samba.git/auth, branch talloc-2.1.3

s4-auth: Always pass down the salt principal

2015-07-16T23:38:15+00:00

We should always pass down the saltPrincipal to smb_krb5_update_keytab()
function.

Signed-off-by: Andreas Schneider 
Reviewed-by: Jeremy Allison

auth/credentials: if credentials have principal set, they are not anonymous anymore

2015-07-15T14:32:54+00:00

When dealing with Kerberos, we cannot consider credentials anonymous
if credentials were obtained properly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11265

Signed-off-by: Alexander Bokovoy 
Reviewed-by: Stefan (metze) Metzmacher 
Reviewed-by: Guenther Deschner 

Autobuild-User(master): Alexander Bokovoy 
Autobuild-Date(master): Wed Jul 15 16:32:55 CEST 2015 on sn-devel-104

auth/credentials: anonymous should not try to use kerberos

2015-07-03T00:00:28+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Guenther Deschner

auth: Explain why GSS_KRB5_CRED_NO_CI_FLAGS_X is needed

2015-06-24T11:37:02+00:00

Signed-off-by: Andreas Schneider 
Reviewed-by: Stefan Metzmacher 

Autobuild-User(master): Andreas Schneider 
Autobuild-Date(master): Wed Jun 24 13:37:02 CEST 2015 on sn-devel-104

auth/kerberos: add gssapi_get_sig_size() and gssapi_{seal,unseal,sign,check}_packet() helper functions

2015-06-23T23:03:16+00:00

These make use of gss_[un]wrap_iov[_length]() where required and support
header signing.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

auth/gensec: remove unused gensec_[un]wrap_packets() hooks

2015-06-23T20:12:08+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison

auth/gensec: make sure gensec_start_mech_by_authtype() resets SIGN/SEAL before starting

2015-06-23T12:38:53+00:00

We want to set GENSEC_FEATURE_SIGN and GENSEC_FEATURE_SEAL based on the given
auth_level and should not have GENSEC_FEATURE_SEAL if
DCERPC_AUTH_LEVEL_INTEGRITY is desired.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison 
Reviewed-by: Andreas Schneider 
Reviewed-by: Andrew Bartlett

auth/gensec: gensec_[un]seal_packet() should only work with GENSEC_FEATURE_DCE_STYLE

2015-06-23T12:38:53+00:00

gensec_sig_size() also requires GENSEC_FEATURE_DCE_STYLE if
GENSEC_FEATURE_SEAL is negotiated.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison 
Reviewed-by: Andreas Schneider 
Reviewed-by: Andrew Bartlett

auth/credentials: use HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X instead of SAMBA4_USES_HEIMDAL

2015-06-23T12:38:53+00:00

Newer MIT versions also have this.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Günther Deschner

dcerpc: NULL pointer deref crash in handling rpc request.

2015-06-18T17:25:27+00:00

source4/rpc_server/dcerpc_server.c:dcesrv_request() calls gensec_have_feature().

Codenomicon found a code path that allows the client to send a
request that calls into this function without ever having set
up security. So call->conn->auth_state.gensec_security exists
(gensec has been initialized when the RPC pipe is set up)
but call->conn->auth_state.gensec_security->ops has not been
initialized. We dereference the NULL pointer and crash.

An alternate way to fix this would be to create a new
public bool gensec_initialized(() function and call that
inside dcesrv_request() instead of doing a null
check on call->conn->auth_state.gensec_security,
but that's a more invasive fix we can add later.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11341

Signed-off-by: Jeremy Allison 
Reviewed-by: Alexander Bokovoy