1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Commit Graph

132 Commits

Author SHA1 Message Date
Andreas Schneider
b6d66e55ad s4:torture: Initialize struct netr_LogonSamLogonEx
"Error: UNINIT (CWE-457):
samba-4.20.0rc2/source4/torture/rpc/schannel.c:250: var_decl: Declaring variable ""r"" without initializer.
samba-4.20.0rc2/source4/torture/rpc/schannel.c:357: uninit_use_in_call: Using uninitialized value ""r.in.validation_level"" when calling ""torture_comment"".
  355|   			""LogonSamLogonEx failed"");
  356|   	} else {
  357|-> 		torture_comment(tctx,
  358|   				""Skip auth_level[%u] Testing LogonSamLogonEx with name %s using %s and validation_level: %d\n"",
  359|   				auth_level, ninfo.identity_info.account_name.string, crypto_alg,"

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Martin Schwenke <mschwenke@ddn.com>
2024-06-30 23:20:33 +00:00
Andreas Schneider
085cfe0c4a s4:torture:rpc: Fix code spelling
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14 21:45:30 +00:00
Stefan Metzmacher
e7e521fe9b s4:torture/rpc: add test for invalid av_pair content in LogonSamLogonEx
A netapp diag tool uses a NTLMv2_CLIENT_CHALLENGE with invalid bytes
as av_pair blob. Which is supposed to be ignored by DCs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-01-04 20:07:28 +00:00
Stefan Metzmacher
6aedd965e1 CVE-2020-25717: s4:torture: start with authoritative = 1
This is not strictly needed, but makes it easier to audit
that we don't miss important places.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09 19:45:32 +00:00
Andreas Schneider
a40bc1d0ee s4:torture: Migrate smbtorture to new cmdline option parser
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-16 00:34:38 +00:00
Andreas Schneider
521f77c667 auth:creds: Add obtained arg to cli_credentials_set_kerberos_state()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28 03:43:34 +00:00
Andreas Schneider
1298280a22 auth:creds: Rename CRED_USE_KERBEROS values
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-11-03 15:25:37 +00:00
Alexander Bokovoy
317bc6a734 torture/rpc/lsa: allow testing different lookup levels
Convert torture/rpc/lsa LookupNames/LookupSids code to allow testing
different LSA_LOOKUP_NAMES_* levels. Keep existing level 1
(LSA_LOOKUP_NAMES_ALL) for the current set of tests.

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-14 11:49:33 +00:00
Gary Lockyer
96e6adedcd librpc idl: netlogon netr_identity_info logon_id to 64 bit
Fold the two 32 bit values logon_id_high and logon_id_low into a single
64 bit logon_id in netr_identity_info.  This will be used to tie
together winbind and SamLogon requests in audit logging.

Summary of the of the Query and Response from Microsoft on it's usage.

[REG:119013019612095] [MS-NRPC]: NETLOGON_LOGON_IDENTITY_INFO: Does
the Reserved field have LogonId meaning?

Questions:
  In NetrLogonSamLogonEx does the Reserved field
  (of NETLOGON_LOGON_IDENTITY_INFO) have LogonId meaning?

  What is a valid LogonID, and does have any audit usage?

  Samba is sending a constant "deadbeef" in hex and would like to
  understand any usage of this field.

Response:
  The NRPC spec is accurate in defining the field as Reserved, and without
  protocol significance. In the header file in our source code, it is
  defined as LogonId and commented as such, but it’s effectively not used.
  This is probably why the API structure has that field name. It may have
  been intended as such but it’s not used.

