svn commit: samba r22018 - in branches: SAMBA_3_0/source/nmbd SAMBA_3_0_25/source/nmbd
Author: herb
Date: 2007-03-31 03:11:02 + (Sat, 31 Mar 2007)
New Revision: 22018
WebSVN:
http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22018
Log:
fix compile error
Modified:
branches/SAMBA_3_0/source/nmbd/nmbd_incomingdgrams.c
branches/SAMBA_3_0_25/source/nmbd/nmbd_incomingdgrams.c
Changeset:
Modified: branches/SAMBA_3_0/source/nmbd/nmbd_incomingdgrams.c
===
--- branches/SAMBA_3_0/source/nmbd/nmbd_incomingdgrams.c2007-03-31
01:14:00 UTC (rev 22017)
+++ branches/SAMBA_3_0/source/nmbd/nmbd_incomingdgrams.c2007-03-31
03:11:02 UTC (rev 22018)
@@ -431,13 +431,13 @@
fstring comment;
char *s = get_safe_offset(buf,len,buf,9);
+ START_PROFILE(lm_host_announce);
if (!s) {
- return;
+ goto done;
}
- START_PROFILE(lm_host_announce);
s = skip_string(buf,len,s,1);
if (!s) {
- return;
+ goto done;
}
pull_ascii(comment, s, sizeof(fstring), 43, STR_TERMINATE);
Modified: branches/SAMBA_3_0_25/source/nmbd/nmbd_incomingdgrams.c
===
--- branches/SAMBA_3_0_25/source/nmbd/nmbd_incomingdgrams.c 2007-03-31
01:14:00 UTC (rev 22017)
+++ branches/SAMBA_3_0_25/source/nmbd/nmbd_incomingdgrams.c 2007-03-31
03:11:02 UTC (rev 22018)
@@ -431,13 +431,13 @@
fstring comment;
char *s = get_safe_offset(buf,len,buf,9);
+ START_PROFILE(lm_host_announce);
if (!s) {
- return;
+ goto done;
}
- START_PROFILE(lm_host_announce);
s = skip_string(buf,len,s,1);
if (!s) {
- return;
+ goto done;
}
pull_ascii(comment, s, sizeof(fstring), 43, STR_TERMINATE);
svn commit: samba r22017 - in branches: SAMBA_3_0/source/smbd SAMBA_3_0_25/source/smbd
Author: jra Date: 2007-03-31 01:14:00 + (Sat, 31 Mar 2007) New Revision: 22017 WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22017 Log: After changing 2000 lines of this I think this is needed :-). Jeremy. Modified: branches/SAMBA_3_0/source/smbd/lanman.c branches/SAMBA_3_0_25/source/smbd/lanman.c Changeset: Modified: branches/SAMBA_3_0/source/smbd/lanman.c === --- branches/SAMBA_3_0/source/smbd/lanman.c 2007-03-30 23:23:45 UTC (rev 22016) +++ branches/SAMBA_3_0/source/smbd/lanman.c 2007-03-31 01:14:00 UTC (rev 22017) @@ -2,6 +2,7 @@ Unix SMB/CIFS implementation. Inter-process communication and named pipe handling Copyright (C) Andrew Tridgell 1992-1998 + Copyright (C) Jeremy Allison 2007. SMB Version handling Copyright (C) John H Terpstra 1995-1998 Modified: branches/SAMBA_3_0_25/source/smbd/lanman.c === --- branches/SAMBA_3_0_25/source/smbd/lanman.c 2007-03-30 23:23:45 UTC (rev 22016) +++ branches/SAMBA_3_0_25/source/smbd/lanman.c 2007-03-31 01:14:00 UTC (rev 22017) @@ -2,6 +2,7 @@ Unix SMB/CIFS implementation. Inter-process communication and named pipe handling Copyright (C) Andrew Tridgell 1992-1998 + Copyright (C) Jeremy Allison 2007. SMB Version handling Copyright (C) John H Terpstra 1995-1998
Build status as of Sat Mar 31 00:00:02 2007
URL: http://build.samba.org/ --- /home/build/master/cache/broken_results.txt.old 2007-03-30 00:00:29.0 + +++ /home/build/master/cache/broken_results.txt 2007-03-31 00:00:25.0 + @@ -1,10 +1,10 @@ -Build status as of Fri Mar 30 00:00:02 2007 +Build status as of Sat Mar 31 00:00:02 2007 Build counts: Tree Total Broken Panic SOC 0 0 0 build_farm 0 0 0 -ccache 30 6 0 +ccache 31 6 0 ctdb 0 0 0 distcc 2 0 0 ldb 30 5 0 @@ -17,7 +17,7 @@ samba-docs 0 0 0 samba-gtk3 3 0 samba4 34 11 0 -samba_3_037 17 1 +samba_3_037 26 1 smb-build28 27 0 talloc 31 1 0 tdb 30 3 0
svn commit: samba r22016 - in branches/SAMBA_3_0/source/libsmb: .
