1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-14 19:24:43 +03:00

14213 Commits

Author SHA1 Message Date
Jeremy Allison
c6674fa628 Output message saying "signed connect" instead of just connect when signing
is active.
Jeremy.
-
Jeremy Allison
69c56ee8bc Fix oplock break detection code on incoming oplock break responses. This
fixes signing for oplocks.
Jeremy.
-
John Terpstra
7b24759c27 Removed duplicated file, no longer in use. Note: profiles.1.xml is still
present and relevant.
-
John Terpstra
d205dd963b Changed "winbind uid/gid" to "idmap uid/gid" -
Gerald Carter
10c7a1af67 make sure to initialize the backend methods when enumerating sequence numbers; reported by Ken Cross -
Jeremy Allison
9a8ffc239c Ensure we don't leak any sign records on cancel of pending requests.
Jeremy.
-
Jeremy Allison
270bf20fe3 Only look for mid sign records on incoming packets for oplock break replies.
Otherwise we find spurious mid sign records on reply_ntcancel calls (they cancel
by mid). That took a *lot* of tracking down. I still need to remove the mid
records from the sign state on reply_ntcancel to avoid leaking memory....
Jeremy.
-
Jeremy Allison
3a789cb7f0 More fixes for client and server side signing. Ensure sequence numbers
are updated correctly on returning an error for server trans streams.
Ensure we turn off client trans streams on error.
Jeremy.
-
Jeremy Allison
844898dbd8 Leave the packet sequence checkers enabled whilst I track down a smbclient -> smbd
sequence number problem.
Jeremy.
-
Jeremy Allison
901544b29b Add the same signing code to the server. Ensure we use identical session
numbers and MIDs when in trans/trans2/nttrans code.
Jeremy.
-
Jeremy Allison
2093a3130d Correct fix (removed the earlier band-aid) for what I thought was a signing
bug with w2k. Turns out that when we're doing a trans/trans2/nttrans call
the MID and send_sequence_number and reply_sequence_number must remain constant.
This was something we got very wrong in earlier versions of Samba. I can now
get a directory listing from WINNT\SYSTEM32 with the older earlier parameters
for clilist.c
This still needs to be fixed for the server side of Samba, client appears to
be working happily now (I'm doing a signed smbtar download of an entire W2K3
image to test this :-).
Jeremy.
-
Jeremy Allison
c4af1ec735 Fix the option processing for smbtar. Does no one check this !
Jeremy.
-
Herb Lewis
ea57a57db0 add tests for IRIX attr functions -
Jim McDonough
a2bd8f0bfa Update my copyrights according to my agreement with IBM -
Jim McDonough
c9b209be2b Update my copyrights according to my agreement with IBM -
Jim McDonough
15d2bc4785 Fix copyright statements for various pieces of Anthony Liguori's work. -
Gerald Carter
042492b862 fix cut-n-paste error found by abartlet -
Volker Lendecke
a82f6a0096 Add ntlmssp client support to ntlm_auth. Find the corresponding cyrus sasl
module under http://samba.sernet.de/cyrus-gss-spnego.diff

Volker
-
Volker Lendecke
5d379345fa Fix a memory leak. I did not check all the calls to winbindd_request, but
we might leak the extra_data somewhere else as well.

Volker
-
Volker Lendecke
c2c901e06b locking.c now refers to map_nt_error_from_unix, so link it in with
smbstatus and smbcontrol

Volker
-
Jeremy Allison
5ef75fa366 Finish reformatting.
Jeremy.
-
Jeremy Allison
43fbc18fdc Final fix for the bug tridge found. Only push locks onto a blocking lock
queue if the posix lock failed with EACCES or EAGAIN (this means another
lock conflicts). Else return an error and don't queue the request.
Jeremy.
-
Jeremy Allison
77f2a91549 Reformat lots of clitar code as I hate the style so much :-).
Jeremy.
-
Jeremy Allison
94b30e7b4a Reformat clitar option processing - getting ready to fix it for popt...
Jeremy.
-
Andrew Tridgell
87ede8d310 CVAL_NC() doesn't need the (unsigned) fix and breaks the IRIX build
Thanks to Herb for pointing this out!
-
Jeremy Allison
c5e11fd010 Added a note inspired by andrew@cis.uoguelph.ca to explain when this
parameter gets run.
Jeremy.
-
Gerald Carter
731420b03d only honor the first OID in the sessetup snego negotiate. Deviates
from RFC but I'm smelling a client bug here.

