Changeset 740 for vendor/current/source3/libads

Timestamp:

Nov 14, 2012, 12:59:34 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to 3.6.0

Location:

vendor/current/source3/libads

Files:

• ads_ldap_protos.h (added)
• ads_proto.h (added)
• ads_status.c (modified) (1 diff)
• ads_status.h (added)
• ads_struct.c (modified) (7 diffs)
• ads_utils.c (deleted)
• authdata.c (modified) (19 diffs)
• cldap.c (modified) (2 diffs)
• cldap.h (added)
• disp_sec.c (modified) (5 diffs)
• dns.c (modified) (8 diffs)
• dns.h (added)
• kerberos.c (modified) (10 diffs)
• kerberos_keytab.c (modified) (27 diffs)
• kerberos_proto.h (added)
• kerberos_util.c (added)
• kerberos_verify.c (modified) (38 diffs)
• krb5_setpw.c (modified) (7 diffs)
• ldap.c (modified) (29 diffs)
• ldap_printer.c (modified) (18 diffs)
• ldap_schema.c (modified) (3 diffs)
• ldap_schema.h (added)
• ldap_user.c (modified) (1 diff)
• ldap_utils.c (modified) (9 diffs)
• ndr.c (modified) (2 diffs)
• sasl.c (modified) (21 diffs)
• sasl_wrapping.c (modified) (1 diff)
• sitename_cache.c (added)
• sitename_cache.h (added)
• util.c (modified) (2 diffs)

vendor/current/source3/libads/ads_status.c

@@ -23 +23 @@
 #include "includes.h"
 #include "smb_krb5.h"
+#include "smb_ldap.h"
+#include "libads/ads_status.h"
 
 /*

vendor/current/source3/libads/ads_struct.c

@@ -4 +4 @@
    Copyright (C) Andrew Tridgell 2001
    Copyright (C) Andrew Bartlett 2001
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -20 +20 @@
 
 #include "includes.h"
+#include "ads.h"
 
 /* return a ldap dn path from a string, given separators and field name
@@ -56 +57 @@
         if (p) {
                 strlcat(ret, p, len);
-        
+
                 while ((p=strtok_r(NULL, sep, &saveptr)) != NULL) {
                         int retval;
@@ -93 +94 @@
 {
         char *dnsdomain = NULL;
-        
+
         /* result should always be shorter than the DN */
 
@@ -123 +124 @@
         ADS_STRUCT *ads;
         int wrap_flags;
-        
+
         ads = SMB_XMALLOC_P(ADS_STRUCT);
         ZERO_STRUCTP(ads);
-        
+
         ads->server.realm = realm? SMB_STRDUP(realm) : NULL;
         ads->server.workgroup = workgroup ? SMB_STRDUP(workgroup) : NULL;
@@ -150 +151 @@
 
         return ads;
+}
+
+/****************************************************************
+****************************************************************/
+
+bool ads_set_sasl_wrap_flags(ADS_STRUCT *ads, int flags)
+{
+        if (!ads) {
+                return false;
+        }
+
+        ads->auth.flags = flags;
+
+        return true;
 }
 
@@ -180 +195 @@
                 SAFE_FREE((*ads)->config.schema_path);
                 SAFE_FREE((*ads)->config.config_path);
-                
+
                 ZERO_STRUCTP(*ads);
 

vendor/current/source3/libads/authdata.c

@@ -26 +26 @@
 #include "librpc/gen_ndr/ndr_krb5pac.h"
 #include "smb_krb5.h"
-#include "authdata.h"
+#include "libads/kerberos_proto.h"
 
 #ifdef HAVE_KRB5
@@ -69 +69 @@
 }
 
-/****************************************************************
-****************************************************************/
-
- NTSTATUS decode_pac_data(TALLOC_CTX *mem_ctx,
+/**
+* @brief Decode a blob containing a NDR envoded PAC structure
+*
+* @param mem_ctx          - The memory context
+* @param pac_data_blob    - The data blob containing the NDR encoded data
+* @param context          - The Kerberos Context
+* @param service_keyblock - The Service Key used to verify the checksum
+* @param client_principal - The client principal
+* @param tgs_authtime     - The ticket timestamp
+* @param pac_data_out     - [out] The decoded PAC
+*
+* @return - A NTSTATUS error code
+*/
+NTSTATUS decode_pac_data(TALLOC_CTX *mem_ctx,
                          DATA_BLOB *pac_data_blob,
                          krb5_context context,
@@ -101 +111 @@
         DATA_BLOB *kdc_sig_blob = NULL;
 
