Progress Report #8

Progress Report #8 29-07-2017

gss-tsig:

• changed tsig record generation in dns_empty_tsig() of client_crypto.c (thanks for the tip Andreas!)
• minor corrections and additions in libcli_crypto.h

tcp-cli:

• changes in socket handling and registered associated callback in dns_tcp.c
• some changes in pdu_blob_send/recv() loop that should be revisited and reviewed, in dns_tcp.c

cmocka-tests:

• initial test suite templates
• added tests for dns_empty_tsig(), dns_find_tkey() and dns_cli_generate_tsig() in cli_crypto_test.c (incomplete)

I consider gss-tsig to be at a valid state at the moment, therefore I will focus in coding a correct cmocka test suite to assure it's ok, then look for potential improvements.

In tcp-cli, I must work on creating the wrapper functions to hide the process. Then I can proceed with writing the tests. Any books or references in declaring/defining/creating wrappers will be extremely appreciated.

In cmocka-tests I'm walking baby steps at this point, but I invest a lot of time on it and I should figure out my tests soon enough.

In the following days, I'll fork Samba to merge with my temp repo, making it easy to incorporate what I've got so far to Samba, as well as for everyone interested to take a look and provide tips and feedback.

Cheers,

Dimitris

Progress Report #7

Progress Report #7 22-07-2017

gss-tsig:

• memset() in dns_empty_tsig() to initialize empty rdata fields in client_crypto.c
• full tsig generation and server mac validation in client_crypto.c
• minor changes in libcli_crypto.h

client_crypto.c

I used WERROR in accordance to error handling in the server code. Is there an advantage in using NTSTATUS instead?

Use of memset() must be reviewed, as it uses pointers and I am not fully aware if all related fields in rdata are declared as such.

dns_find_tkey() is used as coded for its respective use in /source4/dns_server/dns_server.c. It has been suggested that I use a new linked-list to manipulate the cache, though I've come across this tutorial, which suggests that linked-lists may not be ideal for locating specific nodes in the cache.

tcp-cli:

• added tcp connection handling in dns_tcp.c
• tstream_read_pdu_blob_send/recv() loop implemented in dns_tcp.c
• added missing callback assignments in dns_tcp.c
• changes in libdns_tcp to accomodate changes

dns_tcp.c

The send/recv loop should probably be reviewed, since tstream_read_pdu_blob does not appear to be defined in tsocket, so I'm not sure I've got it right.

Additionally, dns_tcp_req_done() is probably wrong, but I'd need some verification on this.

I'm starting writing tests for gss-tsig tomorrow, as I'm quite confident that the code appears to be a solid foundation for fine-tuning.

The TCP call handler needs a bit of work, so that I can add signature generation.

As always, feedback would be greatly appreciated.

Temporary GitHub repo here.

Cheers,

Dimitris

Progress Report #6

Progress Report #6 14-07-2017

gss-tsig

• signature generation in gss-tsig/client_crypto.c.
• removes inbound dns_tsig_record and rebuilds with MAC signature and tsig rdata (as stated in RFC 2845 2.3).
• corresponding header with structures in gss-tsig/libcli_crypto.h.

tcp-cli

• client-side dns tcp query send/receive.
• corresponding header with structures in tcp-cli/libdns-tcp.

gss-tsig needs fine tuning in general, some headers must be removed as well. I followed Samba APIs and existing code.

tcp-cli is not yet sorted out, as there don't seem to be definitions for tstream_read_pdu_blob_send()/recv(), I could use some help on passing the tstream vector to the callback as well. Also I'm not sure if I need to create a new connection from the client to the server, as UDP queries use existing sockets.

Once the above are done, I can wrap up all the features and work on creating tests, so any feedback at all would be greatly appreciated (and really needed!) to speed things up.

I think I'm quite comfortable with tsocket and tevent at this point.

Cheers,

Dimitris

Progress Report #5

Progress Report #5 09-07-2017

libcli/dns:

• tcp client-server communication
• initial client-side call management
• initial client-side tcp call library

I went through tons of documentation regarding DNS, TCP, UDP, TSIG, also invested all available time on comprehending Samba APIs. There's such a solid base behind Samba, but the learning curve is probably too steep, steeper than I initially thought it would be.

Moving on!

Dimitris

Progress Report #4

Progress Report #4 01-07-2017

APIs:

• Understanding talloc API
• Understanding tevent API
• Cross-referencing implementation in DNS parser

Also some very early attempts on adding to the DNS parser. I expect a lot more during this week.

Cheers,
Dimitris

Progress Report #3

Progress Report #3 24-06-2017

Exams! What more can I say!?

cmocka:

• Studied practice examples
• Studied mock() feature documentation

I squeezed some time in cmocka examples though!

Cheers,
Dimitris

Progress Report #2

Progress Report #2 16-06-2017

AD - DC:

• Setup samba-ad-dc.service for systemd management.
• Setup NTPd for time sync.
• Winbindd works correctly.
• Administrator user to --noexpiry.

cmocka:

• Installed Cmake 3.5.1
• Installed cmocka version 1.1.1 and studied relevant documentation
• First attempts at unit testing on pre-existing C programs
• Getting to know the lib

DNS:

• Studied terminology/application/documentation
• Making cross-references with libcli/dns

24hrs/day are not enough -_-

Cheers,
Dimitris

Progress Report #1

Progress Report #1 09-06-2017

So far:

• Extensively studied all DC related wiki articles
• Extensively studied MIT and Heimdal Kerberos from multiple sources
• Checked consistency of Samba installation on my machine via:
1. official Ubuntu repositories (apt)
2. built from source (4.6.4) - failed
• configure successful
• make successful
• make test returned more than 34 errors 
3. built from source (4.6.3) - successful
• configured network interfaces
• set up .local domain
• DC provisioning with samba-tool
• Kerberos configuration

On to testing!

Cheers,
Dimitris