mirror of
https://github.com/samba-team/samba.git
synced 2024-12-31 17:18:04 +03:00
df64302213
I wanted to add a simple 'workstation' argument to the DCERPC
authenticated binding calls, but this patch kind of grew from there.
With SCHANNEL, the 'workstation' name (the netbios name of the client)
matters, as this is what ties the session between the NETLOGON ops and
the SCHANNEL bind. This changes a lot of files, and these will again
be changed when jelmer does the credentials work.
I also correct some schannel IDL to distinguish between workstation
names and account names. The distinction matters for domain trust
accounts.
Issues in handling this (issues with lifetime of talloc pointers)
caused me to change the 'creds_CredentialsState' and 'struct
dcerpc_binding' pointers to always be talloc()ed pointers.
In the schannel DB, we now store both the domain and computername, and
query on both. This should ensure we fault correctly when the domain
is specified incorrectly in the SCHANNEL bind.
In the RPC-SCHANNEL test, I finally fixed a bug that vl pointed out,
where the comment claimed we re-used a connection, but in fact we made
a new connection.
This was achived by breaking apart some of the
dcerpc_secondary_connection() logic.
The addition of workstation handling was also propogated to NTLMSSP
and GENSEC, for completeness.
The RPC-SAMSYNC test has been cleaned up a little, using a loop over
usernames/passwords rather than manually expanded tests. This will be
expanded further (the code in #if 0 in this patch) to use a newly
created user account for testing.
In making this test pass test_rpc.sh, I found a bug in the RPC-ECHO
server, caused by the removal of [ref] and the assoicated pointer from
the IDL. This has been re-added, until the underlying pidl issues are
solved.
(This used to be commit 824289dcc2)
48 lines
1.6 KiB
C
48 lines
1.6 KiB
C
/*
|
|
Unix SMB/CIFS implementation.
|
|
|
|
code to manipulate domain credentials
|
|
|
|
Copyright (C) Andrew Tridgell 2004
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 2 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program; if not, write to the Free Software
|
|
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
*/
|
|
|
|
#include "librpc/gen_ndr/ndr_netlogon.h"
|
|
|
|
struct creds_CredentialState {
|
|
uint32_t negotiate_flags;
|
|
uint8_t session_key[16];
|
|
uint32_t sequence;
|
|
struct netr_Credential seed;
|
|
struct netr_Credential client;
|
|
struct netr_Credential server;
|
|
uint16_t secure_channel_type;
|
|
const char *domain;
|
|
const char *computer_name;
|
|
const char *account_name;
|
|
uint32_t rid;
|
|
};
|
|
|
|
/* for the timebeing, use the same neg flags as Samba3. */
|
|
/* The 7 here seems to be required to get Win2k not to downgrade us
|
|
to NT4. Actually, anything other than 1ff would seem to do... */
|
|
#define NETLOGON_NEG_AUTH2_FLAGS 0x000701ff
|
|
|
|
/* these are the flags that ADS clients use */
|
|
#define NETLOGON_NEG_AUTH2_ADS_FLAGS (0x200fbffb | NETLOGON_NEG_ARCFOUR | NETLOGON_NEG_128BIT | NETLOGON_NEG_SCHANNEL)
|
|
|
|
|