+        bool bool_ret;
+
         *pac_data_out = NULL;
 
@@ -111 +123 @@
         }
 
-        ndr_err = ndr_pull_struct_blob(pac_data_blob, pac_data,
-                        NULL, pac_data,
+        ndr_err = ndr_pull_struct_blob(pac_data_blob, pac_data, pac_data,
                        (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -127 +138 @@
         }
 
-        ndr_err = ndr_pull_struct_blob(pac_data_blob, pac_data_raw,
-                                       NULL, pac_data_raw,
-                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA_RAW);
+        ndr_err = ndr_pull_struct_blob(
+                                pac_data_blob, pac_data_raw, pac_data_raw,
+                                (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA_RAW);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 status = ndr_map_error2ntstatus(ndr_err);
@@ -145 +156 @@
         if (pac_data->num_buffers != pac_data_raw->num_buffers) {
                 /* we need logon_ingo, service_key and kdc_key */
-                DEBUG(0,("misparse!  PAC_DATA has %d buffers while PAC_DATA_RAW has %d\n",
-                         pac_data->num_buffers, pac_data_raw->num_buffers));
+                DEBUG(0, ("misparse! PAC_DATA has %d buffers while "
+                          "PAC_DATA_RAW has %d\n", pac_data->num_buffers,
+                          pac_data_raw->num_buffers));
                 return NT_STATUS_INVALID_PARAMETER;
         }
 
         for (i=0; i < pac_data->num_buffers; i++) {
-                if (pac_data->buffers[i].type != pac_data_raw->buffers[i].type) {
-                        DEBUG(0,("misparse!  PAC_DATA buffer %d has type %d while PAC_DATA_RAW has %d\n",
-                                 i, pac_data->buffers[i].type, pac_data->buffers[i].type));
+                struct PAC_BUFFER *data_buf = &pac_data->buffers[i];
+                struct PAC_BUFFER_RAW *raw_buf = &pac_data_raw->buffers[i];
+
+                if (data_buf->type != raw_buf->type) {
+                        DEBUG(0, ("misparse! PAC_DATA buffer %d has type "
+                                  "%d while PAC_DATA_RAW has %d\n", i,
+                                  data_buf->type, raw_buf->type));
                         return NT_STATUS_INVALID_PARAMETER;
                 }
-                switch (pac_data->buffers[i].type) {
-                        case PAC_TYPE_LOGON_INFO:
-                                if (!pac_data->buffers[i].info) {
-                                        break;
-                                }
-                                logon_info = pac_data->buffers[i].info->logon_info.info;
+                switch (data_buf->type) {
+                case PAC_TYPE_LOGON_INFO:
+                        if (!data_buf->info) {
                                 break;
-                        case PAC_TYPE_SRV_CHECKSUM:
-                                if (!pac_data->buffers[i].info) {
-                                        break;
-                                }
-                                srv_sig_ptr = &pac_data->buffers[i].info->srv_cksum;
-                                srv_sig_blob = &pac_data_raw->buffers[i].info->remaining;
+                        }
+                        logon_info = data_buf->info->logon_info.info;
+                        break;
+                case PAC_TYPE_SRV_CHECKSUM:
+                        if (!data_buf->info) {
                                 break;
-                        case PAC_TYPE_KDC_CHECKSUM:
-                                if (!pac_data->buffers[i].info) {
-                                        break;
-                                }
-                                kdc_sig_ptr = &pac_data->buffers[i].info->kdc_cksum;
-                                kdc_sig_blob = &pac_data_raw->buffers[i].info->remaining;
+                        }
+                        srv_sig_ptr = &data_buf->info->srv_cksum;
+                        srv_sig_blob = &raw_buf->info->remaining;
+                        break;
+                case PAC_TYPE_KDC_CHECKSUM:
+                        if (!data_buf->info) {
                                 break;
-                        case PAC_TYPE_LOGON_NAME:
-                                logon_name = &pac_data->buffers[i].info->logon_name;
-                                break;
-                        default:
-                                break;
+                        }
+                        kdc_sig_ptr = &data_buf->info->kdc_cksum;
+                        kdc_sig_blob = &raw_buf->info->remaining;
+                        break;
+                case PAC_TYPE_LOGON_NAME:
+                        logon_name = &data_buf->info->logon_name;
+                        break;
+                default:
+                        break;
                 }
         }
@@ -205 +221 @@
         }
 
