1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

1405 Commits

Author SHA1 Message Date
Stefan Metzmacher
84c66f1a38 s3:librpc/gse: fix debug message in gse_init_client()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:26 +01:00
Stefan Metzmacher
46b9252518 s3:librpc/gse: make use of GSS_C_EMPTY_BUFFER in gse_init_client
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:26 +01:00
Andreas Schneider
1e1e12a825 s3-libads: Pass down the salt principal in smb_krb5_kt_add_entry()
This is a preparation to move smb_krb5_kt_add_entry() to krb5_wrap.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-03-10 06:52:25 +01:00
Michael Adam
03a3aa9815 smbXsrv.idl: add create_action to smbXsrv_open
Needed for create replay.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-03 13:09:24 +01:00
Michael Adam
1eb5f1e422 librpc:smbXsrv.idl: add flags to smbXsrv_open
These flags reflect the need for and state of the replay cache.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-03 13:09:24 +01:00
Stefan Metzmacher
3590f3f562 idl:smbXsrv: add smbXsrv_connection_pass structures.
To be used for the connection passing message.

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2016-01-26 15:58:11 +01:00
Stefan Metzmacher
bae1b9401c idl:smbXsrv: add smbXsrv_client_global structures
This is for marshalling smbXsrv_client.

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2016-01-26 15:58:11 +01:00
Michael Adam
d60ffcfe44 smbXsrv: introduce bool smbXsrv_client->server_multi_channel_enabled
defaulting to false.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-01-23 00:08:36 +01:00
Ralph Boehme
9d284431fc s3:smb2_server: add signing state tracking flags
Add flags that track the signing state of all incoming and outgoing SMB2
packets and a helper function that can be used to determine whether a
session of tcon can be considered "signed".

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-22 07:52:21 +01:00
Ralph Boehme
fe5353c82e s3:smb2_server: convert signing_required bool to flags bitmap
Use a flags bitmap for storing the signing state. This is in preparation
of a subsequent patch that adds more flags to the bitmap.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-22 07:52:21 +01:00
Ralph Boehme
e501c733ec s3:smb2_server: add encryption state tracking flags
Add two encryption state tracking flags that can be used to tell whether
a session or tcon is "encrypted" and add a helper function to calculate
the encryption state from those flags.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-22 07:52:20 +01:00
Ralph Boehme
736cd36d36 s3:smb2_server: store encryption cipher in the channel
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-22 07:52:20 +01:00
Ralph Boehme
bfdffea0fa s3:smb2_server: convert encryption desired and required bools to flags
This adds a bitmap smbXsrv_encrpytion_flags with flags to the
smbXsrv_session_global.tdb and smbXsrv_tcon_global.tdb that we use
instead of bools for desired and required.

We need this info in the smbXsrv tdbs for smbstatus. Subsequent commits
for smbstatus will use it.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-22 07:52:20 +01:00
Richard Sharpe
8936281bcc gss: samba member server returns incorrect error code with some versions of krb5
As per Simo's comments in https://bugzilla.redhat.com/show_bug.cgi?id=1279249
we need Samba to return the correct thing to the client when gss_accept_sec_context
returns a token along with an error.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11592

Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Nov 12 01:44:08 CET 2015 on sn-devel-104
2015-11-12 01:44:08 +01:00
Michael Adam
86dd7b941c smbXsrv_session:idl: remove the preauth and gensec members
They are now taken from the pending_auth member (smbXsrv_session_auth0).

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Jul 31 01:03:13 CEST 2015 on sn-devel-104
2015-07-31 01:03:13 +02:00
Michael Adam
5e463b553b smbXsrv_session:idl: add smbXsrv_session_auth0
This contains various auth related items for a session,
in particular preauth. This is in preparation to take
the direct member preauth from smbXsrv_session and have
all session auth code operate on session->pending_auth
instead of session->preauth and friends.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2015-07-30 21:58:14 +02:00
Uri Simchoni
ed2ed1ad69 net: fix the order of DC lookup methods when joining a domain
The dsgetdcname() function is able to try just DNS lookup, just NetBIOS,
or start with DNS and fall back to NetBIOS. For "net ads join", we know
most of the time whether the name of the domain we're joining is a DNS
name or a NetBIOS name. In that case, it makes no sense to try both lookup
methods, especially that DNS may fail and we want to fall back from site-aware
DNS lookup to site-less DNS lookup, with no NetBIOS lookup in between.

This change lets "net ads join" tell libnet what is the type of the domain
name, if it is known.

Signed-off-by: Uri Simchoni <urisimchoni@gmail.com>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-09 12:33:25 +02:00
Douglas Bagnall
4e935c5951 Fix format size errors for i386 in source3/librpc/crypto/gse.c
Again, sizeof(size_t) != sizeof(uintmax_t).

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-09 00:42:15 +02:00
Michael Adam
a3ea6dbef5 smbXsrv: add bools encryption_desired to session and tcon
This is to indicate that we should sen the ENCRYPT_DATA
flag on session or tcon replies.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2015-07-07 14:05:27 +02:00
Stefan Metzmacher
fa4f4fed2e s4:gensec/gssapi: make use of add gssapi_get_sig_size() and gssapi_{seal,unseal,sign,check}_packet() helper functions
This way are able to support GENSEC_FEATURE_SIGN_PKT_HEADER also together with
GENSEC_FEATURE_SEAL.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jun 24 04:00:43 CEST 2015 on sn-devel-104
2015-06-24 04:00:43 +02:00
Stefan Metzmacher
f643677d3f s3:librpc/gse: make use of add gssapi_get_sig_size() and gssapi_{seal,unseal,sign,check}_packet() helper functions
This way are able to support GENSEC_FEATURE_SIGN_PKT_HEADER.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-06-24 01:03:17 +02:00
Stefan Metzmacher
b2e042ad96 s3:librpc/rpc: fix padding calculation in dcerpc_guess_sizes()
The padding needs to be relative to the payload start not to the pdu start.
We also need align the padding to DCERPC_AUTH_PAD_ALIGNMENT (16 bytes).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-06-23 14:38:53 +02:00
Stefan Metzmacher
3e6e9e3acd s3:librpc/rpc: allow up to DCERPC_AUTH_PAD_ALIGNMENT padding bytes in dcerpc_add_auth_footer()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-06-23 14:38:53 +02:00
Günther Deschner
4234cbb694 s3-rpc_server: Fix inteface typo.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jun  4 03:51:29 CEST 2015 on sn-devel-104
2015-06-04 03:51:29 +02:00
Simo Sorce
461c69bd7c s3:smb2_server: In CCM and GCM mode we can't reuse nonces
Reuse of nonces with AES-CCM and AES-GCM leads to catastrophic failure,
so make sure the server drops the connection if that ever happens.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11300

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Simo Sorce <simo@redhat.com>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Simo Sorce <idra@samba.org>
Autobuild-Date(master): Fri May 29 22:38:50 CEST 2015 on sn-devel-104
2015-05-29 22:38:50 +02:00
Stefan Metzmacher
4481fea86a s3:smb2_sesssetup.c: For SMB >= 3.1, derive crypto keys from preauth
This protects the full connection setup including
a posteriori verification of the negotiate messages,
by signing the final session setup response with a signing key
derived from the preauth hash and the authentication session key.

Pair-Programmed-With: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2015-05-08 13:00:28 +02:00
Jeremy Allison
13b6199a2f s3: locking: Add a memcache based lock cache.
Based on an idea by Volker to optimize cpu usage when
parsing struct share_mode_data entries.

Add a 64-bit sequence number to the share mode entry,
and after the entry is stored back in the db, cache
the in-memory version using talloc reparenting into the
memcache. The memcache key used is the same struct file_id
used as the key into the locking db.

On read, check if the locking db version sequence number
matches the in-memory cache, and if so reparent the
memcache version back onto the required memory context.

Saves all the ndr decoding when multiple accesses to the
same lock entry happen in succession.

Design also improved by Metze and Ira.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Apr 17 22:38:34 CEST 2015 on sn-devel-104
2015-04-17 22:38:34 +02:00
Andrew Bartlett
eedd127c25 librpc: Move messaging.idl to the top level
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2015-02-16 12:15:07 +01:00
Noel Power
a5d383cbd5 allow net ads join accept new osServicePack parameter
osServicePack paramater allows the default behaviour ( which is to use
the samba version string as the operatingSystemServicePack attribute )
to be overridden
Additionally make sure if blank string is passed that it is treated
as attribute deletion. This is necessary as values for the os attributes
are eventually passed to ads_modlist_add if the value is "" then the
attempt to add this attribute fails in the underlying ldap
'ldap_modfiy_ext_s' function. In this case we need to pass NULL as the
value to force deletion of the ldap attribute

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jan  8 00:18:05 CET 2015 on sn-devel-104
2015-01-08 00:18:05 +01:00
Jeremy Allison
5ebb190385 s3:locking: Change the data model for leases_db to cope with dynamic path renames.
interface leases_db
{
        typedef [public] struct {
                GUID client_guid;
                smb2_lease_key lease_key;
        } leases_db_key;

        typedef [public] struct {
                file_id id;
                [string,charset(UTF8)] char *servicepath;
                [string,charset(UTF8)] char *base_name;
                [string,charset(UTF8)] char *stream_name;
        } leases_db_file;

        typedef [public] struct {
                uint32 num_files;
                [size_is(num_files)] leases_db_file files[];
        } leases_db_value;
}

As designed by metze.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec  9 03:44:04 CET 2014 on sn-devel-104
2014-12-09 03:44:04 +01:00
Jeremy Allison
5661198d71 s3:locking: prepare the data model for leases_db to cope with dynamic path renames.
interface leases_db
{
        typedef [public] struct {
                GUID client_guid;
                smb2_lease_key lease_key;
        } leases_db_key;

        typedef [public] struct {
                file_id id;
                [string,charset(UTF8)] char *servicepath;
                [string,charset(UTF8)] char *base_name;
                [string,charset(UTF8)] char *stream_name;
        } leases_db_file;

        typedef [public] struct {
                uint32 num_files;
                [size_is(num_files)] leases_db_file files[];
        } leases_db_value;
}

As designed by metze.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-12-09 01:18:08 +01:00
Stefan Metzmacher
6b2f19a5e6 s3:open_files.idl: add data structures for SMB2.1 and SMB3.0 leases.
Pair-Programmed-With: Volker Lendecke <vl@samba.org>

Signed-off-by: Volker Lendecke <vl@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2014-12-04 05:45:09 +01:00
Volker Lendecke
14fac5dbc0 s3:locking: add leases_db infrastructure
Will enable us to solve the dynamic share path problem
with leases on [homes].

We're also able to give the correct error codes when a
lease key is re-used with a different file name.

Pair-Programmed-With: Jeremy Allison <jra@samba.org>

Signed-off-by: Volker Lendecke <vl@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-12-04 05:45:09 +01:00
Andrew Bartlett
82c0ecbb2c gse_krb5: Avoid a segfault when we can not read the dedicated keytab file
This improved code simply cleans up the memory as soon as possible,
rather than using memcmp().  Otherwise, we segfault if
krb5_kt_start_seq_get fails, as it can set the fd element in the
handle to -1.

Change-Id: Ib4821ef944a7e12cd8a891ae07dbfc0567c65495
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Nov 27 07:38:02 CET 2014 on sn-devel-104
2014-11-27 07:38:02 +01:00
Stefan Metzmacher
768ec14b3c s3:librpc/idl: mark struct smbXsrv_client as [public]
This avoids compiler warnings about unused code.