Samba will send a random value in this field.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-20 06:03:09 +01:00
Jeremy Allison
b2de5a81bf s4: popt: Global replace of cmdline_credentials -> popt_get_cmdline_credentials().
Add one use of popt_set_cmdline_credentials().
Fix 80 column limits when cmdline_credentials changes
to popt_get_cmdline_credentials().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-05-11 20:30:13 +02:00
Andrew Bartlett
380ec1bb72 torture: Use DCERPC_SCHANNEL_AUTO in rpc.schannel.schannel2 test
This allows it to run against modern servers that do not permit NT4 crypto

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-12-14 11:55:18 +01:00
Stefan Metzmacher
2d9958e46c auth/credentials: also do a shallow copy of the krb5_ccache.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-22 23:34:20 +02:00
Stefan Metzmacher
bbaba64329 CVE-2016-2110: auth/credentials: pass server_timestamp to cli_credentials_get_ntlm_response()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12 19:25:23 +02:00
Stefan Metzmacher
733ccd1320 s4:torture/rpc/schannel: don't use validation level 6 without privacy
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-03-17 17:17:16 +01:00
Stefan Metzmacher
66736fee3a s4:torture/rpc: use dcerpc_secondary_auth_connection with creds
This is the same as calling dcerpc_secondary_connection/dcerpc_bind_auth.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Tue Jul  7 17:07:49 CEST 2015 on sn-devel-104
2015-07-07 17:07:49 +02:00
Stefan Metzmacher
698b69e702 s4:torture/rpc: avoid compiler warnings
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-03-20 20:43:13 +01:00
Volker Lendecke
a99a5a34a5 Fix the developer O3 build
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Wed Feb 25 16:32:29 CET 2015 on sn-devel-104
2015-02-25 16:32:29 +01:00
Andreas Schneider
6e5debf33b torture: Add netr_setPassword(2) schannel test.
Thanks to Florian Weimer <fweimer@redhat.com> for the help to write
this torture test.

Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Mon Feb 23 20:01:01 CET 2015 on sn-devel-104
2015-02-23 20:01:01 +01:00
Stefan Metzmacher
460272d69b s4:torture/rpc: make use of dcerpc_binding_set_flags()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-02-13 11:54:17 +01:00
Stefan Metzmacher
451d7039fe s4:torture/rpc: make use of dcerpc_binding_[g|s]et_transport()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-02-13 11:54:17 +01:00
Stefan Metzmacher
2ea3a24dce s4:torture: avoid usage of dcerpc_schannel_creds()
We use cli_credentials_get_netlogon_creds() which returns the same value.

dcerpc_schannel_creds() is a layer violation.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-10 09:18:59 +02:00
Stefan Metzmacher
d47bf469b8 s4:torture/rpc: make use of cli_credentials_set_netlogon_creds()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 17:48:04 +12:00
Günther Deschner
d0bad6c335 s4-torture: precalculate expected session keys from samlogon in schannel test.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
3dffd29904 s4-torture: use names for r.in.logon_level of netlogon samlogon requests.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Andreas Schneider
2c3dc04be2 s4-torture: Add DCERPC_SCHANNEL_AES tests.
Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:39 +02:00
Andreas Schneider
027b913a25 s4-torture: Call lsarpc tests over the correct pipe. 2012-07-06 10:00:58 +02:00
Stefan Metzmacher
2f5e9aae86 s4-torture: Test rpc schannel netr_LogonGetCapability.
metze
2011-12-22 17:48:24 +01:00
Günther Deschner
030ccc42b9 s4-smbtorture: make sure we can successfully run the schannel test against windows.
lsa lookupsids3/lookupnames4 is only available over schannel sealed
ncacn_ip_tcp.

Guenther

Autobuild-User: Günther Deschner <gd@samba.org>
Autobuild-Date: Wed Dec 14 17:28:29 CET 2011 on sn-devel-104
2011-12-14 17:28:29 +01:00
Andreas Schneider
e917c7b0ee s4-torture: Fix schannel test against win2k8. 2011-12-14 13:41:28 +01:00
Günther Deschner
19411c9953 s4-smbtorture: fix some typos in schannel test.
Guenther