-        /* Find and zero out the signatures, as required by the signing algorithm */
-
-        /* We find the data blobs above, now we parse them to get at the exact portion we should zero */
-        ndr_err = ndr_pull_struct_blob(kdc_sig_blob, kdc_sig_wipe,
-                                       NULL, kdc_sig_wipe,
-                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
+        /* Find and zero out the signatures,
+         * as required by the signing algorithm */
+
+        /* We find the data blobs above,
+         * now we parse them to get at the exact portion we should zero */
+        ndr_err = ndr_pull_struct_blob(
+                        kdc_sig_blob, kdc_sig_wipe, kdc_sig_wipe,
+                        (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 status = ndr_map_error2ntstatus(ndr_err);
@@ -218 +236 @@
         }
 
-        ndr_err = ndr_pull_struct_blob(srv_sig_blob, srv_sig_wipe,
-                                       NULL, srv_sig_wipe,
-                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
+        ndr_err = ndr_pull_struct_blob(
+                        srv_sig_blob, srv_sig_wipe, srv_sig_wipe,
+                        (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 status = ndr_map_error2ntstatus(ndr_err);
@@ -229 +247 @@
 
         /* Now zero the decoded structure */
-        memset(kdc_sig_wipe->signature.data, '\0', kdc_sig_wipe->signature.length);
-        memset(srv_sig_wipe->signature.data, '\0', srv_sig_wipe->signature.length);
+        memset(kdc_sig_wipe->signature.data,
+                '\0', kdc_sig_wipe->signature.length);
+        memset(srv_sig_wipe->signature.data,
+                '\0', srv_sig_wipe->signature.length);
 
         /* and reencode, back into the same place it came from */
-        ndr_err = ndr_push_struct_blob(kdc_sig_blob, pac_data_raw,
-                                       NULL, kdc_sig_wipe,
-                                       (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
+        ndr_err = ndr_push_struct_blob(
+                        kdc_sig_blob, pac_data_raw, kdc_sig_wipe,
+                        (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 status = ndr_map_error2ntstatus(ndr_err);
@@ -242 +262 @@
                 return status;
         }
-        ndr_err = ndr_push_struct_blob(srv_sig_blob, pac_data_raw,
-                                       NULL, srv_sig_wipe,
-                                       (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
+        ndr_err = ndr_push_struct_blob(
+                        srv_sig_blob, pac_data_raw, srv_sig_wipe,
+                        (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 status = ndr_map_error2ntstatus(ndr_err);
@@ -253 +273 @@
 
         /* push out the whole structure, but now with zero'ed signatures */
-        ndr_err = ndr_push_struct_blob(&modified_pac_blob, pac_data_raw,
-                                       NULL, pac_data_raw,
-                                       (ndr_push_flags_fn_t)ndr_push_PAC_DATA_RAW);
+        ndr_err = ndr_push_struct_blob(
+                        &modified_pac_blob, pac_data_raw, pac_data_raw,
+                        (ndr_push_flags_fn_t)ndr_push_PAC_DATA_RAW);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 status = ndr_map_error2ntstatus(ndr_err);
@@ -269 +289 @@
                                  service_keyblock);
         if (ret) {
-                DEBUG(1, ("PAC Decode: Failed to verify the service signature: %s\n",
-                          error_message(ret)));
+                DEBUG(1, ("PAC Decode: Failed to verify the service "
+                          "signature: %s\n", error_message(ret)));
                 return NT_STATUS_ACCESS_DENIED;
         }
@@ -278 +298 @@
 
