sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Code
80,386 Commits 60 Branches 1,144 Tags 452 MiB
5f494c424c
Commit Graph

512 Commits

Author SHA1 Message Date
Günther Deschner
6ef719bf92 s3-libnet-samsync: store samsync sequence number state in keytab. 
Guenther
 2008-11-18 16:05:37 +01:00
Günther Deschner
b8769141e6 s3-libnet-samsync: refactor libnet_samsync. 
Guenther
 2008-11-18 16:05:29 +01:00
Günther Deschner
a079c500a6 s3-libnet-samsync: pass back sequence number from fetch_sam_entries_keytab. 
Guenther
 2008-11-18 16:05:20 +01:00
Günther Deschner
6aaf220f9e s3-libnet-samsync: use netr_DatabaseDeltas unless full replication enforced. 
Guenther
 2008-11-18 16:05:10 +01:00
Günther Deschner
9051351509 s3-libnet-samsync: pass sequence number pointer to process routine. 
Guenther
 2008-11-18 16:05:03 +01:00
Günther Deschner
8c67159755 s3-libnet-samsync: move all modules to startup,process,finish callbacks. 
Guenther
 2008-11-18 16:04:54 +01:00
Günther Deschner
677921b9a3 s3-libnet-samsync: call init and close ops function where appropriate. 
Guenther
 2008-11-18 16:04:46 +01:00
Günther Deschner
eef8de5c88 s3-libnet-samsync: use samsync_ops. 
Guenther
 2008-11-18 16:04:39 +01:00
Günther Deschner
d10293dfdc s3-libnet-samsync: add samsync_ops to all samsync modules. 
Guenther
 2008-11-18 16:04:30 +01:00
Günther Deschner
10572d1bf4 s3-libnet-samsync: add samsync_ops. 
Guenther
 2008-11-18 16:04:21 +01:00
Günther Deschner
0861a7122e s3-libnet: move add_to_keytab_entries to libnet_keytab. 
Guenther
 2008-11-18 16:03:49 +01:00
Günther Deschner
1a48107cc4 s3-libnet-samsync: add support for partial replication. 
Guenther
 2008-11-18 15:59:24 +01:00
Günther Deschner
a48abdaa81 s3-libnet-samsync: use enctype 23 for vampired keytab entries. 
Guenther
 2008-11-17 19:58:30 +01:00
Günther Deschner
fdc28cf8a5 s3-netlogon: fix type of parameters string in user delta. 
Guenther
 2008-11-10 21:46:25 +01:00
Günther Deschner
3fa7a1b085 s3-libnet_samsync: print new line in display output. 
Guenther
 2008-11-04 19:55:07 +01:00
Jeremy Allison
f53578daf4 Fix net rpc vampire, based on an *amazing* piece of debugging work by "Cooper S. Blake" <the_analogkid@yahoo.com>. 
"I believe I have found two bugs in the 3.2 code and one bug that
carried on to the 3.3 branch.  In the 3.2 code, everything is
located in the utils/net_rpc_samsync.c file.  What I believe is the
first problem is that fetch_database() is calling
samsync_fix_delta_array() with rid_crypt set to true, which means
the password hashes are unencrypted from the RID encryption.
However, I believe this call is redundant, and the corresponding
call for samdump has rid_crypt set to false.  So I think the
rid_crypt param should be false in fetch_database().

If you follow the code, it makes its way to sam_account_from_delta()
where the password hashes are decrypted a second time by calling
sam_pwd_hash().  I believe this is what is scrambling my passwords.

These methods were refactored somewhere in the 3.3 branch.  Now the
net_rpc_samsync.c class calls rpc_vampire_internals, which calls
libnet/libnet_samsync.c, which calls samsync_fix_delta_array() with
rid_crypt always set to false.  I think that's correct.  But the
second bug has carried through in the sam_account_from_delta()
function:

 208         if (memcmp(r->ntpassword.hash, zero_buf, 16) != 0) {
 209                 sam_pwd_hash(r->rid, r->ntpassword.hash, lm_passwd, 0);
 210                 pdb_set_lanman_passwd(account, lm_passwd, PDB_CHANGED);
 211         }
 212
 213         if (memcmp(r->lmpassword.hash, zero_buf, 16) != 0) {
 214                 sam_pwd_hash(r->rid, r->lmpassword.hash, nt_passwd, 0);
 215                 pdb_set_nt_passwd(account, nt_passwd, PDB_CHANGED);

If you look closely you'll see that the nt hash is going into the
lm_passwd variable and the decrypted value is being set in the lanman
hash, and the lanman hash is being decrypted and put into the nt hash
field.  So the LanMan and NT hashes look like they're being put in
the opposite fields."

Fix this by removing the rid_crypt parameter.
Jeremy.
 2008-10-22 13:21:23 -07:00
Jelmer Vernooij
7275952568 Add TALLOC_CTX pointer to generate_random_str(), for consistency with 
Samba 4.
 2008-10-19 10:05:48 +02:00
Günther Deschner
6503ffaa04 s3: fix s3 drsuapi callers. 
Guenther
 2008-10-17 10:54:01 +02:00
Günther Deschner
f0dcc1fad4 s4-build: fix drsuapi callers. 
Guenther
 2008-10-16 14:03:10 +02:00
Volker Lendecke
f4095b62a8 If name_to_fqdn fails, retry with the dns domain the DC gave us 
This is a workaround for the cases where you want to join under a netbios name
that is different from your hostname, i.e. a name that can not be found in
/etc/hosts or dns. In these cases, name_to_fqdn fails or gives invalid results.
 2008-10-06 15:23:39 +02:00
Volker Lendecke
0e0371b78a "gwen/cc" does not like the double const :-) 2008-10-04 21:52:11 +02:00
Günther Deschner
022947097f s3-ndr: add stub smb_iconv_convenience to some ndr_ functions. 
Guenther
 2008-09-23 23:35:14 +02:00
Günther Deschner
fd3ba988dc s3-nbt: fix remaining callers of ndr_push/pull_struct_blob. 
Guenther
 2008-09-23 09:49:56 +02:00
Steven Danneman
38fff9f922 Fixed "uninitialized variable" build warning 
With gcc 4.1.3 on Ubuntu 7.10 the following build warning occurs:

Compiling libnet/libnet_samsync_keytab.c
cc1: warnings being treated as errors
libnet/libnet_samsync_keytab.c: In function ‘fetch_sam_entries_keytab’:
libnet/libnet_samsync_keytab.c:102: warning: ‘entry.enctype’ is used uninitialized in this function

Fixed by initializing to ENCTYPE_NULL
 2008-09-15 16:13:35 -07:00
Michael Adam
f9a0b1675e libnet_join: streamline logic of libnet_join_post_processing() 
Michael
(This used to be commit 81cc1af1e6)
 2008-08-29 18:00:51 +02:00
Michael Adam
2d25608a5d libnet: fix join by creating keytab after changing the config. 
Michael
(This used to be commit 96d1c780bf)
 2008-08-29 18:00:51 +02:00
Günther Deschner
bff20e14c3 kerberos: use KRB5_KT_KEY macro where appropriate. 
Guenther
(This used to be commit a042dffd71)
 2008-08-29 11:01:34 +02:00
Günther Deschner
0380fe9d82 kerberos: move the KRB5_KEY* macros to header file. 
Guenther
(This used to be commit c28fa17fff)
 2008-08-29 10:59:28 +02:00
Günther Deschner
5bea31aa3c libnetjoin: support kerberized joining/unjoing (fix #5416). 
Guenther
(This used to be commit da6e0f4f37)
 2008-08-11 19:52:23 +02:00
Michael Adam
a0e664ebe7 libnet samsync ldif: fix the build without LDAP. 
Michael
(This used to be commit 32df05bd1f)
 2008-08-08 23:03:51 +02:00
Jeremy Allison
3907392459 Fix "might be used uninitialized" warnings. 
Jeremy.
(This used to be commit 5abd12eec1)
 2008-08-07 17:49:19 -07:00
Stefan Metzmacher
d8ae40aa3c libnet_keytab: fix the build with heimdal 
metze
(This used to be commit ba18af00cc)
 2008-08-04 14:28:02 +02:00
Michael Adam
87c7496761 libnet dssync: start memory allocation cleanup: use tmp ctx in libnet_dssync(). 
Don't leak temporary data to callers but use a temporary context
that is freed at the end.

Michael
(This used to be commit 2d98ad57f5)
 2008-08-01 17:13:42 +02:00
Michael Adam
84ee630ee9 libnet dssync: fix memory allocation for error/result messages. 
Use the libnet_dssync_context as a talloc context for the
result_message and error_message string members.
Using the passed in mem_ctx makes the implicit assumption
that mem_ctx is at least as long-lived as the libnet_dssync_context,
which is wrong.

Michael
(This used to be commit 635baf6b7d)
 2008-08-01 17:10:59 +02:00
Michael Adam
4c6e9662b8 dssync keytab: add comment header explaining add_to_keytab_entries(). 
Michael
(This used to be commit 1072bd9f96)
 2008-08-01 17:09:08 +02:00
Michael Adam
a5d4b540e2 libnet dssync: add my C after dssync keytab changes. 
Michael
(This used to be commit 9391aec8d4)
 2008-08-01 16:08:00 +02:00
Michael Adam
10225fbef7 dssync: add clean_old_entries flag to dssync_ctx. 
Initialize it to false.
And pass it down to the libnet_keytab context in
libnet_dssync_keytab.c:keytab_startup().

Unused yet.

Michael

Note: This might not be not 100% clean design to put this into the
toplevel dssync context while it is keytab specific. But then, on the
other hand, other imaginable backends might want to use this flag, too...
(This used to be commit 12e884f227)
 2008-08-01 16:08:00 +02:00
Michael Adam
52fee9c87a libnet keytab: implement cleaning of old entries in libnet_keytab_add(). 
Triggered by the flag clean_old_entries from the libnet_keytab_contex
(unused yet...).

Michael
(This used to be commit a5f4e3ad95)
 2008-08-01 16:07:59 +02:00
Michael Adam
8876d79311 libnet keytab: add parameter ingnore_kvno to libnet_keytab_remove_entries() 
to allow for removing all entries with given principal and enctype without
repecting the kvno (i.e. cleaning "old" entries...)

This is called with ignore_kvno == false from libnet_keytab_add_entry() to
keep the original behaviour.

Michael
(This used to be commit 6047f7b685)
 2008-08-01 16:07:59 +02:00
Michael Adam
18573c3e1f libnet keytab: add flag clean_old_entries to libnet_keytab_context. 
Michael
(This used to be commit f40eb8cc20)
 2008-08-01 16:07:59 +02:00
Michael Adam
134d8319c9 libnet keytab: use proper counter type (uint32_t) in libnet_keytab_add(). 
Michael
(This used to be commit d0bd9195f0)
 2008-08-01 16:07:59 +02:00
Michael Adam
efd89b46d6 dssync keytab: when not in single object replication mode, use object dn list as write filter. 
I.e. only the passwords and keys of those objects whose dns are provided
are written to the keytab file. Others are skippded.

Michael
(This used to be commit a013f926ae)
 2008-08-01 16:07:58 +02:00
Michael Adam
982759357f dssync keytab: support storing kerberos keys from supplemental credentials. 
Michael
(This used to be commit 50b1673289)
 2008-08-01 16:07:58 +02:00
Michael Adam
9d12511e45 libnet dssync: rename flag single to single_object_replication 
So that it is more obvious what this controls.

Michael
(This used to be commit 2360f0a19f)
 2008-08-01 16:07:58 +02:00
Michael Adam
072bd87194 libnet dssync: rename repl_nodiff flag to force_full_replication. 
Michael
(This used to be commit ec959b4609)
 2008-08-01 16:07:05 +02:00
Michael Adam
f060b744ef libnet dssync: support lists of dns (instead of one dn) for single object replication. 
Just specify several DNs separated by spaces on the command line of
"net rpc vampire keytab" to get the passwords for each of these
accouns via single object replication.

Michael
(This used to be commit 6e53dc2db8)
 2008-08-01 16:07:04 +02:00
Michael Adam
ab5a6712b6 libnet dssync: move determination of request level into build_request() 
...where it belongs.

