1
0
mirror of https://github.com/samba-team/samba.git synced 2025-12-16 00:23:52 +03:00
Commit Graph

95 Commits

Author SHA1 Message Date
Andrew Bartlett
9db3f0cd5e r7685: Simply the test for session key logic, so we pass against NT4.
Now, to try and figure out why this logic failed for jra...

Andrew Bartlett
(This used to be commit a32066a9ec)
2007-10-10 13:18:22 -05:00
Andrew Bartlett
b0f5ac8248 r7684: Add a test aimed at checking we have agreement between client and
server as to the CIFS session key.

JRA had pain with this being wrong against NT4 (without spnego), hence
this specific test.

Andrew Bartlett
(This used to be commit 47f433708b)
2007-10-10 13:18:22 -05:00
Andrew Bartlett
645711c602 r5941: Commit this patch much earlier than I would normally prefer, but metze needs a working tree...
The main volume of this patch was what I started working on today:
 - Cleans up memory handling around DCE/RPC pipes, to have a parent talloc context.
 - Uses sepereate inner loops for some of the DCE/RPC tests

The other and more important part of this patch fixes issues
surrounding the new credentials framwork:

This makes the struct cli_credentials always a talloc() structure,
rather than on the stack.  Parts of the cli_credentials code already
assumed this.

There were other issues, particularly in the DCERPC over SMB handling,
as well as little things that had to be tidied up before test_w2k3.sh
would start to pass.

Andrew Bartlett
(This used to be commit 0453f9d05d)
2007-10-10 13:11:11 -05:00
Andrew Tridgell
e82aad1ce3 r5298: - got rid of pstring.h from includes.h. This at least makes it a bit
less likely that anyone will use pstring for new code

 - got rid of winbind_client.h from includes.h. This one triggered a
   huge change, as winbind_client.h was including system/filesys.h and
   defining the old uint32 and uint16 types, as well as its own
   pstring and fstring.
(This used to be commit 9db6c79e90)
2007-10-10 13:09:38 -05:00
Andrew Tridgell
759da3b915 r5037: got rid of all of the TALLOC_DEPRECATED stuff. My apologies for the
large commit. I thought this was worthwhile to get done for
consistency.
(This used to be commit ec32b22ed5)
2007-10-10 13:09:15 -05:00
Andrew Bartlett
e54964c618 r4703: Add support for EnumTrustDomain, and expand the testsuite.
Add my copyright to the SAMR server.

Andrew Bartlett
(This used to be commit 51e94fa26c)
2007-10-10 13:08:45 -05:00
Andrew Bartlett
e6be2ad8b7 r4699: Move the test_EnumTrustDom() test into the test_CreateTrustedDomain
test.  This way, it must have at least one domain to enumerate.

Andrew Bartlett
(This used to be commit c19f1850ee)
2007-10-10 13:08:44 -05:00
Andrew Bartlett
c0571f6234 r4698: - Initial implementation of trusted domains in LSA.
- Use templates for Secrets and the new trusted domains

 - Auto-add modifiedTime, createdTime and objectGUID to records in the
   samdb layer.

Andrew Bartlett
(This used to be commit 271c8faadf)
2007-10-10 13:08:44 -05:00
Andrew Bartlett
4e052c1704 r4694: 'fix' the behaviour for setting only the old, but not the new secret.
(The behaviour is a little odd, but we wanted bug-for-bug, right? :-)

Andrew Bartlett
(This used to be commit 6a09a84320)
2007-10-10 13:08:44 -05:00
Andrew Bartlett
a249198d53 r4682: A LDB-based secrets implementation in Samba4.
This uses LDB (a local secrets.ldb and the global samdb) to fill out
the secrets from an LSA perspective.

Some small changes to come, but the bulk of the work is now done.

A re-provision is required after this change.

Andrew Bartlett
(This used to be commit ded3303352)
2007-10-10 13:08:42 -05:00
Andrew Bartlett
7b4d1a4448 r4674: Test SetSecret behaviour for local and global secrets, when setting
only the OLD secret value.

