1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

139 Commits

Author SHA1 Message Date
Simo Sorce
00fe70e5b9 r13609: Get in the initial work on making ldb async
Currently only ldb_ildap is async, the plan
is to first make all backend support the async calls,
and then remove the sync functions from backends and
keep the only in the API.

Modules will need to be transformed along the way.

Simo
(This used to be commit 1e2c13b2d5)
2007-10-10 13:51:59 -05:00
Stefan Metzmacher
7449f4d803 r13508: some ASN.1 element in LDAP are optional,
make it possible to code the difference between a zero length and a NULL DATA_BLOB...

metze
(This used to be commit 54f0b19c55)
2007-10-10 13:51:56 -05:00
Stefan Metzmacher
f2e88ab7cf r13506: zero memory as some ASN.1 elements are optional, and we should initialize
them for the internal use...

found by 'make valgrindtest'

metze
(This used to be commit 1db9501c52)
2007-10-10 13:51:56 -05:00
Simo Sorce
f7def09a1e r13372: fixes ... still no joy
(This used to be commit 0e2cca9153)
2007-10-10 13:51:51 -05:00
Simo Sorce
338c410fec r13361: initial implementation of the vlv control
seem still buggy, can't make w2k3 to like it yet
(This used to be commit e1318383e9)
2007-10-10 13:51:50 -05:00
Simo Sorce
3721bca79d r13354: Add tests to check that controls work properly
Fix asq module, add a second_stage_init to register with rootdse
Fix asq control ldap parsing routines (this was nasty to find out)
(This used to be commit 933a80397d)
2007-10-10 13:51:48 -05:00
Simo Sorce
ad5e8bbe9d r13352: Integrate Patch to support the ManageDSAIT control
from Pete Rowley <prowley@redhat.com>
(This used to be commit bf20a848fd)
2007-10-10 13:51:48 -05:00
Andrew Bartlett
2e7f35f88f r13344: Trust SASL to have subtle distinctions between NULL and zero-length
responses...

Also trust OpenLDAP to be pedantic about it, breaking connections to AD.

In any case, we now get this 'right' (by nasty overloading hacks, but
hey), and we can now use system-supplied OpenLDAP libs and SASL/GSSAPI
to talk to Samba4.

Andrew Bartlett
(This used to be commit 0cbe18211a)
2007-10-10 13:51:46 -05:00
Andrew Bartlett
f256a9c55e r13342: Make the GSSAPI SASL mech actually work, by (shock horror) reading the spec.
GSSAPI differs from GSS-SPNEGO in an additional 3 packets, negotiating
a buffer size and what integrity protection/privacy should be used.

I worked off draft-ietf-sasl-gssapi-03, and this works against Win2k3.

I'm doing this in the hope that Apple clients as well as SASL-based
LDAP tools may get a bit further.

I still can't get ldapsearch to work, it fails with the ever-helpful
'Local error'.

Andrew Bartlett
(This used to be commit 3e46289775)
2007-10-10 13:51:46 -05:00
Stefan Metzmacher
828ee2bc6f r12984: add parse code and ldbsearch cmdline code for
NOTIFICATION LDAP Controls
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ldap/ldap/ldap_server_notification_oid.asp

this doesn't work yet, but it shows that we need to extend ldb to correctly
handle async requests...

metze
(This used to be commit 1fe6718949)
2007-10-10 13:51:14 -05:00
Simo Sorce
3b447ab4a1 r12977: Some code to implement the client side of the Dirsync control
Still investigating how it works.

Simo.
(This used to be commit bebd403523)
2007-10-10 13:51:13 -05:00
Simo Sorce
5db0c6b304 r12925: implement client side of ASQ control
(This used to be commit dd386bdc6c)
2007-10-10 13:51:07 -05:00
Simo Sorce
eed0a95128 r12917: fix decoding of ldap controls
some more work on timeouts
(This used to be commit a7e2fe3cb3)
2007-10-10 13:51:02 -05:00
Simo Sorce
c908d0b2aa r12733: Merge ldap/ldb controls into main tree
There's still lot of work to do but the patch is stable
enough to be pushed into the main samba4 tree.