         if (tgs_authtime_nttime != logon_name->logon_time) {
-                DEBUG(2, ("PAC Decode: Logon time mismatch between ticket and PAC!\n"));
-                DEBUG(2, ("PAC Decode: PAC: %s\n", nt_time_string(mem_ctx, logon_name->logon_time)));
-                DEBUG(2, ("PAC Decode: Ticket: %s\n", nt_time_string(mem_ctx, tgs_authtime_nttime)));
+                DEBUG(2, ("PAC Decode: "
+                          "Logon time mismatch between ticket and PAC!\n"));
+                DEBUG(2, ("PAC Decode: PAC: %s\n",
+                          nt_time_string(mem_ctx, logon_name->logon_time)));
+                DEBUG(2, ("PAC Decode: Ticket: %s\n",
+                          nt_time_string(mem_ctx, tgs_authtime_nttime)));
                 return NT_STATUS_ACCESS_DENIED;
         }
 
-        ret = smb_krb5_parse_name_norealm(context, logon_name->account_name,
-                                    &client_principal_pac);
+        ret = smb_krb5_parse_name_norealm(context,
+                                          logon_name->account_name,
+                                          &client_principal_pac);
         if (ret) {
-                DEBUG(2, ("Could not parse name from incoming PAC: [%s]: %s\n",
-                          logon_name->account_name,
-                          error_message(ret)));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!smb_krb5_principal_compare_any_realm(context, client_principal, client_principal_pac)) {
-                DEBUG(2, ("Name in PAC [%s] does not match principal name in ticket\n",
-                          logon_name->account_name));
-                krb5_free_principal(context, client_principal_pac);
+                DEBUG(2, ("Could not parse name from PAC: [%s]:%s\n",
+                          logon_name->account_name, error_message(ret)));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        bool_ret = smb_krb5_principal_compare_any_realm(context,
+                                                        client_principal,
+                                                        client_principal_pac);
+
+        krb5_free_principal(context, client_principal_pac);
+
+        if (!bool_ret) {
+                DEBUG(2, ("Name in PAC [%s] does not match principal name "
+                          "in ticket\n", logon_name->account_name));
                 return NT_STATUS_ACCESS_DENIED;
         }
@@ -320 +348 @@
 
 /****************************************************************
-****************************************************************/
-
-struct PAC_LOGON_INFO *get_logon_info_from_pac(struct PAC_DATA *pac_data)
-{
-        int i;
-
-        for (i=0; i < pac_data->num_buffers; i++) {
-
-                if (pac_data->buffers[i].type != PAC_TYPE_LOGON_INFO) {
-                        continue;
-                }
-
-                return pac_data->buffers[i].info->logon_info.info;
-        }
-
-        return NULL;
-}
-
-/****************************************************************
+Given a username, password and other details, return the
+PAC_LOGON_INFO (the structure containing the important user
+information such as groups).
 ****************************************************************/
 
@@ -352 +364 @@
                              time_t renewable_time,
                              const char *impersonate_princ_s,
-                             struct PAC_DATA **pac_ret)
+                             struct PAC_LOGON_INFO **logon_info)
 {
         krb5_error_code ret;
         NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
         DATA_BLOB tkt, ap_rep, sesskey1, sesskey2;
-        struct PAC_DATA *pac_data = NULL;
         char *client_princ_out = NULL;
         const char *auth_princ = NULL;
@@ -425 +436 @@
         }
 
-        ret = cli_krb5_get_ticket(local_service,
+        ret = cli_krb5_get_ticket(mem_ctx,
+                                  local_service,
                                   time_offset,
                                   &tkt,
@@ -448 +460 @@
                                    &tkt,
                                    &client_princ_out,
-                                   &pac_data,
+                                   logon_info,
                                    &ap_rep,
                                    &sesskey2,
@@ -458 +470 @@
         }
 