Author: jra
Date: 2007-03-30 23:23:45 + (Fri, 30 Mar 2007)
New Revision: 22016
WebSVN:
http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22016
Log:
Try and fix the build - move things out of proto.h
Jeremy.
Modified:
branches/SAMBA_3_0/source/libsmb/smb_seal.c
Changeset:
Modified: branches/SAMBA_3_0/source/libsmb/smb_seal.c
===
--- branches/SAMBA_3_0/source/libsmb/smb_seal.c 2007-03-30 22:35:35 UTC (rev
22015)
+++ branches/SAMBA_3_0/source/libsmb/smb_seal.c 2007-03-30 23:23:45 UTC (rev
22016)
@@ -164,7 +164,7 @@
**/
#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
-NTSTATUS common_gss_decrypt_buffer(struct smb_tran_enc_state_gss *gss_state,
char *buf)
+static NTSTATUS common_gss_decrypt_buffer(struct smb_tran_enc_state_gss
*gss_state, char *buf)
{
gss_ctx_id_t gss_ctx = gss_state->gss_ctx;
OM_uint32 ret = 0;
@@ -215,7 +215,7 @@
gss-api encrypt an outgoing buffer. Return the alloced encrypted pointer in
buf_out.
**/
-NTSTATUS common_gss_encrypt_buffer(struct smb_tran_enc_state_gss *gss_state,
+static NTSTATUS common_gss_encrypt_buffer(struct smb_tran_enc_state_gss
*gss_state,
uint16 enc_ctx_num,
char *buf,
char **ppbuf_out)
svn commit: samba r22015 - in branches: SAMBA_3_0/source/nsswitch SAMBA_3_0_25/source/nsswitch
Author: jra
Date: 2007-03-30 22:35:35 + (Fri, 30 Mar 2007)
New Revision: 22015
WebSVN:
http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22015
Log:
Fix for memory leak from Steven Danneman <[EMAIL PROTECTED]>
Jeremy.
