summaryrefslogtreecommitdiff
path: root/auth
Commit message (Collapse)AuthorAgeFilesLines
* auth/spnego: do basic state_position checking in gensec_spnego_update_in()Stefan Metzmacher2017-06-291-7/+19
| | | | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Jun 29 20:15:05 CEST 2017 on sn-devel-144
* auth/spnego: move gensec_spnego_update() into gensec_spnego_update_send()Stefan Metzmacher2017-06-291-37/+36
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: split out gensec_spnego_update_{client,server}() functionsStefan Metzmacher2017-06-291-200/+256
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: remove unused out_mem_ctx = spnego_state fallback in ↵Stefan Metzmacher2017-06-291-5/+0
| | | | | | | | | gensec_spnego_update() The only caller never passes NULL. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: add gensec_spnego_update_sub_abort() helper functionStefan Metzmacher2017-06-291-22/+31
| | | | | | | This helps to be consistent when destroying a unuseable sub context. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: remove useless spnego_state->sub_sec_ready checkStefan Metzmacher2017-06-291-3/+1
| | | | | | | | | The lines above make sure it's always true. Check with git show -U15 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: consitently set spnego_state->sub_sec_ready = true after ↵Stefan Metzmacher2017-06-291-10/+15
| | | | | | | gensec_update_ev() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: rename spnego_state->no_response_expected to ->sub_sec_readyStefan Metzmacher2017-06-291-10/+10
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: move gensec_spnego_update_out() behind gensec_spnego_update_in()Stefan Metzmacher2017-06-291-59/+62
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: move some more logic to gensec_spnego_update_in()Stefan Metzmacher2017-06-291-6/+10
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: move gensec_spnego_update_in() after gensec_spnego_update_send()Stefan Metzmacher2017-06-291-86/+89
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: set state_position = SPNEGO_DONE in gensec_spnego_update_cleanup()Stefan Metzmacher2017-06-291-4/+22
| | | | | | | | Every fatal error should mark the spnego_state to reject any further update() calls. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: move gensec_spnego_update_wrapper() into ↵Stefan Metzmacher2017-06-291-45/+53
| | | | | | | gensec_spnego_update_send() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: make use of data_blob_null instead of using data_blob(NULL, 0)Stefan Metzmacher2017-06-291-19/+15
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/credentials: remove unused smb_krb5_create_salt_principal()Stefan Metzmacher2017-06-271-79/+0
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/credentials: make use of smb_krb5_salt_principal() in ↵Stefan Metzmacher2017-06-271-12/+26
| | | | | | | cli_credentials_get_keytab() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/ntlmssp: enforce NTLMSSP_NEGOTIATE_NTLM2 for the NTLMv2 client caseStefan Metzmacher2017-06-261-0/+21
| | | | | | | | | | | | | | Some servers may not announce the NTLMSSP_NEGOTIATE_NTLM2 (a.k.a. NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) bit. But if we're acting as a client using NTLMv2 we need to enforce this flag, because it's not really a negotiationable in that case. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12862 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* auth/ntlmssp: make ntlmssp_server_check_password() shorterStefan Metzmacher2017-06-261-49/+53
| | | | | | | | | | We move as must as possible into ntlmssp_server_{pre,post}auth(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Mon Jun 26 13:07:30 CEST 2017 on sn-devel-144
* auth/ntlmssp: remove useless talloc_steal calls in ↵Stefan Metzmacher2017-06-261-2/+5
| | | | | | | | | | | | | ntlmssp_server_check_password() We only create a temporary auth_usersupplied_info structure and pass it down as const, lets keep the values on ntlmssp_state otherwise we may derefence stale pointers. We finally free the memory at the end of ntlmssp_server_postauth() now. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pycredentials: Add support for netr_crypt_passwordGary Lockyer2017-06-223-0/+77
| | | | | | | | | | Add code to encrypt a netr_CryptPassword structure with the current session key. This allows the making of Netr_ServerPasswordSet2 calls from python. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pycredentials: add function to return the netr_AuthenticatorGary Lockyer2017-06-221-0/+40
| | | | | | | | | | | Add method new_client_authenticator that returns data to allow a netr_Authenticator to be constructed. Allows python to make netr_LogonSamLogonWithFlags, netr_LogonGetDomainInfo and similar calls Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: add GENSEC_UPDATE_IS_NTERROR() helper macroStefan Metzmacher2017-06-171-0/+6
| | | | | | | | | This allows us to write clearer code that checks for NT_STATUS_OK and NT_STATUS_MORE_PROCESSING_REQUIRED. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: clear the update_busy_ptr in gensec_subcontext_start()Stefan Metzmacher2017-06-171-0/+1
| | | | | | | | This is required to support async subcontexts. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth pycredentials: incorrect PyArg_ParseTupleAndKeywords callGary Lockyer2017-05-251-4/+7
| | | | | | | | | | | | | The challenge parameter was being treated as a string rather than as a data blob. This was causing intermittent seg faults. Removed the server_timestamp parameter as it's not currently used. Unable to produce a test case to reliably replicate the failure. However auth_log_samlogon does flap Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth pycredentials: correct docstring of get_ntlm_response methodGary Lockyer2017-05-251-2/+2
| | | | | | | | Fix copy paste error was incorrectly named "get_ntlm_username_domain" Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth_log: Add test that execises the SamLogon python bindingsGary Lockyer2017-05-251-0/+16
| | | | | | Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: make sure there's only one pending gensec_update_send() per contextStefan Metzmacher2017-05-212-1/+34
