1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-31 17:18:04 +03:00
Commit Graph

309 Commits

Author SHA1 Message Date
Günther Deschner
a0700dd275 netlogon.idl: netr_ServerPasswordGet returns NTSTATUS not WERROR.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2015-03-12 17:13:43 +01:00
Stefan Metzmacher
459d1d3fb9 s4:rpc_server/netlogon: fix bugs in dcesrv_netr_DsRGetDCNameEx2()
We should return the our ip address the client is connected too.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2015-01-26 11:55:07 +01:00
Andrew Bartlett
a3ecad4237 idl: Merge NETR_TRUST and LSA_TRUST definitions into one set only in lsa.idl
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-09-27 01:35:36 +02:00
Andrew Bartlett
470e5b8222 s4-netlogond: Give a better error if we do not have a flatname attribute
Change-Id: I3bc283b6fab4326131084d1abb89cb486af7b35a
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Sep  1 02:58:46 CEST 2014 on sn-devel-104
2014-09-01 02:58:46 +02:00
Stefan Metzmacher
321ebc99b5 s4:rpc_server/netlogon: keep a global challenge table
Some clients call netr_ServerReqChallenge() and netr_ServerAuthenticate3()
on different connections. This works against Windows DCs as they
have a global challenge table.

A VMware provisioning task for Windows VMs seemy to rely on this behavior.

As a fallback we're storing the challenge in a global memcache with a fixed
size. This should allow these strange clients to work against a
Samba AD DC.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10723

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-07-19 10:25:05 +02:00
Andrew Bartlett
608d91e300 s4:rpc_server/netlogon: explicitly use dcerpc_binding_handle_set_sync_ev() for irpc
This indicates that we're using nested event loops...

Andrew Bartlett

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Change-Id: I4dcc7bf3c624612980e53b6119a60989fc2ea3b6
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2014-05-13 00:08:12 +02:00
Andrew Bartlett
a0de929009 dsdb: Put password lockout support in samdb_result_passwords()
This seems to be the best choke point to check for locked out
accounts, as aside from the KDC, all the password authentication and
change callers use it.

Andrew Bartlett

Change-Id: I0f21a79697cb8b08ef639445bd05a896a2c9ee1b
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-02 17:12:46 +02:00
Stefan Metzmacher
25fb73f282 s4:rpc_server/netlogon: return a zero return_authenticator and rid on error
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-01-22 17:12:29 +01:00
Stefan Metzmacher
7d2abf520d s4:netlogon: implement "allow nt4 crypto" and "reject md5 clients" features.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan  7 16:53:31 CET 2014 on sn-devel-104
2014-01-07 16:53:31 +01:00
Stefan Metzmacher
2e36fbc77d s4:netlogon: don't generate a debug message for SEC_CHAN_NULL.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-01-07 12:47:18 +01:00
Stefan Metzmacher
3b77b804cd s4:netlogon: correctly calculate the negotiate_flags
We need to bit-wise AND the client and server flags.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-01-07 12:47:18 +01:00
Benjamin Franzke
68ebb09193 s4:dsdb: Move cldap netlogon functions into samdb/ldb_modules
As netlogon is handled by the samdb now,
the corresponding functions should live there as well.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2013-11-11 23:00:54 +01:00
Matthieu Patou
b67085de7f s4-netlogon: honnor DS_RETURN_DNS_NAME flag
Reviewed-By: Andrew Bartlett <abarlett@samba.org>
2013-08-06 21:21:52 -07:00
Matthieu Patou
927a1030d7 s4-netlogon: do not add \\ it has already be done in the fill_netlogon_samlogon_response
Reviewed-By: Andrew Bartlett <abarlett@samba.org>
2013-08-06 21:21:47 -07:00
Stefan Metzmacher
9d548318da s4:netlogon: make use of netlogon_creds_decrypt_samlogon_logon()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-08-05 10:30:01 +02:00
Günther Deschner
d8461992db s4-rpc_server: use netlogon_creds_encrypt_samlogon().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Sun Dec 16 01:34:01 CET 2012 on sn-devel-104
2012-12-16 01:34:01 +01:00
Günther Deschner
71572632bd s4-rpc_server: support AES encryption in interactive and generic samlogon.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
01e69703fb s4-rpc_server: support AES decryption in netr_ServerPasswordSet2 server.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Jelmer Vernooij
90b1a94cb4 netlogon: Per MS-NRPC, don't send unknown workstation flags back to the
client.
2012-09-26 22:12:07 +02:00
Stefan Metzmacher
04d770adac s4:rpc_server/netlogon: add support for AES based netlogon schannel
metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:39 +02:00
Stefan Metzmacher
99231181e3 s4:rpc_server/netlogon: only return STRONG_KEYS if the client asked for it
metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:38 +02:00
Stefan Metzmacher
e48aabc006 s4:rpc_server/netlogon: implement netr_LogonGetCapabilities
This is also needed to support AES.

metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:38 +02:00
Andrew Bartlett
e7397eeaa2 s4-netlogond: Fix use of uninitialised value dns_name
The GET_CHECK_STR macro (now unrolled) did not initialise the trusts->array[n].dns_name
when the value was not set.  New tests for our trusted domains code create
domain trusts without a DNS domain name.  Found by the autobuild flakey build detector.

Andrew Bartlett
2012-02-27 07:36:05 +01:00
Matthias Dieter Wallnöfer
9a91d7f05a s4:netlogon RPC server - dcesrv_netr_DsRGetSiteName - add a small explaination
NETLOGON pipe is only thought for DCs.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-12-23 10:36:33 +01:00
Matthias Dieter Wallnöfer
521c708fe4 s4:netlogon RPC server - DsRGetDcNameEx - set the DNS name flags correctly
The rules are explained in MS-NRPC 2.2.1.2.1.

Patch inspired by Matthieu Patou.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-11-27 12:51:54 +01:00
Matthieu Patou
1770dafafd s4-netlogon: return WERR_NO_SUCH_DOMAIN instead of WERR_DS_UNAVAILABLE if we are unable to translate the domain to a dn
Signed-off-by: Matthias Dieter Wallnöfer <mdw@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-11-27 12:50:49 +01:00
Andrew Bartlett
5603dab647 libcli/auth: Provide a struct loadparm_context to schannel calls
This will allow us to pass this down to the tdb_wrap layer.

Andrew Bartlett
2011-10-13 14:06:07 +02:00
Andrew Tridgell
4afe426877 s4-ipv6: fill in pdc_ip in DsRGetDCNameEx2
this may be different from the CLDAP response, as it can be IPv6

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Wed Jun  8 06:07:29 CEST 2011 on sn-devel-104
2011-06-08 06:07:29 +02:00
Andrew Bartlett
ea0ac9cdfc s4-auth Rename auth -> auth4 to avoid conflict with s3 auth 2011-05-08 10:56:26 +02:00
Andrew Tridgell
f0e7303023 s4-rpc: improved error mapping for several RPC server calls
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-04-04 10:30:30 +10:00
Matthias Dieter Wallnöfer
0b5719f5fc s4:netlogon RPC server - "LogonGetDomainInfo" - check for NULL attributes
This is needed to complete the transition from "samdb_msg_add_string" to
"ldb_msg_add_string".
And this patch yields better NTSTATUS error results than before
(INVALID_PARAMETER rather than OUT_OF_MEMORY).

Reviewed-by: Jelmer

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Tue Mar  1 14:42:15 CET 2011 on sn-devel-104
2011-03-01 14:42:15 +01:00
Jelmer Vernooij
59a077d8f5 Fix some types
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Mon Feb 28 23:30:06 CET 2011 on sn-devel-104
2011-02-28 23:30:06 +01:00
Andrew Bartlett
a2ce53c1f5 s4-auth Rework auth subsystem to remove struct auth_serversupplied_info
This changes auth_serversupplied_info into the IDL-defined struct
auth_user_info_dc.  This then in turn contains a struct
auth_user_info, which is the only part of the structure that is
mainted into the struct session_info.

The idea here is to avoid keeping the incomplete results of the
authentication (such as session keys, lists of SID memberships etc) in
a namespace where it may be confused for the finalised results.