Michael
(This used to be commit 012b33f1c5)
 2008-08-01 16:07:04 +02:00
Michael Adam
89d817386c libnet dssync: refactor dsgetncchanges loop out into libnet_dssync_getncchanges(). 
Michael
(This used to be commit 93cda1aa0a)
 2008-08-01 16:07:04 +02:00
Michael Adam
0099c4b0c7 libnet dssync: fix single object replication by adding one check. 
Before, this used the old uptodate vector in the request...

Michael
(This used to be commit 04fb9322d5)
 2008-08-01 16:07:04 +02:00
Michael Adam
9e1eccc911 libnet dssync: simplify logic of libnet_dssync_process() main loop. 
Untangle parsing of results and processing.
Make loop logic more obvious.
Call finishing operation after the loop, not inside.

Michael
(This used to be commit 47c8b3391c)
 2008-08-01 16:07:04 +02:00
Michael Adam
58e0b8d568 libnet dssync: refactor creation of request out into new function 
libnet_dssync_build_request().

Michael
(This used to be commit d745c1af40)
 2008-08-01 16:07:04 +02:00
Michael Adam
c655e295ef vampire keytab: add switch --repl-nodiff to trigger full replication. 
I.e. replication without keeping track of the up to date vector.

Michael
(This used to be commit d4b36e447b)
 2008-08-01 16:07:04 +02:00
Michael Adam
260bbf13d2 dssync keytab: store the samaccountname in the keytab for diff replication. 
When retreiving a diff replication, the sAMAccountName attribute is usually
not replicated. So in order to build the principle, we need to store the
sAMAccounName in the keytab, referenced  by the DN of the object, so that
it can be retrieved if necessary.

It is stored in the form of SAMACCOUNTNAME/object_dn@dns_domain_name
with kvno=0 and ENCTYPE_NONE.

Michael
(This used to be commit 54e2dc1f4e)
 2008-08-01 16:04:43 +02:00
Michael Adam
f6bc42d80c dssync keytab: move handling of removal of duplicates to libnet_keytab_add_entry(). 
This makes libnet_keytab_remove_entries static and moves it up.
libnet_keytab_add_entry() now removes the duplicates in advance.
No special handling neede for the UTDV - this is also needed
for other entries...

Michael
(This used to be commit 3c46374544)
 2008-08-01 16:04:43 +02:00
Michael Adam
a6e5a5d714 libnet_keytab: add some debug statements to libnet_keytab_search(). 
Michael
(This used to be commit d3354c3516)
 2008-08-01 16:04:43 +02:00
Michael Adam
e1fee8ca6d dssync keytab: store the UpToDate vector with ENCTYPE_NULL. 
Michael
(This used to be commit 9fbc3d4903)
 2008-08-01 16:04:43 +02:00
Michael Adam
ea8129b5f0 libnet keytab: use libnet_keytab_add_entry() in libnet_keytab_add(). 
This will in particular allow us to store ENCTYPE_NULL.

Michael
(This used to be commit 85c7e3ae29)
 2008-08-01 16:04:43 +02:00
Michael Adam
ca0cbabd36 libnet keytab: add function libnet_keytab_add_entry() 
This is a stripped down version of smb_krb5_kt_add_entry() that
takes one explicit enctype instead of an array. And it does
not neither salting of keys nor cleanup of old entries.

Michael
(This used to be commit c83e54f1eb)
 2008-08-01 16:04:43 +02:00
Michael Adam
d74f57826a dssync keytab: log the DN of the object to be parsed. 
For debugging purposes.

Michael
(This used to be commit 6913919e3a)
 2008-08-01 16:04:43 +02:00
Michael Adam
86f91a2ba1 dssync keytab: remove old UpToDateNess vectors from keytab before storing new one. 
Michael
(This used to be commit 717bd6f6c3)
 2008-08-01 16:04:42 +02:00
Michael Adam
7205dd5d12 libnet keytab: add function libnet_keytab_remove_entries(). 
This can be used to remove entries of given principal, kvno and enctype.

Michael
(This used to be commit a6f61c05b2)
 2008-08-01 16:04:42 +02:00
Michael Adam
3fa9e5fdd4 libnet_keytab: cleanup libnet_keytab_search(). 
Michael
(This used to be commit 344428d96c)
 2008-08-01 16:04:42 +02:00
Michael Adam
0f94a38580 libnet keytab: test for matching enctype in libnet_keytab_search(). 
Michael
(This used to be commit 484b35f319)
 2008-08-01 16:04:42 +02:00
Michael Adam
31c67f939f dssync keytab: add parsing and logging of servicePrincipalName-s 
As with the userPrincipalName, this is for debugging purposes only (for now..).

Michael
(This used to be commit 7a1d526cba)
 2008-08-01 16:04:42 +02:00
Michael Adam
7d7e8907ca dssync keytab: fix comma placement in debug output 
Michael
(This used to be commit d21ea83f93)
 2008-08-01 16:04:42 +02:00
Michael Adam
8003c93a27 dssync keytab: add debugging output when skipping an object. 
Michael
(This used to be commit f3c110097f)
 2008-08-01 16:04:42 +02:00
Michael Adam
18976c0129 libnet keytab: add enctype parameter to libnet_keytab_search(). 
Not really used yet.

Note: callers use ENCTYPE_ARCFOUR_HMAC enctype for UTDV (for now).
This is what is currently stored. This is to be changed
to ENCTYPE_NULL.

Michael
(This used to be commit cb91d07413)
 2008-08-01 16:04:42 +02:00
Michael Adam
363fd6e297 dssync keytab: add store enctypes in the libnet_keytype_entry structs. 
Still unused by the libnet_keytab_add() function.
This will follow.
In preparation of supporting multiple encryption types in libnet_dssync_keytab.

Michael
(This used to be commit 447b8b1122)
 2008-08-01 16:04:41 +02:00
Michael Adam
f97ba38c3f libnet_keytab: add enctype field to libnet_keytab_entry struct. 
In preparation of supporting more enctyption types in libnet_dssync_keytab.

Michael
(This used to be commit 2b000a2acd)
 2008-08-01 16:04:41 +02:00
Michael Adam
d42160f9de dssync: allow replications of a single obj with net rpc vampire keytab. 
This is triggered by setting the new "single" flag in the dssync_context
and filling the "object_dn" member with the dn of the object to be
fetched.

