samba.git/source3/utils, branch talloc-2.1.7

lib: Give base64.c its own .h

2016-05-03T23:28:23+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

lib: Make callers of base64_encode_data_blob check for success

2016-05-03T23:28:23+00:00

Quite a few callers already did check for !=NULL. With the current code this is
pointless due to a SMB_ASSERT in base64_encode_data_blob() itself. Make the
callers consistently check, so that we can remove SMB_ASSERT from base64.c.

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

smbcacls: Do not read old ACL for 'set' operation

2016-04-29T23:01:42+00:00

Signed-off-by: Christof Schmitt 
Reviewed-by: Jeremy Allison

Fixes an obvious copy-paste error in source3/utils/net_dns.c

2016-04-22T08:45:30+00:00

Signed-off-by: Richard Sharpe 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): Volker Lendecke 
Autobuild-Date(master): Fri Apr 22 10:45:30 CEST 2016 on sn-devel-144

CVE-2016-2115: net: use SMB_SIGNING_IPC_DEFAULT

2016-04-12T17:25:26+00:00

Use SMB_SIGNING_IPC_DEFAULT for RPC connections.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756

Signed-off-by: Ralph Boehme 
Reviewed-by: Stefan Metzmacher

smbcquotas: print "NO LIMIT" only if returned quota value is 0.

2016-03-31T18:30:11+00:00

If the user being queried has no quota, the server returns 0 as
its quota. This is the observed smbd and Windows behavior, which
is also documented in [MS-FSA] 2.5.1.20.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11815

Signed-off-by: Uri Simchoni 
Reviewed-by: Jeremy Allison

s3:ntlm_auth: pass manage_squid_request() needs a valid struct ntlm_auth_state from within get_password()

2016-03-22T18:20:38+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Tue Mar 22 19:20:38 CET 2016 on sn-devel-144

Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth

2016-03-11T21:58:18+00:00

An implementation of https://lists.samba.org/archive/samba/2012-March/166497.html (which has been discussed in 2012, but was never implemented).

It has been tested on a Debian Jessie system with this patch added to the Debian package (which is currently 4.1.17). Even though this is Samba 4, the ntlm_auth installed is the one from Samba 3 (yes, it surprised me too). The backend was a machine with Windows 2012R2.

It was first tested with the local security policy 'Network Security: LAN Manager authentication level' setting changed to 'Send NTLMv2 Response Only' (allow ntlm v1). This way we are able to authenticate with and without the MSV1_0_ALLOW_MSVCHAPV2 flag (as expected).

After the basic step has been verified, the local security policy 'Network Security: LAN Manager authentication level' setting was changed to 'Send NTLMv2 Response Only. Refuse LM & NTLM' (only allow ntlm v2). The behaviour now changed according to the MSV1_0_ALLOW_MSVCHAPV2 flag (again: as expected).

  $ ntlm_auth --request-nt-key --username=XXXXXXXXXXXXX --challenge=XXXXXXXXXXXXXXXXX --nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --domain=
  Logon failure (0xc000006d)
  $ ntlm_auth --request-nt-key --username=XXXXXXXXXXXXX --challenge=XXXXXXXXXXXXXXXXX --nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --domain= --allow-mschapv2
  NT_KEY: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

The changes in `wbclient.h` are intended for programs that use libwinbind directly instead of authenticating via `ntlm_auth`. I intend to use that within FreeRADIUS (see https://bugzilla.samba.org/show_bug.cgi?id=11149).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11694
Signed-off-by: Herwin Weststrate 
Reviewed-by: Kai Blin 
Reviewed-by: Andrew Bartlett

s3:ntlm_auth: also use gensec for "ntlmssp-client-1" and "gss-spnego-client"

2016-03-10T05:52:28+00:00

This implicitly fixes bug #10708.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10708

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Günther Deschner

s3:ntlm_auth: fix --use-cached-creds with ntlmssp-client-1

2016-03-10T05:52:27+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11776

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Günther Deschner