Simo.
(This used to be commit 77125feaff)
2007-10-10 13:49:47 -05:00
Jelmer Vernooij
78c50015bb r12694: Move some headers to the directory of the subsystem they belong to.
(This used to be commit c722f665c9)
2007-10-10 13:49:39 -05:00
Jelmer Vernooij
d4de4c2d21 r12608: Remove some unused #include lines.
(This used to be commit 70e7449318)
2007-10-10 13:49:03 -05:00
Jelmer Vernooij
46aa296cc9 r12592: Remove some useless dependencies
(This used to be commit ca8db1a0cd)
2007-10-10 13:49:00 -05:00
Jelmer Vernooij
2cd5ca7d25 r12542: Move some more prototypes out to seperate headers
(This used to be commit 0aca5fd513)
2007-10-10 13:47:55 -05:00
Jelmer Vernooij
d8e35f8828 r12498: Eliminate INIT_OBJ_FILES and ADD_OBJ_FILES. We were not using
the difference between these at all, and in the future the
fact that INIT_OBJ_FILES include smb_build.h will be sufficient to
have recompiles at the right time.
(This used to be commit b24f2583ed)
2007-10-10 13:47:45 -05:00
Andrew Tridgell
111a920fdb r12116: got rid of composite_trigger_done() and composite_trigger_error(), and
instead make the normal composite_done() and composite_error()
functions automatically trigger a delayed callback if the caller has
had no opportunity to setup a async callback

this removes one of the common mistakes in writing a composite function
(This used to be commit f9413ce792)
2007-10-10 13:47:11 -05:00
Andrew Bartlett
687545e94e r12062: SASL negotiation now requires a gensec_security context, so that we
only try permitted mechanims.

Andrew Bartlett
(This used to be commit 0f50239dc4)
2007-10-10 13:47:03 -05:00
Andrew Tridgell
614950aed3 r11713: separate out the setting of the fde in the packet context from the
enabling of packet serialisation
(This used to be commit 6a47cd65a8)
2007-10-10 13:46:17 -05:00
Andrew Tridgell
65baaafc34 r11620: switch the ldap client code over to using the generic packet code
(This used to be commit 1d29ad2a27)
2007-10-10 13:45:59 -05:00
Volker Lendecke
69307693dc r11528: Separate finding dcs from initializing a domain. Makes it easier to possibly
support cldap and other stuff in the future.

This temporarily disables wbinfo -t, but that will come back soon.

Try an ldap bind using gss-spnego. This got me krb5 binds against "our" w2k3
and a trusted w2k, although with some memleaks from krb5 and a BAD_OPTION
tgs-rep error.

Volker
(This used to be commit d14948fdf6)
2007-10-10 13:45:49 -05:00
Andrew Bartlett
75ec65597c r11523: Working towards having Samba3 join Samba4, this allows the SASL
credentials to be NULL, where the client is requesting a CIFS style
server-first negTokenInit.

Andrew Bartlett
(This used to be commit eba652ecc8)
2007-10-10 13:45:48 -05:00
Andrew Bartlett
72820aaf92 r11521: Add in client support for checking supportedSASLmechanisms, and then
determining a mechanism to use.

Currently it doesn't to fallbacks like SPNEGO does, but this could be
added (to GENSEC, not to here).

This also adds a new function to GENSEC, which returns a list of SASL
names in our preference order (currently determined by the build
system of all things...).

Also make the similar function used for OIDs in SPNEGO do the same.

This is all a very long-winded way of moving from a hard-coded NTLM to
GSS-SPNEGO in our SASL client...