This call is accomplished by specifying the DRSUAPI_EXOP_REPL_OBJ
extended operation in the DsGetNCCHanges request. This variant does
honor an up-to-date-ness vectore passed in, but the answer does not
return a new up-to-dateness vector.

Call this operation as "net rpc vampire keytab /path/keytab object_dn" .

Michael
(This used to be commit f4a01178a3)
 2008-08-01 16:04:41 +02:00
Michael Adam
4d946b5932 dssync: pass uptodateness vector into and out of DsGetNCChanges request. 
Also store the new uptodateness vector in the backend after completion
and retrieve the old vector before sending the DsGetNCChanges request.

This effectively accomplishes differential replication.

Michael
(This used to be commit a2a88808df)
 2008-08-01 16:04:41 +02:00
Michael Adam
55791799b5 dssync: skip analysis of the msDS_KeyVersionNumber attribute: 
It is a calculated attribute that won't get distributed via replication.

Michael
(This used to be commit d75b7a2052)
 2008-08-01 16:04:41 +02:00
Michael Adam
26cceb8118 dssync: either use the req5 or the req8 request, depending on the supported_extenstion 
that have been recorded in the remote_info28 in the dssync_context.

Michael
(This used to be commit 3a2a69137e)
 2008-08-01 16:04:41 +02:00
Michael Adam
0f98b99483 dssync: record the bind info in the new remote_info28 in libnet_dssync_bind(). 
This extracts the info24 data in case this is what was returned (instead of info28).
E.g. windows 2000 returns info24.

Michael
(This used to be commit 61b41aa615)
 2008-08-01 16:04:41 +02:00
Michael Adam
55b2d50926 dssync: add a drsuapi_DsBindInfo28 struct to the dssync_context struct 
to keep track of what the server told us upon DsBind.

Michael
(This used to be commit bf17d6af61)
 2008-08-01 16:04:40 +02:00
Michael Adam
9f6af6fe7c dssync keytab: wrap printing of the uptodate vector in DEBUGLEVEL >= 10 checks 
Michael
(This used to be commit 7fabe2567d)
 2008-08-01 16:04:40 +02:00
Michael Adam
0db26805da dssync keytab: add support for keeping track of the up-to-date-ness vector. 
The startup operation should get the old up-to-date-ness vector from the backend
and the finish operation should store the new vector to the backend after replication.

This adds the change of the signatures of the operations ot the dssync_ops struct
and the implementation for the keytab ops. The up-to-date-ness vector is stored
under the principal constructed as UTDV/$naming_context_dn@$dns_domain_name.

The vector is still uninterpreted in libnet_dssync_process().
This will be the next step...

This code is essentially by Metze.

Michael
(This used to be commit 01318fb27a)
 2008-08-01 16:04:40 +02:00
Michael Adam
54d6ae09e2 libnet_keytab: add a libnet_keytab_search() function 
that searches and fetches an entry from a keytab file by principal and kvno.

This code is by metze.

Michael
(This used to be commit a51a60066b)
 2008-08-01 16:04:40 +02:00
Michael Adam
7bd3ea0b6f dssync keytab: use add_to_keytab_entries() for pwd history in parse_object(). 
Michael
(This used to be commit 61f071de92)
 2008-08-01 16:04:40 +02:00
Michael Adam
764691fdd1 dssync keytab: add prefix parameter to add_to_keytab_entries() for flexibility. 
This will allow to construct principals of the form PREFIX/name@domain

Michael
(This used to be commit 7dd32b56a6)
 2008-08-01 16:04:40 +02:00
Michael Adam
c1b9eb278f dssync keytab: add check for success of ADD_TO_ARRAY(). 
Michael
(This used to be commit e6f6e61da4)
 2008-08-01 16:04:39 +02:00
Michael Adam
2473888daa dssync keytab: refactor adding entry to keytab_context out into new function 
add_to_keytab_entries()

Michael
(This used to be commit 79151db6ea)
 2008-08-01 16:04:39 +02:00
Michael Adam
16c2190b14 dssync: replace the processing_fn by startup/process/finish ops. 
This remove static a variable for the keytab context in the keytab
processing function and simplifies the signature. The keytab context
is instead in the new private data member of the dssync_context struct.

This is in preparation of adding support for keeping track of the
up-to-date-ness vector, in order to be able to sync diffs instead
of the whole database.

Michael
(This used to be commit c51c3339f3)
 2008-08-01 16:04:39 +02:00
Günther Deschner
9294303943 rpc_client: use init_samr_CryptPassword(Ex) in client tools. 
Guenther
(This used to be commit 97f7f9f21f)
 2008-07-31 13:52:33 +02:00
Tim Prouty
097b27dbcc Enabled domain groups to be added to builtin groups at domain join time 
Previously this was done at token creation time if the Administrators and Users
builtins hadn't been created yet.  A major drawback to this approach is that if
a customer is joined to a domain and decides they want to join a different
domain, the domain groups from this new domain will not be added to the
builtins.

It would be ideal if these groups could be added exclusively at domain join
time, but we can't rely solely on that because there are cases where winbindd
must be running to allocate new gids for the builtins.  In the future if there
is a way to allocate gids for builtins without running winbindd, this code
can be removed from create_local_nt_token.

