1
0
mirror of https://github.com/samba-team/samba.git synced 2025-03-03 12:58:35 +03:00

28322 Commits

Author SHA1 Message Date
Andrew Bartlett
b7becc0b19 s4-rpc_server: Fix search for existing trust to actually look for the dns name
Found by a eagle-eyed user.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Thu Jan 26 08:39:47 CET 2012 on sn-devel-104
2012-01-26 08:39:47 +01:00
Stefan Metzmacher
c74a522db1 s3:build: require gss_krb5_export_lucid_sec_context() for ads support
This is needed to detect krb5 with aes for GENSEC_FEATURE_NEW_SPNEGO
at runtime.

metze
2012-01-25 08:44:33 +01:00
Amitay Isaacs
4444612b86 s4-torture: For authenticated users, add AUTHENTICATED USERS sid
Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Wed Jan 25 01:36:02 CET 2012 on sn-devel-104
2012-01-25 01:36:02 +01:00
Amitay Isaacs
dc4ef9b57b dlz_bind9: for authenticated user, set the AUTHENTICATED USERS sid in token 2012-01-25 10:01:45 +11:00
Andrew Bartlett
1a9ee7cbd5 dsdb: Allow DSDB_CONTROL_PASSWORD_BYPASS_LAST_SET_OID to be specified as a flag 2012-01-24 18:36:49 +11:00
Amitay Isaacs
1f0298dd1b python: Change except: statement to except Exception:
This way we only catch true exceptions and keyboard interrupts
are not caught here.

Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Tue Jan 24 03:32:40 CET 2012 on sn-devel-104
2012-01-24 03:32:40 +01:00
David Disseldorp
ec094bf9ac WERROR type variable being incorrectly checked with a NT_STATUS_IS_X
type macro.
2012-01-23 12:18:01 -08:00
Michael Wood
d65f33de1d Log short_princ instead of uninitialised filter.
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Sat Jan 21 13:06:35 CET 2012 on sn-devel-104
2012-01-21 13:06:35 +01:00
Stefan Metzmacher
30b1e72556 s4:auth/gensec: make sure GSS_C_CONF_FLAG implies GSS_C_INTEG_FLAG
metze
2012-01-20 23:55:54 +01:00
David Disseldorp
3bfcf343cf torture: add spoolss overlapping driver deletion tests
Signed-off-by: Andreas Schneider <asn@samba.org>

Autobuild-User: David Disseldorp <ddiss@samba.org>
Autobuild-Date: Fri Jan 20 18:20:14 CET 2012 on sn-devel-104
2012-01-20 18:20:14 +01:00
David Disseldorp
b37f66c7b7 torture: confirm printer driver file removal
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-01-20 17:44:01 +01:00
David Disseldorp
cc8cd7b038 torture: add spoolss del printer driver test
Test handling of DeletePrinterDriverEx when the DPD_DELETE_ALL_FILES
flag is set.

Signed-off-by: Andreas Schneider <asn@samba.org>
2012-01-20 17:43:54 +01:00
Stefan Metzmacher
13182e792a s4:dsdb/password_hash: require a "Primary:Kerberos" blob in supplementalCredentials
If this is missing a w2k8r2 server will reboot, when someone tries to
change a password.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Mon Jan 16 17:10:07 CET 2012 on sn-devel-104
2012-01-16 17:10:07 +01:00
Dave Craft
ab1f896c51 KCC importldif/exportldif and intersite topology
Add options for extracting an LDIF file from a database
and reimporting the LDIF into a schema-less database for
subsequent topology test/debug.  Add intersite topology
generation with computation of ISTG and bridgehead servers

Signed-off-by: Andrew Tridgell <tridge@samba.org>

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Sat Jan 14 07:45:11 CET 2012 on sn-devel-104
2012-01-14 07:45:11 +01:00
Dave Craft
aff8dad076 Intersite KCC flags for python
Add NTDSSITELINK options to dsdb class for use
in python samba_kcc

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2012-01-14 06:13:08 +01:00
David Disseldorp
2fd4be0085 s4-smbtorture: tweak spoolss_OpenPrinterEx devmode
Flip some bits after the null terminator in the spoolss device mode
character arrays to trigger bug 8606.