We don't use the NDR code for this yet, will be done
when we get multi-channel support.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-11-25 07:25:44 +01:00
Günther Deschner
eb8d914d91 s3-netapi: add DS_8 and WS flags to libnetapi and nltest.
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-10-24 11:30:05 +02:00
Volker Lendecke
bdebf96cab idl: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Tue Oct  7 17:03:42 CEST 2014 on sn-devel-104
2014-10-07 17:03:42 +02:00
Andrew Bartlett
d0a0af3550 librpc: gensec is our security provider abstraction, remove a void *
Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-09-27 01:35:36 +02:00
Andrew Bartlett
f8643b9f5f librpc: Remove user/domain from struct pipe_auth_data
This does require that we always fill in the gensec pointer, but the
simplification is worth the extra allocations.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-09-27 01:35:36 +02:00
Stefan Metzmacher
64d140197e s3:messaging: make it possible to receive a fd array from another process
In order to receive the fd array the caller needs to use
messaging_filtered_read_send/recv(). For all higher level
methods we silently close/ignore the fd array.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-24 08:44:11 +02:00
Stefan Metzmacher
cd7c24a9b1 s3:smbXsrv_session: remember the smbXsrv_connection on channel attached to a session
A session will be usable from multiple connections in future.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-19 09:15:13 +02:00
Stefan Metzmacher
333707fa37 s3:smbd: move smbXsrv_{session,tcon,open} tables to smbXsrv_client
These should be per client (based on the SMB >= 2.1 client_guid),
this is a preparation for multi-channel support.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-19 09:15:12 +02:00
Stefan Metzmacher
80e226ddae s3:smbXsrv_session: change smbXsrv_session->connection to smbXsrv_session->client
A session will be usable from multiple connections in future.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-19 09:15:12 +02:00
Stefan Metzmacher
e23785ae37 s3:smbd: introduce 'struct smbXsrv_client' in order to prepare multi-channel support
This structure is supposed to hold the global state shared between
multiple connections from the same client.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-19 09:15:11 +02:00
Stefan Metzmacher
bd19fd1286 s3:smbd: remember the time of the session setup auth_time
This is the time of the last reauth.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-08-06 09:51:14 +02:00
Volker Lendecke
d7b4f863e4 messaging3: messaging_array is no longer used
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-07-28 22:04:13 +02:00
Michael Adam
cd95937369 s3: remove stat_ex.vfs_private completely
It is not used any more.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Thu Jul 24 14:23:11 CEST 2014 on sn-devel-104
2014-07-24 14:23:11 +02:00
Andrew Bartlett
f4ab082d2b librpc/idl: Merge wbint.idl with winbind.idl so we can forward IRPC requests to internal winbind calls
Change-Id: Iba3913d5a1c7f851b93f37e9beb6dbb20fbf7e55
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-06-11 10:18:26 +02:00
Andrew Bartlett
223fbdaf38 s3-winbindd: Listen on IRPC and do forwarded DNS updates on an RODC
Change-Id: Ib87933c318f510d95f7008e122216d73803ede68
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-06-11 10:18:26 +02:00
Volker Lendecke
dcb3f2150e messaging: Nobody uses G_LOCK_RETRY anymore
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue May  6 23:01:22 CEST 2014 on sn-devel-104
2014-05-06 23:01:22 +02:00
Stefan Metzmacher
6a5cd1857f s3:rpc_client: Use gensec for NCALRPC_AS_SYSTEM.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-04-24 11:21:05 +02:00
Stefan Metzmacher
2ed1789e4d s3:rpc_client: pass everything to gensec by default
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-04-24 11:21:05 +02:00
Volker Lendecke
9e754840de smbd: Remove unused "share_mode_data->id"
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Mar 21 21:22:24 CET 2014 on sn-devel-104
2014-03-21 21:22:24 +01:00
Stefan Metzmacher
caeef257d2 s3:dcerpc_ep: make use of dcerpc_binding_set_abstract_syntax()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-02-13 11:54:16 +01:00
Stefan Metzmacher
52ccd28ca7 s3:dcerpc_ep: make use of dcerpc_binding helper functions
We should not dereference 'struct dcerpc_binding'.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-02-13 11:54:16 +01:00
Stefan Metzmacher
47d7b8df44 s3:dcerpc_up: avoid useless talloc_zero() calls
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-02-11 16:20:28 +01:00
Stefan Metzmacher
f9cc66055d s3:dcerpc_ep: make ep_register() more tolerant regarding the passes binding vector
We should take a copy and set the abstract syntax to from the given interface
before we construct the tower.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-02-11 16:20:28 +01:00
Stefan Metzmacher
754f2eba16 s3:dcerpc_ep: only use the explicitly passed object_guid
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-02-11 16:20:28 +01:00
Stefan Metzmacher
09d3a0cda9 s3:dcerpc_ep: only use an array of 'struct dcerpc_binding *'
In future we should not dereference struct dcerpc_binding
and just keep pointers.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-02-11 16:20:28 +01:00
Stefan Metzmacher
166766e772 s3:dcerpc_ep: make struct dcerpc_binding_vector private
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-02-11 16:20:28 +01:00
Stefan Metzmacher
6ab9164c74 s3:rpc_client: send a dcerpc_sec_verification_trailer if needed
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan  7 02:24:42 CET 2014 on sn-devel-104
2014-01-07 02:24:41 +01:00
Stefan Metzmacher
61bdbc23cd s3:rpc_client: implement DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-01-07 00:27:11 +01:00
Volker Lendecke
84d8b2b013 smbd: Make "num_children" available by smbcontrol
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Christof Schmit <cs@samba.org>
2014-01-06 13:27:05 -07:00
Christian Ambach
4673b488c9 s3:messaging add MSG_SMB_KILL_CLIENT_IP message
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-12-12 10:50:59 -07:00
Stefan Metzmacher
ecdac51e85 CVE-2013-4408:s3:rpc_client: check for invalid frag_len in dcerpc_pull_ncacn_packet()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-12-09 07:05:45 +01:00
Hans Leidekker
4503bdf560 netapi: Add support for info level 502 in NetShareAdd.
Signed-off-by: Hans Leidekker <hans@meelstraat.net>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Tue Nov 19 21:48:17 CET 2013 on sn-devel-104
2013-11-19 21:48:17 +01:00
Volker Lendecke
76e7d8f97f smbd: Remove MSG_SMB_ASYNC_LEVEL2_BREAK
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-10-23 12:12:17 +02:00
Hans Leidekker
a4c3553b5a Add NetWkstaGetInfo.
Modified to include common.h entry for netapitest_wksta function by Kai
Blin <kai@samba.org>

Signed-off-by: Hans Leidekker <hans@meelstraat.net>
Reviewed-by: Kai Blin <kai@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Oct 16 07:00:45 CEST 2013 on sn-devel-104
2013-10-16 07:00:45 +02:00
Andreas Schneider
1a88463654 idl: Add a new message for winbind domain states.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10194

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-10-11 11:50:08 +02:00
Günther Deschner
807628ecac s3-rpc: remove unused source3/librpc/rpc/rpc_common.c
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Sep 20 14:57:06 CEST 2013 on sn-devel-104
2013-09-20 14:57:06 +02:00
Günther Deschner
639f60b151 s3-rpc_cli: remove unused schannel calls from dcerpc_helpers.c
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-09-19 11:09:49 +02:00
Günther Deschner
5a628490e4 s3-rpc: use gensec for schannel footer processing.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-09-19 11:09:44 +02:00
Volker Lendecke
7d91ffc6fd smbd: Fix flawed share_mode_stale_pid API
The comment for this routine said:

> Modifies d->num_share_modes, watch out in routines iterating over
> that array.