- Made create_builtin_users and create_builtin_administrators non-static so
they can be called from libnet
- Added a new function to libnet_join that will make a best effort to add
domain administrators and domain users to BUILTIN\Administrators and
BUILTIN\Users, respectively.  If the builtins don't exist yet, winbindd must be
running to allocate new gids, but if the builtins already exist, the domain
groups will be added even if winbindd is not running.  In the case of a
failure the error will be logged, but the join will not be failed.
- Plumbed libnet_join_add_dom_rids_to_builtins into the join post processing.
(This used to be commit e92faf5996)
 2008-07-30 14:06:36 -07:00
Günther Deschner
3ea5c185ad build: fix some no previous prototype warnings. 
Guenther
(This used to be commit 51062534fd)
 2008-07-30 18:10:46 +02:00
Michael Adam
2bd58bf383 Change occurrences of the u1 member of DsBindInfo* to pid after idl change. 
Michael
(This used to be commit 42f3d681ca)
 2008-07-22 16:28:13 +02:00
Volker Lendecke
ba2cb35ca5 Refactoring: Change calling conventions for cli_rpc_pipe_open_schannel_with_key 
Pass in ndr_syntax_id instead of pipe_idx, return NTSTATUS
(This used to be commit 78e9c937ff)
 2008-07-20 17:37:13 +02:00
Volker Lendecke
b8fc15be95 Refactoring: Make get_schannel_session_key return NTSTATUS 
(This used to be commit a0793cc853)
 2008-07-20 17:37:12 +02:00
Volker Lendecke
1335da2a7c Refactoring: Change calling conventions for cli_rpc_pipe_open_noauth 
Pass in ndr_syntax_id instead of pipe_idx, return NTSTATUS
(This used to be commit 9abc9dc4dc)
 2008-07-20 17:37:11 +02:00
Günther Deschner
88b0b867cb libnetjoin: make libnet_join_rollback() static. 
Guenther
(This used to be commit f1cc39e375)
 2008-07-18 16:42:38 +02:00
Karolin Seeger
490b60b500 Use LDAP macros instead of attribute names. 
Karolin
(This used to be commit 7dae8b04f1)
 2008-07-18 15:36:20 +02:00
Michael Adam
0bb7c0a5d9 dssync: fix missing prototype warning by including the proper header. 
Michael
(This used to be commit 7d7b63e89b)
 2008-07-18 12:20:11 +02:00
Stefan Metzmacher
ddc0d9deb3 libnet_dssync: use ctr[1|6]->more_data 
metze
(This used to be commit 6b7ddb6d66)
 2008-07-16 15:31:23 +02:00
Günther Deschner
2c703ec720 libnetjoin: fix Bug #5570. 
Thanks to Atte Peltomäki.

Guenther
(This used to be commit 144d374ad9)
 2008-07-03 12:02:01 +02:00
Günther Deschner
9b0e3bb0c3 net_vampire: add code to vampire to a Kerberos keytab file using DRSUAPI. 
Guenther
(This used to be commit 0ef420c3a4)
 2008-07-01 10:02:01 +02:00
Günther Deschner
fc836440a5 net_vampire: keep keytab context and flush keytab only after the last query. 
Guenther
(This used to be commit 48efe7dbce)
 2008-07-01 10:00:57 +02:00
Günther Deschner
16e44ee112 kerberos: allow to keep entries with old kvno's while creating keytab. 
Guenther
(This used to be commit 6194244bd9)
 2008-06-30 12:38:40 +02:00
Günther Deschner
52635c6f58 kerberos: rename smb_krb5_kt_add_entry to smb_krb5_kt_add_entry_ext. 
Guenther
(This used to be commit 48600a0019)
 2008-06-30 12:38:32 +02:00
Jeremy Allison
799252f635 Fix the non-LDAP, non-krb5 build, fix gcc -O3 warnings. 
Jeremy.
(This used to be commit 9e2ab30d3c)
 2008-06-26 19:46:18 -07:00
Günther Deschner
46dd2d77ec libnet_dssync: add last_query flag to processing routine. 
Guenther
(This used to be commit 22bdee7fe0)
 2008-06-27 02:01:15 +02:00
Günther Deschner
e58b2db024 libnet_dssync: add output filename and dns_domain_name to dssync struct. 
Guenther
(This used to be commit c16e1820f8)
 2008-06-27 02:01:03 +02:00
Günther Deschner
92df9ae393 net_vampire: use bool for last_query information in samsync. 
Guenther
(This used to be commit fa1976e23a)
 2008-06-27 01:59:26 +02:00
Günther Deschner
8b52e2bc63 net_vampire: separate keytab code from samsync code. 
Guenther
(This used to be commit 69d8442bf3)
 2008-06-27 01:58:39 +02:00
Günther Deschner
31f1ad4311 libnet_dssync: pass down drsuapi_DsReplicaOIDMapping_Ctr to callback. 
Guenther
(This used to be commit cbff970fac)
 2008-06-26 18:36:35 +02:00
Günther Deschner
a8b8994c2d libnet_dssync: always decrypt attributes before passing them to the processing routine. 
Guenther
(This used to be commit 6eedd167e7)
 2008-06-26 18:35:54 +02:00
Günther Deschner
eb6903344c net_vampire: add some error output to libnet_dssync. 
Guenther
(This used to be commit 891d4cca0c)
 2008-06-26 10:24:14 +02:00
Günther Deschner
92bd665aea rpc_client: let cli_get_session_key() return talloced session key. 
Thanks, Volker, for pointing this out.

Guenther
(This used to be commit b47899195e)
 2008-06-25 09:51:31 +02:00
Günther Deschner
2341f3381d net_vampire: add basic libnet_dssync() infrastructure. 
Guenther
(This used to be commit 9486e532da)
 2008-06-24 23:50:31 +02:00
Günther Deschner
adef1b004b net_vampire: add code to vampire a SAM database to a keytab file. 
Guenther
(This used to be commit ee6e422c0e)
 2008-06-24 23:40:14 +02:00
Günther Deschner
34e4167446 net_vampire: add username/password to samsync_context. 
Guenther
(This used to be commit e884304206)
 2008-06-24 23:39:50 +02:00
Günther Deschner
18c9e75218 libads: use ads_connect_user_creds in some places. 
Guenther
(This used to be commit ebf31203e7)
 2008-06-24 23:37:58 +02:00
Günther Deschner
48a680ecf2 net_vampire: more libnet_samsync restructuring. 
Guenther
(This used to be commit 3bcda522f0)
 2008-06-23 23:38:53 +02:00
Günther Deschner
8725626ec8 net_vampire: prepend libnet_ to the public samsync functions. 
Guenther
(This used to be commit f020c947cf)
 2008-06-23 23:38:52 +02:00
Günther Deschner
bd6fece98a net_vampire: move out display routines to one file. 
Guenther
(This used to be commit 64b48a07e7)
 2008-06-23 23:38:52 +02:00
Günther Deschner
de33b264d1 net_vampire: move out passdb routines to one file. 
Guenther
(This used to be commit 74d431270d)
 2008-06-23 23:38:52 +02:00
Günther Deschner
6f4571bf69 net_vampire: fix included header. 
Guenther
(This used to be commit 1dbe6ea860)
 2008-06-23 23:38:52 +02:00
Günther Deschner
ddf6e73b1f net_vampire: move pull_netr_AcctLockStr() to libnet. 
Guenther
(This used to be commit 8ec64a96e4)
 2008-06-23 23:38:52 +02:00
Günther Deschner
fefcb70f87 net_vampire: add error and result_message to samsync_context. 
Guenther
(This used to be commit e0b1172004)
 2008-06-17 19:55:16 +02:00
Günther Deschner
49b269f50f net_vampire: add domain_name to samsync_context. 
Guenther
(This used to be commit 7e7f07ec59)
 2008-06-17 19:55:10 +02:00
Günther Deschner
45bce6e505 net_vampire: fix samsync_process_database(). 
Turns out the password hashes are not rid encrypted in the samsync reply.

