1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-15 23:24:37 +03:00

40 Commits

Author SHA1 Message Date
Günther Deschner
bff20e14c3 kerberos: use KRB5_KT_KEY macro where appropriate.
Guenther
(This used to be commit a042dffd7121bda3dbc9509f69fcfae06ed4cc22)
2008-08-29 11:01:34 +02:00
Jeremy Allison
d701d23b60 Fix uninitialized variables.
Jeremy.
(This used to be commit 1db7e00a5400863fd5dbb81c1a4c6ea6092d0495)
2008-07-30 16:06:30 -07:00
Günther Deschner
c11fb13864 kerberos: make smb_krb5_kt_add_entry() static.
Guenther
(This used to be commit 04b1847f87d166819dfe0f8c27c8cd9fc062544f)
2008-07-18 16:42:55 +02:00
Günther Deschner
16e44ee112 kerberos: allow to keep entries with old kvno's while creating keytab.
Guenther
(This used to be commit 6194244bd9fcc1fb736f3d91433f107270cac1c9)
2008-06-30 12:38:40 +02:00
Günther Deschner
52635c6f58 kerberos: rename smb_krb5_kt_add_entry to smb_krb5_kt_add_entry_ext.
Guenther
(This used to be commit 48600a0019d70d22574cf08e8fe19d44cc332a0f)
2008-06-30 12:38:32 +02:00
Günther Deschner
0ac8c5d49a kerberos: make smb_krb5_kt_add_entry public, allow to pass keys without salting them.
Guenther
(This used to be commit 7c4da23be1105dc224033b21eb486e7fcdc7d9c5)
2008-06-24 23:34:05 +02:00
Günther Deschner
0447e6a0a7 libads: add ads_get_machine_kvno() to make ads_get_kvno() a bit more generic.
Guenther
(This used to be commit cb7ace209c2051ae02647188715fa6ee324c2bf6)
2008-06-17 19:54:09 +02:00
Jeremy Allison
30191d1a57 RIP BOOL. Convert BOOL -> bool. I found a few interesting
bugs in various places whilst doing this (places that assumed
BOOL == int). I also need to fix the Samba4 pidl generation
(next checkin).
Jeremy.
(This used to be commit f35a266b3cbb3e5fa6a86be60f34fe340a3ca71f)
2007-10-18 17:40:25 -07:00
Andrew Tridgell
5e54558c6d r23784: use the GPLv3 boilerplate as recommended by the FSF and the license text
(This used to be commit b0132e94fc5fef936aa766fb99a306b3628e9f07)
2007-10-10 12:28:22 -05:00
Jeremy Allison
d824b98f80 r23779: Change from v2 or later to v3 or later.
Jeremy.
(This used to be commit 407e6e695b8366369b7c76af1ff76869b45347b3)
2007-10-10 12:28:20 -05:00
Günther Deschner
110e420196 r23651: Always, always, always compile before commit...
Guenther
(This used to be commit accb40446ad3f872c5167fc2306d892553293b7b)
2007-10-10 12:23:41 -05:00
Günther Deschner
3b1956f9d2 r23650: Fix remaining callers of krb5_kt_default().
Guenther
(This used to be commit b9d7a2962a472afb0c6b8e3ac5c2c819d4af2b39)
2007-10-10 12:23:41 -05:00
Günther Deschner
a248672932 r23649: Fix the build (by moving smb_krb5_open_keytab() to clikrb5.c).
Guenther
(This used to be commit 19020d19dca7f34be92c8c2ec49ae7dbde60f8c1)
2007-10-10 12:23:41 -05:00
Günther Deschner
a2618aa8d5 r23648: Allow to list a custom krb5 keytab file with:
net ads keytab list /path/to/krb5.keytab

Guenther
(This used to be commit a2befee3f240543ea02ea99cebad886b54ae64eb)
2007-10-10 12:23:41 -05:00
Günther Deschner
df63172ad9 r23646: Generalize our internal keytab handling to support a broader range of default
keytabnames (like "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab"). This also
fixes keytab support with Heimdal (which supports the WRFILE pragma as well
now).