Modified:
branches/SAMBA_3_0/source/nsswitch/winbindd_ads.c
branches/SAMBA_3_0_25/source/nsswitch/winbindd_ads.c
Changeset:
Modified: branches/SAMBA_3_0/source/nsswitch/winbindd_ads.c
===
--- branches/SAMBA_3_0/source/nsswitch/winbindd_ads.c 2007-03-30 22:25:08 UTC
(rev 22014)
+++ branches/SAMBA_3_0/source/nsswitch/winbindd_ads.c 2007-03-30 22:35:35 UTC
(rev 22015)
@@ -931,6 +931,8 @@
if (num_retries < 5) {
num_retries++;
num_members = 0;
+ ads_msgfree(ads, res);
+ res = NULL;
continue;
} else {
DEBUG(5, ("ads: lookup_groupmem USN on this
record changed"
@@ -947,6 +949,9 @@
&num_members,
&more_values);
+ ads_msgfree(ads, res);
+ res = NULL;
+
if ((members == NULL) || (num_members == 0))
break;
Modified: branches/SAMBA_3_0_25/source/nsswitch/winbindd_ads.c
===
--- branches/SAMBA_3_0_25/source/nsswitch/winbindd_ads.c2007-03-30
22:25:08 UTC (rev 22014)
+++ branches/SAMBA_3_0_25/source/nsswitch/winbindd_ads.c2007-03-30
22:35:35 UTC (rev 22015)
@@ -931,6 +931,8 @@
if (num_retries < 5) {
num_retries++;
num_members = 0;
+ ads_msgfree(ads, res);
+ res = NULL;
continue;
} else {
DEBUG(5, ("ads: lookup_groupmem USN on this
record changed"
@@ -947,6 +949,9 @@
&num_members,
&more_values);
+ ads_msgfree(ads, res);
+ res = NULL;
+
if ((members == NULL) || (num_members == 0))
break;
svn commit: samba r22014 - in branches: SAMBA_3_0/source/lib SAMBA_3_0/source/libsmb SAMBA_3_0/source/nmbd SAMBA_3_0/source/smbd SAMBA_3_0_25/source/lib SAMBA_3_0_25/source/libsmb SAMBA_3_0_25/source/
Author: jra Date: 2007-03-30 22:25:08 + (Fri, 30 Mar 2007) New Revision: 22014 WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22014 Log: Make us pass RANDOMIPC test again :-(. This is an ugly check-in, but I've no option. Jeremy. Modified: branches/SAMBA_3_0/source/lib/util.c branches/SAMBA_3_0/source/lib/util_str.c branches/SAMBA_3_0/source/libsmb/clidgram.c branches/SAMBA_3_0/source/libsmb/cliprint.c branches/SAMBA_3_0/source/libsmb/clirap.c branches/SAMBA_3_0/source/libsmb/clirap2.c branches/SAMBA_3_0/source/nmbd/nmbd_browsesync.c branches/SAMBA_3_0/source/nmbd/nmbd_elections.c branches/SAMBA_3_0/source/nmbd/nmbd_incomingdgrams.c branches/SAMBA_3_0/source/nmbd/nmbd_packets.c branches/SAMBA_3_0/source/nmbd/nmbd_processlogon.c branches/SAMBA_3_0/source/nmbd/nmbd_sendannounce.c branches/SAMBA_3_0/source/smbd/lanman.c branches/SAMBA_3_0_25/source/lib/util.c branches/SAMBA_3_0_25/source/lib/util_str.c branches/SAMBA_3_0_25/source/libsmb/clidgram.c branches/SAMBA_3_0_25/source/libsmb/cliprint.c branches/SAMBA_3_0_25/source/libsmb/clirap.c branches/SAMBA_3_0_25/source/libsmb/clirap2.c branches/SAMBA_3_0_25/source/nmbd/nmbd_browsesync.c branches/SAMBA_3_0_25/source/nmbd/nmbd_elections.c branches/SAMBA_3_0_25/source/nmbd/nmbd_incomingdgrams.c branches/SAMBA_3_0_25/source/nmbd/nmbd_packets.c branches/SAMBA_3_0_25/source/nmbd/nmbd_processlogon.c branches/SAMBA_3_0_25/source/nmbd/nmbd_sendannounce.c branches/SAMBA_3_0_25/source/smbd/lanman.c Changeset: Sorry, the patch is too large (4149 lines) to include; please use WebSVN to see it! WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22014
svn commit: samba r22013 - in branches/SAMBA_3_0/source: libsmb smbd
Author: jra
Date: 2007-03-30 22:19:51 + (Fri, 30 Mar 2007)
New Revision: 22013
WebSVN:
http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22013
Log:
Move to SSPI framing (sig first in NTLM).