Guenther
(This used to be commit 7d8d60bcba)
 2008-06-17 10:49:14 +02:00
Günther Deschner
0d0043697d net_vampire: fix build warning. 
Guenther
(This used to be commit eb4232fec0)
 2008-06-17 10:49:14 +02:00
Günther Deschner
16eb846fa5 net_vampire: use generic output filename and use correct argv element. 
Guenther
(This used to be commit e0843e631e)
 2008-06-17 10:49:13 +02:00
Günther Deschner
51fec7863b net_vampire: move ldif code out of net_rpc_samsync.c 
Guenther
(This used to be commit 1d5758ec3a)
 2008-06-17 10:49:13 +02:00
Günther Deschner
ccdcbc2efe net_vampire: move some samsync functions to libnet. 
Guenther
(This used to be commit b3b6af0a3e)
 2008-06-17 10:49:13 +02:00
Günther Deschner
813ca8d705 samsync: add prototype for samsync_fix_delta_array(). 
Guenther
(This used to be commit 6c1904f8be)
 2008-06-13 12:30:36 +02:00
Günther Deschner
61b68fc43c samsync: add samsync_fix_delta_array() 
This code is vastly based on samba4 code.

Guenther
(cherry picked from commit 5b68be9699)
(This used to be commit 2c53d87de4)
 2008-06-13 12:23:50 +02:00
Günther Deschner
e3e1172979 libnetjoin: add libnet_join_rollback(). 
This is required now if the join verify failed and we already
modified the local configuration.

Guenther
(This used to be commit 2870fe50af)
 2008-06-05 19:34:30 +02:00
Günther Deschner
387706a49d libnetjoin: First store configuration and then verify the join. 
Jerry, this fixes the issues while joining with "config backend = registry".

Guenther
(This used to be commit b3d47f0992)
 2008-06-05 19:34:06 +02:00
Günther Deschner
bb58d33b6d libnetjoin: correctly copy returned lsa policy sid. 
Guenther
(This used to be commit f9e5450c94)
 2008-06-04 18:05:15 +02:00
Günther Deschner
dddc5725db libnetjoin: only close existing policy handles while unjoining. 
Guenther
(This used to be commit 6dbed6e7b7)
 2008-06-04 02:43:41 +02:00
Günther Deschner
aa8bfd39eb libnetjoin: delete possible "realm" leftover parameter. 
Guenther
(This used to be commit d7ba98cc3f)
 2008-06-04 01:35:44 +02:00
Michael Adam
04da4453ab libnet: freeze libnet_proto.h from "make proto" 
Michael
(This used to be commit b455cd1a61)
 2008-05-18 23:35:42 +02:00
Günther Deschner
6b2af349cf libnetjoin: for informational reasons, report forest_name. 
Guenther
(This used to be commit 452a9ea4af)
 2008-05-16 12:16:04 +02:00
Günther Deschner
847d385f7b Fix Bug #5465 (joining with createcomputer=ou1/ou2/ou3). 
Guenther
(This used to be commit f3251ba03a)
 2008-05-14 23:53:23 +02:00
Günther Deschner
67c644aa59 dsgetdcname: use existing messaging_context if possible. 
Guenther
(This used to be commit 7889516a38)
 2008-05-09 14:59:20 +02:00
Günther Deschner
f11acf3582 Use strip_hostname after dsgetdcname/getdcname calls. 
Guenther
(This used to be commit 82cbb3269b)
 2008-05-09 14:59:19 +02:00
Günther Deschner
c27e661ad1 libnetjoin: identify type of domain early. 
This finally enables joining AD using workgroup or realm name.

Guenther
(This used to be commit 0cf16e6b47)
 2008-04-22 01:54:49 +02:00
Volker Lendecke
e73e8297f5 Replace cli_rpc_pipe_close by a talloc destructor on rpc_pipe_struct 
(This used to be commit 99fc3283c4)
 2008-04-20 14:08:16 +02:00
Volker Lendecke
2a2188591b Add "desthost" to rpc_pipe_client 
This reduces the dependency on cli_state
(This used to be commit 783afab9c8)
 2008-04-20 00:13:09 +02:00
Günther Deschner
ae1e1085a1 libnetjoin/net: Fix lp_config_backend_is_registry() handling. 
Thanks obnox, now we can net ads join and net ads leave with zero
configuration changes if "config backend = registry".

Guenther
(This used to be commit 9003881773)
 2008-04-14 23:07:55 +02:00
Günther Deschner
a31281a751 libnetjoin: delete the workgroup name when requested while unjoining. 
Guenther
(This used to be commit 1782e89f33)
 2008-04-14 22:57:37 +02:00
Günther Deschner
c8d96d57f8 libnetjoin: separate out libnet_join_lookup_dc_rpc. 
Guenther
(This used to be commit 8d3d1c094a)
 2008-04-14 22:56:12 +02:00
Günther Deschner
cbd07aa047 libnetjoin: Fix unjoining when no KRB5CCNAME is around. 
Guenther
(This used to be commit 7fd237c545)
 2008-04-14 16:15:18 +02:00
Günther Deschner
a4e0f60c4e libnetjoin: Remove machine account if we failed to set password. 
Guenther
(This used to be commit db5e0ed186)
 2008-04-14 14:44:58 +02:00
Günther Deschner
e33b13e826 libnetjoin: Fix joining when no KRB5CCNAME is around. 
Guenther
(This used to be commit 512e6ca0a9)
 2008-04-14 12:33:10 +02:00
Günther Deschner
99d3590455 Fix NETLOGON credential chain with Windows 2008 all over the place. 
In order to avoid receiving NT_STATUS_DOWNGRADE_DETECTED from a w2k8
netr_ServerAuthenticate2 reply, we need to start with the AD netlogon negotiate
flags everywhere (not only when running in security=ads). Only for NT4 we need
to do a downgrade to the returned negotiate flags.