-        if (!pac_data) {
+        if (!*logon_info) {
                 DEBUG(1,("no PAC\n"));
                 status = NT_STATUS_INVALID_PARAMETER;
                 goto out;
         }
-
-        *pac_ret = pac_data;
 
 out:
@@ -481 +491 @@
 }
 
-/****************************************************************
-****************************************************************/
-
-static NTSTATUS kerberos_return_pac_logon_info(TALLOC_CTX *mem_ctx,
-                                               const char *name,
-                                               const char *pass,
-                                               time_t time_offset,
-                                               time_t *expire_time,
-                                               time_t *renew_till_time,
-                                               const char *cache_name,
-                                               bool request_pac,
-                                               bool add_netbios_addr,
-                                               time_t renewable_time,
-                                               const char *impersonate_princ_s,
-                                               struct PAC_LOGON_INFO **logon_info)
-{
-        NTSTATUS status;
-        struct PAC_DATA *pac_data = NULL;
-        struct PAC_LOGON_INFO *info = NULL;
-
-        status = kerberos_return_pac(mem_ctx,
-                                     name,
-                                     pass,
-                                     time_offset,
-                                     expire_time,
-                                     renew_till_time,
-                                     cache_name,
-                                     request_pac,
-                                     add_netbios_addr,
-                                     renewable_time,
-                                     impersonate_princ_s,
-                                     &pac_data);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        if (!pac_data) {
-                DEBUG(3,("no pac\n"));
-                return NT_STATUS_INVALID_USER_BUFFER;
-        }
-
-        info = get_logon_info_from_pac(pac_data);
-        if (!info) {
-                DEBUG(1,("no logon_info\n"));
-                return NT_STATUS_INVALID_USER_BUFFER;
-        }
-
-        *logon_info = info;
-
-        return NT_STATUS_OK;
-}
-
-/****************************************************************
-****************************************************************/
-
-NTSTATUS kerberos_return_info3_from_pac(TALLOC_CTX *mem_ctx,
-                                        const char *name,
-                                        const char *pass,
-                                        time_t time_offset,
-                                        time_t *expire_time,
-                                        time_t *renew_till_time,
-                                        const char *cache_name,
-                                        bool request_pac,
-                                        bool add_netbios_addr,
-                                        time_t renewable_time,
-                                        const char *impersonate_princ_s,
-                                        struct netr_SamInfo3 **info3)
-{
-        NTSTATUS status;
-        struct PAC_LOGON_INFO *logon_info = NULL;
-
-        status = kerberos_return_pac_logon_info(mem_ctx,
-                                                name,
-                                                pass,
-                                                time_offset,
-                                                expire_time,
-                                                renew_till_time,
-                                                cache_name,
-                                                request_pac,
-                                                add_netbios_addr,
-                                                renewable_time,
-                                                impersonate_princ_s,
-                                                &logon_info);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        *info3 = &logon_info->info3;
-
-        return NT_STATUS_OK;
-}
 #endif

vendor/current/source3/libads/cldap.c

@@ -24 +24 @@
 #include "../libcli/cldap/cldap.h"
 #include "../lib/tsocket/tsocket.h"
+#include "libads/cldap.h"
 
 /*******************************************************************
@@ -93 +94 @@
         io.in.map_response      = false;
 
-        status = cldap_netlogon(cldap, NULL, reply, &io);
+        status = cldap_netlogon(cldap, reply, &io);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(2,("cldap_netlogon() failed: %s\n", nt_errstr(status)));

vendor/current/source3/libads/disp_sec.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "ads.h"
+#include "libads/ldap_schema.h"
+#include "../libcli/security/secace.h"
+#include "../librpc/ndr/libndr.h"
+
+/* for ADS */
+#define SEC_RIGHTS_FULL_CTRL            0xf01ff
 
 #ifdef HAVE_LDAP
@@ -28 +35 @@
         {SEC_RIGHTS_FULL_CTRL,          "[Full Control]"},
 
