sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Code
107,466 Commits 60 Branches 1,144 Tags 452 MiB
764e485450
Commit Graph

107466 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Andreas Schneider
764e485450 mit-samba: Remove obsolete mit_samba_update_pac_data() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:12 +02:00
Andreas Schneider
0668c460b4 s4-kdc: Use mit_samba_reget_pac() in ks_verify_pac() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:12 +02:00
Andreas Schneider
648388ad00 s4-kdc: Implement mit_samba_reget_pac() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:12 +02:00
Andreas Schneider
9c33e9635e s4-pac-glue: Do not add an empty PAC_TYPE_LOGON_NAME with MIT 
MIT Kerberos will insert an empty PAC_TYPE_LOGON_NAME during
krb5_pac_sign().

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
a72eecd5bf mit-samba: Remove unused mit_samba_get_pac_data() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
bff4311ec4 s4-kdc: Use mit_samba_get_pac() in ks_get_pac() 
This adds UPN_DNS_INFO to the PAC.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
e240cff591 s4-kdc: Implement mit_samba_get_pac() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
ecf42cef39 s4-kdc: Fix logging with the KDB driver 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
2a43c8d6c7 s4-torture: Fix reauth tests with smaller clockskew grace time 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
57edd3e781 waf: Move python build instructions to wscript 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
9b932d6a19 python: Add provisioning support for MIT KDC in samba-tool 
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
18917d28a9 python: Add py_is_heimdal_built() to pyglue 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
09f84d0fe5 selftest: Add a variable to indicate that selftest is running 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
fecbc81c60 waf: Create kerberos_implementation.py for provisioning 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
41f03493ec selftest: Skip s4u2proxy tests, no support yet 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
c5113138a9 testprogs: Add MIT Kerberos specific kpasswd blackbox test 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:11 +02:00
Andreas Schneider
dce438e18e s4-kdc: Start the kpasswd service with MIT KDC 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
ec7cdcc5da waf: Search for MIT kadm-server library 
This is needed for plugin registration in the KDC.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
a1d9e8814a s4-kdc: Add MIT Kerberos specific kpasswd code 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
088f171e93 s4-torture: Add AES and RC4 enctype checks 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
3b0f1c2712 s4-torture: Add TORTURE_KRB5_TEST_CLOCK_SKEW test 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
3022307a63 s4-torture: Add TORTURE_KRB5_TEST_BREAK_PW test 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
5d51e4b39b s4-torture: Add TORTURE_KRB5_TEST_PAC_REQUEST test 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
7ad7fca683 s4-torture: Add KDC test harness and first test 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
6ffef6f5ae waf: Only build KRB5 KDC tests when AD_DC build is enabled 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
8fd03be276 testprogs: Add test with exported keytab from samba-tool 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
1521ec4083 testprogs: Add a kinit trust test for MIT KDC 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
3924426785 testprogs: Add test_kinit_mit.sh test 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
c761f9f7d2 s4-torture: Fix kinit of samba4.blackbox.locktest 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
8de3fd59e0 testprogs: Fix usage printout of bogus blackbox test 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:10 +02:00
Andreas Schneider
bec3a18999 testprogs: Fix test_chgdcpass blackbox test with MIT 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Günther Deschner
612714d109 s4-torture: disable s4u2self/proxy remote pac tests for MIT build for now. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
ac5427c6eb selftest: Set clockskew grace time to 5 seconds 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
c85f9b24ce selftest: Setup configs for MIT KDC 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
b40c92016f selftest: Disable RODC tests with MIT KDC 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
687da88590 selftest: Start MIT KDC if Kerberos is from MIT 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
6d19a66cf8 waf: Do not disable the ntvfs fileserver when we have MIT DC build 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
eaaf5ce66e param: Add 'mit kdc config' option to smb.conf 
This points to the kdc config file created by Samba by default.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
6eb1ff9b47 s4-kdc: Register the MIT irpc PAC validation service 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
6b67a39f9f s4-kdc: Add MIT KRB5 based irpc service for PAC validation 
Pair-Programmed-With: Guenther Deschner <gd@samba.org>

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>

Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
32e772b4b9 s4-kdc: Add a MIT Kerberos KDC service 
This starts the krb5kdc binary shipped with MIT Kerberos.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
7556c20d4b param: Add 'mit kdc command' to change the default. 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
b5a67b9d24 waf: Check for MIT KDC binary 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:09 +02:00
Andreas Schneider
990cca36b1 mit-kdb: Update KDB vtable for DAL version 6 
This changed between 1.14 and 1.15. Also the 1.15 change removed the
ability that the KDB module can free memory. This caused issues of
serveral projects. It got fixed with 1.15.1.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:08 +02:00
Andreas Schneider
a0464e3f87 waf: Require MIT Kerberos 1.15.1 for Samba AD 
Are build without AD DC still only requried MIT Kerberos 1.9.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:08 +02:00
Andreas Schneider
b161e5c923 mit-kdb: Zero the db principal when we allocate it 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:08 +02:00
Andreas Schneider
0e84e83252 samba_dnsupdate: Do not rewrite krb5.conf in selftest 
The samba_dnsupdate script is responsible to provision the DNS entries.
The private krb5.conf uses dns lookups to find the KDC to acquire a
Kerberos ticket.  Obviously this will fail because currently we are are
in the process of adding the DNS entries for the KDC.

If we are inside of selftest we need to use the krb5.conf created by
selftest itself.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:08 +02:00
Andreas Schneider
9fee64d0e6 s3-tests: Use common functions in test_smbclient_netbios_aliases.sh 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:08 +02:00
Andreas Schneider
31491f8bb4 testprogs: Add common kinit function 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:08 +02:00
Andreas Schneider
f0e8d98b79 s4:torture: Fix the remote_pac test 
All the Kerberos implementation do not expect an order of the pac
buffer. The buffers are not processed in the oder they are sent but when
required just located.

I confirmed this with MS at the IO Lab.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2017-04-29 23:31:08 +02:00