Tested with w2k8, w2ksp4, w2k3r2 and nt4sp6.

Guenther
(This used to be commit 0970369ca0)
 2008-04-02 11:12:47 +02:00
Günther Deschner
8b29c8f634 Support "net ads join" format while joining to a specific ou. 
libnetjoin now supports Computers/Servers/Unix as well as
ou=Computers,ou=Servers,ou=Unix,dc=ber,dc=realm,dc=com.

Guenther
(This used to be commit c0be84c96d)
 2008-03-28 16:43:59 +01:00
Günther Deschner
14b6e9d46b Add Support for DOMAIN\DCNAME syntax in libnetjoin. 
This format is used by Windows to enforce joining to a specific DC.

Guenther
(This used to be commit cc654892c0)
 2008-03-28 14:15:20 +01:00
Michael Adam
6f7cfeddd6 libsmbconf: add a "path" variable to the conf context. 
This is passed to the module init routines.
In case of the registry, this is the path of the
basekey in registry, that is to be used, defaulting
to KEY_SMBCONF (HKLM\software\samba\smbconf), when
NULL is given. This is the only case currently used.

In order to support other keys, registry initialization
for smbconf has to be changed to support different keys.

Michael
(This used to be commit 96434d9dc7)
 2008-03-21 18:19:24 +01:00
Volker Lendecke
c69c5c132a Fix Coverity ID 547 
Günther, please check. If r->in.ads==NULL, we can't call ads_leave_realm at
all.

Thanks,

Volker
(This used to be commit 120d8c889f)
 2008-03-21 10:40:40 +01:00
Michael Adam
fececde181 libsmbconf: add backend specific init function. 
Hide generic init function taking smbconf_ops argument
from public api.

Michael
(This used to be commit b3f6920ccb)
 2008-03-21 02:25:56 +01:00
Michael Adam
23b1d721b8 libsmbconf: rename smbconf_close() to smbconf_shutdown(). 
Michael
(This used to be commit 797b26ad3f)
 2008-03-21 02:25:56 +01:00
Michael Adam
adf5bf554c libsmbconf: rename smbconf_open() to smbconf_init(). 
That's more appropriate.

Michael
(This used to be commit d7bd9bb8aa)
 2008-03-21 02:25:56 +01:00
Michael Adam
6274929b1e libsmbconf: rename all occurrences of libnet_conf_ to smbconf_ . 
Michael
(This used to be commit 097af0309d)
 2008-03-17 18:03:02 +01:00
Michael Adam
670418c116 Move libnet_conf to a library lib/smbconf/ of its own, fixing the api. 
The libnet_conf code to access the registry based configuration has
become more of a library used in several places in samba (e.g. loadparm)
than an abstraction of "net conf". So I move it to a location lib/smbconf/.

In the same breath, the api is fixed (not generated by make proto anymore).

Michael
(This used to be commit 5315ef41f4)
 2008-03-17 18:03:02 +01:00
Günther Deschner
d06274b541 Add secure_channel_type to libnetjoin. 
Guenther
(This used to be commit f88910c1e5)
 2008-03-04 19:04:54 +01:00
Günther Deschner
5a4182012d Use TALLOC_FREE in libnetjoin debugging dump code. 
Guenther
(This used to be commit b753087ff7)
 2008-03-04 11:07:13 +01:00
Günther Deschner
422af9a516 Make sure we are still able to join Windows 2008. 
Guenther
(This used to be commit aa9c0f5877)
 2008-03-01 16:14:39 +01:00
Günther Deschner
53d55794df libnetjoin: add fallback to level 24 samr setinfo so that libnet can join NT4. 
Guenther
(This used to be commit bc2d3d5144)
 2008-02-29 01:27:52 +01:00
Günther Deschner
29222fa551 libnetjoin: Trying to avoid confusion between acct_flags, acb_info and 
access_desired.

Guenther
(This used to be commit 63894e5c93)
 2008-02-29 01:25:45 +01:00
Günther Deschner
2306574570 libnetjoin: Merge in comments, debugs and missing code from original join code. 
Guenther
(This used to be commit 09e6010159)
 2008-02-28 19:49:07 +01:00
Günther Deschner
15f6e27bd5 Add some more error handling in libnetjoin. 
Guenther
(This used to be commit 892b2bc0cf)
 2008-02-28 17:05:38 +01:00
Günther Deschner
0d8985f2da Let dsgetdcname() return a struct netr_DsRGetDCNameInfo. 
Guenther
(This used to be commit b1a4b21f8c)
 2008-02-28 12:40:55 +01:00
Günther Deschner
7347e1ff47 Store domain_is_ad info as early as possible in libnetjoin. 
Guenther
(This used to be commit c4ba68aa94)
 2008-02-28 11:38:01 +01:00
Günther Deschner
46bdaa5d37 Check for mandatory domain name in libnetjoin/unjoin. 
Guenther
(This used to be commit 95bdf2f23c)
 2008-02-28 11:38:01 +01:00
Günther Deschner
4ba6c04d0a Delete affinity cache entries while unjoining with libnetunjoin. 
Guenther
(This used to be commit 0315b8e53d)
 2008-02-28 11:38:01 +01:00
Günther Deschner
09886976f6 Fill in machine account manipulation flags while unjoining in libnetunjoin. 
Guenther
(This used to be commit 23ae67158e)
 2008-02-28 11:38:01 +01:00
Günther Deschner
1d807c3c29 Add preliminary libnet_join_post_verify call to libnetjoin. 
Guenther
(This used to be commit f0e319a18d)
 2008-02-28 11:38:01 +01:00
Günther Deschner
39ba91fd83 Merge all connect ads calls into libnet_join_post_processing_ads(). 
Guenther
(This used to be commit be96baeffc)
 2008-02-28 11:38:01 +01:00
Günther Deschner
97c2dfc52f Use W_ERROR_NOT_OK_GOTO_DONE macro in libnetjoin. 
Guenther
(This used to be commit fec230b28f)
 2008-02-28 11:38:01 +01:00
Michael Adam
3e3df1bfe2 Add a function libnet_conf_get_seqnum() to the libnet_conf API. 
This is to provide a change sequence number to users, so that they
can use it to detect change in the config and trigger a reload.