Well, it turns out that *every* caller of this API got it wrong. So I
think it's better to change the routine.

This leaves the array untouched while iterating but filters out the
deleted ones while saving them back to disk.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-09-03 17:13:53 +02:00
Volker Lendecke
696bc569b1 smbd: Don't store in-memory only flags in locking.tdb
Hey, pidl knows the [skip] attribute ... :-)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-09-03 17:13:53 +02:00
Stefan Metzmacher
71c63e85e7 auth/gensec: introduce gensec_internal.h
We should treat most gensec related structures private.

It's a long way, but this is a start.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-10 09:19:02 +02:00
Stefan Metzmacher
a36ccdc83e s3:dcerpc_helpers: remove unused DEBUG message of schannel_state->seq_num.
This is a layer violation and not needed anymore as we know
how the seqnum handling works now.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-10 09:18:58 +02:00
Stefan Metzmacher
9f2e81ae02 libcli/auth: maintain the sequence number for the NETLOGON SSP as 64bit
See [MS-NPRC] 3.3.4.2 The Netlogon Signature Token.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-10 09:18:56 +02:00
Günther Deschner
c11a79c5a0 s3: libnet_join: add admin_domain.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-08-05 10:30:00 +02:00
Günther Deschner
9b4fb5b074 s3-rpc_cli: pass down ndr_interface_table to rpc_pipe_open_ncalrpc().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-08-05 10:29:59 +02:00
Volker Lendecke
78d4bdc0b8 smbd: Obsolete MSG_SMB_OPEN_RETRY
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-04-26 15:17:22 -07:00
Volker Lendecke
234edb525d smbd: Obsolete MSG_SMB_BREAK_RESPONSE
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-04-26 15:17:21 -07:00
Gregor Beck
1ed22ba4b7 s3:smbd: add a scavenger process for disconnected durable handles
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Gregor Beck <gbeck@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-04-18 13:15:13 +02:00
Michael Adam
aa77161871 s3:winbindd: remove wbint_Sid2Gid from the wbint.idl
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:26 +01:00
Michael Adam
8b73556e3f s3:winbindd: remove wbint_Sid2Uid() from the wbint.idl
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:26 +01:00
Michael Adam
28e7d73bdc s3:winbindd: use struct unixid instead of uint64 in Sids2Xids parent<->child
This implicitly also hands the type of the resulting unix-id that the idmap
backend has created back to the caller. This is important for backends that
would set a broader type than the requested one, e.g. rid backend returning
BOTH instead of UID or GID.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:22 +01:00
Stefan Metzmacher
6b123607c8 s3:librpc: add support for PFC_FLAG_OBJECT_UUID when parsing packets (bug #9382)
Now the logic matches the one in dcerpc_read_ncacn_packet_done().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-20 17:37:19 +01:00
Michael Adam
a6726f9023 s3:open_files.idl: add stat-info to vfs_default_durable_cookie.
Pair-programmed-with: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-10-19 17:13:35 +02:00
Stefan Metzmacher
506249b863 s3:open_files.idl: add write_time specific stuff to vfs_default_durable_cookie
metze

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-10-19 15:25:17 +02:00
Stefan Metzmacher
7be7ec803f s3:smbXsrv.idl: add session_global_id to smbXsrv_tcon_global
This is required for some debugging tools like smbstatus.

metze

Signed-off-by: Michael Adam <obnox@samba.org>
2012-10-19 12:15:02 +02:00
Michael Adam
eabe4c8fc4 s3:vfs_default: add basic support for durable handle request and reconnect
We only grant durable handles for CIFS/SMB2 only access,
that means "kernel oplocks", "kernel share modes" and "posix locking"
need to be set to "no".

For now we also don't grant durable handles if delete on close
is active on the handle.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Pair-Programmed-With: Volker Lendecke <vl@samba.org>
2012-09-08 19:48:20 +02:00
Stefan Metzmacher
5e63494508 s3:smbXsrv.idl: add properties for durable handles to smbXsrv_open_global0
Pair-Programmed-With: Michael Adam <obnox@samba.org>

metze
2012-09-08 03:39:06 +02:00
Stefan Metzmacher
6f9610e618 smbXsrv.idl: add nonce_* to smbsrv_session
metze
2012-08-23 08:23:07 +02:00
Christof Schmitt
bd23c8f1ce s3-winbind: Return the DC name from DC_PING
The DC that was attempted to ping is useful for troubleshooting. Return
the DC name in the response to the wbclient.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-15 11:44:42 +10:00
Stefan Metzmacher
205185e88c s3:smbXsrv.idl: remove smbXsrv_*0 defines
This makes ctags more usable.

metze
2012-08-10 15:56:13 +02:00
Jeremy Allison
b70f23c2b5 Correctly check for errors in strlower_m() returns. 2012-08-09 12:08:18 -07:00
Stefan Metzmacher
8734887348 s3:smbXsrv.idl: add encryption_required to smbXsrv_tcon_global0
metze
2012-08-09 08:21:35 +02:00
Stefan Metzmacher
8e1c6d4232 s3:rpc_client: rename pipe_auth_data->user_session_key to transport_session_key
metze
2012-08-01 14:17:15 +02:00
Andrew Bartlett
f3562424b6 lib/param: Move all enum declarations to lib/param
This is in preperation for the parameter table being made common.