Guenther
(This used to be commit 7ca002f4cc9ec4139c0c48952ebf05f89b5795ef)
2007-10-10 12:23:40 -05:00
Günther Deschner
1ee9650a1d r22479: Add "net ads keytab list".
Guenther
(This used to be commit 9ec76c542775ae58ff03f42ebfa1acc1a63a1bb1)
2007-10-10 12:19:37 -05:00
Jeremy Allison
42b2ddec8f r21863: Fix debug messages with incorrect function name.
Jeremy.
(This used to be commit d432d81c8321a4444b970169a5c7c3c5709de8e5)
2007-10-10 12:18:39 -05:00
Günther Deschner
81e4a28718 r21561: It makes absolutely no sense to call krb5_kt_resolve() two times
directly after another.

Guenther
(This used to be commit 76ba11d7770bac7c6db2eb1640139bbe270d82c3)
2007-10-10 12:18:13 -05:00
Gerald Carter
725cb5d7c9 r20486: Always upper case the "host/<sAMAccoutnName>" entry in the keytab file
so apps will know which one to look for,
(This used to be commit d4a5dc3ad5f56a5f741424ecc4fffa0ef39bdc67)
2007-10-10 12:16:52 -05:00
Gerald Carter
060b155cd2 r16952: New derive DES salt code and Krb5 keytab generation
Major points of interest:

* Figure the DES salt based on the domain functional level
  and UPN (if present and applicable)
* Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC
  keys
* Remove all the case permutations in the keytab entry
  generation (to be partially re-added only if necessary).
* Generate keytab entries based on the existing SPN values
  in AD

The resulting keytab looks like:

ktutil:  list -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32)
   2    6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5)
   3    6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5)
   4    6           host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32)
   5    6           host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5)
   6    6           host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5)
   7    6               suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32)
   8    6               suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5)
   9    6               suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5)

The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName)
and the sAMAccountName value.  The UPN will be added as well if the machine has
one. This fixes 'kinit -k'.

