summaryrefslogtreecommitdiff
path: root/libcli/auth
Commit message (Collapse)AuthorAgeFilesLines
* libcli:auth: Use C99 initializers or ZERO_ARRAY instead of ZERO_STRUCTAndreas Schneider2018-12-201-9/+6
| | | | | | | | | | ZERO_STRUCT is not wrong here, it will give the same result, but better use macros with correct naming as it makes clear what happens when you read the code. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Fix uClibc build on 64bit platforms by including stdint.hBernd Kuhls2018-08-241-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes an error detected by buildroot autobuilders: http://autobuild.buildroot.net/results/573/573e2268e205e10d1352fa81122d8f225fdb4575/build-end.log /home/rclinux/rc-buildroot-test/scripts/instance-1/output/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/stdint.h:122:27: error: conflicting types for 'uintptr_t' typedef unsigned long int uintptr_t; ^ In file included from ../lib/ldb/tests/ldb_msg.c:17:0: ../third_party/cmocka/cmocka.h:126:28: note: previous declaration of 'uintptr_t' was here typedef unsigned int uintptr_t; The define __WORDSIZE is missing when cmocka.h decides how to define uintptr_t, this patch includes stdint.h when needed. Patch sent upstream: https://lists.samba.org/archive/samba-technical/2018-January/125306.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Fri Aug 24 17:22:10 CEST 2018 on sn-devel-144
* CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled ↵Günther Deschner2018-08-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | via "ntlm auth". This fixes a regression that came in via 00db3aba6cf9ebaafdf39ee2f9c7ba5ec2281ea0. Found by Vivek Das <vdas@redhat.com> (Red Hat QE). In order to demonstrate simply run: smbclient //server/share -U user%password -mNT1 -c quit \ --option="client ntlmv2 auth"=no \ --option="client use spnego"=no against a server that uses "ntlm auth = ntlmv2-only" (our default setting). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360 CVE-2018-1139: Weak authentication protocol allowed. Guenther Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2018-1139 libcli/auth: fix debug messages in hash_password_check()Günther Deschner2018-08-141-4/+4
| | | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360 CVE-2018-1139: Weak authentication protocol allowed. Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2018-1139 libcli/auth: Add initial tests for ntlm_password_check()Andrew Bartlett2018-08-142-0/+426
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dbwrap: Remove calls to loadparmVolker Lendecke2018-04-242-2/+0
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli: Call dbwrap_local_open with the correct tdb flagsVolker Lendecke2018-04-241-2/+5
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli: Call dbwrap_local_open with the correct hash sizeVolker Lendecke2018-04-241-6/+13
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli: Call dbwrap_local_open with the correct tdb_flagsVolker Lendecke2018-04-241-2/+3
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli: Call dbwrap_local_open with the correct hash sizeVolker Lendecke2018-04-241-4/+13
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* lib: Make g_lock_unlock use TDB_DATAVolker Lendecke2018-02-081-2/+3
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* lib: Make g_lock_lock_send use TDB_DATAVolker Lendecke2018-02-081-2/+2
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* netlogon_creds_cli: Pass "capabilities" up from creds_cli_checkVolker Lendecke2017-09-252-5/+15
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Protect netlogon_creds_cli_auth by _lckVolker Lendecke2017-09-251-60/+2
| | | | | | | | | This widens the lock range to cover the check for established credentials. Before this patch it could happen that more than one winbind finds no credentials and does the auth3. This can pile up. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Protect netlogon_creds_cli_check by _lckVolker Lendecke2017-09-251-63/+38
| | | | | | | netlogon_creds_cli_lck provides the locking around the operation Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Add netlogon_creds_cli_delete_lckVolker Lendecke2017-09-252-0/+15
| | | | | | | | Like netlogon_creds_cli_delete, protected by netlogon_creds_cli_lck instead of netlogon_creds_cli_lock. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Add netlogon_creds_cli_lckVolker Lendecke2017-09-252-0/+163
| | | | | | | | | | This adds an external locking scheme to protect our netlogon_creds_CredentialState. This is needed because the routines exposed by netlogon_creds_cli.h need a more flexible locking to set up our credentials in a properly protected way. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* rpc_client3: Avoid "cli_credentials" in cli_rpc_pipe_open_schannel_with_credsVolker Lendecke2017-09-251-0/+1
| | | | | | | | | This provides cleaner data dependencies. A netlogon_creds_ctx contains everything required to open an schannel, there is no good reason to require cli_credentials here. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Create cli_credentials from netlogon creds ctxVolker Lendecke2017-09-252-0/+36
| | | | | | | | A netlogon_creds_cli_context holds all information required to do an schannel bind. Used in the next commit. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Factor out netlogon_creds_cli_delete_internalVolker Lendecke2017-09-251-7/+10
| | | | | | | | In a future commit we'll need a version that does not check for context->db.locked_state Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Factor out netlogon_creds_cli_store_internalVolker Lendecke2017-09-251-16/+26
| | | | | | | | In a future commit we'll need a version that does not check for context->db.locked_state Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Print netlogon_creds_CredentialStateVolker Lendecke2017-09-251-0/+8
| | | | | | | Add some debugging for the tdb records Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Simplify netlogon_creds_cli_getVolker Lendecke2017-09-251-70/+11
| | | | | | | | netlogon_creds_cli_get_internal almost does everything needed, only the invalidating for credential chain use is missing. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Rename netlogon_creds_cli_lock_fetch->get_internalVolker Lendecke2017-09-251-4/+4
