summaryrefslogtreecommitdiffstats
path: root/source/smbd/negprot.c
Commit message (Collapse)AuthorAgeFilesLines
* more off-by-one safe_strcpy()Andrew Bartlett2003-03-061-3/+3
|
* BIG patch...Andrew Bartlett2003-01-021-3/+3
| | | | | | | | | | | | | | | | This patch makes Samba compile cleanly with -Wwrite-strings. - That is, all string literals are marked as 'const'. These strings are always read only, this just marks them as such for passing to other functions. What is most supprising is that I didn't need to change more than a few lines of code (all in 'net', which got a small cleanup of net.h and extern variables). The rest is just adding a lot of 'const'. As far as I can tell, I have not added any new warnings - apart from making all of tdbutil.c's function const (so they warn for adding that const string to struct). Andrew Bartlett
* Removed global_myworkgroup, global_myname, global_myscope. Added liberalJeremy Allison2002-11-121-4/+2
| | | | | | dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy.
* Change default of max_xmit to match W2K. Ensure NT negprot uses it.Jeremy Allison2002-10-151-1/+1
| | | | Jeremy.
* change ADS negprot to match more closely the options used by w2k. ThisAndrew Tridgell2002-09-201-5/+3
| | | | affects the principal used and the order of SPNEGO OIDs
* made the CAP_UNIX test a bit cleanerAndrew Tridgell2002-08-221-1/+5
|
* Remember to check for UNIX extensions before saying we support them.Jeremy Allison2002-08-221-1/+1
| | | | Jeremy.
* Make 'remote_machine' private to lib/substitute.c, and fix all the user to useAndrew Bartlett2002-08-111-1/+0
| | | | | | the new accessor functions. Andrew Bartlett
* This fixes a number of ADS problems, particularly with netbioslessAndrew Tridgell2002-08-051-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | setups. - split up the ads structure into logical pieces. This makes it much easier to keep things like the authentication realm and the server realm separate (they can be different). - allow ads callers to specify that no sasl bind should be performed (used by "net ads info" for example) - fix an error with handing ADS_ERROR_SYSTEM() when errno is 0 - completely rewrote the code for finding the LDAP server. Now try DNS methods first, and try all DNS servers returned from the SRV DNS query, sorted by closeness to our interfaces (using the same sort code as we use in replies from WINS servers). This allows us to cope with ADS DCs that are down, and ensures we don't pick one that is on the other side of the country unless absolutely necessary. - recognise dnsRecords as binary when displaying them - cope with the realm not being configured in smb.conf (work it out from the LDAP server) - look at the trustDirection when looking up trusted domains and don't include trusts that trust our domains but we don't trust theirs. - use LDAP to query the alternate (netbios) name for a realm, and make sure that both and long and short forms of the name are accepted by winbindd. Use the short form by default for listing users/groups. - rescan the list of trusted domains every 5 minutes in case new trust relationships are added while winbindd is running - include transient trust relationships (ie. C trusts B, B trusts A, so C trusts A) in winbindd. - don't do a gratuituous node status lookup when finding an ADS DC (we don't need it and it could fail) - remove unused sid_to_distinguished_name function - make sure we find the allternate name of our primary domain when operating with a netbiosless ADS DC (using LDAP to do the lookup) - fixed the rpc trusted domain enumeration to support up to approx 2000 trusted domains (the old limit was 3) - use the IP for the remote_machine (%m) macro when the client doesn't supply us with a name via a netbios session request (eg. port 445) - if the client uses SPNEGO then use the machine name from the SPNEGO auth packet for remote_machine (%m) macro - add new 'net ads workgroup' command to find the netbios workgroup name for a realm
* this fixes plaintext passwords with win2000Andrew Tridgell2002-07-301-2/+4
| | | | | | | | | | there were 2 bugs: 1) we were sending a null challenge when we should have sent an empty challenge 2) the password can be in unicode if unicode is negotiated. This means our client code was wrong too :(
* Update the smbd reply code a little:Andrew Bartlett2002-07-201-0/+9
| | | | | | | | | | | | I don't like the idea of muliple netprots - becouse I see potential problems with people being able to maniplate internal samba variables. This applies in particular to remote names, so don't allow muliple session requests either. Also remove a pstrcpy() from the tcon code, we really don't need it. Andrew Bartlett
* Removed some unused variables - tidy up some formating, add struct toJeremy Allison2002-05-311-190/+188
| | | | | client state to implement smb signing - this is a test at present. Jeremy.
* fixed the fallback to a BDC for ADS connectionsAndrew Tridgell2002-04-181-1/+1
|
* Renamed get_nt_error_msg() to nt_errstr().Tim Potter2002-03-171-1/+1
|
* Added "nt status support" parameter. Fix offline synchronisation.Jeremy Allison2002-02-271-12/+13
| | | | Jeremy.