Signed-off-by: Jeremy Allison <jra@samba.org>
2012-01-13 09:37:36 -08:00
Stefan Metzmacher
01f246e873 auth/gensec: move spnego.c to the toplevel
metze
2012-01-13 04:58:41 +01:00
Stefan Metzmacher
d88af2fe24 auth/gensec: common helper functions should be in gensec_util.c
This makes the dependencies easier to handle.

metze
2012-01-13 04:58:41 +01:00
Stefan Metzmacher
3ad7ca59b3 s4:auth/gensec: inline packet_full_request_u32()
This removes the dependency to s4 specific code.

metze
2012-01-13 04:58:40 +01:00
Stefan Metzmacher
36829cff8f s4:auth/gensec: fix compiler warnings in spnego.c
metze
2012-01-13 04:58:40 +01:00
Stefan Metzmacher
15cdbba254 s4:repl_cleartext_pwd.py: add optional 'clear_utf16_name' parameter
Not all cleartext password (machine passwords) can be converted to utf8,
let's export the raw uint16_t array.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Jan 12 23:58:12 CET 2012 on sn-devel-104
2012-01-12 23:58:11 +01:00
Stefan Metzmacher
5efe29baed s4:repl_cleartext_pwd.py: add 'attmode' parameter to convert the attname to utf8
metze
2012-01-12 22:15:58 +01:00
Stefan Metzmacher
9a8b72a318 s4:repl_cleartext_pwd.py: correctly compare attids as uint32_t values
metze
2012-01-12 22:12:41 +01:00
Stefan Metzmacher
0f14ac40a2 s4:pygensec/tests: add test for gensec_set_max_update_size()
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Jan 12 14:47:05 CET 2012 on sn-devel-104
2012-01-12 14:47:05 +01:00
Stefan Metzmacher
891318ee4c s4:auth/gensec/spnego: add support for fragmented spnego messages
metze
2012-01-12 13:15:08 +01:00
Stefan Metzmacher
b3f8f7e8a3 s4:pygensec: add set_max_update_size() and max_update_size() functions
metze
2012-01-12 13:15:08 +01:00
Andrew Bartlett
bd164acb82 Revert "make paranoia check less paranoid" - check that key types strictly match
This reverts commit c25af51232616061bb08eea86aae595b4f029490 because
otherwise we could attempt to check a CKSUMTYPE_HMAC_SHA1_96_AES_256 key with a
KRB5_ENCTYPE_ARCFOUR_HMAC_MD5 key.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Thu Jan 12 09:43:07 CET 2012 on sn-devel-104
2012-01-12 09:43:07 +01:00
Andrew Bartlett
3628f34aa3 make hmac-md5 the keyed checksum type for arcfour-hmac-md5 2012-01-12 18:02:55 +11:00
Andrew Bartlett
1787efaa00 use ETYPE_DES3_CBC_SHA1 for the verify step in verify_mic_des3
This allows a strict link between checksum types and key types to be
enforced.

Andrew Bartlett
2012-01-12 18:02:54 +11:00
Andrew Bartlett
d087e715fc heimdal: remove checking of KDC PAC signature, delegate to wdc plugin
The checking of the KDC signature is more complex than it looks, it may be of a different
enc type to that which the ticket is encrypted with, and may even be prefixed
with the RODC number.

This is better handled in the plugin which can easily look up the DB for the
correct key to verify this with, and can also quickly determine if this is
an interdomain trust, which we cannot verify the PAC for.

Andrew Bartlett
2012-01-12 18:02:54 +11:00
Andrew Bartlett
b69c40ffce auth/kerberos: Remove unused TALLOC_CTX argument to check_pac_checksum 2012-01-12 18:02:54 +11:00
Andrew Bartlett
49f8113fab s4-kdc Do the KDC PAC checksum validation in the Samba plugin
Here we can fetch the right key, and check if the PAC is likely to be signed by a key that
we know.  We cannot check the KDC signature on incoming trusts.

