1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-14 19:24:43 +03:00

78257 Commits

Author SHA1 Message Date
Stefan Metzmacher
342be2851a s3:build: add auth/gensec/spnego.o
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Fri Jan 13 06:32:30 CET 2012 on sn-devel-104
2012-01-13 06:32:30 +01:00
Stefan Metzmacher
01f246e873 auth/gensec: move spnego.c to the toplevel
metze
2012-01-13 04:58:41 +01:00
Stefan Metzmacher
d88af2fe24 auth/gensec: common helper functions should be in gensec_util.c
This makes the dependencies easier to handle.

metze
2012-01-13 04:58:41 +01:00
Stefan Metzmacher
3ad7ca59b3 s4:auth/gensec: inline packet_full_request_u32()
This removes the dependency to s4 specific code.

metze
2012-01-13 04:58:40 +01:00
Stefan Metzmacher
edaa933b17 auth/gensec: add some more functions from gensec_start.c to gensec.h
metze
2012-01-13 04:58:40 +01:00
Stefan Metzmacher
bb6e64802e auth/gensec: make sure functions from gensec.c are in gensec.h
metze
2012-01-13 04:58:40 +01:00
Stefan Metzmacher
36829cff8f s4:auth/gensec: fix compiler warnings in spnego.c
metze
2012-01-13 04:58:40 +01:00
Andrew Bartlett
339d5ea4e6 s3-selftest The krb5 encrypted CIFS test was wrong
Sadly this fails in the test environement for now.  It needs a /etc/krb5.keytab
which we do not provide.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Fri Jan 13 04:57:22 CET 2012 on sn-devel-104
2012-01-13 04:57:22 +01:00
Amitay Isaacs
84ad540ab9 selftest: Do not run symbol check if setting up testenv
Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Fri Jan 13 03:11:20 CET 2012 on sn-devel-104
2012-01-13 03:11:20 +01:00
Jeremy Allison
6c1d98eac0 Add comments to all functions (to help me understand it better).
Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Fri Jan 13 01:35:03 CET 2012 on sn-devel-104
2012-01-13 01:35:03 +01:00
Volker Lendecke
6da246bae1 s3: Fix nested get_share_mode_lock calls
This forces us to only do one real get_share_mode_lock call and
share the data between the nested get_share_mode_lock calls.

Signed-off-by: Jeremy Allison <jra@samba.org>
2012-01-12 23:59:22 +01:00
Volker Lendecke
6f9442a705 s3: Move the share_mode_lock handling to its own file
Signed-off-by: Jeremy Allison <jra@samba.org>
2012-01-12 23:59:22 +01:00
Volker Lendecke
cfebba96bd s3: Put an indirection layer into share_mode_lock
Signed-off-by: Jeremy Allison <jra@samba.org>
2012-01-12 23:59:22 +01:00
Volker Lendecke
9cf6d735d4 s3: Introduce get_share_mode_lock_fresh()
This slightly simplifies the code path for all callers which assume
that a share mode exists already. Only the callers in open_file_ntcreate
and open_directory will ever create new share modes.

Signed-off-by: Jeremy Allison <jra@samba.org>
2012-01-12 23:59:22 +01:00
Volker Lendecke
540e51f77e s3: Replace fill_share_mode_lock()
This replaces fill_share_mode_lock() with the two routines
fresh_share_mode_lock() and parse_share_modes(). This lifts the
decision whether a share mode already existed on level up.

