delta/samba.git/libcli/named_pipe_auth, branch master

rpc: Remove named_pipe_auth_req_info6->need_idle_server

2023-05-16T10:53:40+00:00

Involves bumping up the version number

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15361
Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

named_pipe_auth: Bump info5 to info6

2023-02-08T00:03:39+00:00

In the next commit, we shall replace the 'authenticated' field of
named_pipe_auth_req_info.info5.session_info.session_info.info with a
more general 'user_flags' field.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

lib: Remove unused tstream_npa_socketpair()

2022-01-18T20:22:38+00:00

This was used in the pre samba-dcerpcd source3 rpc server.

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

librpc: Get transport out of tstream_npa_accept_existing_recv()

2021-12-10T14:02:30+00:00

To be used by the RPC servers in the next commit

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

librpc: Add named_pipe_auth_req_info5->transport

2021-12-10T14:02:30+00:00

This will serve as a check to make sure that in particular a SAMR
client is really root. This is for example used in get_user_info_18()
handing out a machine password.

The unix domain sockets for NCACN_NP can only be contacted by root,
the "np\" subdirectory for those sockets is root/root 0700.

Connecting to such a socket is done in two situations: First, local
real root processes connecting and smbd on behalf of SMB clients
connecting to \\pipe\name, smbd does become_root() there. Via the
named_pipe_auth_req_info4 smbd hands over the SMB session information
that the RPC server blindly trusts. The session information (i.e. the
NT token) is heavily influenced by external sources like the KDC. It
is highly unlikely that we get a system token via SMB, but who knows,
this is information not fully controlled by smbd.

This is where this additional field in named_pipe_auth_req_info5 makes
a difference: This field is set to NCACN_NP by smbd's code, not
directly controlled by the clients. Other clients directly connecting
to a socket in "np\" is root anyway (only smbd can do become_root())
and can set this field to NCALRPC.

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

named_pipe_auth: Bump info4 to info5

2021-12-10T14:02:30+00:00

We'll add a field soon

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

tstream: Add tstream_npa_existing_stream()

2021-04-01T20:36:19+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Thu Apr  1 20:36:19 UTC 2021 on sn-devel-184

tstream_npa: Allow NULL output parameters

2021-04-01T19:32:36+00:00

When reading the info4, the substructs might not be interesting for
you.

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

tstream_npa: Return named_pipe_auth_req_info4 from accept_existing

2021-04-01T19:32:36+00:00

Callers might want the full picture. We need to make
named_pipe_auth_req_info4 public for that.

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

tstream_npa: Keep "named_pipe_auth_req" around in tstream_npa_accept_existing_send()/recv()

2021-04-01T19:32:36+00:00

This will make it simpler to return a copy of the struct
named_pipe_auth_req_info4 in the next commit.

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison