summaryrefslogtreecommitdiffstats
path: root/source3/libads
Commit message (Collapse)AuthorAgeFilesLines
* r18015: Try and detect network failures immediately inJeremy Allison2007-10-101-0/+20
| | | | | | | | | | | set_dc_type_and_flags(). Fix problem when DC is down in ads_connect, where we fall back to NetBIOS and try exactly the same IP addresses we just put in the negative connection cache.... We can never succeed, so don't try lookups a second time. Jeremy. (This used to be commit 2d28f3e94a1a87bc9e9ed6630ef48b1ce17022e8)
* r18010: Ensure we don't timeout twice to the sameJeremy Allison2007-10-102-1/+6
| | | | | | | | server in winbindd when it's down and listed in the -ve connection cache. Fix memory leak, reduce timeout for cldap calls - minimum 3 secs. Jeremy. (This used to be commit 10b32cb6de234fa17fdd691bb294864d4d40f782)
* r18006: Actually a smaller change than it looks. LeverageJeremy Allison2007-10-102-10/+86
| | | | | | | | | | the get_dc_list code to get the _kerberos. names for site support. This way we don't depend on one KDC to do ticket refresh. Even though we know it's up when we add it, it may go down when we're trying to refresh. Jeremy. (This used to be commit 77fe2a3d7418012a8dbfb6aaeb2a8dd57c6e1a5d)
* r18004: If you're writing out a krb5.conf, at leastJeremy Allison2007-10-101-2/+2
| | | | | | get the syntax right... :-). Jeremy. (This used to be commit ecca467e463ef5c9acd48ee0a5f446755bd2f306)
* r18003: Creating a directory and getting EEXIST isn't an error.Jeremy Allison2007-10-101-1/+1
| | | | | Jeremy. (This used to be commit 515f86167bd9ec64170218f2ea4fb20d12a28365)
* r18002: Improved debug.Jeremy Allison2007-10-101-1/+2
| | | | | Jeremy. (This used to be commit 5f84c8c815ff0c941ef06d682dcc4be52e8867d2)
* r18001: Proper error reporting on write/close fail.Jeremy Allison2007-10-101-1/+7
| | | | | Jeremy. (This used to be commit ba311ac4eac060c12cafeeb8e458f45c2927aabf)
* r18000: Get nelem/size args right for x_fwrite.Jeremy Allison2007-10-101-1/+1
| | | | | Jeremy. (This used to be commit f1c5409b9fa201c6d726857b02515167b0d7cef1)
* r17999: No need to prevent others from reading. Use 755 insteadJeremy Allison2007-10-101-2/+2
| | | | | | | of 700, and 644 instead of 600. Reading might help debugging. Jeremy. (This used to be commit 99f100cfecb53e00d17f7426251a3d4022db791a)
* r17997: Ensure lockdir exists for winbindd. Store tmpJeremy Allison2007-10-101-1/+1
| | | | | | krb5.conf files under lockdir, not privatedir. Jeremy. (This used to be commit c59eff3e53f5bfae3a9fb136e8566628339863ad)
* r17996: Don't talloc free the memory then reference it. Doh !Jeremy Allison2007-10-101-3/+4
| | | | | Jeremy. (This used to be commit 188eb9794df265e8a55602d46b6bb4bd7daffa7f)
* r17995: Ensure we create the domain-specific krb5 files in aJeremy Allison2007-10-101-8/+22
| | | | | | separate directory. Jeremy. (This used to be commit 541594153b3a29a4ca30f1897264f2cc715b0698)
* r17994: Add debugs that showed me why my site code wasn'tJeremy Allison2007-10-102-2/+10
| | | | | | | working right. Don't update the server site when we have a client one... Jeremy. (This used to be commit 7acbcf9a6c71f8e7f9167880488613c930cef4d9)
* r17972: revert accidental commit to ads_verify_ticket()Gerald Carter2007-10-101-7/+5
| | | | (This used to be commit 95f6b22e5179e1fb738c07112de2e06024fc9a83)
* r17971: Disable storing SIDs in the S-1-22-1 and S-1-22-2 domain to the ↵Gerald Carter2007-10-101-5/+7
| | | | | | SID<->uid/gid cache. FIxes a bug in token creation (This used to be commit fa05708789654a8a34cb4a4068514a0b3d950653)
* r17970: Add missing include-guards around ads.h and ads_cldap.h.Jeremy Allison2007-10-101-9/+0
| | | | | | | Remove all reference to "Default-First-Site-Name" and treat it like any other site. Jeremy. (This used to be commit 5ae3564d6844f44a6943b2028917bd457371af1e)
* r17946: Fix couple of typos...Jeremy Allison2007-10-102-3/+3
| | | | | Jeremy. (This used to be commit 638d53e2ad524dfe4666b79d36997dea8a44c8cd)
* r17945: Store the server and client sitenames in the ADSJeremy Allison2007-10-104-4/+53
| | | | | | | struct so we can see when they match - only create the ugly krb5 hack when they do. Jeremy. (This used to be commit 9be4ecf24b6b5dacf4c2891bddb072fa7543753f)
* r17944: Handle locking madness.Jeremy Allison2007-10-101-11/+32
