summaryrefslogtreecommitdiff
path: root/auth
Commit message (Collapse)AuthorAgeFilesLines
* krb5-samba: interdomain trust uses different salt principalAlexander Bokovoy2018-09-051-4/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Salt principal for the interdomain trust is krbtgt/DOMAIN@REALM where DOMAIN is the sAMAccountName without the dollar sign ($) The salt principal for the BLA$ user object was generated wrong. dn: CN=bla.base,CN=System,DC=w4edom-l4,DC=base securityIdentifier: S-1-5-21-4053568372-2049667917-3384589010 trustDirection: 3 trustPartner: bla.base trustPosixOffset: -2147483648 trustType: 2 trustAttributes: 8 flatName: BLA dn: CN=BLA$,CN=Users,DC=w4edom-l4,DC=base userAccountControl: 2080 primaryGroupID: 513 objectSid: S-1-5-21-278041429-3399921908-1452754838-1597 accountExpires: 9223372036854775807 sAMAccountName: BLA$ sAMAccountType: 805306370 pwdLastSet: 131485652467995000 The salt stored by Windows in the package_PrimaryKerberosBlob (within supplementalCredentials) seems to be 'W4EDOM-L4.BASEkrbtgtBLA' for the above trust and Samba stores 'W4EDOM-L4.BASEBLA$'. While the salt used when building the keys from trustAuthOutgoing/trustAuthIncoming is 'W4EDOM-L4.BASEkrbtgtBLA.BASE', which we handle correct. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Alexander Bokovoy <ab@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Sep 5 03:57:22 CEST 2018 on sn-devel-144 (cherry picked from commit f3e349bebc443133fdbe4e14b148ca8db8237060) Autobuild-User(v4-8-test): Stefan Metzmacher <metze@samba.org> Autobuild-Date(v4-8-test): Wed Sep 5 18:32:05 CEST 2018 on sn-devel-144
* lib: Fix array size in audit_loggingAndreas Schneider2018-06-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ../lib/audit_logging/audit_logging.c: In function ‘json_add_timestamp’: ../lib/audit_logging/audit_logging.c:603:12: error: ‘%s’ directive output may be truncated writing up to 9 bytes into a region of size between 0 and 43 [-Werror=format-truncation=] "%s.%06ld%s", ^~ ../lib/audit_logging/audit_logging.c:606:3: tz); ~~ ../lib/audit_logging/audit_logging.c:600:2: note: ‘snprintf’ output between 8 and 70 bytes into a destination of size 50 snprintf( ^~~~~~~~~ timestamp, ~~~~~~~~~~ sizeof(timestamp), ~~~~~~~~~~~~~~~~~~ "%s.%06ld%s", ~~~~~~~~~~~~~ buffer, ~~~~~~~ tv.tv_usec, ~~~~~~~~~~~ tz); ~~~ BUG: https://bugzilla.samba.org/show_bug.cgi?id=13437 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> (cherry picked from commit 8b7c8eb3907e2123acee67949e88c26072afc81a)
* auth/ntlmssp: fix handling of GENSEC_FEATURE_LDAP_STYLE as a serverStefan Metzmacher2018-06-042-19/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes "NTLMSSP NTLM2 packet check failed due to invalid signature!" error messages, which were generated if the client only sends NTLMSSP_NEGOTIATE_SIGN without NTLMSSP_NEGOTIATE_SEAL on an LDAP connection. This fixes a regession in the combination of commits 77adac8c3cd2f7419894d18db735782c9646a202 and 3a0b835408a6efa339e8b34333906bfe3aacd6e3. We need to evaluate GENSEC_FEATURE_LDAP_STYLE at the end of the authentication (as a server, while we already do so at the beginning as a client). As a reminder I introduced GENSEC_FEATURE_LDAP_STYLE (as an internal flag) in order to let us work as a Windows using NTLMSSP for LDAP. Even if only signing is negotiated during the authentication the following PDUs will still be encrypted if NTLMSSP is used. This is exactly the same as if the client would have negotiated NTLMSSP_NEGOTIATE_SEAL. I guess it's a bug in Windows, but we have to reimplement that bug. Note this only applies to NTLMSSP and only to LDAP! Signing only works fine for LDAP with Kerberos or DCERPC and NTLMSSP. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13427 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed May 16 03:26:03 CEST 2018 on sn-devel-144 (cherry picked from commit c7a3ce95ac4ce837d8fde36578b3b1f56c3ac2fa)
* auth/ntlmssp: add ntlmssp_client:ldap_style_send_seal optionStefan Metzmacher2018-06-041-7/+17
| | | | | | | | | | | | | This will be used to similate a Windows client only using NTLMSSP_NEGOTIATE_SIGN without NTLMSSP_NEGOTIATE_SEAL on an LDAP connection, which is indicated internally by GENSEC_FEATURE_LDAP_STYLE. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13427 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 7f2bebf09cd8056b3f901dd9ff1fc9e9525f3e9d)
* auth: add auth_user_info_copy() functionStefan Metzmacher2018-03-202-0/+38
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13328 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 6ff891195855403bc485725aef8d43d4e3cabacb)
* tests/bind.py: Add a bind test with NTLMSSP with no domainGarming Sam2018-02-271-1/+25
| | | | | | | | | | | Confirmed to pass against Windows 2012 R2. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13206 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 2e49a97777ebf5bffbeadca03517b4a21bca24c0)
* define DBGC_AUTH classkkplein2018-01-0819-0/+59
| | | | | | Signed-off-by: Mourik Jan C Heupink <heupink@merit.unu.edu> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* credentials: Simplify cli_credentials_get_server_gss_creds()Andreas Schneider2018-01-031-9/+10
| | | | | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Wed Jan 3 14:37:12 CET 2018 on sn-devel-144