Andrew Bartlett

Pair-Programmed-With: Andrew Tridgell <tridge@samba.org>
2012-07-24 11:01:17 +02:00
Stefan Metzmacher
9c8e2b5af0 s3:smbXsrv.idl: add smbXsrv_open* structures
struct smbXsrv_open will represent a SMB 1 or SMB 2
open file handle, while 'files_struct' will be changed
to handle just the protocol independent glue for the SMB_VFS layer.

Note: the format is not stable yet, we need to add more things
      when we start to support durable handles.

metze
2012-06-29 19:11:04 +02:00
Stefan Metzmacher
9f2c89cbea s3:smbXsrv.idl: add smbXsrv_session_close*
metze
2012-06-25 20:55:07 +02:00
Stefan Metzmacher
da40aa0e68 s3:messaging.idl: define MSG_SMBXSRV_SESSION_CLOSE
metze
2012-06-25 20:55:07 +02:00
Stefan Metzmacher
463b308f16 s3:smbd: make use of smbXsrv_tcon and smbXsrv_session for smb2
The removes the protocol specific smbd_smb2_session and
smbd_smb2_tcon.

Pair-Programmed-With: Michael Adam <obnox@samba.org>

metze
2012-06-25 20:55:06 +02:00
Stefan Metzmacher
80f9abf637 s3:smbXsrv.idl: add smbXsrv_tcon* structures
struct smbXsrv_tcon will represent a SMB 1 or SMB 2
tree connect. It will replace 'struct smbd_smb2_tcon' and
'connection_struct' will be changed to handle just the protocol
independent glue for the SMB_VFS layer.

metze
2012-06-25 20:55:06 +02:00
Stefan Metzmacher
5b3c07fa89 s3:smbXsrv.idl: add smbXsrv_session* structures
struct smbXsrv_session will represent a SMB 1 or SMB 2
session. It will replace 'struct smbd_smb2_session' and
'user_struct' will be changed to handle just the protocol
independent glue for the SMB_VFS layer.

metze
2012-06-25 20:55:06 +02:00
Stefan Metzmacher
e09806000b s3:librpc/idl/smbXsrv.idl: add smbXsrv_version_* structures
metze
2012-06-25 20:55:05 +02:00
Stefan Metzmacher
47ddfe2e59 s3:librpc: add smbXsrv.idl
metze
2012-06-25 20:55:05 +02:00
David Disseldorp
ac7b60a17b s3-rpcclient: add fsrvp commands
fss_create_expose connects to an FSRVP server and negotiates the
creation and exposure of a share shadow-copy.
shadow-copies of multiple shares can be requested with a single
fss_create_expose request.

ddiss@plati:~> bin/rpcclient -k -U 'LURCH\administrator%password' \
                             ncacn_np:lutze[sign]
rpcclient $> fss_create_expose backup ro hyper
381884f2-b578-45ea-b8d2-cf82491f4011: shadow-copy set created
...
share hyper@{B6137E21-9CBB-4547-A21D-E7AD40D0874B} exposed as a snapshot
of \\lutze\hyper

fss_delete removes the shadow-copy share:
rpcclient $> fss_delete hyper 381884f2-b578-45ea-b8d2-cf82491f4011 \
                        b6137e21-9cbb-4547-a21d-e7ad40d0874

Shadow-copies can be created read-write or read-only.
Experimenting with Windows Server "8" beta, a recovery complete call is
required after creating a read-write (ATTR_AUTO_RECOVERY) shadow copy.
Otherwise subsequent creation requests fail with
FSRVP_E_SHADOW_COPY_SET_IN_PROGRESS.
2012-06-08 13:34:31 +02:00
Andreas Schneider
2b144531f1 gse: Use the smb_gss_oid_equal wrapper.
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-05-23 17:51:51 +03:00
Alexander Bokovoy
2ddf89a2bc Introduce system MIT krb5 build with --with-system-mitkrb5 option.
System MIT krb5 build also enabled by specifying --without-ad-dc

When --with-system-mitkrb5 (or --withou-ad-dc) option is passed to top level
configure in WAF build we are trying to detect and use system-wide MIT krb5
libraries. As result, Samba 4 DC functionality will be disabled due to the fact
that it is currently impossible to implement embedded KDC server with MIT krb5.

Thus, --with-system-mitkrb5/--without-ad-dc build will only produce
  * Samba 4 client libraries and their Python bindings
  * Samba 3 server (smbd, nmbd, winbindd from source3/)
  * Samba 3 client libraries

In addition, Samba 4 DC server-specific tests will not be compiled into smbtorture.
This in particular affects spoolss_win, spoolss_notify, and remote_pac rpc tests.
2012-05-23 17:51:50 +03:00
Stefan Metzmacher
bffa1c5547 s3:gse: implement gensec_gse_expire_time()
metze
2012-05-17 20:04:33 +02:00
Stefan Metzmacher
9ec866fb6c s3:gse: remember the expire time
metze
2012-05-17 20:04:31 +02:00
Volker Lendecke
d38a171a43 s3: Attempt to fix the build without kerberos
Autobuild-User: Volker Lendecke <vl@samba.org>
Autobuild-Date: Tue Apr 24 15:04:14 CEST 2012 on sn-devel-104
2012-04-24 15:04:13 +02:00
Simo Sorce
08c733d75f Make krb5 wrapper library common so they can be used all over 2012-04-23 19:20:38 -04:00
Michael Adam
499e7372be s3:id_cache: do not use the in-memory idmap cache (it is going to be removed)
This also removes the ID_CACHE_FLUSH message.
2012-04-20 23:17:36 +02:00
Volker Lendecke
99fa29ae09 s3-dbwrap: Add dbwrap_record_watch_send/recv
With this API you can asynchronously wait for a record to be modified
2012-04-19 22:24:18 +02:00
Volker Lendecke
843432d56f s3: New notify implementation
From notify_internal.c:

        /*
         * The notify database is split up into two databases: One
         * relatively static index db and the real notify db with the
         * volatile entries.
         */

This change is necessary to make notify scale better in a cluster
2012-04-17 10:21:02 +02:00
Simo Sorce
46ab219005 gse: Remove unnecessary header.
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12 12:06:43 +02:00
Simo Sorce
88d5d5c4b4 auth-krb: Nove oid packet check to gensec_util.
This is clearly a utiliy function generic to gensec.  Also the 3 callers
had identical implementations. Provide a generic implementation for all
of them and avoid duplicating the code everywhere.

Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12 12:06:42 +02:00
Jeremy Allison
c10ed730d4 Second part of bugfix for bug #8837 - smbd crashes when deleting directory and veto files are enabled.
Store the 'struct security_token' as well as the 'struct security_unix_token'
inside the locking db when setting a delete on close.
2012-04-04 14:58:42 -07:00
Stefan Metzmacher
8d00fe57c2 s3:gse: fix debug message in gse_get_server_auth_token()
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Sat Mar 17 03:21:06 CET 2012 on sn-devel-104
2012-03-17 03:21:06 +01:00
Andrew Bartlett
49bb7f248a s3-krb5: Remove GSS_WRAP_IOV conditional
We already confirm that we have this functionality before we set HAVE_KRB5 at
configure time.

Andrew Bartlett
2012-03-15 09:29:02 +11:00
Jeremy Allison
21528da9cd Fix a bunch of "unused variable" warnings.
Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Sat Feb 18 06:22:40 CET 2012 on sn-devel-104
2012-02-18 06:22:40 +01:00
Andrew Bartlett
674278d5b0 auth/kerberos: Move gse_get_session_key() to common code and use in gensec_gssapi
Thie ensures that both code bases use the same logic to determine the use
of NEW_SPNEGO.

Andrew Bartlett
2012-02-17 17:36:38 +11:00
Andrew Bartlett
a315350341 s3-gse: Allow kerberos key type OID to be optional 2012-02-17 17:36:37 +11:00
Andrew Bartlett
6088f44ed7 s3-gse: Fix OID to read for kerberos key type 2012-02-17 17:36:37 +11:00
Andrew Bartlett
05cf2d41cc s3-librpc: Remove backup declaration of GSS_C_DCE_STYLE
All our supported krb5 libs provide this.

Andrew Bartlett
2012-02-17 17:36:37 +11:00
Andrew Bartlett
9eb8f07fc4 s3-gse: Remove unused OID declaration 2012-02-17 17:36:37 +11:00
Andrew Bartlett
91c325bb70 s3-librpc: Remove gse_verify_server_auth_flags
gensec_update() ensures that DCE-style and sign/seal are negotiated correctly
for DCE/RPC pipes.  Also, the smb sealing client/server already check for the
gensec_have_feature().

This additional check just keeps causing trouble, and is 'protecting'
an already secure negoitated exchange.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Feb 16 21:19:44 CET 2012 on sn-devel-104
2012-02-16 21:19:44 +01:00
Andrew Bartlett
2b511f0e92 s3-librpc: Use gensec_spnego for DCE/RPC authentication
This ensures that we use the same SPNEGO code on session setup and on
DCE/RPC binds, and simplfies the calling code as spnego is no longer
a special case in cli_pipe.c

A special case wrapper function remains to avoid changing the
application layer callers in this patch.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-02-16 15:18:42 +01:00
Andrew Bartlett
5c9b6db68e s3-gse: Use the session key type, not the lucid context to set NEW_SPNEGO
Using gss_krb5_export_lucid_sec_context() is a problem with MIT krb5, as
it (reasonably, I suppose) invalidates the gssapi context on which it
is called.  Instead, we look to the type of session key which is
negotiated, and see if it not AES (or newer).

If we negotiated AES or newer, then we set GENSEC_FEATURE_NEW_SPENGO
so that we know to generate valid mechListMic values in SPNEGO.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-02-16 15:18:42 +01:00
Andrew Bartlett
1d0684c845 s3-librpc: Remove unused bool gensec_hook
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-02-16 15:18:42 +01:00
Stefan Metzmacher
01588585b1 s3:gse: return NT_STATUS_LOGON_FAILURE instead of NT_STATUS_INTERNAL_ERROR
This matches the behavior of ads_verify_ticket().

Note that ads_verify_ticket() calls krb5_to_nt_status(), but
as a server it's likely to always returns NT_STATUS_UNSUCCESSFUL.
ads_verify_ticket() maps NT_STATUS_UNSUCCESSFUL to NT_STATUS_LOGON_FAILURE.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Jan 26 10:48:36 CET 2012 on sn-devel-104
2012-01-26 10:48:36 +01:00
Stefan Metzmacher
0f039b196a s3-gse: add GENSEC_FEATURE_NEW_SPNEGO detection in gensec_gse_have_feature()
metze
2012-01-25 08:44:33 +01:00
Stefan Metzmacher
7fe189749e s3-gse: make sure GSS_C_CONF_FLAG implies GSS_C_INTEG_FLAG
metze
2012-01-20 23:55:54 +01:00
Stefan Metzmacher
6f0f10c798 s3-gse: implement fill_mem_keytab_from_[system|dedicated]_keytab
metze
2012-01-20 23:55:53 +01:00
Stefan Metzmacher
6158ea1abd s3-gse: create memory keytab in gse_krb5_get_server_keytab()
The other functions just add entries to it.

metze
2012-01-20 23:55:53 +01:00
Stefan Metzmacher
f86ab29470 s3-gse: fix SECRETS_AND_KEYTAB fallback in gse_krb5_get_server_keytab()
metze
2012-01-20 23:55:53 +01:00
Andrew Bartlett
e249bdd32e s3-gse: align common elements between gse_context and gensec_gssapi_state
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:25 +01:00
Andrew Bartlett
45ec777e0e s3-gse: Make gensec_gse cope with non-DCE GSSAPI
The validation of the mutual authentication reply produces no further
data to send to the server.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:25 +01:00
Stefan Metzmacher
545c1ad1b9 s3-gse: the server should not check for GSS_C_MUTUAL_FLAG
It up to the client to ask for GSS_C_MUTUAL_FLAG,
except for the dcerpc case, where the server is stricter.

metze
2012-01-18 16:23:25 +01:00
Stefan Metzmacher
c5864deadc s3-gse: verify that we got GSS_C_DCE_STYLE when expected
GSS_C_DCE_STYLE implies GSS_C_MUTUAL_FLAG, so also check for it.

