summaryrefslogtreecommitdiffstats
path: root/source/nsswitch/wb_common.c
Commit message (Collapse)AuthorAgeFilesLines
* Fix denial of service - memory corruption.Karolin Seeger2011-02-271-2/+20
| | | | | | | | | | | | | | | | | | | | | | CVE-2011-0719 Fix bug #7949 (DoS in Winbind and smbd with many file descriptors open). All current released versions of Samba are vulnerable to a denial of service caused by memory corruption. Range checks on file descriptors being used in the FD_SET macro were not present allowing stack corruption. This can cause the Samba code to crash or to loop attempting to select on a bad file descriptor set. A connection to a file share, or a local account is needed to exploit this problem, either authenticated or unauthenticated (guest connection). Currently we do not believe this flaw is exploitable beyond a crash or causing the code to loop, but on the advice of our security reviewers we are releasing fixes in case an exploit is discovered at a later date.
* [PATCH] Clean-up various trailing space and >80 column lines.Steven Danneman2008-11-191-1/+1
| | | | (cherry picked from commit b72335fc9771ec815f3a32b6e0d9f5fb9faebc18)
* nss_winbind: When returning NSS_UNAVAIL, squash errno to ENOENTGerald (Jerry) Carter2008-08-211-2/+18
| | | | | | | | | | | | According to the GNU libc nss guide, we should always set errno to ENOENT when returning NSS_UNAVAIL. http://www.gnu.org/software/libtool/manual/libc/NSS-Modules-Interface.html#NSS-Modules-Interface At least the MQ Series message queing service that runs on WebSphere will fail if you return any other errno in this case. (cherry picked from commit ee26664602445fa7798e2061f6bcbef0756d6528) (cherry picked from commit a46d7ffeef1807bafda15eb76ec74fcf41aae7f6)
* nsswitch: convert winbind_env_set(), winbind_on() and winbind_off() into macrosStefan Metzmacher2008-02-131-27/+0
| | | | metze
* Remove pstrings from nsswitch/ and registry/Jeremy Allison2007-11-261-22/+19
| | | | Jeremy.
* r25177: if configured using --enable-socket-wrapperStefan Metzmacher2007-10-101-1/+15
| | | | | | | allow overwritting the location of the WINBINDD_SOCKET_DIR via an environment variable metze
* r25143: rename public functions from winbind_client.hStefan Metzmacher2007-10-101-28/+32
| | | | | | | | | | | | init_request => winbindd_init_request free_response => winbindd_free_response read_reply => winbindd_read_reply write_sock => winbind_write_sock read_sock => winbind_read_sock close_sock => winbind_close_sock(void) metze
* r25130: make use only of base types which are provided by libreplaceStefan Metzmacher2007-10-101-18/+7
| | | | | | in winbind client and nss/pam stuff metze
* r24746: As the winbindd pipe is officially broken since a while: split out ↵Günther Deschner2007-10-101-4/+4
| | | | | | | | | | | | request specfic and generic flags in a winbindd_request. It turns out that the WBFLAG_RECURSE flag is the only non-PAM specific flag we put into the "flags" field of a winbind request anyway. Now each request command can use the entire space of the "flags" field. Guenther
* r24740: Fix the build.Günther Deschner2007-10-101-0/+2
| | | | Guenther
* r24734: Move nss_err_str() to a more public place.Günther Deschner2007-10-101-0/+20
| | | | Guenther
* r24629: Make read_sock return the total number of bytes read insteadMichael Adam2007-10-101-3/+3
| | | | | | | | | of the number of bytes read in the last of possibly several read calls. This was noted by Metze. Michael
* r23800: LGPL is now called GNU Lesser General Public LicenseAndrew Tridgell2007-10-101-2/+2
| | | | not GNU Library General Public License
* r23794: convert more code from LGPLv2+ to LGPLv3+Andrew Tridgell2007-10-101-5/+3
|
* r21940: Sorry Volker, I have to revert your revert in r21935.Gerald Carter2007-10-101-7/+40
| | | | | We can talk about this later if you still feel that strongly but I need to fix the build for now.