Andrew Bartlett
2012-01-12 18:02:54 +11:00
Andrew Bartlett
d0bb8b8a15 s4-kdc: use IDL constant NETLOGON_GENERIC_KRB5_PAC_VALIDATE 2012-01-12 17:54:15 +11:00
Amitay Isaacs
6764e4f20d samba-tool:dns: DNS names are case insensitive
Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Thu Jan 12 06:43:01 CET 2012 on sn-devel-104
2012-01-12 06:43:01 +01:00
Amitay Isaacs
44a85e3752 s4-rpc:dnsserver: DNS names are case insensitive 2012-01-12 05:10:08 +01:00
Andrew Bartlett
fc2c76f921 s4:auth: Make sure to check the optional auth_context hooks before using them
These are optional to supply - some callers only provide an auth_context for the
other plugin functions, and so we need to deal with this cleanly.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Jan 11 10:49:13 CET 2012 on sn-devel-104
2012-01-11 10:49:13 +01:00
Andrew Bartlett
98ba33b258 gensec: Rename want_flags and got_flags in gensec_gssapi
This make it clearer what type of flags these are.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:11:22 +01:00
Andrew Bartlett
226c3ef7a6 gensec: make gensec_gssapi.h common
This will make it easier to share elements of the GSSAPI gensec mechs,
in much the same way elements of the NTLMSSP mech are shared.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:10:02 +01:00
Andrew Bartlett
f5a117172e gensec: move gensec_util.c to the top level
To do this some defines need to move to common_auth.h

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:02:41 +01:00
Andrew Bartlett
14c8a13d3e auth: make auth4_context common to provide access to generate_session_info_pac()
By providing this context, a function pointer for
generate_session_info_pac() can be inserted into gensec, allowing the
s3 PAC processing in an otherwise more generic gensec module.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 08:59:34 +01:00
Andrew Bartlett
cfe68f2d5f krb5: Require krb5_set_real_time is available to build with krb5 2012-01-10 21:50:07 +01:00
Andrew Bartlett
39d73e2420 krb5: Require krb5_get_renewed_creds be available to build with krb5 2012-01-10 21:50:07 +01:00
Andrew Bartlett
a33d86a745 krb5: Remove now unused checks for krb5_verify_checksum 2012-01-10 21:50:07 +01:00
Andrew Bartlett
17e61e4290 krb5: Require krb5_c_enctype_compare is available to build with krb5 2012-01-10 21:50:07 +01:00
Michael Adam
803dc389d1 s4:provision: add "+dns" to server services if the dns backend is SAMBA_INTERNAL
Signed-off-by: Kai Blin <kai@samba.org>

Autobuild-User: Kai Blin <kai@samba.org>
Autobuild-Date: Tue Jan 10 21:17:45 CET 2012 on sn-devel-104
2012-01-10 21:17:45 +01:00
Michael Adam
83c149de4d s4:provision: add a server services line to the smb.conf template for the dc
Signed-off-by: Kai Blin <kai@samba.org>
2012-01-10 19:19:27 +01:00
Michael Adam
f489c681ea s4:provision: add the possibility to provision "server services" in smb.conf
Signed-off-by: Kai Blin <kai@samba.org>
2012-01-10 19:19:21 +01:00
Michael Adam
a876d519fe s4:provision: improve a message
Signed-off-by: Kai Blin <kai@samba.org>
2012-01-10 19:19:06 +01:00
Günther Deschner
0f7918425a samba: check for AES encryption type defines.
Guenther

Autobuild-User: Günther Deschner <gd@samba.org>
Autobuild-Date: Tue Jan 10 15:05:38 CET 2012 on sn-devel-104
2012-01-10 15:05:37 +01:00
Matthias Dieter Wallnöfer
354e43ca1e s4:python tests __init__.py - do not depend on "subprocess.check_call()"
Method not present in Python 2.4

Reviewed-by: Jelmer

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Tue Jan 10 00:41:59 CET 2012 on sn-devel-104
2012-01-10 00:41:59 +01:00