Michael
(This used to be commit a0b12f4d81)
 2008-02-19 09:09:04 +01:00
Michael Adam
9af84dd382 Rename registry_init_regdb() to registry_init_smbconf(). 
That's what it actually is.

Michael
(This used to be commit 9d3c27f557)
 2008-02-15 16:23:10 +01:00
Günther Deschner
e2b3aad817 Collect all init_lsa_string varients in one place. 
Guenther
(This used to be commit f4581e9f44)
 2008-02-12 22:05:39 +01:00
Günther Deschner
bc742a06a2 Remove all callers of rpccli_samr_setuserinfo2 and replace with 
rpccli_samr_SetUserInfo (see the opcode mixup in rpc_samr.h).

Guenther
(This used to be commit bdc4918503)
 2008-02-12 18:53:59 +01:00
Günther Deschner
b1c6104fa4 Use every 
(This used to be commit d9cec295bf)
 2008-02-12 18:21:52 +01:00
Günther Deschner
90631dd2c2 Removing unused ACCT_-flags. 
Guenther
(This used to be commit d1e5a5a7f9)
 2008-02-12 09:48:47 +01:00
Günther Deschner
210a4ab76f Use rpccli_samr_LookupNames() in libnetjoin. 
Guenther
(This used to be commit e62bfd2dee)
 2008-02-08 15:30:35 +01:00
Günther Deschner
adeb94a9a6 Use rpccli_lsa_QueryInfoPolicy() in libnet_join. 
Guenther
(This used to be commit 28ef55cbf1)
 2008-02-08 10:26:51 +01:00
Günther Deschner
3783e6af8a Use rpccli_lsa_QueryInfoPolicy2 in libnet join. 
Guenther
(This used to be commit ddc2fc16bf)
 2008-02-08 10:16:00 +01:00
Günther Deschner
270ba9c238 Use rpccli_samr_Connect2() all over the place. 
Guenther
(This used to be commit bdf8d56262)
 2008-02-04 22:12:40 +01:00
Günther Deschner
ddbe4ea6b7 Use rpccli_samr_CreateUser2() all over the place. 
Guenther
(This used to be commit 701af69118)
 2008-02-01 16:29:20 +01:00
Günther Deschner
37b56c0113 Use rpccli_samr_OpenUser() all over the place. 
Guenther
(This used to be commit da90eb7653)
 2008-02-01 12:30:15 +01:00
Günther Deschner
42960f817a Use rpccli_samr_OpenDomain() all over the place. 
Guenther
(This used to be commit e4e9d72724)
 2008-02-01 12:29:10 +01:00
Günther Deschner
5334b364c2 Remove rpccli_samr_close and use pidl generated function instead. 
Guenther
(This used to be commit 64f0889401)
 2008-01-31 11:09:11 +01:00
Günther Deschner
5ab43ae0d8 Eliminate remote tree of dsgetdcname (which will happen in libnetapi then). 
Guenther
(This used to be commit fd490d236b)
 2008-01-29 15:09:56 +01:00
Günther Deschner
92183450f1 Trying to avoid defining new SAMR acct creation flags when we already have them with different 
names. Matt, Jeremy, please check.

Guenther
(This used to be commit d4a9e46edf)
 2008-01-25 01:04:30 +01:00
Jeremy Allison
a0186fb78d Forward ported version of Matt Geddes <musicalcarrion@gmail.com> 
patch for adding acct_flags to rpccli_samr_create_dom_user().
Jerry please test.
Jeremy.
(This used to be commit 7d94f97947)
 2008-01-23 13:54:02 -08:00
Michael Adam
feb77c978b Add another check for talloc failure to libnet_conf 
Michael
(This used to be commit 196e4ce8c5)
 2008-01-21 22:49:45 +01:00
Michael Adam
c5c38d6227 Fix formatting of multi_sz registry values. 
Don't print only the last component.

Michael
(This used to be commit 654e96208e)
 2008-01-21 22:49:45 +01:00
Michael Adam
7f2e253efb Use talloc_stackframe() for temporary contexts throughout libnet_conf.c 
Michael
(This used to be commit 4d734106b7)
 2008-01-21 22:49:45 +01:00
Michael Adam
188bfbc192 Add a check for talloc failure. - Pointed out by Volker. 
Michael
(This used to be commit bdc49b07cc)
 2008-01-21 22:49:45 +01:00
Michael Adam
7bfceba4bc Use lp_config_backend_is_registry() instead of lp_include_registry_globals(). 
Michael
(This used to be commit c5a7d421c5)
 2008-01-16 17:10:02 +01:00
Günther Deschner
168e122682 Autofetch domain_sid while unjoining in libnetjoin. 
Guenther
(This used to be commit 622109895c)
 2008-01-16 11:08:05 +01:00
Günther Deschner
1311918d17 Nicen some error strings in libnetjoin. 
Guenther
(This used to be commit 05cf1413cc)
 2008-01-16 11:08:05 +01:00
Günther Deschner
1bb220174f Avoid use of NDR_PRINT_X_DEBUG (that debugs with level 0) in libnetjoin. 
Guenther
(This used to be commit 357a393b10)
 2008-01-16 11:08:05 +01:00
Günther Deschner
fe165e4a9f Use autogenerated debugging functions in libnetjoin when requested. 
Guenther
(This used to be commit 08c1720509)
 2008-01-15 17:00:58 +01:00
Günther Deschner
40222cc8e2 Remove unrequired TALLOC_FREE. 
Guenther
(This used to be commit 15d0e57438)
 2008-01-15 15:48:48 +01:00
Günther Deschner
b239612fcf Use autogenerated libnet_join header. 
Guenther
(This used to be commit d94bd3a03b)
 2008-01-15 15:29:50 +01:00
Günther Deschner
b32d613ed0 No need to re-establish AD connection all the time. 
Guenther
(This used to be commit f21871c6d6)
 2008-01-15 11:02:56 +01:00