| | | | | Jeremy. (This used to be commit 408267a2d725a0596be37b019fe4513502b2c0ec)
* r17943: The horror, the horror. Add KDC site support byJeremy Allison2007-10-103-2/+59
| | | | | | | | writing out a custom krb5.conf file containing the KDC I need. This may suck.... Needs some testing :-). Jeremy. (This used to be commit d500e1f96d92dfcc6292c448d1b399195f762d89)
* r17942: Jerry is right - when no site support is enabledJeremy Allison2007-10-101-6/+11
| | | | | | | the client sitename is "Default-First-Site-Name". Treat this as a blank site (no site configured). Jeremy. (This used to be commit 5c46381bd7dd1b3f11f427d111ded0b76fc1bec8)
* r17937: Move the saf_ cache into the tcp ad connection code.Jeremy Allison2007-10-101-5/+5
| | | | | | | Cause winbindd to set site support before doing the generic AD server lookup. Jeremy. (This used to be commit a9833941715472ece747bce69ef53ba8ad98d7a5)
* r17929: Ok, I think I finally figured out where to putJeremy Allison2007-10-101-1/+20
| | | | | | | | the code to redo the CLDAP query to restrict DC DNS lookups to the sitename. Jerry, please check to stop me going insane :-). Jeremy. (This used to be commit 8d22cc111579c57aec65be8884b41564b79b133a)
* r17928: Implement the basic store for CLDAP sitenameJeremy Allison2007-10-103-7/+99
| | | | | | | | | | | | | | | | | support when looking up DC's. On every CLDAP call store the returned client sitename (if present, delete store if not) in gencache with infinate timeout. On AD DNS DC lookup, try looking for sitename DC's first, only try generic if sitename DNS lookup failed. I still haven't figured out yet how to ensure we fetch the sitename with a CLDAP query before doing the generic DC list lookup. This code is difficult to understand. I'll do some experiments and backtraces tomorrow to try and work out where to force a CLDAP site query first. Jeremy. (This used to be commit ab3f0c5b1e9c5fd192c5514cbe9451b938f9cd5d)
* r17910: remove incorrect comment (code has already been fixed)Gerald Carter2007-10-101-3/+0
| | | | (This used to be commit 9810d74e171542408eea3ec22a0ebb57a9e1e87e)
* r17901: Stanford checker fix. cookie here can't be null or we'dJeremy Allison2007-10-101-1/+1
| | | | | | deref null. Make interface explicit. Jeremy. (This used to be commit 4e99606ec16b978a76219b5362a23a7b06ee5468)
* r17899: Fix Stanford checker bug - possible null deref.Jeremy Allison2007-10-101-2/+5
| | | | | Jeremy. (This used to be commit e77949175144cbe4cfa58788d13acc704eebc251)
* r17881: Another microstep towards better error reporting: Make ↵Volker Lendecke2007-10-101-8/+12
| | | | | | | | | | | | | | | | | get_sorted_dc_list return NTSTATUS. If we want to differentiate different name resolution problems we might want to introduce yet another error class for Samba-internal errors. Things like no route to host to the WINS server, a DNS server explicitly said host not found etc might be worth passing up. Because we can not stash everything into the existing NT_STATUS codes, what about a Samba-specific error class like NT_STATUS_DOS and NT_STATUS_LDAP? Volker (This used to be commit 60a166f0347170dff38554bed46193ce1226c8c1)
* r17854: Steal the LDAP in NTSTATUS trick from Samba4Volker Lendecke2007-10-101-4/+1
| | | | | | | Thanks to Michael Adam <ma@sernet.de> Volker (This used to be commit 91878f9b6fbe5187fb7d0464008ea0abe7f11a73)
* r17798: Beginnings of a standalone libaddns library released underGerald Carter2007-10-101-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | the LGPL. Original code by Krishna Ganugapati <krishnag@centeris.com>. Additional work by me. It's still got some warts, but non-secure updates do currently work. There are at least four things left to really clean up. 1. Change the memory management to use talloc() rather than malloc() and cleanup the leaks. 2. Fix the error code reporting (see initial changes to dnserr.h) 3. Fix the secure updates 4. Define a public interface in addns.h 5. Move the code in libads/dns.c into the libaddns/ directory (and under the LGPL). A few notes: * Enable the new code by compiling with --with-dnsupdate * Also adds the command 'net ads dns register' * Requires -luuid (included in the e2fsprogs-devel package). * Has only been tested on Linux platforms so there may be portability issues. (This used to be commit 36f04674aeefd93c5a0408b8967dcd48b86fdbc1)