Jeremy
Modified:
branches/SAMBA_3_0/source/libsmb/smb_seal.c
branches/SAMBA_3_0/source/smbd/seal.c
Changeset:
Modified: branches/SAMBA_3_0/source/libsmb/smb_seal.c
===
--- branches/SAMBA_3_0/source/libsmb/smb_seal.c 2007-03-29 22:12:28 UTC (rev
22012)
+++ branches/SAMBA_3_0/source/libsmb/smb_seal.c 2007-03-30 22:19:51 UTC (rev
22013)
@@ -30,13 +30,15 @@
return NT_STATUS_INVALID_BUFFER_SIZE;
}
- if (buf[4] == (char)0xFF && buf[5] == 'S') {
- if (buf [6] == 'M' && buf[7] == 'B') {
+ if (buf[4] == (char)0xFF) {
+ if (buf[5] == 'S' && buf [6] == 'M' && buf[7] == 'B') {
/* Not an encrypted buffer. */
return NT_STATUS_NOT_FOUND;
}
- *p_enc_ctx_num = SVAL(buf,6);
- return NT_STATUS_OK;
+ if (buf[5] == 'E') {
+ *p_enc_ctx_num = SVAL(buf,6);
+ return NT_STATUS_OK;
+ }
}
return NT_STATUS_INVALID_NETWORK_RESPONSE;
}
@@ -54,44 +56,55 @@
/**
Generic code for client and server.
NTLM decrypt an incoming buffer.
+ Abartlett tells me that SSPI puts the signature first before the encrypted
+ output, so cope with the same for compatibility.
**/
NTSTATUS common_ntlm_decrypt_buffer(NTLMSSP_STATE *ntlmssp_state, char *buf)
{
NTSTATUS status;
size_t buf_len = smb_len(buf) + 4; /* Don't forget the 4 length bytes.
*/
+ size_t data_len;
+ char *inbuf;
DATA_BLOB sig;
if (buf_len < 8 + NTLMSSP_SIG_SIZE) {
return NT_STATUS_BUFFER_TOO_SMALL;
}
+ inbuf = smb_xmemdup(buf, buf_len);
+
/* Adjust for the signature. */
- buf_len -= NTLMSSP_SIG_SIZE;
+ data_len = buf_len - 8 - NTLMSSP_SIG_SIZE;
- /* Save off the signature. */
- sig = data_blob(buf+buf_len, NTLMSSP_SIG_SIZE);
+ /* Point at the signature. */
+ sig = data_blob_const(inbuf+8, NTLMSSP_SIG_SIZE);
status = ntlmssp_unseal_packet(ntlmssp_state,
- (unsigned char *)buf + 8, /* 4 byte len + 0xFF 'S'
*/
- buf_len - 8,
- (unsigned char *)buf + 8,
- buf_len - 8,
+ (unsigned char *)inbuf + 8 + NTLMSSP_SIG_SIZE, /* 4 byte len +
0xFF 'E' */
+ data_len,
+ (unsigned char *)inbuf + 8 + NTLMSSP_SIG_SIZE,
+ data_len,
&sig);
if (!NT_STATUS_IS_OK(status)) {
- data_blob_free(&sig);
+ SAFE_FREE(inbuf);
return status;
}
+ memcpy(buf + 8, inbuf + 8 + NTLMSSP_SIG_SIZE, data_len);
+ SAFE_FREE(inbuf);
+
/* Reset the length. */
- smb_setlen(buf, smb_len(buf) - NTLMSSP_SIG_SIZE);
+ smb_setlen(buf, data_len + 4);
return NT_STATUS_OK;
}
/**
Generic code for client and server.
NTLM encrypt an outgoing buffer. Return the encrypted pointer in ppbuf_out.
+ Abartlett tells me that SSPI puts the signature first before the encrypted
+ output, so do the same for compatibility.
**/
NTSTATUS common_ntlm_encrypt_buffer(NTLMSSP_STATE *ntlmssp_state,
@@ -101,12 +114,12 @@
{
NTSTATUS status;
char *buf_out;
- size_t buf_len = smb_len(buf) + 4; /* Don't forget the 4 length bytes.
