The branch, master has been updated via 6c89bb8 waf Remove debugging hacks left in the top level build via 45b16de s4-waf Remove source4 build system. via 7e76367 s4-auth Fix setting of bad_password_count in auth_convert_user_info_dc_sambaseinfo() via ce461a7 s4-selftest Fix valgrind and gdb options for top level build via a2ce53c s4-auth Rework auth subsystem to remove struct auth_serversupplied_info via f1c0e95 s4-auth Add auth.idl to encode auth subsystem structures in IDL from a674a56 Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 6c89bb8d85c0f7cfe781dbcb7db2d23fba12afce Author: Andrew Bartlett <abart...@samba.org> Date: Wed Feb 9 10:59:18 2011 +1100 waf Remove debugging hacks left in the top level build Autobuild-User: Andrew Bartlett <abart...@samba.org> Autobuild-Date: Wed Feb 9 01:55:15 CET 2011 on sn-devel-104 commit 45b16de1fcc6a76bd4d9dcdd41616942065f7fc4 Author: Andrew Bartlett <abart...@samba.org> Date: Wed Feb 9 10:50:57 2011 +1100 s4-waf Remove source4 build system. The top level build is the official build system now. Andrew Bartlett commit 7e76367e59452bc8f516572eb05ed614b776087d Author: Andrew Bartlett <abart...@samba.org> Date: Wed Feb 9 10:46:21 2011 +1100 s4-auth Fix setting of bad_password_count in auth_convert_user_info_dc_sambaseinfo() Discovered during the convertion to auth_user_info. Andrew Bartlett commit ce461a7857cfc1658b31f43ebfda0cccf73fb5fb Author: Andrew Bartlett <abart...@samba.org> Date: Tue Feb 8 20:38:05 2011 +1100 s4-selftest Fix valgrind and gdb options for top level build Andrew Bartlett commit a2ce53c1f5301ffcf990dbab837c328ea22739b6 Author: Andrew Bartlett <abart...@samba.org> Date: Tue Feb 8 16:53:13 2011 +1100 s4-auth Rework auth subsystem to remove struct auth_serversupplied_info This changes auth_serversupplied_info into the IDL-defined struct auth_user_info_dc. This then in turn contains a struct auth_user_info, which is the only part of the structure that is mainted into the struct session_info. The idea here is to avoid keeping the incomplete results of the authentication (such as session keys, lists of SID memberships etc) in a namespace where it may be confused for the finalised results. Andrew Barltett commit f1c0e9532d8e3fb0d8942e4d4e1a122429266b16 Author: Andrew Bartlett <abart...@samba.org> Date: Tue Feb 8 16:39:34 2011 +1100 s4-auth Add auth.idl to encode auth subsystem structures in IDL This is not only a useful way to encode stuff, it also allows python to handle the structures, and natrually allows them to be NDR encoded. Andrew Bartlett ----------------------------------------------------------------------- Summary of changes: librpc/idl/auth.idl | 70 ++++++ librpc/idl/wscript_build | 2 +- source4/Makefile | 75 ------ source4/VERSION | 117 --------- source4/auth/auth.h | 80 ++----- source4/auth/auth_sam_reply.c | 220 +++++++++--------- source4/auth/gensec/gensec.c | 8 +- source4/auth/gensec/gensec.h | 2 +- source4/auth/gensec/gensec_gssapi.c | 39 +++- source4/auth/gensec/gensec_krb5.c | 14 +- source4/auth/kerberos/kerberos.h | 4 +- source4/auth/kerberos/kerberos_pac.c | 103 +++++---- source4/auth/ntlm/auth.c | 50 ++-- source4/auth/ntlm/auth_anonymous.c | 4 +- source4/auth/ntlm/auth_developer.c | 82 ++++--- source4/auth/ntlm/auth_sam.c | 20 +- source4/auth/ntlm/auth_server.c | 70 +++--- source4/auth/ntlm/auth_simple.c | 8 +- source4/auth/ntlm/auth_unix.c | 99 ++++---- source4/auth/ntlm/auth_winbind.c | 12 +- source4/auth/ntlmssp/ntlmssp.h | 2 +- source4/auth/ntlmssp/ntlmssp_server.c | 20 +- source4/auth/sam.c | 164 +++++++------- source4/auth/session.c | 43 ++-- source4/auth/session.h | 16 +- source4/auth/system_session.c | 314 +++++++++++++------------ source4/configure | 14 - source4/configure.nodebug.developer | 3 - source4/configure.tridge.opt | 2 - source4/dsdb/samdb/ldb_modules/acl_util.c | 4 +- source4/kdc/kpasswdd.c | 10 +- source4/kdc/pac-glue.c | 21 +- source4/ntvfs/ipc/vfs_ipc.c | 14 +- source4/rpc_server/lsa/dcesrv_lsa.c | 4 +- source4/rpc_server/netlogon/dcerpc_netlogon.c | 14 +- source4/samba_tool/gpo.c | 10 +- source4/selftest/wscript | 4 +- source4/smb_server/management.c | 4 +- source4/smb_server/smb/sesssetup.c | 21 +- source4/smbd/service_named_pipe.c | 12 +- source4/torture/auth/pac.c | 62 +++--- source4/torture/rpc/remote_pac.c | 76 +++--- source4/utils/ntlm_auth.c | 4 +- source4/wscript | 199 ---------------- source4/wscript_build | 106 --------- wscript | 2 +- 46 files changed, 916 insertions(+), 1308 deletions(-) create mode 100644 librpc/idl/auth.idl delete mode 100644 source4/Makefile delete mode 100644 source4/VERSION delete mode 100755 source4/configure delete mode 100755 source4/configure.nodebug.developer delete mode 100755 source4/configure.tridge.opt delete mode 100644 source4/wscript delete mode 100644 source4/wscript_build Changeset truncated at 500 lines: diff --git a/librpc/idl/auth.idl b/librpc/idl/auth.idl new file mode 100644 index 0000000..525497d --- /dev/null +++ b/librpc/idl/auth.idl @@ -0,0 +1,70 @@ +#include "idl_types.h" + +/* + security IDL structures +*/ + +import "misc.idl", "security.idl", "lsa.idl", "krb5pac.idl"; + +interface auth +{ + typedef [public] enum { + SEC_AUTH_METHOD_UNAUTHENTICATED = 0, + SEC_AUTH_METHOD_NTLM = 1, + SEC_AUTH_METHOD_KERBEROS = 2 + } auth_method; + + /* This is the parts of the session_info that don't change + * during local privilage and group manipulations */ + typedef [public] struct { + utf8string account_name; + utf8string domain_name; + + utf8string full_name; + utf8string logon_script; + utf8string profile_path; + utf8string home_directory; + utf8string home_drive; + utf8string logon_server; + + NTTIME last_logon; + NTTIME last_logoff; + NTTIME acct_expiry; + NTTIME last_password_change; + NTTIME allow_password_change; + NTTIME force_password_change; + + uint16 logon_count; + uint16 bad_password_count; + + uint32 acct_flags; + + uint8 authenticated; + } auth_user_info; + + /* This information is preserved only to assist torture tests */ + typedef [public] struct { + /* Number SIDs from the DC netlogon validation info */ + uint32 num_dc_sids; + [size_is(num_sids)] dom_sid dc_sids[*]; + PAC_SIGNATURE_DATA *pac_srv_sig; + PAC_SIGNATURE_DATA *pac_kdc_sig; + } auth_user_info_torture; + + /* This is the interim product of the auth subsystem, before + * privileges and local groups are handled */ + typedef [public] struct { + uint32 num_sids; + [size_is(num_sids)] dom_sid sids[*]; + auth_user_info *info; + DATA_BLOB user_session_key; + DATA_BLOB lm_session_key; + } auth_user_info_dc; + + typedef [public] struct { + security_token *security_token; + auth_user_info *info; + DATA_BLOB session_key; + DATA_BLOB exported_gssapi_credentials; + } auth_session_info_transport; +} diff --git a/librpc/idl/wscript_build b/librpc/idl/wscript_build index 6fdd5f3..52476c4 100644 --- a/librpc/idl/wscript_build +++ b/librpc/idl/wscript_build @@ -1,7 +1,7 @@ #!