1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-13 13:18:06 +03:00
Commit Graph

394 Commits

Author SHA1 Message Date
Volker Lendecke
9af73f62ce lib: Add lib/util/server_id.h
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:11 +01:00
Stefan Metzmacher
aa5760433b s3:smbd: fix anonymous authentication if signing is mandatory
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11910

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed May 18 15:49:46 CEST 2016 on sn-devel-144
2016-05-18 15:49:46 +02:00
Stefan Metzmacher
79a71545bf s3:smbd: only mark real guest sessions with the GUEST flag
Real anonymous sessions don't get it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11847

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-28 16:51:17 +02:00
Stefan Metzmacher
25ce97892a s3:smbd: make use SMB_SETUP_GUEST constant
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11847

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-28 16:51:17 +02:00
Ralph Boehme
99f2bbccbd CVE-2016-2114: s3:smbd: enforce "server signing = mandatory"
This fixes a regression that was introduced by commit
abb24bf8e8
("s3:smbd: make use of better SMB signing negotiation").

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11687

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12 19:25:26 +02:00
Stefan Metzmacher
fbcc30931c s3:smbd: remove unused spnego related includes
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2015-12-17 14:45:13 +01:00
Michael Adam
321862d4ac s3:sesssetup: use session->pending_auth in smb1 session setup
(instead of session->gensec)

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-07-30 21:58:14 +02:00
Richard Sharpe
6abd986704 Convert all uses of uint8/16/32 to _t in source3/smbd.
Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-05-06 04:14:14 +02:00
Volker Lendecke
06f4ba3217 lib: Remove server_id_str()
Call server_id_str_buf instead

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Apr 28 20:48:01 CEST 2015 on sn-devel-104
2015-04-28 20:48:01 +02:00
Stefan Metzmacher
47f00fee35 s3:smbd: use req->sconn in sesssetup.c
xconn->sconn will go away soon.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-19 09:15:11 +02:00
Stefan Metzmacher
bd19fd1286 s3:smbd: remember the time of the session setup auth_time
This is the time of the last reauth.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-08-06 09:51:14 +02:00
Stefan Metzmacher
5ee5de89a4 s3:smbd: use req->xconn in sesssetup.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-08-06 09:51:13 +02:00
Stefan Metzmacher
314ef691ba s3:smbd: move sconn->smb1.signing_state to xconn->smb1.signing_state
This prepares the structures for multi-channel support.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-08-06 09:51:11 +02:00
Stefan Metzmacher
7cf7fd77f7 s3:smbd: move sconn->smb1.sessions.* to xconn->smb1.sessions.*
This prepares the structures for multi-channel support.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-08-06 09:51:11 +02:00
Stefan Metzmacher
cd8105484c s3:smbd: move sconn->smb1.negprot.* to xconn->smb1.negprot.*
This prepares the structures for multi-channel support.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-08-06 09:51:11 +02:00
Andrew Bartlett
4d50c75159 s3-auth: Finally change make_user_info_*() use a parent talloc context
Change-Id: Iedf516e8c24e0d18064aeedd8e287ed692d3c5b4
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2014-04-02 11:05:46 +02:00
Stefan Metzmacher
427db654ac s3:smbd: let srvstr_pull_req_talloc() take 'const uint8_t *src'
This is the correct thing to do the smb request buffer contains
just bytes (uint8_t).