Signed-off-by: Jeremy Allison <jra@samba.org>
2012-01-12 23:59:22 +01:00
Stefan Metzmacher
15cdbba254 s4:repl_cleartext_pwd.py: add optional 'clear_utf16_name' parameter
Not all cleartext password (machine passwords) can be converted to utf8,
let's export the raw uint16_t array.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Jan 12 23:58:12 CET 2012 on sn-devel-104
2012-01-12 23:58:11 +01:00
Stefan Metzmacher
5efe29baed s4:repl_cleartext_pwd.py: add 'attmode' parameter to convert the attname to utf8
metze
2012-01-12 22:15:58 +01:00
Stefan Metzmacher
9a8b72a318 s4:repl_cleartext_pwd.py: correctly compare attids as uint32_t values
metze
2012-01-12 22:12:41 +01:00
Andreas Schneider
103c1cb9bf s3-waf: auth_netlogond depends on tldap.
Autobuild-User: Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date: Thu Jan 12 17:33:10 CET 2012 on sn-devel-104
2012-01-12 17:33:10 +01:00
Andreas Schneider
ad6d8a526e s3-waf: link SECRETS3 only against samba3util. 2012-01-12 15:55:46 +01:00
Andreas Schneider
9bafbf9994 s3-waf: Create a smaller samba3util subsystem. 2012-01-12 15:55:46 +01:00
Stefan Metzmacher
0f14ac40a2 s4:pygensec/tests: add test for gensec_set_max_update_size()
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Jan 12 14:47:05 CET 2012 on sn-devel-104
2012-01-12 14:47:05 +01:00
Stefan Metzmacher
891318ee4c s4:auth/gensec/spnego: add support for fragmented spnego messages
metze
2012-01-12 13:15:08 +01:00
Stefan Metzmacher
b3f8f7e8a3 s4:pygensec: add set_max_update_size() and max_update_size() functions
metze
2012-01-12 13:15:08 +01:00
Stefan Metzmacher
6eea2c33c7 auth/gensec: add gensec_*max_update_size()
This is only a hint for the backend, which may want to fragment
update tokens.

metze
2012-01-12 13:15:08 +01:00
Volker Lendecke
17986097a3 s3: Split a line with 1 statements
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Thu Jan 12 13:10:19 CET 2012 on sn-devel-104
2012-01-12 13:10:19 +01:00
Stefan Metzmacher
d3e5a0bea4 s3:smbd: explicitly ask for GENSEC_FEATURE_UNIX_TOKEN
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Jan 12 11:22:53 CET 2012 on sn-devel-104
2012-01-12 11:22:53 +01:00
Andrew Bartlett
bd164acb82 Revert "make paranoia check less paranoid" - check that key types strictly match
This reverts commit c25af51232616061bb08eea86aae595b4f029490 because
otherwise we could attempt to check a CKSUMTYPE_HMAC_SHA1_96_AES_256 key with a
KRB5_ENCTYPE_ARCFOUR_HMAC_MD5 key.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Thu Jan 12 09:43:07 CET 2012 on sn-devel-104
2012-01-12 09:43:07 +01:00
Andrew Bartlett
3628f34aa3 make hmac-md5 the keyed checksum type for arcfour-hmac-md5 2012-01-12 18:02:55 +11:00
Andrew Bartlett
1787efaa00 use ETYPE_DES3_CBC_SHA1 for the verify step in verify_mic_des3
This allows a strict link between checksum types and key types to be
enforced.

Andrew Bartlett
2012-01-12 18:02:54 +11:00
Andrew Bartlett
d087e715fc heimdal: remove checking of KDC PAC signature, delegate to wdc plugin
The checking of the KDC signature is more complex than it looks, it may be of a different
enc type to that which the ticket is encrypted with, and may even be prefixed
with the RODC number.

This is better handled in the plugin which can easily look up the DB for the
correct key to verify this with, and can also quickly determine if this is
an interdomain trust, which we cannot verify the PAC for.

Andrew Bartlett
2012-01-12 18:02:54 +11:00
Andrew Bartlett
b69c40ffce auth/kerberos: Remove unused TALLOC_CTX argument to check_pac_checksum 2012-01-12 18:02:54 +11:00
Andrew Bartlett
49f8113fab s4-kdc Do the KDC PAC checksum validation in the Samba plugin
Here we can fetch the right key, and check if the PAC is likely to be signed by a key that
we know.  We cannot check the KDC signature on incoming trusts.

Andrew Bartlett
2012-01-12 18:02:54 +11:00
Andrew Bartlett
d0bb8b8a15 s4-kdc: use IDL constant NETLOGON_GENERIC_KRB5_PAC_VALIDATE 2012-01-12 17:54:15 +11:00
Amitay Isaacs
6764e4f20d samba-tool:dns: DNS names are case insensitive
Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Thu Jan 12 06:43:01 CET 2012 on sn-devel-104
2012-01-12 06:43:01 +01:00
Amitay Isaacs
44a85e3752 s4-rpc:dnsserver: DNS names are case insensitive 2012-01-12 05:10:08 +01:00
Jeremy Allison
ddc1f3df51 Ensure we always free aio_ex on all error paths by moving the TALLOC_FREE
call out of smbd_aio_complete_aio_ex() and into the caller.