Andrew Bartlett
(This used to be commit 130eb9bb9a)
2007-10-10 13:45:48 -05:00
Volker Lendecke
134b2488c8 r11369: Implement socket_connect_multi: Connect to multiple ipv4 tcp ports in
sequence, with a 2-millisecond timeout between firing the syn packets. Build
smbcli_sock_connect_send upon that.

Volker
(This used to be commit 5718df44d9)
2007-10-10 13:45:27 -05:00
Volker Lendecke
d6e070b74a r11274: Start a connection attempt to the DC's port 389. To do this properly, make
socket_connect and ldap_connect properly async.

Volker
(This used to be commit bcc71fc1de)
2007-10-10 13:45:12 -05:00
Volker Lendecke
ca40d0a6fe r11271: Fix a warning and an infinite recursion
(This used to be commit 7bc855359a)
2007-10-10 13:45:11 -05:00
Jelmer Vernooij
4c5a4a7e02 r11244: Relative path names in .mk files
(This used to be commit 24e1030090)
2007-10-10 13:45:06 -05:00
Jelmer Vernooij
f4d590662e r11214: Remove scons files (see http://lists.samba.org/archive/samba-technical/2005-October/043443.html)
(This used to be commit 7fffc5c917)
2007-10-10 13:45:03 -05:00
Andrew Tridgell
d73bd8f01a r11114: - fixed error handling on bad bind in ildap client
- added nicer error display, giving a string version of the error code
(This used to be commit 5ec486bb81)
2007-10-10 13:44:52 -05:00
Stefan Metzmacher
cffd522b5c r11052: bring samba4 uptodate with the samba4-winsrepl branch,
before the bad merge

metze
(This used to be commit 471c0ca4ab)
2007-10-10 13:44:43 -05:00
Stefan Metzmacher
2ecb46d595 r11037:
(This used to be commit 6913e33840)
2007-10-10 13:42:33 -05:00
Andrew Tridgell
a599edf04c r10913: This patch isn't as big as it looks ...
most of the changes are fixes to make all the ldb code compile without
warnings on gcc4. Unfortunately That required a lot of casts :-(

I have also added the start of an 'operational' module, which will
replace the timestamp module, plus add support for some other
operational attributes

In ldb_msg_*() I added some new utility functions to make the
operational module sane, and remove the 'ldb' argument from the
ldb_msg_add_*() functions. That argument was only needed back in the
early days of ldb when we didn't use the hierarchical talloc and thus
needed a place to get the allocation function from. Now its just a
pain to pass around everywhere.

Also added a ldb_debug_set() function that calls ldb_debug() plus sets
the result using ldb_set_errstring(). That saves on some awkward
coding in a few places.
(This used to be commit f6818daecc)
2007-10-10 13:39:41 -05:00
Andrew Tridgell
67762d7965 r10668: added a ildap_search_bytree() function
(This used to be commit fd6d895ebd)
2007-10-10 13:39:16 -05:00
Jelmer Vernooij
3d4ea18d4d r10478: More work on proto headers; we now generate a couple of smaller ones
that are then included by include/proto.h
(This used to be commit 703ffbaaac)
2007-10-10 13:38:52 -05:00
Jelmer Vernooij
6812c73534 r10348: Add scons scripts for remaining subsystems. Most subsystems build now,
but final linking still fails (as does generating files asn1, et, idl and proto
files)
(This used to be commit 4f0d7f75b9)
2007-10-10 13:38:30 -05:00
Andrew Tridgell
a129ad36eb r10213: fixed a memory leak in the ldap client and server code spotted by Karl
Melcher. ldap_encode() now takes a memory context to use for the data
blob
(This used to be commit 09948a5933)
2007-10-10 13:38:09 -05:00
Andrew Bartlett
ba90b652d9 r9505: Work on GENSEC and the code that calls it, for tighter interface
requirements, and for better error reporting.

In particular, the composite session setup (extended security/SPNEGO)
code now returns errors, rather than NT_STATUS_NO_MEMORY.  This is
seen particularly when GENSEC fails to start.