Tested keytab using mod_auth_krb and MIT's telnet.  ads_verify_ticket()
continues to work with RC4-HMAC and DES keys.
(This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2007-10-10 11:19:15 -05:00
Jeremy Allison
b68b05854f r15210: Add wrapper functions smb_krb5_parse_name, smb_krb5_unparse_name,
smb_krb5_parse_name_norealm_conv that pull/push from unix charset
to utf8 (which krb5 uses on the wire). This should fix issues when
the unix charset is not compatible with or set to utf8.
Jeremy.
(This used to be commit 37ab42afbc9a79cf5b04ce6a1bf4060e9c961199)
2007-10-10 11:16:28 -05:00
Jeremy Allison
ce8ad0c3b1 r5759: Patch from Doug VanLeuven <roamdad@sonic.net> to add more case/realm/name
permutations to the kerberos keytab.
Jeremy.
(This used to be commit c687e73f242967cd3a78db66c1dd23349766ebb8)
2007-10-10 10:55:59 -05:00
Jeremy Allison
acf9d61421 r4088: Get medieval on our ass about malloc.... :-). Take control of all our allocation
functions so we can funnel through some well known functions. Should help greatly with
malloc checking.
HEAD patch to follow.
Jeremy.
(This used to be commit 620f2e608f70ba92f032720c031283d295c5c06a)
2007-10-10 10:53:32 -05:00
Jeremy Allison
5ee08e89bf r3502: Tidy up debugging in kerberos_keytab code.
Jeremy.
(This used to be commit 82651c1b1704d90ca52be1463ee871801c607d3b)
2007-10-10 10:53:08 -05:00
Jeremy Allison
917a53cc58 r3492: Fixes from testing kerberos salted principal fix.
Jeremy.
(This used to be commit b356a8fdc5a1ac45f2f7f56a0836e794bdecddc6)
2007-10-10 10:53:07 -05:00
Jeremy Allison
2d4725cfa6 r3381: More merging of the #1717 patch. Fixup some erroneous assumptions about
memcpy's into fqdn names. I think the original intent was to create
MYNAME.fqdn.tail.part.
Will need testing to see I haven't broken keytab support.
Jeremy.
(This used to be commit 82acf83040654eb8b7e261518a3e5eb9caea7750)
2007-10-10 10:53:05 -05:00
Jeremy Allison
cf47845b1c r3379: More merging of kerberos keytab and salting fixes from Nalin Dahyabhai <nalin@redhat.com>
(bugid #1717).
Jeremy.
(This used to be commit 30b8807cf6d5c3c5b9947a7e841d69f0b22eb019)
2007-10-10 10:53:05 -05:00
Jeremy Allison
12b0bd2aca r1373: Fix from Guenther Deschner <gd@sernet.de> to ensure last error return is not invalid.
Jeremy.
(This used to be commit 4bdf914cba2a63d186138d1341a7260ad79da1f5)
2007-10-10 10:52:08 -05:00
Jeremy Allison
34f985c971 r1243: Fix so this compiles with Heimdal (in Heimdal krb5_kt_cursor is a struct not a pointer).
Jeremy.
(This used to be commit 940f893d485a01e73afe714a70d724c2d41c7ad4)
2007-10-10 10:52:02 -05:00
Jeremy Allison
2b76b28932 r1236: Heimdal fixes from Guenther Deschner <gd@sernet.de>, more to come before
it compiles with Heimdal.
Jeremy.
(This used to be commit dd07278b892770ac51750b87a4ab902d4de3a960)
2007-10-10 10:52:01 -05:00
Jeremy Allison
7825677b86 r1222: Valgrind memory leak fixes. Still tracking down a strange one...
Can't fix the krb5 memory leaks inside that library :-(.
Jeremy.
(This used to be commit ad440213aaae58fb5bff6e8a6fcf811c5ba83669)
2007-10-10 10:52:00 -05:00
Jeremy Allison
2055155291 r1221: Added the last of the system keytab patch from "Dan Perry" <dperry@pppl.gov>,
fixed valgrind detected mem corruption in libads/kerberos_keytab.c.
Jeremy.
(This used to be commit 286f4c809cb1532b3f8ae7ddf92349c68cc8ce31)
2007-10-10 10:52:00 -05:00
Jeremy Allison
e948458a79 r1215: Intermediate checkin of the new keytab code. I need to make sure I
haven't broken krb5 ticket verification in the mainline code path,
also need to check with valgrind. Everything now compiles (MIT, need
to also check Heimdal) and the "net keytab" utility code will follow.
Jeremy.
(This used to be commit f0f2e28958cb9abfed216c71f291f19ea346d630)
2007-10-10 10:52:00 -05:00
Jeremy Allison
5a889c9d7b r1214: Now compiles. Changed krb5_kt_free_entry to krb5_free_keytab_entry_contents
Jeremy.
(This used to be commit be8a2dc00dd876c4b596600ae72d4ac05f9ebe64)
2007-10-10 10:52:00 -05:00
Jeremy Allison
f38c27b4e0 r1193: Ensure we check for and use krb5_free_unparsed_name().
Jeremy.
(This used to be commit af5a08f5ad895cb33c9134771da19ba5e709e742)
2007-10-10 10:51:59 -05:00
Jeremy Allison
d703c350cb r1192: Fixed all memleaks/error code return path leaks I can find. Not sure if compiles yet,
but will soon :-).
Jeremy.
(This used to be commit 0d982956f6ba2f284ffa4313a9e7581a79dbf397)
2007-10-10 10:51:59 -05:00
Jeremy Allison
92fea615f5 r1184: Keep latest changes... not compilable yet.
Jeremy.
(This used to be commit 57c037c6c92d28b70e36859a639c53979126ff01)
2007-10-10 10:51:59 -05:00
Jeremy Allison
04257821e9 r1183: Updates to the code cleanup so I don't lose my changes...
Jeremy.
(This used to be commit 786a440c189556d5c122b2c9ddca9fdf6bd65d1d)
2007-10-10 10:51:58 -05:00
Jeremy Allison
920034ec3b r1182: Partial re-write of keytab code to clean up, remove memory leaks etc. Work in progress !
It seems the krb5 interfaces are so horrible it's impossible to write good error checking
code :-(.
Jeremy.
(This used to be commit 03f8c8bc07c9d8a378a34c271dcc088d17adb342)
2007-10-10 10:51:58 -05:00
Jeremy Allison
a986d45e98 r1180: New file - basis of new system keytab code.
Jeremy.
(This used to be commit 858e849af697bba67ebaa970257d93b6cff7d9e0)
2007-10-10 10:51:58 -05:00