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Transfer a commentVolker Lendecke2017-09-251-0/+32
| | | | | | | This part of from netlogon_creds_cli_get will go Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Remove tevent_req handling from ↵Volker Lendecke2017-09-251-21/+26
| | | | | | | | | | netlogon_creds_cli_lock_fetch Disentangle concerns, make netlogon_creds_cli_lock_fetch usable for other callers Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Remove unused codeVolker Lendecke2017-09-252-51/+0
| | | | | | | According to metze this was meant for test code that never materialized Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Simplify netlogon_creds_cli_deleteVolker Lendecke2017-09-252-15/+16
| | | | | | | Don't implicitly TALLOC_FREE(creds) in the pure delete routine Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Simplify netlogon_creds_cli_storeVolker Lendecke2017-09-252-17/+18
| | | | | | | | | Don't implicitly TALLOC_FREE(creds) in the pure store routine. This mixes up responsibilities, and there's not enough callers to justify the TALLOC_FREE to be centralized. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Simplify netlogon_creds_cli_context_globalVolker Lendecke2017-09-251-7/+0
| | | | | | | netlogon_creds_cli_open_global_db() already contains the NULL check. Use that. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Fix talloc_stackframe leaksVolker Lendecke2017-09-251-0/+2
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli: Apply some constVolker Lendecke2017-09-162-4/+6
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Use data_blob_cmp in netlogon_creds_cli_validateVolker Lendecke2017-09-161-11/+3
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Simplify netlogon_creds_cli_context_globalVolker Lendecke2017-09-161-3/+3
| | | | | | | (require_sign_or_seal == false) looks odd :-) Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Simplify netlogon_creds_cli_context_commonVolker Lendecke2017-09-161-11/+2
| | | | | | | | IMHO a full talloc_stackframe is overkill for the one allocation that is left here. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Simplify netlogon_creds_cli_context_commonVolker Lendecke2017-09-161-11/+8
| | | | | | | printf knows to only print part of a string. No need to talloc_strdup. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: A netlogon_creds_cli_context needs a msg_ctxVolker Lendecke2017-09-161-7/+9
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Remove an obsolete commentVolker Lendecke2017-09-161-4/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Avoid a static const structVolker Lendecke2017-09-161-4/+3
| | | | | | | | | | | | | Same number of .text bytes, but simpler code. Yes, this is {{0}} instead of {0}, which I always promote. I've just read a comment on stackoverflow (which I've unfortunately just closed the tab for :-() that {{0}} might actually be the correct way to init a struct to zero if the first struct element is again a struct. I'm lost. 25 years of C coding and I have no clue of the language :-( Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Pass "server_dns_domain" through ↵Volker Lendecke2017-09-162-0/+2
| | | | | | | netlogon_creds_cli_context_global Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon_creds_cli: Add "dns_domain" to netlogon_creds_cli_contextVolker Lendecke2017-09-161-0/+11
| | | | | | | Used later for creating schannel cli_credentials Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* lib: Fix an error path memleakVolker Lendecke2017-07-311-1/+3
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Jul 31 13:49:02 CEST 2017 on sn-devel-144
* lib: Fix a typoVolker Lendecke2017-07-311-1/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* lib: auth: Store the netlogon_creds_cli_global_db pointer on the NULL context.Jeremy Allison2017-07-271-2/+2
| | | | | | | | | | | | | | | | Now we shutdown correctly it doesn't need the talloc_autofree_context(). Last use of talloc_autofree_context() ourside the talloc test code ! Please don't add it ever again :-). BUG: https://bugzilla.samba.org/show_bug.cgi?id=12932 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Jul 27 01:34:12 CEST 2017 on sn-devel-144
* lib: auth: Add a shutdown function for netlogon_creds_cli_global_db.Jeremy Allison2017-07-262-0/+6
| | | | | | | | | Will allow us to move off the talloc_autofree_context(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=12932 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* lib: cli: fname is a local variable already freed in the function scope, ↵Jeremy Allison2017-07-261-1/+1
| | | | | | | | | doesn't need to be on talloc_autofree_context() BUG: https://bugzilla.samba.org/show_bug.cgi?id=12932 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* param: Add new "disabled" value to "ntlm auth" to disable NTLM totallyAndrew Bartlett2017-07-042-1/+7
| | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923 Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* auth: Allow NTLMv1 if MSV1_0_ALLOW_MSVCHAPV2 is given and re-factor 'ntlm ↵Andrew Bartlett2017-07-042-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | auth =' The ntlm auth parameter is expanded to more clearly describe the role of each option, and to allow the new mode that permits MSCHAPv2 (as declared by the client over the NETLOGON protocol) while still banning NTLMv1. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12252 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Based on a patch by Mantas Mikulėnas <mantas@utenos-kolegija.lt>: Commit 0b500d413c5b ("Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth") added the --allow-mschapv2 option, but didn't implement checking for it server-side. This implements such checking. Additionally, Samba now disables NTLMv1 authentication by default for security reasons. To avoid having to re-enable it globally, 'ntlm auth' becomes an enum and a new setting is added to allow only MSCHAPv2. Signed-off-by: Mantas Mikulėnas <mantas@utenos-kolegija.lt> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* libcli/auth: pass the cleartext blob to netlogon_creds_cli_ServerPasswordSet*()Stefan Metzmacher2017-06-272-11/+13
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* libcli/auth: add const to set_pw_in_buffer()Stefan Metzmacher2017-06-272-2/+2
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
View Lorry Controller Status