Andrew Bartlett
(This used to be commit 5853af89c8)
2007-10-10 13:08:41 -05:00
Andrew Bartlett
462ef44745 r4673: Fix the IDL for the QuerySecret LSA call.
This call uses a new IDL type, NTTIME_hyper.  This is 8-byte aligned,
as the name suggests.

Expand the QuerySecret LSA calls in RPC-SAMLOGON and RPC-LSA, to
validate the behaviour of times, and of the old secrets.

Thanks to tridge for spotting the use of HYPER!

Andrew Bartlett
(This used to be commit 1fed79cb0f)
2007-10-10 13:08:40 -05:00
Andrew Bartlett
4e89127786 r4671: Expand the RPC-LSA test to set secret values twice.
Andrew Bartlett
(This used to be commit 357d9114f0)
2007-10-10 13:08:40 -05:00
Andrew Bartlett
daf67d76fc r4660: Test what we should return for a secret that does not exist.
Andrew Bartlett
(This used to be commit a17a8fbf9a)
2007-10-10 13:08:39 -05:00
Andrew Tridgell
ab9ca55926 r4617: basic alter_context requests now work in our client library. The test
just does a simple LSA/DSSETUP combo, which is what w2k does in the
ACL editor rpc calls that triggered this work
(This used to be commit 0129ec947a)
2007-10-10 13:08:34 -05:00
Andrew Bartlett
c375b30ead r4603: Test creating local and global secrets over LSA.
Andrew Bartlett
(This used to be commit 96806136ea)
2007-10-10 13:08:32 -05:00
Andrew Tridgell
4ea89e5cf9 r4585: don't consider LookupSids3 failing with NT_STATUS_ACCESS_DENIED (as w2k3 does) or
NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED (as longhorn does) to be an error.

fixed the CreateTrustedDomain test to cope with the "torturedomain" being left over
from a previous aborted run
(This used to be commit 429d79815c)
2007-10-10 13:08:29 -05:00
Andrew Tridgell
fc26c0c077 r4443: test lsa_LookupNames3() even when lsa_LookupSids3() fails
(This used to be commit d37f556258)
2007-10-10 13:07:50 -05:00
Andrew Tridgell
835d231cee r4437: added IDL and test code for lsa_LookupSids3() and lsa_LookupNames3().
For some reason I am getting ACCESS_DENIED from w2k3 on
lsa_LookupSids3(). I will investigate.
(This used to be commit c759fa0000)
2007-10-10 13:07:50 -05:00
Stefan Metzmacher
447d088595 r4322: use a nicer name
metze
(This used to be commit f8ea82cbd1)
2007-10-10 13:07:34 -05:00
Andrew Tridgell
6bc971d8b5 r4310: fixed the authority_name field in lsa_GetUserName()
(This used to be commit f78506697a)
2007-10-10 13:07:33 -05:00
Stefan Metzmacher
c2f94222e9 r4309: idl and torture test for lsa_GetUserName()
why does samba3 return domain_name as in the unknown_name field in the code
and on the wire it returns DCERPC_FAULT_OP_RNG_ERROR?

all of my test machines NT4,W2K,W2K3,XP returned NULL

and if I file the string in the .in.* the server echos the strings back
and returns NT_STATUS_INVALID_PARAMETER

metze
(This used to be commit 67e765b7e9)
2007-10-10 13:07:33 -05:00
Stefan Metzmacher
e67b439264 r4308: [out,ref] pointer needs to set (don't corrupt the stack and segfault)
metze

