
if they are installed, then we rebuild the generated files, otherwise
we use the ones in svn
(This used to be commit 6ab503b7cc)
2007-10-10 13:20:04 -05:00
Heimdal Import User
954c01728e r8302: import mini HEIMDAL into the tree
(This used to be commit 118be28a7a)
2007-10-10 13:19:33 -05:00