samba.git/source4/lib/tls, branch master

build: Require GnuTLS if building with Active Directory

2015-02-25T00:08:12+00:00

Without GnuTLS, we don't have ldaps:// support and we are unable to
readily create RSA keys of the correct length for the BackupKey
protocol.

Signed-off-by: Garming Sam 
Reviewed-by: Andrew Bartlett

s4:lib/tls: explicitly use allow_warnings=True

2014-04-02T07:03:46+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

Revert "s4:tls_tstream: allow mode of SSL keyfile to be 0400, not only 0600"

2014-03-28T11:37:17+00:00

This reverts commit 05c1fe50556e2330e23b7efb38e653428b9bdadf.

This was discussed here:
https://bugzilla.samba.org/show_bug.cgi?id=10392#c11

This generated warnings like:
invalid permissions on file
'/memdisk/metze/W/b138235/samba/bin/ab/promoted_dc/private/tls/key.pem': has
0600 should be 0400'.

I think we need a better way. Maybe file_check_permissions()
should get allow_perms and deny_perms. And we would call it
with allow_perms = 0400 and deny_perms = 0177. And bits in none
of them are ignored.

For now we revert this and wait for a better fix.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Fri Mar 28 12:37:17 CET 2014 on sn-devel-104

s4:tls_tstream: allow mode of SSL keyfile to be 0400, not only 0600

2014-01-31T00:27:03+00:00

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10392

Signed-off-by: Michael Brown 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Fri Jan 31 01:27:03 CET 2014 on sn-devel-104

tls: Fix CID 242014 Uninitialized scalar variable

2013-11-13T08:01:55+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Andreas Schneider

tls: Fix some noblank line endings

2013-11-13T08:01:55+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Andreas Schneider

CVE-2013-4476: s4:libtls: check for safe permissions of tls private key file (key.pem)

2013-11-11T12:07:16+00:00

If the tls key is not owned by root or has not mode 0600 samba will not
start up.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Pair-Programmed-With: Stefan Metzmacher 

Signed-off-by: Björn Baumbach 
Signed-off-by: Stefan Metzmacher 
Reviewed-by: Stefan Metzmacher 

Autobuild-User(master): Karolin Seeger 
Autobuild-Date(master): Mon Nov 11 13:07:16 CET 2013 on sn-devel-104

CVE-2013-4476: s4:libtls: Create tls private key file (key.pem) with mode 0600

2013-11-11T10:14:36+00:00

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Signed-off-by: Björn Baumbach 
Reviewed-by: Stefan Metzmacher

s4-lib/tls: Try socket_send() multiple times to send partial packets

2012-07-18T09:23:55+00:00

This works around an artificial limitation in socket_wrapper that breaks
some versions of GnuTLS when we return a short write.

Instead, keep pushing until the OS will not take it.

The correct solution will be to use tls_tstream, but the client code
for this is not yet tested and needs the ldap client layer changed
to use it.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Wed Jul 18 11:23:55 CEST 2012 on sn-devel-104

s4:lib/tls - include GNUTLS headers consistently using <...>

2012-02-17T23:43:58+00:00

These are system-specific.

Reviewed-by: Jelmer

Autobuild-User: Matthias Dieter Wallnöfer 
Autobuild-Date: Sat Feb 18 00:43:58 CET 2012 on sn-devel-104