metze
2012-01-18 16:23:24 +01:00
Andrew Bartlett
ed88012dd2 s3-gse Remove authenticated flag from gse
The only user for this flag is called only directly after it was set.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:24 +01:00
Andrew Bartlett
c759097956 s3-gse remove special more_processing hook from gse
The NT_STATUS_MORE_PROCESSING_REQUIRED status code is what gensec
is expecting in any case.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:24 +01:00
Andrew Bartlett
5b90bcf83b s3-gse Rename gss_c_flags and ret_flags in gse
This make it clearer what type of flags these are and matches
gensec_gssapi

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:24 +01:00
Andrew Bartlett
cf39b63a7b s3-gse Rename gss_ctx to match gensec_gssapi_context
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:24 +01:00
Andrew Bartlett
e8c8d293d8 s3-gse Rename delegated_creds to match gensec_gssapi_context
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:24 +01:00
Stefan Metzmacher
f14bcdf8ec s3-gse gss_wrap_iov_length() only needs the type and length
metze
2012-01-18 16:23:23 +01:00
Andrew Bartlett
23a062b51b s3-gse Make seal parameter a boolean for clarity
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:23 +01:00
Andrew Bartlett
f2efb0f6a3 s3-librpc Remove special case for spnego session key
SPNEGO is implemented only in terms of gensec mechanisms now.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:23 +01:00
Andrew Bartlett
1818612830 s3-librpc Remove special case for spnego dcerpc sign/seal
SPNEGO is implemented only in terms of gensec mechanisms now.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:23 +01:00
Andrew Bartlett
ad14b8c655 s3-gse Move GSS_C_DCE_STYLE backup definition to gse.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:23 +01:00
Andrew Bartlett
0132cca825 s3-gse Add const
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:23 +01:00
Andrew Bartlett
90efbe0fad s3-gse Remove or make static unused/local-only GSE functions
The GSE layer is now used via the GENSEC module, so we do not need these
functions exposed any more.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:23 +01:00
Andrew Bartlett
f70c9fb76c s3-librpc Remove layer around struct gensec_security
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:22 +01:00
Andrew Bartlett
5ddec1182e s3-librpc: Simplify SPNEGO code now that all mechs use a struct gensec_security
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:22 +01:00
Andrew Bartlett
0c1b4c2321 s3-librpc Call SPENGO/GSSAPI via the auth_generic layer and gensec
This simplifies a lot of code, as we know we are always dealing
with a struct gensec_security, and allows the gensec module being
used to implement GSSAPI to be swapped for AD-server operation.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:22 +01:00
Andrew Bartlett
53cc9c6a30 s3-librpc Allow spnego_generic_init_client to handle kerberos too
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:22 +01:00
Andrew Bartlett
e012ad9d8b s3-librpc Call GSSAPI via the auth_generic layer and gensec
This simplifies a lot of code, as we know we are always dealing with a
struct gensec_security, and allows the gensec module being used to
implement GSSAPI to be swapped when required for AD-server operation.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:22 +01:00
Andrew Bartlett
d95d59138c s3-gse Make gse available as a gensec client module
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:22 +01:00
Andrew Bartlett
cbd8231e34 s3-gse: Add gensec wrapper for gse GSSAPI client
This brings in part of the s4 gensec_gssapi as the boilerplate for the
new module.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:21 +01:00
Volker Lendecke
cfebba96bd s3: Put an indirection layer into share_mode_lock
Signed-off-by: Jeremy Allison <jra@samba.org>
2012-01-12 23:59:22 +01:00
Andrew Bartlett
49bafcfa48 s3-librpc Supply target service and server to spnego_generic_init_client()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:09:43 +01:00
Andrew Bartlett
50a939ad85 s3-librpc: Rename spnego_ntlmssp_init_client and make generic
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:05:01 +01:00
Andrew Bartlett
e8cd972177 s3-librpc: rename get_ntlmssp_auth_footer to be more generic
This can handle any gensec auth type now.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 09:04:52 +01:00
Andrew Bartlett
6412ff84ce s3-librpc Return user principal name on supplied mem_ctx
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-11 08:25:19 +01:00
Andrew Bartlett
a00032a92d s3-libsmb Make auth_ntlmssp client more generic
As well as renaming, this allows us to start the mech by DCE/RPC auth
type or OID.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-06 08:12:49 +01:00
Andrew Bartlett
4ac34f3288 s3-librpc remove unused headers
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-05 17:17:29 +01:00
Stefan Metzmacher
73ed88df35 s3:gse: MIT krb5 1.8.1 has a bug in gss_wrap_iov()
gss_krb5int_make_seal_token_v3_iov() doesn't set '*conf_state'.

metze
2012-01-05 17:17:28 +01:00
Andrew Bartlett
a1fd1a4c65 s3-librpc store the sign/seal flags we got in the gssapi client
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-05 17:17:28 +01:00
Andrew Bartlett
860ad734ba s3-libads Factor out a new routine kerberos_get_principal_from_service_hostname()
This is now used in the GSE GSSAPI client, so that when we connect to
a target server at the CIFS level, we use the same name to connect
at the DCE/RPC level.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-05 17:17:28 +01:00
Andrew Bartlett
25d7675d69 s3-librpc Use gsskrb5_get_subkey() where available to get the session key
This allows gse_get_session_key() to work against Heimdal.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-05 17:17:28 +01:00
Andrew Bartlett
21fb9a47ea s3-librpc Use gensec_sig_size() instead of a fixed NTLMSSP_SIG_SIZE
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Dec 22 20:57:27 CET 2011 on sn-devel-104
2011-12-22 20:57:27 +01:00
Andrew Bartlett
6391fff9da s3-auth rename auth_ntlmssp_state -> auth_generic_state
This structure handles more than NTLMSSP now, at least when we are an AD DC
and so changing the name may avoid some confusion in the future.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-12-22 19:25:10 +01:00
Volker Lendecke
3441c01b16 s3: Convert open_files.idl to tab indents 2011-12-13 14:14:24 +01:00
Stefan Metzmacher
4eb5b0b392 s3:messaging.idl: obsolete unused MSG_SMB_SAM_*
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Dec 13 14:13:38 CET 2011 on sn-devel-104
2011-12-13 14:13:38 +01:00
Volker Lendecke
1c46fb5c3e s3: Use autogenerated open_files.idl 2011-12-02 22:43:05 +01:00
Volker Lendecke
0c325463a2 s3: Add open_files.idl 2011-12-02 22:43:05 +01:00
Volker Lendecke
a86c536227 s3: Remove some leftovers of old ctdb tdb2 code 2011-10-31 12:48:06 +01:00
Andrew Bartlett
321204eaeb s3-ntlmssp Remove references to auth_ntlmssp_context from the rpc code
We always dereferenced auth_ntlmssp_state->gensec_security, so now we
do not bother passing around the whole auth_ntlmssp_state.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-21 08:50:55 +02:00
Andrew Bartlett
0a0839821a s3-ntlmssp Remove auth_ntlmssp_session_key()
We now just call the gensec_session_key() directly.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-21 08:43:38 +02:00
Andrew Bartlett
3f079885b2 s3-ntlmssp Remove auth_ntlmssp_want_feature()
We now just call the gensec_want_feature() directly.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-21 08:43:33 +02:00
Andrew Bartlett
bd29f79463 s3-ntlmssp use gensec_{seal,unseal,sign,check}_packet
This avoids the indirection via the auth_ntlmsssp wrapper functions.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-21 08:43:23 +02:00
Andrew Bartlett
083025ccd5 s3-ntlmssp Remove auth_ntlmssp_update wrapper
We now just call gensec_update directly.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-21 08:43:10 +02:00
Andrew Bartlett
f9b042641f s3-ntlmssp split auth_ntlmssp_client_start() into two parts
This will allow it to be a wrapper around a gensec module, which
requires that they options be set on a context, but before the
mechanism is started.