* CVE-2017-12150: auth/credentials: cli_credentials_authentication_requested() ↵Stefan Metzmacher2017-09-201-0/+16
| | | | | | | | should check for NTLM_CCACHE/SIGN/SEAL BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997 Signed-off-by: Stefan Metzmacher <metze@samba.org>
* cli_credentials: Apply some constVolker Lendecke2017-09-162-4/+6
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Sep 16 12:28:17 CEST 2017 on sn-devel-144
* cli_credentials: Fix a typoVolker Lendecke2017-09-071-1/+1
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Sep 7 05:56:14 CEST 2017 on sn-devel-144
* cli_credentials: Fix a return valueVolker Lendecke2017-09-051-1/+1
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Sep 5 23:06:42 CEST 2017 on sn-devel-144
* auth/common: add support for auth4_ctx->check_ntlm_password_send/recv()Stefan Metzmacher2017-08-072-0/+75
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/ntlmssp: merge ntlmssp_server_check_password() into ↵Stefan Metzmacher2017-08-071-48/+22
| | | | | | | ntlmssp_server_auth_send() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/ntlmssp: introduce ntlmssp_server_auth_send/recvStefan Metzmacher2017-08-073-66/+81
| | | | | | | We still use the sync ntlmssp_server_check_password(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/ntlmssp: prepare update_send/recv for real async processingStefan Metzmacher2017-08-071-0/+48
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* pycredentials: Add set_named_ccache()Andrew Bartlett2017-07-281-0/+45
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* pycredentials: Add get_name() for a credentials cacheAndrew Bartlett2017-07-281-0/+30
| | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* pycredentials: Allow optional "name" argument to get_named_ccache() to be ↵Andrew Bartlett2017-07-281-1/+1
| | | | | | | | missing Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* auth/gensec: finally remove unused gensec_update_ev()Stefan Metzmacher2017-07-252-37/+23
| | | | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Jul 25 17:42:55 CEST 2017 on sn-devel-144
* auth/gensec: don't allow gensec_update[_ev] to be called on a subcontextStefan Metzmacher2017-07-251-0/+7
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/gensec: make use of gensec_update_send/recv in gensec_update_ev()Stefan Metzmacher2017-07-251-20/+2
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/gensec: introduce gensec_security_ops.glue in order to avoid depending ↵Stefan Metzmacher2017-07-253-8/+7
| | | | | | | | | | on GENSEC_OID_SPNEGO being special In future we have get more backends that can negotiate other backends, we should keep all of them even if we require kerberos. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/gensec: add some useful debugging to gensec_update_send/gensec_update_doneStefan Metzmacher2017-07-251-3/+26
| | | | | | | This makes it easier to spot problems with all the abstraction and async layers. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: Use talloc_get_type_abort() in gsensec_spnego_update_out()Andreas Schneider2017-07-251-1/+3
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* auth/spnego: Use talloc_get_type_abort() in gsensec_spnego_update_in()Andreas Schneider2017-07-251-1/+3
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* auth/spnego: Rename gensec_spnego_update_sub_abort()Andreas Schneider2017-07-251-8/+8
| | | | | | | | The name is not ideal as someone might think we will panic and abort the process. So rename it to gensec_spnego_reset_sub_sec(). Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* auth/spnego: replace gensec_spnego_neg_loop() by real async processing of ↵Stefan Metzmacher2017-07-251-167/+107
| | | | | | | {start,step,finish}_fn() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: split gensec_spnego_server_negTokenTarg() into subfunctionsStefan Metzmacher2017-07-251-29/+96
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: split gensec_spnego_server_negTokenInit() into subfunctionsStefan Metzmacher2017-07-251-75/+151
| | | | | | | Check with git show -U15 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: split gensec_spnego_client_negTokenTarg() into subfunctionsStefan Metzmacher2017-07-251-35/+111
| | | | | | | Check with git show -U15 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: split gensec_spnego_client_negTokenInit() into subfunctionsStefan Metzmacher2017-07-251-71/+112
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: split gensec_spnego_create_negTokenInit() into subfunctionsStefan Metzmacher2017-07-251-72/+253
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds and uses the gensec_spnego_neg_loop() abstraction, which abstracts start, step and finish hooks. The start hook does the initial processing on the incoming paket and may start the first possible subcontext. It indicates that gensec_update() is required on the subcontext by returning NT_STATUS_MORE_PROCESSING_REQUIRED and return something useful in 'in_next'. Note that 'in_mem_ctx' is just passed as a hint, the caller should treat 'in_next' as const and don't attempt to free the content. NT_STATUS_OK indicates the finish hook should be invoked directly withing the need of gensec_update() on the subcontext. Every other error indicates an error that's returned to the caller. The step hook processes the result of a failed gensec_update() and can decide to ignore a failure or continue the negotiation by setting up the next possible subcontext. It indicates that gensec_update() is required on the subcontext by returning NT_STATUS_MORE_PROCESSING_REQUIRED and return something useful in 'in_next'. Note that 'in_mem_ctx' is just passed as a hint, the caller should treat 'in_next' as const and don't attempt to free the content. NT_STATUS_OK indicates the finish hook should be invoced directly withing the need of gensec_update() on the subcontext. Every other error indicated an error that's returned to the caller. The finish hook processes the result of a successful gensec_update() (NT_STATUS_OK or NT_STATUS_MORE_PROCESSING_REQUIRED). It forms the response pdu that will be returned from the toplevel gensec_update() together with NT_STATUS_OK or NT_STATUS_MORE_PROCESSING_REQUIRED. It may also alter the state machine to prepare receiving the next pdu from the peer. This is the start of using this abstraction for the initial client or server start with on empty input token from the peer. This abstraction will be applied to all four other spnego states, gensec_spnego_{client,server}_negToken{Init,Targ}() in the following commits. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: don't produce an output token for errors in ↵Stefan Metzmacher2017-07-251-5/+0
| | | | | | | | | gensec_spnego_server_response() gensec_spnego_server_response() is never called with a fatal error anymore. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: don't call gensec_spnego_server_response() with a fatal errorStefan Metzmacher2017-07-251-4/+11
| | | | | | | | | | | | It doesn't make sense to produce an output token without returning OK or MORE_PROCESSING_REQUIRED. Even in v4-0-test we had gensec_spnego_update_wrapper() which only passed the constructed output token to the caller with OK or MORE_PROCESSING_REQUIRED. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: generate a valid packet if gensec_spnego_client_negTokenTarg() ↵Stefan Metzmacher2017-07-251-6/+4
| | | | | | | | | | gives MORE_PROCESSING_REQUIRED If we wait for the mechListMIC from the server we should send a valid paket instead of an empty blob. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: make sure we don't return OK without sub_sec_ready in ↵Stefan Metzmacher2017-07-251-0/+6
| | | | | | | gensec_spnego_client_negTokenTarg() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: do an early return for the success case in ↵Stefan Metzmacher2017-07-251-21/+22
| | | | | | | | | gensec_spnego_client_negTokenTarg() Check with git show -w Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: use better variable names in gensec_spnego_create_negTokenInit()Stefan Metzmacher2017-07-251-10/+17
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: introduce an early return in gensec_spnego_create_negTokenInit()Stefan Metzmacher2017-07-251-4/+10
| | | | | | | This avoids print two debug message for the same failure. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: add more error checking to gensec_spnego_create_negTokenInit()Stefan Metzmacher2017-07-251-0/+13
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: rename 'nt_status' to 'status' in ↵Stefan Metzmacher2017-07-251-15/+15
| | | | | | | | | gensec_spnego_create_negTokenInit() This makes future diffs smaller. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: make the debug messages in gensec_spnego_create_negTokenInit() ↵Stefan Metzmacher2017-07-251-8/+10
| | | | | | | more useful Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: remove one more useless indentation level in ↵Stefan Metzmacher2017-07-251-33/+31
| | | | | | | | | gensec_spnego_create_negTokenInit() Check with git show -w -U20 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: introduce an early goto reply: for the server in ↵Stefan Metzmacher2017-07-251-41/+46
| | | | | | | | | | | gensec_spnego_create_negTokenInit() This removes a useless indentation level and simplifies future patches. Check with git show -w Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: move the output generation to the end of ↵Stefan Metzmacher2017-07-251-42/+44
| | | | | | | | | | | gensec_spnego_create_negTokenInit() This will simplify the diff of future patches. Check with git show -w Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: make the SPNEGO_FALLBACK continuation completely asyncStefan Metzmacher2017-07-251-12/+62
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: invert the fallback logic in gensec_spnego_client_negTokenInit()Stefan Metzmacher2017-07-251-7/+6
| | | | | | | We should do the return first, that will simplify further changes. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: split out gensec_spnego_update_pre/post() functionsStefan Metzmacher2017-07-251-81/+153
| | | | | | | | | | | For now we keep doing sync processing only, in future we'll do some preprocessing before a gensec_update_send() on the subcontext in gensec_spnego_update_pre() and handle the the result of gensec_update_recv() in gensec_spnego_update_post(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: inline gensec_spnego_parse_negTokenInit() into ↵Stefan Metzmacher2017-07-251-144/+123
| | | | | | | gensec_spnego_server_negTokenInit() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
View Lorry Controller Status