*/
+ size_t data_len = smb_len(buf) - 4; /* Ignore the 0xFF SMB bytes. */
DATA_BLOB sig;
*ppbuf_out = NULL;
- if (buf_len < 8) {
+ if (data_len == 0) {
return NT_STATUS_BUFFER_TOO_SMALL;
}
@@ -115,21 +128,21 @@
* check needed.
*/
- /* Copy the original buffer. */
+ buf_out = SMB_XMALLOC_ARRAY(char, 8 + NTLMSSP_SIG_SIZE + data_len);
- buf_out = SMB_XMALLOC_ARRAY(char, buf_len + NTLMSSP_SIG_SIZE);
- memcpy(buf_out, buf, buf_len);
- /* Last 16 bytes undefined here... */
+ /* Copy the data from the original buffer. */
+ memcpy(buf_out + 8 + NTLMSSP_SIG_SIZE, buf + 8, data_len);
+
smb_set_enclen(buf_out, smb_len(buf) + NTLMSSP_SIG_SIZE, enc_ctx_num);
sig = data_blob(NULL, NTLMSSP_SIG_SIZE);
status = ntlmssp_seal_packet(ntlmssp_state,
- (unsigned char *)buf_out + 8, /* 4 byte len + 0xFF 'S'
*/
- buf_len - 8,
- (unsigned ch
Rev 5313: merge from upstream in http://samba.sernet.de/ma/bzr/SAMBA_3_0-registry.bzr/
At http://samba.sernet.de/ma/bzr/SAMBA_3_0-registry.bzr/ revno: 5313 revision-id: [EMAIL PROTECTED] parent: [EMAIL PROTECTED] parent: [EMAIL PROTECTED] committer: Michael Adam <[EMAIL PROTECTED]> branch nick: SAMBA_3_0-registry.bzr timestamp: Fri 2007-03-30 22:34:06 +0200 message: merge from upstream modified: REVISION REVISION-20060530022625-68239662668b41c3 source/Makefile.in Makefile.in-20060530022626-b16dac2328ebe703 source/auth/auth.c auth.c-20060530022627-0865681abfd2872c source/auth/auth_ntlmssp.c auth_ntlmssp.c-20060530022627-f744dd7847855295 source/auth/auth_util.cauth_util.c-20060530022627-f9a3e5940d409fe9 source/client/client.c client.c-20060530022627-a5e98bdfdd1ca9d9 source/client/clitar.c clitar.c-20060530022627-e189af4ba0a2289b source/groupdb/mapping_tdb.c mapping_tdb.c-20060924130026-az0qb9gyg33leshz-1 source/include/client.hclient.h-20060530022627-f51e99ba840436e5 source/include/includes.h includes.h-20060530022627-d1a059a99c05e8be source/include/trans2.htrans2.h-20060530022627-ff896a707ae81fc0 source/include/util_tdb.h util_tdb.h-20061021025433-i0dxsjereh6bu8u7-1 source/intl/lang_tdb.c lang_tdb.c-20060530022627-b86eb16f840ce3e7 source/lib/gencache.c gencache.c-20060530022627-c858f466111a3ae0 source/lib/ldb/ldb_tdb/ldb_pack.c ldb_pack.c-20060924130013-wfsw0zps5y9p71dq-56 source/lib/ldb/ldb_tdb/ldb_tdb.c ldb_tdb.c-20060924130013-wfsw0zps5y9p71dq-62 source/lib/messages.c messages.c-20060530022627-fcc341b253a85c20 source/lib/privileges.cprivileges.c-20060530022627-dcf14febf91e0143 source/lib/sharesec.c sharesec.c-20060530090213-46cb22d7f55a32fe source/lib/util.c util.c-20060530022627-d569af0e687a4dd3 source/lib/util_sock.c util_sock.c-20060530022627-30f22f2d8b038b4b source/lib/util_tdb.c util_tdb.c-20061021025435-o3vr4t381qf9lv7e-1 source/libads/ads_status.c ads_status.c-20060530022627-7d57be87f7b83055 source/librpc/ndr/ndr_basic.c ndr_basic.c-20060908151645-5zx7mkkabpiwuown-8 source/libsmb/cliconnect.c cliconnect.c-20060530022627-fb16a3a9bd86c44d source/libsmb/clientgen.c clientgen.c-20060530022627-3aad65ce54001b6b source/libsmb/clifsinfo.c clifsinfo.c-20060530022627-9360212d14f20006 source/libsmb/clikrb5.cclikrb5.c-20060530022627-20af6b3ec85369b2 source/libsmb/clirap.c clirap.c-20060530022627-ec81fdd89a06c9ea source/libsmb/errormap.c errormap.c-20060530022627-f469e8a07ae28ddc