/usr/bin/env python bld.SAMBA_PIDL_LIST('PIDL', - '''atsvc.idl drsuapi.idl epmapper.idl initshutdown.idl + '''atsvc.idl auth.idl drsuapi.idl epmapper.idl initshutdown.idl misc.idl ntlmssp.idl schannel.idl trkwks.idl audiosrv.idl dfsblobs.idl dsbackup.idl eventlog.idl file_id.idl keysvc.idl msgsvc.idl ntsvcs.idl remact.idl security.idl unixinfo.idl wzcsvc.idl diff --git a/source4/Makefile b/source4/Makefile deleted file mode 100644 index bc77be9..0000000 --- a/source4/Makefile +++ /dev/null @@ -1,75 +0,0 @@ -# simple makefile wrapper to run waf - -WAF_BINARY=../buildtools/bin/waf -WAF=WAF_MAKE=1 $(WAF_BINARY) - -all: - $(WAF) build - -install: - $(WAF) install - -uninstall: - $(WAF) uninstall - -test: - $(WAF) test $(TEST_OPTIONS) - -help: - @echo NOTE: to run extended waf options use $(WAF_BINARY) or modify your PATH - $(WAF) --help - -subunit-test: - $(WAF) test --filtered-subunit $(TEST_OPTIONS) - -testenv: - $(WAF) test --testenv $(TEST_OPTIONS) - -quicktest: - $(WAF) test --quick $(TEST_OPTIONS) - -dist: - touch .tmplock - WAFLOCK=.tmplock $(WAF) dist - -distcheck: - touch .tmplock - WAFLOCK=.tmplock $(WAF) distcheck - -clean: - $(WAF) clean - -distclean: - $(WAF) distclean - -reconfigure: configure - $(WAF) reconfigure - -show_waf_options: - $(WAF) --help - -# some compatibility make targets -everything: all - -testsuite: all - -check: test - -torture: all - -# this should do an install as well, once install is finished -installcheck: test - -etags: - $(WAF) etags - -ctags: - $(WAF) ctags - -# this allows for things like "make bin/smbtorture" -bin/%:: FORCE - $(WAF) --targets=`basename $@` -FORCE: - -pydoctor: - $(WAF) pydoctor diff --git a/source4/VERSION b/source4/VERSION deleted file mode 100644 index 394e114..0000000 --- a/source4/VERSION +++ /dev/null @@ -1,117 +0,0 @@ -######################################################## -# SAMBA Version # -# # -# Samba versions are as follows # -# 3.0.x New production series # -# 3.0.x{tp,pre,rc}y Preview/Testing & RC # -# 3.0.x[a-z] Patch releases # -# 3.0.x[a-z]-VENDOR-z Vendor patch releases # -# # -# script/mkversion.sh # -# will use this file to create # -# include/version.h # -# # -######################################################## - -######################################################## -# This are the main SAMBA version numbers # -# # -# <MAJOR>.<MINOR>.<RELEASE> # -# # -# e.g. SAMBA_VERSION_MAJOR=3 # -# SAMBA_VERSION_MINOR=0 # -# SAMBA_VERSION_RELEASE=0 # -# -> "3.0.0" # -######################################################## -SAMBA_VERSION_MAJOR=4 -SAMBA_VERSION_MINOR=0 -SAMBA_VERSION_RELEASE=0 - -######################################################## -# If a official release has a serious bug # -# a security release will have 'a' sufffix # -# # -# so SAMBA's version will be # -# <MAJOR>.<MINOR>.<RELEASE><REVISION> # -# # -# e.g. SAMBA_VERSION_REVISION=a # -# -> "2.2.8a" # -######################################################## -SAMBA_VERSION_REVISION= - -######################################################## -# For 'tp' releases the version will be # -# # -# <MAJOR>.