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: improve NT_STATUS_MORE_PROCESSING_REQUIRED logic in ↵Stefan Metzmacher2017-05-211-7/+11
| | | | | | | gensec_update_*() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: avoid using a state->subreq pointerStefan Metzmacher2017-05-211-12/+7
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: remove the sync update() hook from gensec_security_opsStefan Metzmacher2017-05-212-87/+0
| | | | | | | | | Some backends still do some nested event context magic, but that mapping between async and sync is done in these backends and not in the core gensec code anymore. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/spnego: add simple gensec_spnego_update_send/recv() wrapper functionsStefan Metzmacher2017-05-211-1/+63
| | | | | | | TODO: we still need to do the internals async. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: add implement gensec_ntlmssp_update_send/recv()Stefan Metzmacher2017-05-211-24/+57
| | | | | | | | Currently only backend functions are sync functions, but that needs to change in future. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: make gensec_ntlmssp_update() staticStefan Metzmacher2017-05-212-11/+4
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: rename 'input' to 'in' in gensec_ntlmssp_update()Stefan Metzmacher2017-05-211-3/+7
| | | | | | | This matches all other gensec modules. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: remove unused variable from gensec_ntlmssp_update()Stefan Metzmacher2017-05-211-1/+0
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: avoid using NT_STATUS_NOT_OK_RETURN() in gensec_ntlmssp_update()Stefan Metzmacher2017-05-211-2/+6
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: remove mem_ctx=NULL handling from gensec_ntlmssp_update()Stefan Metzmacher2017-05-211-6/+0
| | | | | | | | The caller is expected always pass a valid context and this fallback was needed ages ago. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/spnego: make sure a fatal error or the final success make the state as ↵Stefan Metzmacher2017-05-211-0/+8
| | | | | | | | | | SPNEGO_DONE This means any further gensec_update() will fail with NT_STATUS_INVALID_PARAMETER. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/spnego: let spnego.c use the new gensec_child_* helper functionsStefan Metzmacher2017-05-211-268/+26
| | | | | | | | This means we no longer allow operations on a half finished authentication, it's activated by gensec_child_ready(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: add gensec_child_* helper functionsStefan Metzmacher2017-05-214-0/+300
| | | | | | | | They will be used to simplify the spnego backend and maybe of some use for a future negoex backend. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: reset existing context on gensec_start_mech()Stefan Metzmacher2017-05-211-0/+8
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: make gensec_start_mech() staticStefan Metzmacher2017-05-212-2/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: add some basic doxygen comments for gensec_{want,have}_feature()Stefan Metzmacher2017-05-211-0/+43
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/spnego: always announce GENSEC_FEATURE_SIGN_PKT_HEADER support.Stefan Metzmacher2017-05-211-0/+14
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: call gensec_verify_features() also after update_recv() in ↵Stefan Metzmacher2017-05-211-0/+13
| | | | | | | | | | | | gensec_update_ev() This is no a real problem until now, because the only backends with update_send()/recv() are "schannel" (which only supports AUTH_LEVEL_{INTEGRITY,PRIVACY}) and "naclrpc_as_system" (which doesn't support any protection beside using unix domain sockets). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/spnego: fix gensec_update_ev() argument order for the SPNEGO_FALLBACK caseStefan Metzmacher2017-05-211-3/+3
| | | | | | | | | | | This went unnoticed so long as we don't use -Wc++-compat and gensec_update_ev() used the sync update() hook for all NTLMSSP and Kerberos. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12788 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python3: Use "y#" instead of "s#" for binary data in PyArg_ParseTuplePetr Viktorin2017-05-191-2/+4
| | | | | | | | | | | | | | | | | The "s#" format code for PyArg_ParseTupleAndKeywords and Py_BuildValue converts a char* and size to/from Python str (with utf-8 encoding under Python 3). In some cases, we want bytes (str on Python 2, bytes on 3) instead. The code for this is "y#" in Python 3, but that is not available in 2. Introduce a PYARG_BYTES_LEN macro that expands to "s#" or "y#", and use that in: - credentials.get_ntlm_response (for input and output) - ndr_unpack argument in PIDL generated code Signed-off-by: Petr Viktorin <pviktori@redhat.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* gensec: Add a TALLOC_CTX * to gensec_register().Jeremy Allison2017-05-137-9/+11
| | | | | | | | Pass in the TALLOC_CTX * from the module init to remove another talloc_autofree_context() use. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* lib: modules: Change XXX_init interface from XXX_init(void) to ↵Jeremy Allison2017-04-228-14/+15
| | | | | | | | | | | | | | | | | | | | XXX_init(TALLOC_CTX *) Not currently used - no logic changes inside. This will make it possible to pass down a long-lived talloc context from the loading function for modules to use instead of having them internally all use talloc_autofree_context() which is a hidden global. Updated all known module interface numbers, and added a WHATSNEW. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: Ralph Böhme <slow@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Apr 22 01:17:00 CEST 2017 on sn-devel-144
* build: correct package dependenciesJan Engelhardt2017-04-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | The wscript_build files convey what header files belong to which logical package. For example, # lib/util/wscript_build: bld.SAMBA_LIBRARY('samba-util', public_headers='... data_blob.h ...' # auth/credentials/wscript_build: bld.SAMBA_LIBRARY('samba-credentials', public_headers='credentials.h', Now, credentials.h #includes <util/data_blob.h> and therefore, samba-credentials.pc must have a Requires: samba-util. Similarly for other parts. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
View Lorry Controller Status