It also avoids strange casting in the callers.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-04-02 09:03:43 +02:00
Stefan Metzmacher
2103c373b4 auth/gensec: remove tevent_context argument from gensec_update()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-03-27 00:36:32 +01:00
Stefan Metzmacher
cce1eaea91 s3:smbd: reject a MaxBufferSize < SMB_BUFFER_SIZE_MIN (500) in a session setup request
This makes sure sconn->smb1.sessions.max_send is always >= SMB_BUFFER_SIZE_MIN.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-03-05 10:06:24 -08:00
Björn Jacke
666948c776 s3: set native os according to Windows and NBT_ANNOUNCE_VERSION defines
When the native os in sessionsetup is "Unix" then broken Konica Minolta
printers refuse to talk to those CIFS servers. Other CIFS servers also announce
themselves with native os Windows. Let's do the same to improve
interoperability with broken devices like those printers from Konica Minolta.
Thanks to Daniel Hoffmann for finding and reporting this Konika printer
brokenness.

https://bugzilla.samba.org/show_bug.cgi?id=10168

Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-01-14 16:48:30 -08:00
Stefan Metzmacher
d24b8afb79 s3:smbd: keep global_client_caps and max_send from the first successful session setup
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-03-20 09:32:26 -07:00
Gregor Beck
f588704640 s3:smbd:setup_new_vc_session: traverse sessions instead of connections to shutdown other smbds
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2012-10-19 12:15:00 +02:00
Gregor Beck
e24b1041b1 s3:smbd: initialize session->global before calling session_claim
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2012-10-19 12:14:59 +02:00
Gregor Beck
02b9b79447 s3:smbd: remove smbd_server_connection argument from session_claim()
retrieve the server connection from the smbXsrv_session  argument instead.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2012-10-19 12:14:59 +02:00
Gregor Beck
4878769f8e s3:smbd: pass smbXsrv_session instead of user_struct to session_claim() and session_yield()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2012-10-19 12:14:59 +02:00
Stefan Metzmacher
1c7bd2b71c s3:smbd: remove unused variable in sesssetup.c
metze

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sun Aug  5 23:09:06 CEST 2012 on sn-devel-104
2012-08-05 23:09:06 +02:00
Stefan Metzmacher
ff75fd9eda s3:smbd: setup the application session key with the first tcon on a session
Look for Server.Session.SessionKeyState in [MS-SMB].
The first SMBtconX sets the state to available, which makes it possible
to protect the session key at that stage, if client and server
support TREE_CONNECT_ANDX_EXTENDED_SIGNATURE.

metze
2012-08-04 12:33:06 +02:00
Stefan Metzmacher
49d0432efd s3:smbd: setup session->global->signing_/application_key during SPNEGO SMB1 session setups
metze

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sat Aug  4 11:09:42 CEST 2012 on sn-devel-104
2012-08-04 11:09:42 +02:00
Stefan Metzmacher
2265e4633a s3:smbd: setup session->global->signing_/application_key during old SMB1 session setups
metze
2012-08-04 09:10:23 +02:00
Stefan Metzmacher
3d63e4da17 s3:smbd: keep the "application session key" during SMB1 reauth
metze
2012-08-04 09:10:22 +02:00
Stefan Metzmacher
e77000259c s3:smbd/sesssetup: implement dynamic re-authentication and expire session if client supports it
metze
2012-06-25 20:55:06 +02:00
Stefan Metzmacher
a129e271b5 s3:smbd: make use of smbXsrv_session for smb1
Pair-Programmed-With: Michael Adam <obnox@samba.org>

metze
2012-06-25 20:55:06 +02:00
Michael Adam
73b200064f s3:util: rename procid_equal() to serverid_equal()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-06-21 08:27:32 +02:00
Volker Lendecke
53cfde7204 s3: Remove a user of procid_is_me
Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-06-21 08:27:30 +02:00
Stefan Metzmacher
02d9ba6ee1 s3:smbd: change user_struct->vuid to uint64_t
Only sconn->smb1.sessions.next_vuid remains as uint16_t,
so that we do not generate larger values yet.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Jun  6 12:07:33 CEST 2012 on sn-devel-104
2012-06-06 12:07:33 +02:00
Stefan Metzmacher
f52e5738a2 s3:smbd: use 'struct user_struct' instead of typedef'ed 'user_struct'
metze
2012-06-06 10:18:39 +02:00
Stefan Metzmacher
8693a4fff9 s3:lib: split things into a conn_tdb.h
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Jun  5 19:28:35 CEST 2012 on sn-devel-104
2012-06-05 19:28:35 +02:00
Stefan Metzmacher
d58f7cd546 s3:smbd: allow creating new spnego sessions only with a 0 vuid
Found by the raw.context test.

metze
2012-05-18 16:36:16 +02:00
Stefan Metzmacher
1e7f8d5ad0 s3:smbd/sesssetup: use a helper variable 'action' to mark guest access
metze
2012-04-16 10:39:50 +02:00
Volker Lendecke
11d087aa04 s3: Remove chain_reply
<insert your favourite tombstone ascii art here>
2012-03-10 15:34:12 +01:00
Volker Lendecke
90b33a05e9 s3: Make sure the andX chains are ended correctly
Normally chain_reply took care of this. This will go away soon.
2012-03-10 15:34:11 +01:00
Andrew Bartlett
50547a9950 s3-auth: Follow auth_ntlmssp and use auth4_context for Session Setup
This patch ensures consistency in behaviour between NTLMSSP and NTLM
session setup handlers.  By calling the same layer that auth_ntlmssp
calls, we can not only allow redirection of all authentication to the
AD DC, we ensure that map to guest and username map handling is
consistent, even in the file server alone.

Andrew Bartlett
2012-03-08 10:14:05 +01:00
Andrew Bartlett
d7bb961859 s3-auth: Remove security=share (depricated since 3.6).
This patch removes security=share, which Samba implemented by matching
the per-share password provided by the client in the Tree Connect with
a selection of usernames supplied by the client, the smb.conf or
guessed from the environment.

The rationale for the removal is that for the bulk of security=share
users, we just we need a very simple way to run a 'trust the network'
Samba server, where users mark shares as guest ok.  This is still
supported, and the smb.conf options are documented at
https://wiki.samba.org/index.php/Public_Samba_Server

At the same time, this closes the door on one of the most arcane areas
of Samba authentication.

Naturally, full user-name/password authentication remain available in
security=user and above.

This includes documentation updates for username and only user, which
now only do a small amount of what they used to do.

Andrew Bartlett

                       --------------
                      /              \
                     /      REST      \
                    /        IN        \
                   /       PEACE        \
                  /                      \
                  |      SEC_SHARE       |
                  |    security=share    |
                  |                      |
                  |                      |
                  |       5 March        |
                  |                      |
                  |        2012          |
                 *|     *  *  *          | *
        _________)/\\_//(\/(/\)/\//\/\///|_)_______
2012-03-04 23:33:05 +01:00
Andrew Bartlett
2f74f2f180 s3-auth: Add extra error messages on authentication or authorization failure
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-02-17 10:48:09 +01:00
Andrew Bartlett
eb3e34e965 s3-smbd Remove unused code now we always have SPNEGO via gensec
This was previously needed because SPNEGO was only available in the AD DC.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-02-16 15:18:43 +01:00
Stefan Metzmacher
507872f90f s3:smbd: inline code in reply_sesssetup_and_X_spnego()
This makes the logic much easier to follow.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Jan 31 21:52:45 CET 2012 on sn-devel-104
2012-01-31 21:52:45 +01:00
Stefan Metzmacher
5f79ad5f87 s3:smbd: the spnego session setup don't need to copy the in blob
metze
2012-01-31 20:17:10 +01:00
Stefan Metzmacher
ec0142dd31 s3:smbd: rework reply_spnego_ntlmssp to reply_spnego_generic
This removes the unused spnego_gen_auth_response() wrapping.

metze
2012-01-31 20:17:10 +01:00
Stefan Metzmacher
ee15790d7a s3:smbd: remove unused code from sesssetup.c
metze
2012-01-31 20:17:10 +01:00
Stefan Metzmacher
63f6567ca9 s3:smbd: remove pending_auth_data logic
This is handled by the gensec_spnego module.

metze
2012-01-31 20:17:10 +01:00