* r17795: Finally track down the "ads_connect: Interrupted system call"Gerald Carter2007-10-101-2/+33
| | | | | | | | error. Fix our DNS SRV lookup code to deal with multi-homed hosts. We were noly remembering one IP address per host from the Additional records section in the SRV response which could have been an unreachable address. (This used to be commit 899179d2b9fba13cc6f4dab6efc3c22e44e062bc)
* r17677: There is no need for a 2nd krb5_to_nt_status function, is there?Günther Deschner2007-10-102-1/+2
| | | | | | | Michael Adam/Volker, please check. Guenther (This used to be commit d0feb85781f69325ee70aff98370cfac037c4cc2)
* r17626: Some C++ WarningsVolker Lendecke2007-10-102-2/+4
| | | | (This used to be commit 09e7c010f03ac3c621f7a7fad44685d278c1481a)
* r17606: Introduce krb5_to_ntstatus.Volker Lendecke2007-10-101-18/+17
| | | | | | | Thanks to Michael Adam <ma@sernet.de> Volker (This used to be commit 6e641c90b8f52a822a83701cdf305c60416d7f0c)
* r17589: Check in the really uncontroversial patch from MichaelVolker Lendecke2007-10-101-0/+5
| | | | (This used to be commit de76217cfb9d20431189e838999a634e4de067a9)
* r17551: Move some DEBUG to d_printf in interactive functions and returnVolker Lendecke2007-10-101-1/+1
| | | | | | | | | NO_LOGON_SERVERS if no domain controller was found. Thanks to Michael Adam <ma@sernet.de>. Volker (This used to be commit d44599de3a61707a32851f37ddfb2425949622f8)
* r17536: Add a debug message citing the reason why an LDAP connection failed, ↵Volker Lendecke2007-10-101-0/+5
| | | | | | | | | inspired by Christian M Ambach <CAMBACH1@de.ibm.com>. Volker (This used to be commit cf7c83d462dc766fa6f48728d0a4e8d534cc2bd4)
* r17535: Reformatting, this had many tabs instead of ^$Volker Lendecke2007-10-101-6/+6
| | | | (This used to be commit 0f483cf66c203d8590998b83cbeeb236ba06ab63)
* r17345: Some C++ warningsVolker Lendecke2007-10-101-1/+2
| | | | (This used to be commit 21c8fa2fc8bfd35d203b089ff61efc7c292b4dc0)
* r17242: BUG 3957: make sure to zero memory in the SRV hostlist in case there ↵Gerald Carter2007-10-101-1/+1
| | | | | | is not an A record for each SRV name (This used to be commit 42608b8bb974e1bd88cf2105bf1774622c045458)
* r17239: BUG 3959: patch from William Charles <william@charles.name> to fix a ↵Gerald Carter2007-10-101-7/+1
| | | | | | segv in the DNS SRV lookups dur to calling rand() (This used to be commit be12519fd8a7ccd8400fd298e05921eda56b4e16)
* r17146: Starting to cleanout my local tree someGerald Carter2007-10-101-16/+199
| | | | | | * add code to lookup NS records (in prep for later coe that does DNS updates as part of the net ads join) (This used to be commit 36d4970646638a2719ebb05a091c951183535987)
* r17089: Fix a possible null dereference and some memleaks.Volker Lendecke2007-10-102-0/+8
| | | | | | | | | Jerry, please check. Thanks, Volker (This used to be commit b87c4952216b6302b0e1f22689b5a36b6aa65349)
* r17003: Fix coverity #303 - possible null deref. Jerry pleaseJeremy Allison2007-10-101-0/+1
| | | | | | check this is your new code. Jeremy. (This used to be commit 144067783d1c56b574911532f074bdaa7cea9c6e)
* r16957: fix cut-n-paste error. The check for 'if (\!salt)' make no sense ↵Gerald Carter2007-10-101-5/+0
| | | | | | when fetching the DES salting principal (This used to be commit baf554c7934cbd591635196453c19d402358e073)
* r16955: Fix an uninitialized var -- Jerry, please check.Volker Lendecke2007-10-101-2/+2
| | | | (This used to be commit bf701f51294dacd0d4077b5304772c40119460eb)
* r16952: New derive DES salt code and Krb5 keytab generationGerald Carter2007-10-105-734/+510
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
* r16945: Sync trunk -> 3.0 for 3.0.24 code. Still needJeremy Allison2007-10-103-6/+9
| | | | | | | | to do the upper layer directories but this is what everyone is waiting for.... Jeremy. (This used to be commit 9dafb7f48ca3e7af956b0a7d1720c2546fc4cfb8)
* r16862: Reverting accidential changes in ads_try_connect() from previous commit.Günther Deschner2007-10-101-2/+2
| | | | | Guenther (This used to be commit 6257f9af93f2391940b2c60fe39c0bf106de15dd)
* r16861: Fixing crash bug when passing no domain/realm name to the CLDAP request.Günther Deschner2007-10-102-7/+10
| | | | | Guenther (This used to be commit 863aeb621afa7dcec1bfef8e503ef8ed363e3742)
generated by cgit (git 2.34.1) at 2024-09-20 18:35:17 +0000