source/libsmb/ntlm_check.c ntlm_check.c-20060530022627-0315fd3d850287af source/libsmb/ntlmssp.cntlmssp.c-20060530022627-02a546ec2ea73b92 source/libsmb/ntlmssp_sign.c ntlmssp_sign.c-20060530022627-43be47dcc067106b source/libsmb/samlogon_cache.c samlogon_cache.c-20060530081558-752eb588cc2c12ab source/libsmb/smb_seal.c smb_seal.c-20070317050048-jthijp4m79ic4h3q-1 source/libsmb/smb_share_modes.c smb_share_modes.c-20060530073738-d37c371a41d3c54a source/libsmb/smb_signing.csmb_signing.c-20060530022627-1e3c4643957ae652 source/libsmb/smbencrypt.c smbencrypt.c-20060530022627-705bc568ea0cfac8 source/libsmb/unexpected.c unexpected.c-20060530022627-d0a5ae1af8291fe8 source/locking/brlock.cbrlock.c-20060530022627-3b8aec140997e136 source/locking/locking.c locking.c-20060530022627-4f229d47402340bb source/locking/posix.c posix.c-20060530022627-997d33ad43f0bd3e source/nmbd/nmbd_processlogon.c nmbd_processlogon.c-20060530022627-ba032f504f8ff80c source/nmbd/nmbd_winsserver.c nmbd_winsserver.c-20060530022627-e309a34b4ec33413 source/nsswitch/idmap_cache.c idmap_cache.c-20061212152803-7ux8tgbe0zeiy4lo-1 source/nsswitch/idmap_tdb.cidmap_tdb.c-20061212152807-vd9wgefsa63jj0is-1 source/nsswitch/winbindd_cache.c winbindd_cache.c-20060530022627-45b83e217d38566d source/nsswitch/winbindd_creds.c winbindd_creds.c-20060530090222-aa656dc47583d789 source/nsswitch/winbindd_pam.c winbindd_pam.c-20060530022627-6b827f2f7ba30f85 source/passdb/login_cache.clogin_cache.c-20060530022627-7ffc4691617a4899 source/passdb/passdb.c passdb.c-20060530022627-6eeb9667474b279d source/passdb/pdb_smbpasswd.c pdb_smbpasswd.c-20060530022627-4a7de86c04ba05b6 source/passdb/pdb_tdb.cpdb_tdb.c-20060530022627-b60f9dcd220e2886 source/passdb/secrets.csecrets.c-20060530022627-871f686af94b25c8 source/printing/notify.c notify.c-20060530022627-261dbd9f8eaf7cbe source/printing/nt_printing.c nt_printing.c-20060530022627-6f18c47e6548d98a source/printing/printing.c printing.c-20060530022627-9c11c090f2b843d1 source/registry/reg_db.c reg_db.c-20060530022627-e9a827257fb89131 source/registry/reg_eventlog.c reg_eventlog.c-20060530055250-1bf0026d662d371e source/registry/reg_perfcount.c reg_per
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
On Fri, Mar 30, 2007 at 09:36:11AM -0700, Jeremy Allison wrote: > A lesson in SMB politics. The top level numbers are defined by > Microsoft who reserve the right to allocate new ones at any > time and for any reason. The space *we* have reserved to allocate > from is the trans2 space defined in the UNIX extensions. We > can't create new calls at the SMB level. How much is that BTW? We might have to reserve a sub-trans 32 bit soon if the development continues at the current pace :-) Volker pgpnzWxMm3pV9.pgp Description: PGP signature
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
On Fri, Mar 30, 2007 at 12:32:16PM +0200, Stefan (metze) Metzmacher wrote: > Then I'd say it should be a trans2 call on the IPC$ share. Yep, that's what we decided on. > Is that trans2 call a replacement for the session setup? > or is it just an 'switch on encryption for the next request' > on the already created gssapi session? It's a replacement for the session setup in creating an encryption context. Jeremy.
