| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
| |
decoded.length after it's been zero'ed out by data_blob_free() doesn't
give you the original length...
Andrew Bartlett
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Add a 'privileged' mode to Winbindd. This is achieved by means of a directory
under lockdir, that the admin can change the group access for.
- This mode is now required to access with 'CRAP' authentication feature.
- This *will* break the current SQUID helper, so I've fixed up our ntlm_auth
replacement:
- Update our NTLMSSP code to cope with 'datagram' mode, where we don't get a
challenge.
- Use this to make our ntlm_auth utility suitable for use in current Squid 2.5
servers.
- Tested - works for Win2k clients, but not Win9X at present. NTLMSSP updates
are needed.
- Now uses fgets(), not x_fgets() to cope with Squid environment (I think
somthing to do with non-blocking stdin).
- Add much more robust connection code to wb_common.c - it will not connect to
a server of a different protocol version, and it will automatically try and
reconnect to the 'privileged' pipe if possible.
- This could help with 'privileged' idmap operations etc in future.
- Add a generic HEX encode routine to util_str.c,
- fix a small line of dodgy C in StrnCpy_fn()
- Correctly pull our 'session key' out of the info3 from th the DC. This is
used in both the auth code, and in for export over the winbind pipe to
ntlm_auth.
- Given the user's challenge/response and access to the privileged pipe,
allow external access to the 'session key'. To be used for MSCHAPv2
integration.
Andrew Bartlett
|
| |
|
|
|
|
|
|
|
|
| |
First of all, do a char-by-char walk through both buffers until we get
to a non-ascii character, or a difference between the strings. This
prefix can be directly compared without needing to call into iconv.
This should be much faster for strings that are either all ascii, or
differ near the start.
|
|
|
|
| |
grows too much larger.
|
|
|
|
| |
requests, without needing --client-perms=yes.
|
|
|
|
|
|
|
|
|
|
| |
clobbering the region, just in case clobbering causes us to crash
immediately. (That might happen if we just shot ourselves in the
stack and strcpy was not inlined.)
Also, in DEVELOPER mode and when Valgrind is available, mark the
clobbered region as uninitialized. This is an even stronger
protection than clobbering with 0xf1.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch enables the compile-time checking of strings assable by means of
sizeof(). (Original code had the configure check reversed).
This is extended to all safe_strcpy() users, push_string and pull_string,
as well as the cli and srv derivitives. There is an attempt to cap strings
at the end of the cli buffer, and clobber_region() of the speified length
(when not -1 :-).
Becouse of the way they are declared, the 'overmalloc a string' users of
safe_strcpy() have been changed to use overmalloc_safe_strcpy() (which skips
some of the checks).
This whole ball of mud worked fine, until I pulled out my 'fix' for our
statcache. When jeremy fixes that, we should be able to get back to testing
this stuff.
This patch also includes a 'marker' of the last caller to clobber_region (ie,
the function that called pstrcpy() that called clobber_region) to assist in
debugging problems that may have smashed the stack. This is printed at
smb_panic() time. (Original idea and patch by metze).
It also removes some unsused functions, and #if 0's some others that are
unused but probably should be used in the near future.
For now, this patch gives us some confidence on one class of trivial parsing
error in our code.
Andrew Bartlett
|
|
|
|
| |
recent Valgrind relases and clashing with -DVALGRIND.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
lengths are correct. Attempts to pstrcpy into an fstring or allocated
string should fail in developer builds.
This builds on abartlet's earlier overflow probe for safe_strcpy, but
by clobbering the whole string with a nonzero value is more likely to
find overflows on the stack.
This is only used in -DDEVELOPER mode.
Reviewed by abartlet, tpot.
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
| |
it really is a developer hack...
Andrew Bartlett
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When we look see if a user is in a list, and we try to 'expand' an @group, we
should lookup the user's own list of groups, rather than looking for all the
members of a group.
I'm sure this will fix some nasty performance issues, particularly on large
domains etc. In particular, this avoids contacting winbind at all, if the
group is not a winbind group.
(This caused a deadlock on my winbind-on-PDC setup).