-        {SEC_RIGHTS_LIST_CONTENTS,      "[List Contents]"},
-        {SEC_RIGHTS_LIST_OBJECT,        "[List Object]"},
-
-        {SEC_RIGHTS_READ_ALL_PROP,      "[Read All Properties]"},       
-        {SEC_RIGHTS_READ_PERMS,         "[Read Permissions]"},  
-
-        {SEC_RIGHTS_WRITE_ALL_VALID,    "[All validate writes]"},
-        {SEC_RIGHTS_WRITE_ALL_PROP,     "[Write All Properties]"},
-
-        {SEC_RIGHTS_MODIFY_PERMS,       "[Modify Permissions]"},
-        {SEC_RIGHTS_MODIFY_OWNER,       "[Modify Owner]"},
-
-        {SEC_RIGHTS_CREATE_CHILD,       "[Create All Child Objects]"},
-
-        {SEC_RIGHTS_DELETE,             "[Delete]"},
-        {SEC_RIGHTS_DELETE_SUBTREE,     "[Delete Subtree]"},
-        {SEC_RIGHTS_DELETE_CHILD,       "[Delete All Child Objects]"},
-
-        {SEC_RIGHTS_CHANGE_PASSWD,      "[Change Password]"},   
-        {SEC_RIGHTS_RESET_PASSWD,       "[Reset Password]"},
+        {SEC_ADS_LIST,                  "[List Contents]"},
+        {SEC_ADS_LIST_OBJECT,           "[List Object]"},
+
+        {SEC_ADS_READ_PROP,             "[Read All Properties]"},
+        {SEC_STD_READ_CONTROL,          "[Read Permissions]"},
+
+        {SEC_ADS_SELF_WRITE,            "[All validate writes]"},
+        {SEC_ADS_WRITE_PROP,            "[Write All Properties]"},
+
+        {SEC_STD_WRITE_DAC,             "[Modify Permissions]"},
+        {SEC_STD_WRITE_OWNER,           "[Modify Owner]"},
+
+        {SEC_ADS_CREATE_CHILD,          "[Create All Child Objects]"},
+
+        {SEC_STD_DELETE,                "[Delete]"},
+        {SEC_ADS_DELETE_TREE,           "[Delete Subtree]"},
+        {SEC_ADS_DELETE_CHILD,          "[Delete All Child Objects]"},
+
+        {SEC_ADS_CONTROL_ACCESS,        "[Change Password]"},
+        {SEC_ADS_CONTROL_ACCESS,        "[Reset Password]"},
 
         {0,                             0}
@@ -130 +137 @@
 
 /* display ACE */
-static void ads_disp_ace(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, SEC_ACE *sec_ace)
+static void ads_disp_ace(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct security_ace *sec_ace)
 {
         const char *access_type = "UNKNOWN";
@@ -174 +181 @@
 
 /* display ACL */
-static void ads_disp_acl(SEC_ACL *sec_acl, const char *type)
+static void ads_disp_acl(struct security_acl *sec_acl, const char *type)
 {
         if (!sec_acl)
@@ -188 +195 @@
 
 /* display SD */
-void ads_disp_sd(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, SEC_DESC *sd)
+void ads_disp_sd(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct security_descriptor *sd)
 {
         int i;

vendor/current/source3/libads/dns.c

@@ -20 +20 @@
 
 #include "includes.h"
+#include "libads/dns.h"
+#include "../librpc/ndr/libndr.h"
 
 /* AIX resolv.h uses 'class' in struct ns_rr */
@@ -297 +299 @@
         static time_t last_dns_check = 0;
         static NTSTATUS last_dns_status = NT_STATUS_OK;
-        time_t now = time(NULL);
+        time_t now = time_mono(NULL);
 
         /* Try to prevent bursts of DNS lookups if the server is down */
@@ -332 +334 @@
                                         "talloc() failed!\n"));
                                 last_dns_status = NT_STATUS_NO_MEMORY;
-                                last_dns_check = time(NULL);
+                                last_dns_check = time_mono(NULL);
                                 return last_dns_status;
                         }
@@ -351 +353 @@
                                 last_dns_status = NT_STATUS_CONNECTION_REFUSED;
                         }
-                        last_dns_check = time(NULL);
+                        last_dns_check = time_mono(NULL);
                         return last_dns_status;
                 }
@@ -365 +367 @@
                                 TALLOC_FREE( buffer );
                                 last_dns_status = NT_STATUS_BUFFER_TOO_SMALL;
-                                last_dns_check = time(NULL);
+                                last_dns_check = time_mono(NULL);
                                 return last_dns_status;
                         }
@@ -378 +380 @@
         *resp_length = resp_len;
 