This also simplfies the callers, by moving the lp_*() calls
into one place.

Andrew Bartlett
2011-10-18 12:25:30 +02:00
Andrew Bartlett
0c6e4adcb2 ntlmssp: Move ntlmssp code to auth/ntlmssp
This brings in the code from both libcli/auth and
source4/auth/ntlmssp.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-18 13:13:31 +11:00
Volker Lendecke
f5081df369 s3: Remove an unused variable 2011-09-30 10:21:43 +02:00
Andreas Schneider
61ada700a6 s3-id_cache: Use better names for id cache management ops
The IDMAP term is normally associated with Winbind's idmap stuff.
These functions deal with id caching not id mapping.

Signed-off-by: Simo Sorce <idra@samba.org>
2011-08-21 09:08:25 -04:00
Simo Sorce
5c1a8dcf8e s3-messaging: Add preforked child-parent message types
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Simo Sorce <idra@samba.org>
2011-08-21 09:05:06 -04:00
Simo Sorce
d1bc22eeb3 s3-rpc_server: Use rpc_epmapper_mode() in ep_register()
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Simo Sorce <idra@samba.org>
2011-08-21 09:05:03 -04:00
Simo Sorce
0825a52a36 Revert "s3-messaging: IDMAP_ messages belongs to the Winbind range"
This reverts commit 102f39ae3e.

These messages are handled by smbd not winbind, and could potentially be of
general interest.

Autobuild-User: Simo Sorce <idra@samba.org>
Autobuild-Date: Fri Aug 19 16:16:05 CEST 2011 on sn-devel-104
2011-08-19 16:16:05 +02:00
Simo Sorce
102f39ae3e s3-messaging: IDMAP_ messages belongs to the Winbind range
Autobuild-User: Simo Sorce <idra@samba.org>
Autobuild-Date: Tue Aug 16 22:27:05 CEST 2011 on sn-devel-104
2011-08-16 22:27:05 +02:00
Simo Sorce
9f12575712 s3-messaging: Change classification of MSG_SMB_CONF_UPDATED.
smbd is not the only daemon interested in smb.conf changes. Move this
message to the GENERAL class so that all interested partied (nmbd,
winbindd, spoolssd, etc..) can receive this notification.

Signed-off-by: Andreas Schneider <asn@samba.org>
2011-08-11 14:58:05 +02:00
Simo Sorce
b706fd37f6 s3-messaging: Fix messaging classes.
This has been broken since ff0ac5b0 (May 2007).
Basically all messages were belonging to the General class except for CTDB
messages.
This fixed the message_send_all() function to correctly compute the class, and
fixes registrations to include all they need to cope with the fact not all
messages are of calss general (registrations rotted a bit because as long as
FLAG_MSG_GENERAL was defined the process woould receive all messages).

Signed-off-by: Andreas Schneider <asn@samba.org>
2011-08-11 14:58:01 +02:00
Simo Sorce
cb1af61cb1 s3-messaging: Remove obsolete class.
The FLAG_MSG_PRINT_NOTIFY class is actually obsolete and never used, as the
only message belonging to it is not used either.

Signed-off-by: Andreas Schneider <asn@samba.org>
2011-08-11 14:57:55 +02:00
Andrew Bartlett
7b1d6a6a05 selftest: test plugin_s4_dc against all ncacn_np tests
Changes to the s3 epmapper behaviour seem to have fixed the rest of these
tests.

Andrew Bartlett
2011-08-03 18:48:05 +10:00
Andrew Bartlett
1231b784a1 s3-ntlmssp Remove auth_ntlmssp_and_flags()
There is no need to mask out these flags as they simply are not set
yet.

The correct abstraction is to ask for NTLMSSP features.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-08-03 18:48:03 +10:00
Andrew Bartlett
bba5f0a641 s3-ntlmssp Remove auth_ntlmssp_or_flags
We now just use auth_ntlmssp_want_feature to get extra flags
on the NTLMSSP context

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-08-03 18:48:03 +10:00
Andrew Bartlett
778bf87d8d s3-ntlmssp Remove calls to auth_ntlmssp_and_flags from the server
This is changed so that the callers ask for the additional flags
that they need, starting with no additional flags.

This helps to create a proper abstraction layer in
ntlmssp_wrap/auth_ntlmssp.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-08-03 18:48:03 +10:00
Andrew Bartlett
6d7ac4f1ad s3-ntlmssp Add mem_ctx argument to auth_ntlmssp_update
This clarifies the lifetime of the returned token.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-08-03 18:48:03 +10:00
Andrew Bartlett
dee845eb70 s3-ntlmssp Add mem_ctx argument to auth_ntlmssp_get_session_key() 2011-08-03 18:48:02 +10:00