The groups list always includes the user's primary group, as per the
getgrouplist manpage, and my recent changes to our implementation.
Andrew Bartlett
|
|
|
|
| |
Thanks to Andrew Bartlett for spotting this.
|
|
|
|
| |
compiler could have produced complete crap for this code.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
of the SWAT code, and adding a base64 encoder.
The main purpose of this patch is to add NTLMSSP support to 'ntlm_auth', for
use with Squid. Unfortunetly the squid side doesn't quite support what we need
yet.
Changes to winbind to get us the info we need, and a couple of consequential
changes/cleanups in the rest of the code.
Andrew Bartlett
|
|
|
|
|
|
| |
instead.
Andrew Bartlett
|
|
|
|
| |
Andrew Bartlett
|
|
|
|
| |
compiler-based argument checking.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch makes Samba compile cleanly with -Wwrite-strings.
- That is, all string literals are marked as 'const'. These strings are
always read only, this just marks them as such for passing to other functions.
What is most supprising is that I didn't need to change more than a few lines of code (all
in 'net', which got a small cleanup of net.h and extern variables). The rest
is just adding a lot of 'const'.
As far as I can tell, I have not added any new warnings - apart from making all
of tdbutil.c's function const (so they warn for adding that const string to
struct).
Andrew Bartlett
|
|
|
|
| |
Jeremy.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
cache code.
This uses gencache, mimir's new caching code that stores at text-based cache
of various data.
Mimir has done a *lot* of work on this patch, and it is finally time to
get it in CVS.
Andrew Bartlett
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
authentication code.
In particular, ntlm_auth is designed to replace the winbind authentication
'helpers' currently supplied by Squid. I have added support for the current
plaintext password protocol used by Squid, and will add the real guts (NTLMSSP
support) shortly.
I'll merge this into 3.0 when I've got the interface more stable (error message
format etc) and got the important NTLMSSP support added.
Also move SWAT's URL decoding code into util_str.c, for use in both utilities.
Andrew Bartlett
|
|
|
|
|
|
| |
dashes of const. This is a rather large check-in, some things may break.
It does compile though :-).
Jeremy.
|
|
|
|
| |
Jeremy.
|
|
|
|
|
|
| |
off his laptop :-)
Andrew Bartlett
|
| |
|
|
|
|
|
|
|
| |
Tridge suggested a generic caching mechanism for Samba to avoid the
proliferation of little cache files hanging around limpet like in the
locks directory. Someone should probably implement this at some
stage.
|
|
|
|
|
|
|
|
|
|
|
|
| |
null before close
this one fixes swat not working with browsers that set more then one language.
along the way implemented language priority in web/neg_lang.c with bubble sort
also changet str_list_make to be able to use a different separator string
Simo.
|
|
|
|
| |
Andrew Bartlett
|
|
|
|
|
| |
of a string....
Jeremy.
|
|
|
|
|
|
| |
number of *bytes*. >= check was correct, the len=0 case needed changing
to len = ls + 1.
Jeremy.
|
|
|
|
| |
Jeremy.
|
|
|
|
| |
Jeremy.
|
|
|
|
|
|
| |
It complained about an overflow of 0 bytes.
Jeremy please check since you modified this last.
|
|
|
|
|
| |
they will get a const string and return a (t)alloced epanded one.
also modified passdb/* stuff to use this one.
|
| |
|
|
|
|
|
|
| |
Went through and checked all string_subs I could to ensure they're being
used correctly.
Jeremy.
|
|
|
|
|
| |
and renamed to str_list_* as it is a better name.
Elrond should be satisfied now :)
|
| |
|
|
|
|
| |
for both null terminated and buffer length terminated strings
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
| |
the hash for this scheme is *much* larger (approximately 31 bits) and
the code is written to be very fast, correctly handling multibyte
while not doing any actual multi-byte conversions in the vast majority
of cases
you can select this scheme using "mangling method = hash2", although I
may make it the default if it works out well.
|
|
|
|
| |
Changed "SMB/Netbios" to "SMB/CIFS" in file header.
|
| |
|