| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
| |
farm failures when winbindd connects as guest.
This one took a *lot* of tracking down :-).
Jeremy.
|
| |
|
|
|
|
|
|
|
|
| |
Log when we kill other smbd sessions like when we hit the VC == 0 case.
This one fixes BUG #5476.
Initial patch from Björn Jacke <bj@sernet.de>.
Karolin
|
| |
|
| |
|
| |
|
|
|
|
|
| |
"nss_token" from my point of view much better reflects what this flag actually
represents
|
| |
|
|
|
|
| |
This one took a bit -- I hope I covered all data paths
|
|
|
|
|
| |
Ignore optional req_flags. Use the Kerberos mechanism OID negotiated
with the client rather than hardcoding OID_KERBEROS5_OLD.
|
|
|
|
|
| |
ignoring passwords.
Jeremy.
|
|
|
|
|
|
|
|
|
| |
Broken by pstring removal in 9ed12bfc48fe7f9b1863a9dd88e881974083053c.
Jeremy, please check.
Thanks to Yannick Bergeron <yaberger@ca.ibm.com> for noting this.
Michael
|
|
|
|
|
|
| |
NTLMSSP and Kerberos session setup
Guenther
|
|
|
|
| |
Guenther
|
|
|
|
|
| |
Previously we didn't implement the 'NEGO' part of SPNEGO :-).
Jeremy.
|
|
|
|
| |
metze
|
|
|
|
|
| |
ads_verify_ticket as it's always derefed.
Jeremy.
|
|
|
|
| |
Jeremy.
|
|
|
|
|
|
| |
an extra parameter. This cleans up quite a few places
we were passing it around without needing it.
Jeremy.
|
|
|
|
|
|
| |
with Volker. Mostly making sure we have data on the incoming
packet type, not stored in the smb header.
Jeremy.
|
|
|
|
| |
Jeremy.
|
|
|
|
|
|
| |
I have a plan for dealing with the remaining..... Watch
this space.
Jeremy.
|
|
|
|
| |
Jeremy.
|
|
|
|
|
| |
statics. Part of my library cleanups.
Jeremy.
|
|
|
|
|
|
|
| |
bugs in various places whilst doing this (places that assumed
BOOL == int). I also need to fix the Samba4 pidl generation
(next checkin).
Jeremy.
|
|
|
|
|
| |
calls. Use the IPv6 varient for get_peer_addr().
Jeremy.
|
|
|
|
|
|
| |
in -1 for maxlen.
Michael
|
| |
|
|
|
|
|
|
|
|
|
| |
Jeremy, there are two remaining diffs in sesssetup.c which I don't really
know which one is right. Can you take a look?
Thanks,
Volker
|
|
|
|
| |
Jeremy
|
|
|
|
|
|
|
| |
should
have been :-).
Jeremy.
|
|
|
|
|
|
|
|
|
|
|
| |
vuid that was allocated whilst the connection is
being constructed and after the connection has been set up.
This is what Windows does and at least one client
(and HP printer) depends on this behaviour. As it
depends on the req struct not yet ported to SAMBA_3_2_0
(Volker, hint hint.... :-) I am not yet adding this
to that branch, but will investigate that tomorrow.
Jeremy.
|
|
|
|
|
|
|
|
|
| |
This itself won't help much, because send_trans2_replies_new still allocates
the big buffers, but stay tuned :-)
Also add/update my copyright on stuff I recently touched.
Volker
|
|
|
|
|
|
|
|
|
| |
As usual,
its history can be found on http://samba.org/~vlendec/sesssetup/. This very
obviously needs close review.
Volker
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
InBuffer/OutBuffer
The complete history of this patch can be found under
http://www.samba.org/~vlendec/inbuf-checkin/.
Jeremy, Jerry: If possible I would like to see this in 3.2.0. I'm only
checking into 3_2 at the moment, as it currently will slow down operations for
all non-converted (i.e. all at this moment) operations, as it will copy the
talloc'ed inbuf over the global InBuffer. It will need quite a bit of effort
to convert everything necessary for the normal operations an XP box does.
I have patches for negprot, session setup, tcon_and_X, open_and_X, close. More
to come, but I would appreciate some help here.
Volker
|
| |
|
|
|
|
| |
Jeremy.
|
|
|
|
| |
Jeremy.
|
|
|
|
|
|
| |
checkin will pull this up to srvstr_get_path. At that point we can get more
independent of the inbuf, the base_ptr in pull_string will only be used
to satisfy UCS2 alignment constraints.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
when verifying a ticket from winbindd_pam.c.
I've found during multiple, fast, automated SSH logins (such
as from a cron script) that the replay cache in MIT's krb5
lib will occasionally fail the krb5_rd_req() as a replay attack.
There seems to be a small window during which the MIT krb5
libs could reproduce identical time stamps for ctime and cusec
in the authenticator since Unix systems only give back
milli-seconds rather than the micro-seconds needed by the
authenticator. Checked against MIT 1.5.1. Have not
researched how Heimdal does it.
My thinking is that if someone can spoof the KDC and TDS
services we are pretty hopeless anyways.
|
|
|
|
| |
session_traverse.
|
|
|
|
| |
tomorrow.
|
|
|
|
| |
replace all data_blob(NULL, 0) calls.
|
|
|
|
| |
server_id' instead of a 'uint32 pid'
|
| |
|
|
|
|
|
|
|
| |
to all callers of smb_setlen (via set_message()
calls). This will allow the server to reflect back
the correct encryption context.
Jeremy.
|
|
|
|
| |
absence of native OS and Lanman strings in the session setup request)
|
|
|
|
|
|
|
|
| |
not just an NTLMSSP - grr. This complicates the re-use of
common client and server code but I think I've got it right.
Not turned on of valgrinded yet, but you can see it start
to take shape !
Jeremy.
|
|
|
|
|
| |
in sasl bind. Wonder why coverity didn't find these ?
Jeremy.
|