<MINOR>.<RELEASE>tp<TP_RELEASE> # -# # -# e.g. SAMBA_VERSION_TP_RELEASE=1 # -# -> "4.0.0tp1" # -######################################################## -SAMBA_VERSION_TP_RELEASE= - -######################################################## -# For 'alpha' releases the version will be # -# # -# <MAJOR>.<MINOR>.<RELEASE>alpha<TP_RELEASE> # -# # -# e.g. SAMBA_VERSION_ALPHA_RELEASE=1 # -# -> "4.0.0alpha1" # -######################################################## -SAMBA_VERSION_ALPHA_RELEASE=15 - -######################################################## -# For 'pre' releases the version will be # -# # -# <MAJOR>.<MINOR>.<RELEASE>pre<PRE_RELEASE> # -# # -# e.g. SAMBA_VERSION_PRE_RELEASE=1 # -# -> "2.2.9pre1" # -######################################################## -SAMBA_VERSION_PRE_RELEASE= - -######################################################## -# For 'rc' releases the version will be # -# # -# <MAJOR>.<MINOR>.<RELEASE>rc<RC_RELEASE> # -# # -# e.g. SAMBA_VERSION_RC_RELEASE=1 # -# -> "3.0.0rc1" # -######################################################## -SAMBA_VERSION_RC_RELEASE= - -######################################################## -# To mark SVN snapshots this should be set to 'yes' # -# in the development BRANCH, and set to 'no' only in # -# the SAMBA_X_X_RELEASE BRANCH # -# # -# <MAJOR>.<MINOR>.<RELEASE>[...]-SVN-build-xxx # -# # -# e.g. SAMBA_VERSION_IS_SVN_SNAPSHOT=yes # -# -> "3.0.0-SVN-build-199" # -######################################################## -SAMBA_VERSION_IS_GIT_SNAPSHOT=yes - -######################################################## -# This is for specifying a release nickname # -# # -# e.g. SAMBA_VERSION_RELEASE_NICKNAME=Nicky Nickname # -# smbd --version will then give: # -# -> "4.0.0-tp1-VendorVersion (Nicky Nickname)" # -######################################################## -SAMBA_VERSION_RELEASE_NICKNAME= - -######################################################## -# This can be set by vendors if they want... # -# This can be a string constant or a function which # -# returns a string (const char *) # -# # -# <MAJOR>.<MINOR>.<RELEASE>[...]-<VENDOR_SUFFIX> # -# # -# Note the '-' is automaticaly added # -# # -# e.g. SAMBA_VERSION_VENDOR_SUFFIX=VendorVersion # -# -> "3.0.0rc2-VendorVersion" # -# # -######################################################## -SAMBA_VERSION_VENDOR_SUFFIX= -SAMBA_VERSION_VENDOR_PATCH= diff --git a/source4/auth/auth.h b/source4/auth/auth.h index 21790c4..10818dc 100644 --- a/source4/auth/auth.h +++ b/source4/auth/auth.h @@ -22,6 +22,7 @@ #define _SAMBA_AUTH_H #include "librpc/gen_ndr/ndr_krb5pac.h" +#include "librpc/gen_ndr/auth.h" #include "../auth/common_auth.h" extern const char *krbtgt_attrs[]; @@ -48,41 +49,6 @@ struct loadparm_context; #define AUTH_SESSION_INFO_AUTHENTICATED 0x02 /* Add the user to the 'authenticated users' group */ #define AUTH_SESSION_INFO_SIMPLE_PRIVILEGES 0x04 /* Use a trivial map between users and privilages, rather than a DB */ -struct auth_serversupplied_info -{ - size_t num_sids; - struct dom_sid *sids; - - DATA_BLOB user_session_key; - DATA_BLOB lm_session_key; - - const char *account_name; - const char *domain_name; - - const char *full_name; - const char *logon_script; - const char *profile_path; - const char *home_directory; - const char *home_drive; - const