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Thu Jan 12 03:10:52 CET 2012 on sn-devel-104
2012-01-12 03:10:52 +01:00
Jeremy Allison
f15cf9176d Second part of fix for bug #8673 - NT ACL issue.
Ensure we process the entire ACE list instead of returning ACCESS_DENIED
and terminating the walk - ensure we only return the exact bits that cause
the access to be denied. Some of the S3 fileserver needs to know if we
are only denied DELETE access before overriding it by looking at the
containing directory ACL.

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Wed Jan 11 19:24:53 CET 2012 on sn-devel-104
2012-01-11 19:24:53 +01:00
Jeremy Allison
6aafd8684b First part of fix for bug #8673 - NT ACL issue.
Simplify the logic in the unlink/rmdir calls - makes it readable
(and correct).
2012-01-11 08:54:08 -08:00
Stefan Metzmacher
d7dcbcc42d lib/param: avoid talloc_reference() in copy_service()
The memory reduction compared of talloc_reference() over talloc_strdup()
is typically very low. As the strings are typically short compared
to the talloc header overhead.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Jan 11 16:13:50 CET 2012 on sn-devel-104
2012-01-11 16:13:50 +01:00
David Disseldorp
97818fd6e5 s3-rpcclient: add deldriverex flags argument
The spoolss DeletePrinterDriverEx command offers three flags for
controlling how associated files and other versions of the driver are
effected: DPD_DELETE_UNUSED_FILES (1), DPD_DELETE_SPECIFIC_VERSION (2)
and DPD_DELETE_ALL_FILES (4).

This commit adds an optional numeric flags argument to the rpcclient
deldriverex command.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>

Autobuild-User: David Disseldorp <ddiss@samba.org>
Autobuild-Date: Wed Jan 11 14:39:35 CET 2012 on sn-devel-104
2012-01-11 14:39:35 +01:00
David Disseldorp
8dc9fbd3af spoolss: fix DPD_DELETE_ALL_FILES error return
If DeletePrinterDriverEx is called with DPD_DELETE_ALL_FILES and files
assigned to the to-be-deleted driver overlap with other drivers then an
error is returned. Change the error code here to match Windows 2k8r2.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-01-11 13:56:44 +01:00
Andrew Bartlett
fc2c76f921 s4:auth: Make sure to check the optional auth_context hooks before using them
These are optional to supply - some callers only provide an auth_context for the
other plugin functions, and so we need to deal with this cleanly.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Jan 11 10:49:13 CET 2012 on sn-devel-104
2012-01-11 10:49:13 +01:00
Andrew Bartlett
5c92e9a46f gensec: Make sure to check the optional auth_context hooks before using them
These are optional to supply - some callers only provide an auth_context for the
other plugin functions, and so we need to deal with this cleanly.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:15:42 +01:00
Andrew Bartlett
98ba33b258 gensec: Rename want_flags and got_flags in gensec_gssapi
This make it clearer what type of flags these are.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:11:22 +01:00
Andrew Bartlett
226c3ef7a6 gensec: make gensec_gssapi.h common
This will make it easier to share elements of the GSSAPI gensec mechs,
in much the same way elements of the NTLMSSP mech are shared.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:10:02 +01:00
Andrew Bartlett
49bafcfa48 s3-librpc Supply target service and server to spnego_generic_init_client()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:09:43 +01:00
Andrew Bartlett
50a939ad85 s3-librpc: Rename spnego_ntlmssp_init_client and make generic
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:05:01 +01:00
Andrew Bartlett
138121c516 s3-libsmb: split out auth_generic client functions into auth_generic.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:04:56 +01:00
Andrew Bartlett
e8cd972177 s3-librpc: rename get_ntlmssp_auth_footer to be more generic
This can handle any gensec auth type now.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:04:52 +01:00