Andrew Barltett
2011-02-09 01:11:06 +01:00
Stefan Metzmacher
a4d4217dfa s4:rpc_server/netlogon: add dcesrv_netr_LogonSamLogon_check()
We need to check for invalid parameters before we check for
access denied.

metze
2011-02-02 11:58:26 +01:00
Stefan Metzmacher
578e87dbf2 s4:rpc_server/netlogon: set *r->out.authoritative = 1 even on INVALID_PARAMETER/INFO_CLASS
metze
2011-02-02 11:58:26 +01:00
Stefan Metzmacher
97727e1068 s4:rpc_server/netlogon: return INVALID_INFO_CLASS for invalid netr_Validation levels
metze
2011-02-02 11:58:26 +01:00
Matthias Dieter Wallnöfer
d0993e1278 s4:netlogon/LogonGetDomainInfo - handle a NULL "dns_hostname"
- Performs the short computer name check against the sam account name.
- Enhances the LogonGetDomainInfo testsuite which checks the NULL
  "dns_hostname" behaviour

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Fri Nov 19 12:50:33 CET 2010 on sn-devel-104
2010-11-19 12:50:32 +01:00
Matthias Dieter Wallnöfer
229f3cc9e8 s4:netlogon RPC server - "LogonGetDomainInfo" - always check the LDB return codes
Plus some cosmetic indentation fixes

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sun Oct 31 19:26:45 UTC 2010 on sn-devel-104
2010-10-31 19:26:45 +00:00
Matthias Dieter Wallnöfer
39d40892c6 s4:netlogon RPC server - point out that the "LogonGetDomainInfo" "servicePrincipalName" generation is still needed 2010-10-31 18:44:06 +00:00
Matthias Dieter Wallnöfer
7b3dbbde04 s4:dsdb - remove some calls of "samdb_msg_add_string" when we have talloc'ed strings
They can be substituted by "ldb_msg_add_string" if the string was already
talloc'ed.

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sun Oct 24 20:03:27 UTC 2010 on sn-devel-104
2010-10-24 20:03:27 +00:00
Stefan Metzmacher
821a20221d s4:rpc_server/netlogon: netr_ServerAuthenticate3 should return NO_TRUST_SAM_ACCOUNT
If we can't find the account we should return NT_STATUS_NO_TRUST_SAM_ACCOUNT
instead of NT_STATUS_ACCESS_DENIED.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Sat Oct 23 10:05:35 UTC 2010 on sn-devel-104
2010-10-23 10:05:35 +00:00
Stefan Metzmacher
f0879fc3b2 s4:rpc_server/netlogon: netr_ServerAuthenticate3 should reject invalid sec_channel_types early
metze
2010-10-23 11:02:43 +02:00
Stefan Metzmacher
c2696b2ec3 s4:rpc_server/netlogon: netr_ServerAuthenticate3 should check the challenge after the account
metze
2010-10-23 11:01:43 +02:00
Stefan Metzmacher
5ee49fc1c1 s4:rpc_server/netlogon: fix comment in netr_DsRGetDCName()
metze
2010-10-23 10:58:15 +02:00
Stefan Metzmacher
675c354b6b s4:rpc_server/netlogon: handle DC_RETURN_NETBIOS and DC_RETURN_DNS in netr_DsRGetDCNameEx2()
metze
2010-10-23 10:58:15 +02:00
Stefan Metzmacher
fcc2f6ba4a s4:rpc_server/netlogon: validate flags in netr_DsRGetDCNameEx2() and callers
Thanks to Tarun Chopra for the help of looking up all the bits in
the docs.

metze
2010-10-23 10:58:14 +02:00
Stefan Metzmacher
e297625d96 s4:rpc_server/netlogon: netr_GetDcName should return WERR_DCNOTFOUND for invalid names
Only netbios domain names are allowed.

metze
2010-10-23 10:58:14 +02:00
Matthias Dieter Wallnöfer
a3f61dea40 Revert "s4:remove "util_ldb" submodule and integrate the three gendb_* calls in "dsdb/common/util.c""
This reverts commit 8a2ce5c47c.

Jelmer pointed out that these are also in use by other LDB databases - not only
SAMDB ones.

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sun Oct 17 13:37:16 UTC 2010 on sn-devel-104
2010-10-17 13:37:16 +00:00
Matthias Dieter Wallnöfer
8a2ce5c47c s4:remove "util_ldb" submodule and integrate the three gendb_* calls in "dsdb/common/util.c"
They're only in use by SAMDB code.

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sun Oct 17 09:40:13 UTC 2010 on sn-devel-104
2010-10-17 09:40:13 +00:00
Matthias Dieter Wallnöfer
a0e9814c0d s4:dsdb - remove "samdb_result_uint", "samdb_result_int64", "samdb_result_uint64" and "samdb_result_string"
We have ldb_msg_find_attr_as_* calls which do exactly the same. Therefore this
reduces only code redundancies.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-15 08:36:01 +11:00