IF YOU WOULD LIKE TO GET AN ACCOUNT, please write an
email to Administrator. User accounts are meant only to access repo
and report issues and/or generate pull requests.
This is a purpose-specific Git hosting for
BaseALT
projects. Thank you for your understanding!
Только зарегистрированные пользователи имеют доступ к сервису!
Для получения аккаунта, обратитесь к администратору.
regenerate lex.c files with flex 2.5.33
this makes sure we include config.h as first header
hopefully fixes the build on SerNet-aix
abartlet: please don't revert that again with your next
heimdal merge...:-)
metze
the krbtgt hdb entry provides.
We need to make sure other KDC's with the same hdb backend data
can accept the TGT. (w2k and w2k3 don't support aes256-cts-hmac-sha1-96 (18)
session keys.)
Love: I'm not sure if this is the correct way of doing it...
metze
of KDC behaviour. This should allow PKINIT to be turned on and
managed with reasonable sanity.
This also means that the krb5.conf in the same directory as the
smb.conf will always have priority in Samba4, which I think will be
useful.
Andrew Bartlett
Update Heimdal to match current lorikeet-heimdal. This includes
integrated PAC hooks, so Samba doesn't have to handle this any more.
This also brings in the PKINIT code, hence so many new files.
Andrew Bartlett
Remove kerberos_verify.c, as we don't need that code any more.
Replace with code for using the new krb5_rd_req_ctx() borrowed from
Heimdal's accecpt_sec_context.c
Andrew Bartlett
full database name. The existing code (needed for when we use the HDB
as a keytab, such as for the kpasswd service) only works for HDB
keytabs not prefixed with a type.
Andrew Bartlett
(it doesn't compile on suse 10.1 because gethostname() isn't found,
unistd.h isn't included...)
as we don't need the spnego mech, disable it till it gets fixed in heimdal
metze
This merges Samba4 with lorikeet-heimdal, which itself has been
tracking Heimdal CVS for the past couple of weeks.
This is such a big change because Heimdal reorganised it's internal
structures, with the mechglue merge, and because many of our 'wishes' have been granted: we now have DCE_STYLE GSSAPI, send_to_kdc hooks and many other features merged into the mainline code. We have adapted to upstream's choice of API in these cases.
In gensec_gssapi and gensec_krb5, we either expect a valid PAC, or NO
PAC. This matches windows behavour. We also have an option to
require the PAC to be present (which allows us to automate the testing
of this code).
This also includes a restructure of how the kerberos dependencies are
handled, due to the fallout of the merge.
Andrew Bartlett
These principals do not need to be in the same realm as the rest of
the ticket, the full principal name is in the first componet of the
ASN.1.
Samba4's backend will handle getting this to the 'right' place.
Andrew Bartlett
caused the RPC-SECRETS test to crash smbd in an inlined version of
this memcmp() call. This patch should have absolutely no effect at
all, but in fact it prevents the crash.
Disassembling at the point of the crash, it shows that gcc is inlining
the memcmp(). I don't know enough MIPS assembler to actually spot the
bug. In case anyone reading this does know MIPS assembler, here is the
gcc generated code that crashes:
0x105e0218 <gssapi_krb5_verify_header+168>: lw $t1,52($sp)
0x105e021c <gssapi_krb5_verify_header+172>: lw $t1,0($t1)
0x105e0220 <gssapi_krb5_verify_header+176>: lhu $t1,0($t1)
0x105e0224 <gssapi_krb5_verify_header+180>: lw $t2,68($sp)
0x105e0228 <gssapi_krb5_verify_header+184>: lhu $t2,0($t2)
0x105e022c <gssapi_krb5_verify_header+188>: subu $t1,$t1,$t2
it gets a segv at 0x105e0220.
lha, what do you think of this? The change should be innocuous on all
other platforms, apart from making the code harder to read :(