* don't do an ADS init when not in ADS modeAndrew Tridgell2002-02-221-5/+4
|
* Removed version number from file header.Tim Potter2002-01-301-2/+1
| | | | Changed "SMB/Netbios" to "SMB/CIFS" in file header.
* Spelling fixes.Tim Potter2002-01-201-7/+7
|
* Same fix as went into 2.2 (I'm waiting for jerry to finish some code).Jeremy Allison2002-01-111-1/+1
| | | | Jeremy.
* First part of UNIX extensions (#ifdefed out) more to follow.Jeremy Allison2002-01-101-1/+1
| | | | Jeremy.
* Better explanation message for dmalloc.Martin Pool2002-01-091-1/+1
| | | | | | | | | | Also more insertion of parenthesis to handle struct members called 'free'. You can now get useful dmalloc output, as long as it is compatible with your C library. On RH7.1 it looks like you have to rebuild dmalloc to allow free(0) by default, because something in libcrypt does that. (sigh)
* I've decided to move the auth code around a bit more...Andrew Bartlett2002-01-051-23/+28
| | | | | | | | | | | | | | | | | | | | | | | | The auth_authsupplied_info typedef is now just a plain struct - auth_context, but it has been modified to contain the function pointers to the rest of the auth subsystem's components. (Who needs non-static functions anyway?) In working all this mess out, I fixed a number of memory leaks and moved the entire auth subsystem over to talloc(). Note that the TALLOC_CTX attached to the auth_context can be rather long-lived, it is provided for things that are intended to live as long. (The global_negprot_auth_context lasts the whole life of the smbd). I've also adjusted a few things in auth_domain.c, mainly passing the domain as a paramater to a few functions instead of looking up lp_workgroup(). I'm hopign to make this entire thing a bit more trusted domains (as PDC) freindly in the near future. Other than that, I moved a bit of the code around, hence the rather messy diff. Andrew Bartlett
* added a "use spnego" optionAndrew Tridgell2001-12-071-0/+1
| | | | | you need to set "use spnego = no" for w2k to be able to join a samba domain. Otherwise the w2k box will assume we can do kerberos as a KDC
* added a REALLY gross hack into kerberos_kinit_password so thatAndrew Tridgell2001-12-051-1/+1
| | | | | | winbindd can do a kinit this will be removed once we have code that gets a tgt and puts it in a place where cyrus-sasl can see it
* Make better use of the ads_init() function to get the kerberos relam etc.Andrew Bartlett2001-11-291-9/+13
| | | | | | | | | This allows us to use automagically obtained values in future, and the value from krb5.conf now. Also fix mem leaks etc. Andrew Bartlett
* always send an OID list until we handle raw (unwrapped) NTLMSSPAndrew Tridgell2001-11-271-6/+15
| | | | packets in session setup
* challange -> challengeTim Potter2001-11-261-3/+3
|
* fixed spnego, non-kerberos negprotAndrew Tridgell2001-11-261-2/+2
|
* added 'security=ADS'Andrew Tridgell2001-11-251-0/+7
|
* This is another rather major change to the samba authenticaionAndrew Bartlett2001-11-241-64/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | subystem. The particular aim is to modularized the interface - so that we can have arbitrary password back-ends. This code adds one such back-end, a 'winbind' module to authenticate against the winbind_auth_crap functionality. While fully-functional this code is mainly useful as a demonstration, because we don't get back the info3 as we would for direct ntdomain authentication. This commit introduced the new 'auth methods' parameter, in the spirit of the 'auth order' discussed on the lists. It is renamed because not all the methods may be consulted, even if previous methods fail - they may not have a suitable challenge for example. Also, we have a 'local' authentication method, for old-style 'unix if plaintext, sam if encrypted' authentication and a 'guest' module to handle guest logins in a single place. While this current design is not ideal, I feel that it does provide a better infrastructure than the current design, and can be built upon. The following parameters have changed: - use rhosts = This has been replaced by the 'rhosts' authentication method, and can be specified like 'auth methods = guest rhosts' - hosts equiv = This needs both this parameter and an 'auth methods' entry to be effective. (auth methods = guest hostsequiv ....) - plaintext to smbpasswd = This is replaced by specifying 'sam' rather than 'local' in the auth methods. The security = parameter is unchanged, and now provides defaults for the 'auth methods' parameter. The available auth methods are: guest rhosts hostsequiv sam (passdb direct hash access) unix (PAM, crypt() etc) local (the combination of the above, based on encryption) smbserver (old security=server) ntdomain (old security=domain) winbind (use winbind to cache DC connections) Assistance in testing, or the production of new and interesting authentication modules is always appreciated. Andrew Bartlett
* SPNEGO works perfectly well with security=domain, so don't exclude it.Andrew Bartlett2001-10-311-3/+7
|
* Spnego on the 'server' end of security=server just does not work, so set theAndrew Bartlett2001-10-301-1/+4
| | | | | | | | | flags so we just do a 'normal' session setup. Also add some parinoia code to detect when sombody attempts to do a 'normal' session setup when spnego had been negoitiated. Andrew Bartlett
* get rid of compiler warnings (casts and delete unused variables)Herb Lewis2001-10-231-4/+4
|
* - fixed link order of krb5 libsAndrew Tridgell2001-10-221-0/+1
| | | | - accept a wide range of principal names in session setup
* Ok, I know it's a language thing and it shouldn't matter.... but a kerberosJeremy Allison2001-10-211-4/+4
| | | | | name is a "principal", not a principle. English majors will complain :-). Jeremy.