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
On Fri, Mar 30, 2007 at 11:43:11AM +0200, Stefan (metze) Metzmacher wrote: > > We could also create a new call at SMB level maybe SMBsesssetup2? > > There're a lot of free message numbers. Are there also some ranges > defined? Or were the number randomly picked by the first implementor of > a call? A lesson in SMB politics. The top level numbers are defined by Microsoft who reserve the right to allocate new ones at any time and for any reason. The space *we* have reserved to allocate from is the trans2 space defined in the UNIX extensions. We can't create new calls at the SMB level. Jeremy.
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
On Fri, Mar 30, 2007 at 11:09:17AM +0200, Stefan (metze) Metzmacher wrote: > > So I think it would be much better to use the vuid as enc-ctx, > but check for each call to a specific tid that the call was encrypted > or not. And maybe also allow plain requests with the vuid, or force the > client to create a new vuid for plain traffic. Yep, after chatting with Andrew Bartlett I agree. > And for the case vuid == enc-ctx we can better add a new session setup > variant instead of using a trans2 call. As soon as you clear that with Microsoft, then we're good to go on that one Metze. :-). Jeremy.
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Volker Lendecke schrieb: > On Fri, Mar 30, 2007 at 11:43:11AM +0200, Stefan (metze) Metzmacher wrote: >> We could also create a new call at SMB level maybe SMBsesssetup2? >> >> There're a lot of free message numbers. Are there also some ranges >> defined? Or were the number randomly picked by the first implementor of >> a call? > > Naa, I would not go there. If we have to pass stuff through > trans2, that's what it costs. Then I'd say it should be a trans2 call on the IPC$ share. Is that trans2 call a replacement for the session setup? or is it just an 'switch on encryption for the next request' on the already created gssapi session? metze -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFGDOcwm70gjA5TCD8RAkE1AJ9GbYPcO9kp5bh0sWTl0dVllJuNKwCgroN7 P3YztByDabafdRyajWJCwi8= =o1fg -END PGP SIGNATURE-
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Stefan (metze) Metzmacher schrieb: > So I think it would be much better to use the vuid as enc-ctx, > but check for each call to a specific tid that the call was encrypted > or not. And maybe also allow plain requests with the vuid, or force the > client to create a new vuid for plain traffic. and for replies without vuid (oplock breaks) we should use the same context as used by smb signing (first session setup wins). does smb signing still work when the first vuid is closed? metze -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFGDOXRm70gjA5TCD8RAqzxAJ0R1OyS4LlKnwILHqBkTwEH7FCmbQCgg3Lx 7GV13/Z6M96MJzAi4U3pBu8= =JFzT -END PGP SIGNATURE-
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
On Fri, Mar 30, 2007 at 11:43:11AM +0200, Stefan (metze) Metzmacher wrote: > We could also create a new call at SMB level maybe SMBsesssetup2? > > There're a lot of free message numbers. Are there also some ranges > defined? Or were the number randomly picked by the first implementor of > a call? Naa, I would not go there. If we have to pass stuff through trans2, that's what it costs. Volker pgpIiCp0rjSgM.pgp Description: PGP signature
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Andrew Bartlett schrieb: > I agree that the trans2 stuff is ugly, but at least it is in an already > reserved space in the protocol. Whatever we do, we should continue to > allow a re-key modal (despite the issues it then has with credentials > expiring/passwords changing). We could also create a new call at SMB level maybe SMBsesssetup2? There're a lot of free message numbers. Are there also some ranges defined? Or were the number randomly picked by the first implementor of a call? metze -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFGDNuvm70gjA5TCD8RApINAJ0YrlrEoTWDMqPkAgnNmnzMJ5WCTQCgxfd2 47HOznxArhbxAT8GyVIdlUE= =+3fP -END PGP SIGNATURE-
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