char *logon_server; - - NTTIME last_logon; - NTTIME last_logoff; - NTTIME acct_expiry; - NTTIME last_password_change; - NTTIME allow_password_change; - NTTIME force_password_change; - - uint16_t logon_count; - uint16_t bad_password_count; - - uint32_t acct_flags; - - bool authenticated; - - struct PAC_SIGNATURE_DATA pac_srv_sig, pac_kdc_sig; -}; - struct auth_method_context; struct auth_check_password_request; struct auth_context; @@ -108,14 +74,14 @@ struct auth_operations { NTSTATUS (*check_password)(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, const struct auth_usersupplied_info *user_info, - struct auth_serversupplied_info **server_info); - - /* Lookup a 'server info' return based only on the principal */ - NTSTATUS (*get_server_info_principal)(TALLOC_CTX *mem_ctx, - struct auth_context *auth_context, - const char *principal, - struct ldb_dn *user_dn, - struct auth_serversupplied_info **server_info); + struct auth_user_info_dc **interim_info); + + /* Lookup a 'session info interim' return based only on the principal or DN */ + NTSTATUS (*get_user_info_dc_principal)(TALLOC_CTX *mem_ctx, + struct auth_context *auth_context, + const char *principal, + struct ldb_dn *user_dn, + struct auth_user_info_dc **interim_info); }; struct auth_method_context { @@ -154,7 +120,7 @@ struct auth_context { NTSTATUS (*check_password)(struct auth_context *auth_ctx, TALLOC_CTX *mem_ctx, const struct auth_usersupplied_info *user_info, - struct auth_serversupplied_info **server_info); + struct auth_user_info_dc **user_info_dc); NTSTATUS (*get_challenge)(struct auth_context *auth_ctx, uint8_t chal[8]); @@ -162,15 +128,15 @@ struct auth_context { NTSTATUS (*set_challenge)(struct auth_context *auth_ctx, const uint8_t chal[8], const char *set_by); - NTSTATUS (*get_server_info_principal)(TALLOC_CTX *mem_ctx, - struct auth_context *auth_ctx, - const char *principal, - struct ldb_dn *user_dn, - struct auth_serversupplied_info **server_info); + NTSTATUS (*get_user_info_dc_principal)(TALLOC_CTX *mem_ctx, + struct auth_context *auth_ctx, + const char *principal, + struct ldb_dn *user_dn, + struct auth_user_info_dc **user_info_dc); NTSTATUS (*generate_session_info)(TALLOC_CTX *mem_ctx, struct auth_context *auth_context, - struct auth_serversupplied_info *server_info, + struct auth_user_info_dc *user_info_dc, uint32_t session_info_flags, struct auth_session_info **session_info); }; @@ -182,7 +148,7 @@ struct auth_critical_sizes { int sizeof_auth_methods; int sizeof_auth_context; int sizeof_auth_usersupplied_info; - int sizeof_auth_serversupplied_info; + int sizeof_auth_user_info_dc; }; NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth_context *auth_context, @@ -212,13 +178,13 @@ NTSTATUS authsam_expand_nested_groups(struct ldb_context *sam_ctx, TALLOC_CTX *res_sids_ctx, struct dom_sid ***res_sids, unsigned int *num_res_sids); struct auth_session_info *system_session(struct loadparm_context *lp_ctx); -NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx, +NTSTATUS authsam_make_user_info_dc(TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx, const char *netbios_name, const char *domain_name, struct ldb_dn *domain_dn, struct ldb_message *msg, DATA_BLOB user_sess_key, DATA_BLOB lm_sess_key, - struct auth_serversupplied_info **_server_info); + struct auth_user_info_dc **_user_info_dc); NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx, struct loadparm_context *lp_ctx, struct auth_session_info **_session_info) ; @@ -242,7 +208,7 @@ NTSTATUS auth_context_create_from_ldb(TALLOC_CTX *mem_ctx, struct ldb_context *l NTSTATUS auth_check_password(struct auth_context *auth_ctx, TALLOC_CTX *mem_ctx, const struct auth_usersupplied_info *user_info, - struct auth_serversupplied_info **server_info); + struct auth_user_info_dc **user_info_dc); NTSTATUS auth_init(void); NTSTATUS auth_register(const struct auth_operations *ops); NTSTATUS server_service_auth_init(void); @@ -262,16 +228,16 @@ struct tevent_req *auth_check_password_send(TALLOC_CTX *mem_ctx, const struct auth_usersupplied_info *user_info); NTSTATUS auth_check_password_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx, - struct auth_serversupplied_info **server_info); + struct auth_user_info_dc **user_info_dc); bool auth_challenge_may_be_modified(struct auth_context *auth_ctx); NTSTATUS auth_context_set_challenge(struct auth_context *auth_ctx, const uint8_t chal[8], const char *set_by); -NTSTATUS auth_get_server_info_principal(TALLOC_CTX *mem_ctx, +NTSTATUS auth_get_user_info_dc_principal(TALLOC_CTX *mem_ctx, struct auth_context *auth_ctx, const char *principal, struct ldb_dn *user_dn, - struct auth_serversupplied_info **server_info); + struct auth_user_info_dc **user_info_dc); NTSTATUS samba_server_gensec_start(TALLOC_CTX *mem_ctx, struct tevent_context *event_ctx, diff --git a/source4/auth/auth_sam_reply.c b/source4/auth/auth_sam_reply.c index bb2b6eb..eb9a834 100644 --- a/source4/auth/auth_sam_reply.c +++ b/source4/auth/auth_sam_reply.c @@ -25,16 +25,17 @@ #include "libcli/security/security.h" #include "auth/auth_sam_reply.h" -NTSTATUS auth_convert_server_info_sambaseinfo(TALLOC_CTX *mem_ctx, - struct auth_serversupplied_info *server_info, +NTSTATUS auth_convert_user_info_dc_sambaseinfo(TALLOC_CTX *mem_ctx, + struct auth_user_info_dc *user_info_dc, struct netr_SamBaseInfo **_sam) { NTSTATUS status; + struct auth_user_info *info; struct netr_SamBaseInfo *sam = talloc_zero(mem_ctx, struct netr_SamBaseInfo); NT_STATUS_HAVE_NO_MEMORY(sam); - if (server_info->num_sids > PRIMARY_USER_SID_INDEX) { - status = dom_sid_split_rid(sam, &server_info->sids[PRIMARY_USER_SID_INDEX], + if (user_info_dc->num_sids > PRIMARY_USER_SID_INDEX) { + status = dom_sid_split_rid(sam, &user_info_dc->sids[PRIMARY_USER_SID_INDEX], &sam->domain_sid, &sam->rid); if (!NT_STATUS_IS_OK(status)) { return status; @@ -43,8 +44,8 @@ NTSTATUS auth_convert_server_info_sambaseinfo(TALLOC_CTX *mem_ctx, return NT_STATUS_INVALID_PARAMETER; } - if (server_info->num_sids > PRIMARY_GROUP_SID_INDEX) { - status = dom_sid_split_rid(NULL, &server_info->sids[PRIMARY_GROUP_SID_INDEX], + if (user_info_dc->num_sids > PRIMARY_GROUP_SID_INDEX) { + status = dom_sid_split_rid(NULL, &user_info_dc->sids[PRIMARY_GROUP_SID_INDEX], NULL, &sam->primary_gid); if (!NT_STATUS_IS_OK(status)) { return status; @@ -56,35 +57,37 @@ NTSTATUS auth_convert_server_info_sambaseinfo(TALLOC_CTX *mem_ctx, sam->primary_gid = sam->rid; } - sam->last_logon = server_info->last_logon; - sam->last_logoff = server_info->last_logoff; - sam->acct_expiry = server_info->acct_expiry; - sam->last_password_change = server_info->last_password_change; -- Samba Shared Repository