	/* only look at the first OID for determining the mechToken --
	   accoirding to RFC2478, we should choose the one we want
	   and renegotiate, but i smell a client bug here..

	   Problem observed when connecting to a member (samba box)
	   of an AD domain as a user in a Samba domain.  Samba member
	   server sent back krb5/mskrb5/ntlmssp as mechtypes, but the
	   client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an
	   NTLMSSP mechtoken.                 --jerry              */
-
Alexander Bokovoy
44bae9da9e Return proper error when it is impossible to change quota flags -
Volker Lendecke
bc39c9b57f Fix off-by-one found by valgrind.
Volker
-
Volker Lendecke
9a04750dea spnego.c has function definitions. Prototype them.
Anybody familiar with Makefile.in could you please look at this?
This is probably the wrong way to fix this.

Volker
-
Volker Lendecke
946695242f Fixes for memory leaks in gss spnego handling by aliguori.
Volker
-
Volker Lendecke
6c252440fb This fixes an error I must have made when playing with spnego.c found
by aliguori: NegTokenInit.mechListMIC is an Octet String.

Second: add a free_spnego_data function.

Both thanks to aliguori.

Volker
-
Volker Lendecke
692ff44ba3 Apply some const -
Gerald Carter
6e8f23d1b1 make sure the domain sid is set when enumerating trusted domains
(we don't always get it back)
-
Gerald Carter
0ab00ccaed working on transtive trusts issue:
* use DsEnumerateDomainTrusts() instead of LDAP search.
    wbinfo -m now lists all trusted downlevel domains and
    all domains in the forest.

Thnigs to do:

  o Look at Krb5 connection trusted domains
  o make sure to initial the trusted domain cache as soon
    as possible
-
Tim Potter
4644085b68 Whoops - this is probably better shell syntax. -
Tim Potter
e6210295e4 Turn on automatic winbindd support for FreeBSD and see what the compile farm
thinks of it.
-
Andrew Tridgell
886661c377 This is a critical bug fix for a data corruption bug. If you
maintain another tree then please apply!

On non-X86 machines out byte-order macros fails for one particular
value. If you asked for IVAL() of 0xFFFFFFFF and assigned it to a 64
bit quantity then you got a 63 bit number 0x7FFFFFFFFFFFFFFF rather
than the expected 0xFFFFFFFF. This is due to some rather bizarre and
obscure sign extension rules to do with unsigned chars and arithmetic
operators (basically if you | together two unsigned chars you get a
signed result!)

This affected a byte range lock using the large lockingX format and a
lock of offset 0 and length 0xFFFFFFFF. Microsoft Excel does one of
these locks when opening a .csv file. If the platform you run on does
not then handle locks of length 0x7FFFFFFFFFFFFFFF then the posix lock
fails and the client is given a lockingX failure. This causes the .csv
file to be trunated!!
-
Jeremy Allison
1734d43eb5 Wrap calls to change_oem_password() in become_root()/unbecome_root() pairs
to allow UNIX password change scripts to work correctly. This is safe as
the old password has been checked as correct before invoking this.
Jeremy.
-
Jeremy Allison
7c58673a10 Turn the 'doing_signing' variable on - fix bug where it was only being set
on when signing was mandatory.
Jeremy.
-
Jeremy Allison
879309671d Add a command line option (-S on|off|required) to enable signing on client
connections. Overrides smb.conf parameter if set.
Jeremy.
-
Jeremy Allison
f3f29665bd Save us from possibly uninitialised variable (caught by gcc).
Jeremy.
-
Jeremy Allison
677d3a3c4c Fix bug we discovered in W2K client signing on secondary trans2 packets.
Use W2K parameters. tpot please re-test smbclient with your problem
directory.
Jeremy.
-
Jeremy Allison
b8f6b83646 Eliminate valgrind error when client gets bad sig on list. Some reformatting.
Jeremy.
-
Gerald Carter
f8abdd23e1 add a few more tidy ups. Now onto winbindd -
Gerald Carter
c691c7f7d9 add support for DsEnumerateDomainTrusted for enumerating all the
trusted domains in a forest.
-
Jeremy Allison
d57d9b99df Don't revert something until you've seen if volker has already fixed it :-).
Jeremy.
-
Jeremy Allison
382d1732ca Comment out mutex until I get dependencies sorted out...
Jeremy
-
Volker Lendecke
ee09db891a bin/net needs server_mutex as kerberos_verify now uses it.
Volker
-
Jeremy Allison
9e0534a1b6 Put mutex around access of replay cache for krb5 tickets. krb5 replay cache
is not multi-process safe.
Jeremy.
-