* r21935: Revert obviously not sufficiently tested code -- sorry for the pain. ↵Volker Lendecke2007-10-101-40/+7
| | | | I am afraid I was basically off the net for the day
* r21878: Fix a bug with smbd serving a windows terminal server: If winbind ↵Volker Lendecke2007-10-101-7/+40
| | | | | | | | | | | | | | decides smbd to be idle it might happen that smbd needs to do a winbind operation (for example sid2name) as non-root. This then fails to get the privileged pipe. When later on on the same connection another authentication request comes in, we try to do the CRAP auth via the non-privileged pipe. This adds a winbindd_priv_request_response() request that kills the existing winbind pipe connection if it's not privileged. Volker
* r21397: revert accidential commitHerb Lewis2007-10-101-1/+1
|
* r21396: fix wbinfo --lookup-rids commandHerb Lewis2007-10-101-1/+1
| | | | allow detection of libbiconv if all others fail - need for FreeBSD
* r21231: get rid of unused defines that cause a redefined warningHerb Lewis2007-10-101-2/+0
|
* r20269: merge -r20264:20267 from SAMBA_3_0_24Herb Lewis2007-10-101-1/+5
| | | | more no previous prototype warnings
* r19420: Remove strequal and use strcmp() instead. Meant toGerald Carter2007-10-101-11/+12
| | | | make the change before theprevious commit.
* r19419: BUG 4109: Patch from Timur Bakeyev. Fix bug causing smbd to turn offGerald Carter2007-10-101-7/+14
| | | | winbindd and fail to disable the _NO_WINBIND environment.
* r17345: Some C++ warningsVolker Lendecke2007-10-101-1/+1
|
* r15053: fix portabilities issues between 32-bit winbind clients and a 64-bit ↵Gerald Carter2007-10-101-7/+7
| | | | winbindd server
* r14868: I will not write code when changing to Daylight Savings Time.Gerald Carter2007-10-101-7/+9
| | | | | | | | | | | | | | | | I will not write code when changing to Daylight Savings Time. I will not write code when changing to Daylight Savings Time. I will not write code when changing to Daylight Savings Time. I will not write code when changing to Daylight Savings Time. I will not write code when changing to Daylight Savings Time. I will not write code when changing to Daylight Savings Time. I will not write code when changing to Daylight Savings Time. I will not write code when changing to Daylight Savings Time. ... Fix my brain dead inverted logic for turning winbindd on and off when run on a DC or when calling pdb functions from within winbindd.
* r14855: Various fixes:Gerald Carter2007-10-101-8/+7
| | | | | | | | * depreacte 'acl group control' after discussion with Jeremy and implement functionality as part of 'dos filemode' * fix winbindd on a non-member server to expand local groups * prevent code previously only used by smbd from blindly turning _NO_WINBINDD back on
* r14760: Fix #3642, ensure we don't call FD_SET on read with fd == -1.Jeremy Allison2007-10-101-0/+4
| | | | Jeremy.
* r11137: Compile with only 2 warnings (I'm still working on that code) on a gcc4Jeremy Allison2007-10-101-1/+2
| | | | | x86_64 box. Jeremy.
* r10656: BIG merge from trunk. Features not copied overGerald Carter2007-10-101-0/+5
| | | | | | | * \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck)
* r10321: Fix winbindd recursion bug found by Ingo Steuwer ↵Jeremy Allison2007-10-101-4/+10
| | | | | | <steuwer@univention.de>. Jeremy.
* r9780: Clean up a bunch of compiler warnings.James Peach2007-10-101-8/+0
|
* r7882: Looks like a large patch - but what it actually does is make SambaJeremy Allison2007-10-101-3/+3
| | | | | | safe for using our headers and linking with C++ modules. Stops us from using C++ reserved keywords in our code. Jeremy
* r7148: Fix #2736: winbind race condition with detecting idle clientsJim McDonough2007-10-101-6/+12
| | | | | | | winbind idle connection closing logic is getting invoked under high loads for clients which may already have commands in the pipe. This race condition causes clients to fail with NSS_STATUS_UNAVAIL sometimes. We now retry several times hoping (still not guaranteed, though) it will work.
* r6643: fix some build issues on IRIX;l patch from james peachGerald Carter2007-10-101-3/+0
|
* r6149: Fixes bugs #2498 and 2484.Derrell Lipman2007-10-101-2/+5
| | | | | | | | | | | | | | | | | | 1. using smbc_getxattr() et al, one may now request all access control entities in the ACL without getting all other NT attributes. 2. added the ability to exclude specified attributes from the result set provided by smbc_getxattr() et al, when requesting all attributes, all NT attributes, or all DOS attributes. 3. eliminated all compiler warnings, including when --enable-developer compiler flags are in use. removed -Wcast-qual flag from list, as that is specifically to force warnings in the case of casting away qualifiers. Note: In the process of eliminating compiler warnings, a few nasties were discovered. In the file libads/sasl.c, PRIVATE kerberos interfaces are being used; and in libsmb/clikrb5.c, both PRIAVE and DEPRECATED kerberos interfaces are being used. Someone who knows kerberos should look at these and determine if there is an alternate method of accomplishing the task.