* change smbd to use HOST/hostname principle form until I work out howAndrew Tridgell2001-10-211-1/+3
| | | | to use the other form in netjoin
* support both old and new kerberos OIDsAndrew Tridgell2001-10-211-1/+1
|
* better krb5 error handling (thanks andrewb!)Andrew Tridgell2001-10-201-1/+1
|
* the beginnings of kerberos support in smbd. It doesn't work yet, butAndrew Tridgell2001-10-181-3/+0
| | | | | it should give something for others to hack on and possibly find what I'm doing wrong.
* added basic NTLMSSP support in smbd. This is still quite rough, andAndrew Tridgell2001-10-171-14/+61
| | | | | | loses things like username mapping. I wanted to get this in then discuss it a bit to see how we want to split up the existing session setup code
* initial kerberos/ADS/SPNEGO support in libsmb and smbclient. ToAndrew Tridgell2001-10-111-4/+4
| | | | | | | | | | activate you need to: - install krb5 libraries - run configure - build smbclient - run kinit to get a TGT - run smbclient with the -k option to choose kerberos auth
* Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter2001-10-021-1/+0
|
* Kill of the reply.c end of the workstaion trust account mess.Andrew Bartlett2001-09-261-14/+18
| | | | | | | | | | | | | | Fix the NT errror codes, this time in line with WinXP/2k. - Return the normal error codes, expect for bad user/bad password. These map to logon failure, as a quick security hack. We follow suit. Simplfy some of the password extraction code, the auth subsytem has the intelegence to sort this stuff out, no need to do it here. Move to 'global_encrypted_passwords_negotiated' to determine the use of unencrypted hacks, replacing the current mess. Andrew Bartlett
* Fix up NT_STATUS return for session setups, Win2k objects to anything otherAndrew Bartlett2001-09-231-6/+4
| | | | | | | | | | | than NT_STATUS_LOGON_FAILURE. This also brings us (almost) back in line with their implementation. Kill off SMBENCRYPT() macro Kill off 'nt smb support' paramater - tridge okayed this one. Andrew Bartlett
* - enable MSDFS by default, there seems no reason not to have it enabledAndrew Tridgell2001-09-121-3/+1
| | | | | | | | by default in Samba 3.x - got rid of some unused parameters in Makefile.in - declare DEBUGLEVEL in debug.h rather than in each file
* converted smbd to use NTSTATUS by defaultAndrew Tridgell2001-08-271-87/+89
| | | | | | | | | | | | | | | | major changes include: - added NSTATUS type - added automatic mapping between dos and nt error codes - changed all ERROR() calls to ERROR_DOS() and many to ERROR_NT() these calls auto-translate to the client error code system - got rid of the cached error code and the writebmpx code We eventually will need to also: - get rid of BOOL, so we don't lose error info - replace all ERROR_DOS() calls with ERROR_NT() calls but that is too much for one night
* Some better debugs for our security=server code. I want to track down whyAndrew Bartlett2001-08-081-1/+3
| | | | we occasionally don't make the connection to the server.
* This is my 'Authentication Rewrite' version 1.01, mostly as submitted toAndrew Bartlett2001-08-031-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | samba-technical a few weeks ago. The idea here is to standardize the checking of user names and passwords, thereby ensuring that all authtentications pass the same standards. The interface currently implemented in as nt_status = check_password(user_info, server_info) where user_info contains (mostly) the authentication data, and server_info contains things like the user-id they got, and their resolved user name. The current ugliness with the way the structures are created will be killed the next revision, when they will be created and malloced by creator functions. This patch also includes the first implementation of NTLMv2 in HEAD, but which needs some more testing. We also add a hack to allow plaintext passwords to be compared with smbpasswd, not the system password database. Finally, this patch probably reintroduces the PAM accounts bug we had in 2.2.0, I'll fix that once this hits the tree. (I've just finished testing it on a wide variety of platforms, so I want to get this patch in).
* The big character set handling changeover!Andrew Tridgell2001-07-041-1/+1
| | | | | | | This commit gets rid of all our old codepage handling and replaces it with iconv. All internal strings in Samba are now in "unix" charset, which may be multi-byte. See internals.doc and my posting to samba-technical for a more complete explanation.
* - fix bug in reply_nt- fix bug in reply_nt1Simo Sorce2001-07-011-4/+4
|
generated by cgit (git 2.34.1) at 2025-09-25 19:27:43 +0000