On Fri, 2007-03-30 at 11:09 +0200, Stefan (metze) Metzmacher wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Jeremy Allison schrieb: > >> What is the typical request sequence to establish the encryption context? > > > > trans2 setfsinfo. > > what I was after was the request *sequence* from the start of the tcp > connect to the point where the client opens a file. > > > No. The use case Steve bugged me about was the ability > > to have some shares (tid's) encrypted and some not on > > the same session. In this case encryption is a property > > of the tid, not the sessionid. > > With this model your're not able to protect traffic of userB from userA. > > So when you use the encryption context with credentials from userA > to encrypt traffic for one specific tid, then this could happen: > > - - userA can read all traffic to the specific tid with wireshark > (when using krb5 userA just need to setup a keytab file with his >password and need to capture the SMB traffic together with the KRB5 >AS-REQ/AS-REP and TGS-REQ/TGS-REP) > > - - the same tid can be used when userB accesses the same share, > all whole traffic is visible to userA. > > So I think it would be much better to use the vuid as enc-ctx, > but check for each call to a specific tid that the call was encrypted > or not. And maybe also allow plain requests with the vuid, or force the > client to create a new vuid for plain traffic. Jeremy and I discussed this on IRC, and we basiclly agreed that we needed to tie it to the VUID, for this kind of reason. > And for the case vuid == enc-ctx we can better add a new session setup > variant instead of using a trans2 call. I agree that the trans2 stuff is ugly, but at least it is in an already reserved space in the protocol. Whatever we do, we should continue to allow a re-key modal (despite the issues it then has with credentials expiring/passwords changing). Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com signature.asc Description: This is a digitally signed message part
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
On Fri, Mar 30, 2007 at 11:09:17AM +0200, Stefan (metze) Metzmacher wrote: > So I think it would be much better to use the vuid as enc-ctx, > but check for each call to a specific tid that the call was encrypted > or not. And maybe also allow plain requests with the vuid, or force the > client to create a new vuid for plain traffic. Full ack from here. Key generation is a per-session setup thing, so the encryption context should be the same. The fact that we have contexts broken in Samba3 should not influence the design ;-) Volker pgpKkNk0hWEkj.pgp Description: PGP signature
Re: svn commit: samba r21991 - in branches/SAMBA_3_0/source: include lib libsmb smbd
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jeremy Allison schrieb: >> What is the typical request sequence to establish the encryption context? > > trans2 setfsinfo. what I was after was the request *sequence* from the start of the tcp connect to the point where the client opens a file. > No. The use case Steve bugged me about was the ability > to have some shares (tid's) encrypted and some not on > the same session. In this case encryption is a property > of the tid, not the sessionid. With this model your're not able to protect traffic of userB from userA. So when you use the encryption context with credentials from userA to encrypt traffic for one specific tid, then this could happen: - - userA can read all traffic to the specific tid with wireshark (when using krb5 userA just need to setup a keytab file with his password and need to capture the SMB traffic together with the KRB5 AS-REQ/AS-REP and TGS-REQ/TGS-REP) - - the same tid can be used when userB accesses the same share, all whole traffic is visible to userA. So I think it would be much better to use the vuid as enc-ctx, but check for each call to a specific tid that the call was encrypted or not. And maybe also allow plain requests with the vuid, or force the client to create a new vuid for plain traffic. And for the case vuid == enc-ctx we can better add a new session setup variant instead of using a trans2 call. metze -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFGDNO9m70gjA5TCD8RAjj8AKCkn1vbC2YEe0Hz3Y9nIeAAFz2EJACfdA53 IAUY6ByuSf+u6E6mvhyFmyE= =G1o4 -END PGP SIGNATURE-