* r698: Now wb pipe is non-blocking remember to read in non-blocking mode...Jeremy Allison2007-10-101-11/+44
| | | | Jeremy.
* r651: Patch from kawasa_r@itg.hitachi.co.jp to connect to winbindJeremy Allison2007-10-101-2/+94
| | | | | pipe in non-blocking mode to prevent process hang. Jeremy.
* Use a static string instead of malloced one in winbind_{off,on}() utilityTim Potter2003-11-041-29/+8
| | | | functions.
* Use putenv() instead of setenv() in the winbind_{off,on}() functions. SomeTim Potter2003-11-021-3/+30
| | | | platforms don't have setenv().
* Merge of spelling fix from HEAD.Tim Potter2003-10-211-1/+1
|
* Undo previous commit because it breaks the build.Tim Potter2003-10-141-2/+0
| | | | | | DEBUG() should not be called in winbind client code as it's actually dynamically linked by glibc into programs that use the nsswitch database functions.
* Add a better error message to wb_common.c when unable to connect to a pipeRichard Sharpe2003-10-131-0/+2
| | | | | socket and add a comment to winbindd.c to explain the fancy calculation of buffer offset.
* Fix a memory leak. I did not check all the calls to winbindd_request, butVolker Lendecke2003-08-011-0/+2
| | | | | | we might leak the extra_data somewhere else as well. Volker
* and so it begins....Gerald Carter2003-07-071-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * remove idmap_XX_to_XX calls from smbd. Move back to the the winbind_XXX and local_XXX calls used in 2.2 * all uid/gid allocation must involve winbindd now * move flags field around in winbindd_request struct * add WBFLAG_QUERY_ONLY option to winbindd_sid_to_[ug]id() to prevent automatic allocation for unknown SIDs * add 'winbind trusted domains only' parameter to force a domain member server to use matching users names from /etc/passwd for its domain (needed for domain member of a Samba domain) * rename 'idmap only' to 'enable rid algorithm' for better clarity (defaults to "yes") code has been tested on * domain member of native mode 2k domain * ads domain member of native mode 2k domain * domain member of NT4 domain * domain member of Samba domain * Samba PDC running winbindd with trusts Logons tested using 2k clients and smbclient as domain users and trusted users. Tested both 'winbind trusted domains only = [yes|no]' This will be a long week of changes. The next item on the list is winbindd_passdb.c & machine trust accounts not in /etc/passwd (done via winbindd_passdb)
* fix for platforms that don't have unsetenv().Gerald Carter2003-06-301-3/+7
| | | | | we now have to check the value for _NO_WINBINDD. "1" enables, and != "1" disables (use "0" by convention).
* (merge from HEAD)Andrew Bartlett2003-03-241-20/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NTLM Authentication: - Add a 'privileged' mode to Winbindd. This is achieved by means of a directory under lockdir, that the admin can change the group access for. - This mode is now required to access with 'CRAP' authentication feature. - This *will* break the current SQUID helper, so I've fixed up our ntlm_auth replacement: - Update our NTLMSSP code to cope with 'datagram' mode, where we don't get a challenge. - Use this to make our ntlm_auth utility suitable for use in current Squid 2.5 servers. - Tested - works for Win2k clients, but not Win9X at present. NTLMSSP updates are needed. - Now uses fgets(), not x_fgets() to cope with Squid environment (I think somthing to do with non-blocking stdin). - Add much more robust connection code to wb_common.c - it will not connect to a server of a different protocol version, and it will automatically try and reconnect to the 'privileged' pipe if possible. - This could help with 'privileged' idmap operations etc in future. - Add a generic HEX encode routine to util_str.c, - fix a small line of dodgy C in StrnCpy_fn() - Correctly pull our 'session key' out of the info3 from th the DC. This is used in both the auth code, and in for export over the winbind pipe to ntlm_auth. - Given the user's challenge/response and access to the privileged pipe, allow external access to the 'session key'. To be used for MSCHAPv2 integration. Andrew Bartlett
* Merge removal of unpopular winbind client environment variable.Tim Potter2002-12-201-16/+1
|
* sync'ing up for 3.0alpha20 releaseGerald Carter2002-09-251-4/+74
|
* sync 3.0 branch with headJelmer Vernooij2002-08-171-17/+0
|
generated by cgit (git 2.34.1) at 2024-09-22 16:06:01 +0000