Autobuild-User: Günther Deschner <gd@samba.org>
Autobuild-Date: Wed Dec 14 02:52:54 CET 2011 on sn-devel-104
2011-12-14 02:52:54 +01:00
Günther Deschner
87be316c57 s4-smbtorture: avoid printf(); in schannel test.
Guenther
2011-12-14 01:18:04 +01:00
Günther Deschner
b550ead171 s4-smbtorture: remove trailing whitespace from schannel test.
Guenther
2011-12-14 01:18:04 +01:00
Simo Sorce
b120c5f288 torture: use tevent_ functions names instead of the legacy event_ ones 2011-08-13 09:54:15 -04:00
Andrew Bartlett
16b2118b43 gensec: split GENSEC into mechanism-dependent and runtime functions
The startup and runtime functions that have no dependencies are moved
into the top level.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-08-03 18:48:01 +10:00
Andrew Tridgell
6b266b85cf s4-loadparm: 2nd half of lp_ to lpcfg_ conversion
this converts all callers that use the Samba4 loadparm lp_ calling
convention to use the lpcfg_ prefix.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-07-16 18:24:27 +10:00
Stefan Metzmacher
e1e2195a4a s4:torture/rpc: rename rpc.h => torture_rpc.h
The reason for this is that some systems include
<rpc/rpc.h> from within system headers. HP-UX 11.00
does so somewhere deep inside of <shadow.h>.

For torture/winbind/struct_based.c <rpc/rpc.h> resolves
to torture/rpc/rpc.h and breaks the build.

metze
2010-04-14 20:27:11 +02:00
Günther Deschner
2d35523f24 s4:torture/rpc/schannel.c: add explicit check for NTSTATUS r.out.result
Guenther
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2010-03-29 15:35:47 +02:00
Stefan Metzmacher
c05a0f7823 s4:torture/rpc/schannel.c: make use of dcerpc_binding_handle stubs
metze
2010-03-17 18:26:19 +01:00
Stefan Metzmacher
ff54cbe3d4 s4:torture/rpc: make use of use tevent_req based dcerpc_binding_handle stubs
metze
2010-03-12 15:25:48 +01:00
Stefan Metzmacher
c84b4b23c8 s4:torture/rpc: make use of explicit dcerpc_*_recv functions
metze
2010-03-01 16:11:55 +01:00
Stefan Metzmacher
9ada48ffdb s4:torture/rpc: use generate_random_password()
metze
2010-02-26 08:57:29 +01:00
Matthias Dieter Wallnöfer
44df2488e3 s4: fix various warnings (not "const" related ones) 2009-10-02 15:33:48 +02:00
Günther Deschner
2cdfd67cae s4-smbtorture: Avoid failing RPC-SCHANNEL when testing lsa_GetUserName behaviour against Samba 3.
Guenther
2009-05-07 13:05:13 +02:00
Andrew Bartlett
5095d7b1c8 Rework Samba4 to use the new common libcli/auth code
In particular, this is the rename from creds_ to netlogon_creds_, as
well as other links to use the new common crypto.

Andrew Bartlett
2009-04-14 16:23:44 +10:00
Jelmer Vernooij
dcc4081f75 Fix more compiler warnings. 2008-12-23 23:22:57 +01:00
Günther Deschner
8f1559c350 s4-samr: merge samr_GetDomPwInfo from s3 idl. (fixme: python)
Guenther
2008-11-10 21:46:28 +01:00
Jelmer Vernooij
3ebc574be4 Fix the build. 2008-11-02 02:30:21 +01:00
Günther Deschner
556b5bb9ee s4-netlogon: merge netr_ServerPasswordSet from s3 idl.
Guenther
2008-10-29 08:57:52 +01:00
Günther Deschner
f285af6367 s4-netlogon: merge netr_LogonSamLogon{Ex,WithFlags} from s3 idl.
Guenther
2008-10-29 08:57:31 +01:00
Günther Deschner
6a2dabe1a7 s4-lsa: merge lsa_GetUserName from s3 lsa idl.
Guenther
2008-10-27 19:33:22 +01:00