PS: <tridge> "silly tridge forgot a out [ref] var" :-)
(This used to be commit a46c68a800)
2007-10-10 13:07:32 -05:00
Andrew Tridgell
e52b216473 r4279: added IDL and test code for lsa_AddPrivilegesToAccount() and lsa_RemovePrivilegesFromAccount()
(This used to be commit 705b870c73)
2007-10-10 13:07:31 -05:00
Andrew Tridgell
9b3ea6dc4e r4277: - added server support for lsa_EnumAccounts()
- expanded the lsa test suite to better test lsa_EnumAccounts()
(This used to be commit bafdb17729)
2007-10-10 13:07:31 -05:00
Andrew Tridgell
02f7d260a2 r4195: added IDL, test suite and server side code for lsa_LookupPrivValue
(This used to be commit 7bddd47403)
2007-10-10 13:07:25 -05:00
Andrew Tridgell
58c326809a r4052: fixed a bunch of code to use the type safe _p allocation macros
(This used to be commit 80d15fa340)
2007-10-10 13:06:18 -05:00
Andrew Tridgell
cc8f4358cc r4035: more effort on consistent naming of the access mask bits.
This removes the duplicate named SEC_RIGHTS_MAXIMUM_ALLOWED and
SEC_RIGHTS_FULL_CONTROL, which are just other names for
SEC_FLAG_MAXIMUM_ALLOWED and SEC_RIGHTS_FILE_ALL. The latter names
match the new naming conventions in security.idl

Also added names for the generic->specific mappings for files are
directories
(This used to be commit 17a4e0b3ac)
2007-10-10 13:06:16 -05:00
Andrew Tridgell
b56d1c5cb7 r3978: added IDL and test code for lsa_LookupSids2() and lsa_LookupNames2()
(This used to be commit 9da455ed56)
2007-10-10 13:06:10 -05:00
Andrew Bartlett
587745e32d r3919: Add more info levels to the QueryTrustedDomainInfo structures, with
names and other assistance from the ethereal sources.

More work needs to be done to validate some of the levels, which do
not appear in the query - perhaps they are modification levels.

Andrew Bartlett
(This used to be commit 6363553369)
2007-10-10 13:06:05 -05:00
Andrew Bartlett
88baaee093 r3917: A few more LSA RPCs found in my wanderings (for trusted domains, these
seem to be 'shortcut' RPCs, that just avoid an open/query pair).

Rename a few others to give us a slightly sensible pattern.

Andrew Bartlett
(This used to be commit d6a7ab57e7)
2007-10-10 13:06:05 -05:00
Andrew Bartlett
b6b61cec79 r3907: * Rename lsa_Name to lsa_String
* Add new IDL to LSA, to query information about trusted domains (for
  cross-check with SamSync).

Andrew Bartlett
(This used to be commit 174c077842)
2007-10-10 13:06:04 -05:00
Andrew Bartlett
be7a3e3ce0 r3904: * Add new LSA calls to open trusted domains
* Add new tests for ACCOUNTs in SamSync

* Clean up names in NETLOGON and LSA

* Verify Security Descriptors against LSA, as well as SamR

Andrew Bartlett
(This used to be commit 7094502fe0)
2007-10-10 13:06:03 -05:00
Andrew Tridgell
90067934cd r3428: switched to using minimal includes for the auto-generated RPC code.
The thing that finally convinced me that minimal includes was worth
pursuing for rpc was a compiler (tcc) that failed to build Samba due
to reaching internal limits of the size of include files. Also the
fact that includes.h.gch was 16MB, which really seems excessive. This
patch brings it back to 12M, which is still too large, but
better. Note that this patch speeds up compile times for both the pch
and non-pch case.