The tighter interface rules apply to NTLMSSP, which must be called
exactly the right number of times.  This is to match some of our other
less-tested modules, where adding flexablity is harder.  (and this is
security code, so let's just get it right).  As such, the DCE/RPC and
LDAP clients have been updated.

Andrew Bartlett
(This used to be commit 134550cf75)
2007-10-10 13:34:24 -05:00
Stefan Metzmacher
3be75a4c6d r9240: - move struct security_token to the idl file, with this we can
the ndr_pull/push/print functions for it in the ntacl-lsm module

- fix compiler warnings in the ldap_encode_ndr_* code

metze
(This used to be commit 83d65d0d7e)
2007-10-10 13:31:37 -05:00
Simo Sorce
f297f82398 r8917: Better support for extended ldap search operations
Try to follow the RFC where possible and adapt to
  openLdap and AD way of handling this structure
(This used to be commit d844d45d87)
2007-10-10 13:30:57 -05:00
Jelmer Vernooij
6553dd0c60 r8811: Fix the build..
(This used to be commit fac77f5fa2)
2007-10-10 13:30:07 -05:00
Simo Sorce
bfb1186269 r8585: add to ldb and ldap comparison functionality
better pares filters
Approx is currently only a stub need to dig more info to
understand what it really means and how it works exactly
(This used to be commit a9e8cd0bad)
2007-10-10 13:29:41 -05:00
Simo Sorce
f4576157ed r8530: Now our ldap server is able to fullfill present and substring searches
(This used to be commit a910671bd8)
2007-10-10 13:29:35 -05:00
Andrew Tridgell
039393d662 r8523: match a zero message id in ldap replies to the last request sent. Thanks to simo
for noticing that this is needed to catch the server sending a "can't decode request"
error reply
(This used to be commit 6e81e866dc)
2007-10-10 13:29:35 -05:00
Tim Potter
52bef30fd4 r8414: Some C++ friendlyness fixes - 'not' is apparently a keyword in C++.
(This used to be commit bcfb3a45e4)
2007-10-10 13:23:00 -05:00
Andrew Tridgell
bdee131f30 r7860: switch our ldb storage format to use a NDR encoded objectSid. This is
quite a large change as we had lots of code that assumed that
objectSid was a string in S- format.

metze and simo tried to convince me to use NDR format months ago, but
I didn't listen, so its fair that I have the pain of fixing all the
code now :-)

This builds on the ldb_register_samba_handlers() and ldif handlers
code I did earlier this week. There are still three parts of this
conversion I have not finished:

 - the ltdb index records need to use the string form of the objectSid
   (to keep the DNs sane). Until that it done I have disabled indexing on
   objectSid, which is a big performance hit, but allows us to pass
   all our tests while I rejig the indexing system to use a externally
   supplied conversion function

 - I haven't yet put in place the code that allows client to use the
   "S-xxx-yyy" form for objectSid in ldap search expressions. w2k3
   supports this, presumably by looking for the "S-" prefix to
   determine what type of objectSid form is being used by the client. I
   have been working on ways to handle this, but am not happy with
   them yet so they aren't part of this patch

 - I need to change pidl to generate push functions that take a
   "const void *" instead of a "void*" for the data pointer. That will
   fix the couple of new warnings this code generates.

Luckily it many places the conversion to NDR formatted records
actually simplified the code, as it means we no longer need as many
calls to dom_sid_parse_talloc(). In some places it got more complex,
but not many.
(This used to be commit d40bc2fa8d)
2007-10-10 13:18:44 -05:00
Andrew Tridgell
acd04c9281 r7855: fixed a typo
(This used to be commit a1155651e7)
2007-10-10 13:18:43 -05:00
Andrew Tridgell
bec0058124 r7810: don't give errors when the ldap server sends us reference replies
(This used to be commit f2b2d2626f)
2007-10-10 13:18:38 -05:00