This change also includes the addition iof a "depends()" option in our
IDL files, allowing you to specify that one IDL file depends on
another. This capability was needed for the auto-includes generation.
(This used to be commit b8f5fa8ac8)
2007-10-10 13:05:09 -05:00
Andrew Tridgell
ba6d5fcb97 r3324: made the smbtorture code completely warning free
(This used to be commit 7067bb9b52)
2007-10-10 13:04:55 -05:00
Andrew Tridgell
22275a4c2f r2266: yay! LSA session keys on TCP now work!
(This used to be commit f6ea24296a)
2007-10-10 12:58:35 -05:00
Andrew Tridgell
905dd977fa r2203: delete the key after testing, so as not to clutter the server with random keys
(This used to be commit d98ed1fbe5)
2007-10-10 12:58:31 -05:00
Andrew Tridgell
73da5b1e87 r2202: don't close the smb pipe after the puzzle test
(This used to be commit 591ee2308c)
2007-10-10 12:58:31 -05:00
Andrew Tridgell
b702a07f0b r2201: removed an exit I accidentially left in
(This used to be commit e1d13631f0)
2007-10-10 12:58:30 -05:00
Andrew Tridgell
a67ec52fde r2200: solved another piece of the lsakey puzzle - the session key for lsa
encryption on ncacn_ip_tcp is a fixed buffer! I don't yet know what
the buffer is, but this code proves its the same buffer for different
w2k3 servers and different user passwords, plus it is independent of
the negotiated NTLMSSP session key.
(This used to be commit 05fd38f3cf)
2007-10-10 12:58:30 -05:00
Andrew Tridgell
a560082c60 r2199: the unknown 16 bit number in lsa_LookupPrivDisplayName() is a language
ID, so the client can choose what language they get the privilege
description in.

this is the first time I've seen a language ID on the wire in CIFS.
(This used to be commit e99d88915f)
2007-10-10 12:58:30 -05:00
Andrew Tridgell
55b38541a0 r2186: setting [ref] output pointers in dcerpc calls is pointless. Removed it
for test_LookupPrivDisplayName
(This used to be commit 2d8f400592)
2007-10-10 12:58:30 -05:00
Andrew Tridgell
01f704e5ec r2179: two more lsa torture tests from Richard Renard. Thanks!
(This used to be commit 25f85efd75)
2007-10-10 12:58:29 -05:00
Andrew Tridgell
c58b64b7bf r2031: add a check for a blank secret return in lsa secret tests
(This used to be commit eddb31d196)
2007-10-10 12:58:18 -05:00
Andrew Tridgell
707c94babb r1637: - w2k3 can't handle more than 1000 names in a LookupNames request
- use a SID that w2k3 likes in CreateTrustedDomain
(This used to be commit b5f25fdb74)
2007-10-10 12:57:46 -05:00
Volker Lendecke
0fa0eaa383 r1342: When fixing _lsa_lookupsids in samba3 I wanted to find out the number of SIDs
w2k3 can handle in a single request. With the samba3 client rpc libs I can do
about 21000 SIDs in a single request. test_many_LookupSIDs with 10000 SIDs
fails on the subsequent request with a NET_WRITE_FAULT. Maybe the Samba4 DCE
people want to take a look at this -- I don't see the problem.

Bug fix: SID components should be treated as unsigned when parsing

Volker
(This used to be commit 8c997a2ad2)
2007-10-10 12:56:51 -05:00
Stefan Metzmacher
770e3307ce r962: convert 'unsigned' and 'unsigned int' to uint_t
metze
(This used to be commit 57151e80eb)
2007-10-10 12:56:23 -05:00
Andrew Tridgell
7f3d4cc980 r919: - added lsa_QueryInfoPolicy2() to IDL, test suite and server
- added lsa_OpenPolicy2() to server

- added guid handling in samdb

- added a couple more info policy levels in lsa server

- added some DNS info in the provisioning template and script

With the above changes WinXP professional can join a Samba4 domain
(This used to be commit d6dca96352)
2007-10-10 12:56:20 -05:00
Andrew Tridgell
db3c011977 r917: - added the start of a LSA server to samba4.
- added start of QueryDomainInfo in samr server

"net rpc info" from samba3 now works against a samba4 server. I
suspect join will work fairly soon.
(This used to be commit 0a2c6a1062)
2007-10-10 12:56:19 -05:00
Stefan Metzmacher
f88bf54c7f r889: convert samba4 to use [u]int16_t instead of [u]int16
metze
(This used to be commit af6f1f8a01)
2007-10-10 12:56:16 -05:00