-        last_dns_check = time(NULL);
+        last_dns_check = time_mono(NULL);
         last_dns_status = NT_STATUS_OK;
         return last_dns_status;
@@ -564 +566 @@
         }
 
-        qsort( dcs, idx, sizeof(struct dns_rr_srv), QSORT_CAST dnssrvcmp );
+        TYPESAFE_QSORT(dcs, idx, dnssrvcmp );
 
         *dclist = dcs;
@@ -727 +729 @@
 }
 
-/****************************************************************************
- Store and fetch the AD client sitename.
-****************************************************************************/
-
-#define SITENAME_KEY    "AD_SITENAME/DOMAIN/%s"
-
-static char *sitename_key(const char *realm)
-{
-        char *keystr;
-
-        if (asprintf_strupper_m(&keystr, SITENAME_KEY, realm) == -1) {
-                return NULL;
-        }
-
-        return keystr;
-}
-
-
-/****************************************************************************
- Store the AD client sitename.
- We store indefinately as every new CLDAP query will re-write this.
-****************************************************************************/
-
-bool sitename_store(const char *realm, const char *sitename)
-{
-        time_t expire;
-        bool ret = False;
-        char *key;
-
-        if (!realm || (strlen(realm) == 0)) {
-                DEBUG(0,("sitename_store: no realm\n"));
-                return False;
-        }
-
-        key = sitename_key(realm);
-
-        if (!sitename || (sitename && !*sitename)) {
-                DEBUG(5,("sitename_store: deleting empty sitename!\n"));
-                ret = gencache_del(key);
-                SAFE_FREE(key);
-                return ret;
-        }
-
-        expire = get_time_t_max(); /* Store indefinately. */
-
-        DEBUG(10,("sitename_store: realm = [%s], sitename = [%s], expire = [%u]\n",
-                realm, sitename, (unsigned int)expire ));
-
-        ret = gencache_set( key, sitename, expire );
-        SAFE_FREE(key);
-        return ret;
-}
-
-/****************************************************************************
- Fetch the AD client sitename.
- Caller must free.
-****************************************************************************/
-
-char *sitename_fetch(const char *realm)
-{
-        char *sitename = NULL;
-        time_t timeout;
-        bool ret = False;
-        const char *query_realm;
-        char *key;
-
-        if (!realm || (strlen(realm) == 0)) {
-                query_realm = lp_realm();
-        } else {
-                query_realm = realm;
-        }
-
-        key = sitename_key(query_realm);
-
-        ret = gencache_get( key, &sitename, &timeout );
-        SAFE_FREE(key);
-        if ( !ret ) {
-                DEBUG(5,("sitename_fetch: No stored sitename for %s\n",
-                        query_realm));
-        } else {
-                DEBUG(5,("sitename_fetch: Returning sitename for %s: \"%s\"\n",
-                        query_realm, sitename ));
-        }
-        return sitename;
-}
-
-/****************************************************************************
- Did the sitename change ?
-****************************************************************************/
-
-bool stored_sitename_changed(const char *realm, const char *sitename)
-{
-        bool ret = False;
-
-        char *new_sitename;
-
-        if (!realm || (strlen(realm) == 0)) {
-                DEBUG(0,("stored_sitename_changed: no realm\n"));
-                return False;
-        }
-
-        new_sitename = sitename_fetch(realm);
-
-        if (sitename && new_sitename && !strequal(sitename, new_sitename)) {
-                ret = True;
-        } else if ((sitename && !new_sitename) ||
-                        (!sitename && new_sitename)) {
-                ret = True;
-        }
-        SAFE_FREE(new_sitename);
-        return ret;
-}
-
 /********************************************************************
  Query with optional sitename.

vendor/current/source3/libads/kerberos.c

@@ -12 +12 @@
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -23 +23 @@
 
 #include "includes.h"
+#include "system/filesys.h"
 #include "smb_krb5.h"
+#include "../librpc/gen_ndr/ndr_misc.h"
+#include "libads/kerberos_proto.h"
+#include "secrets.h"
 
 #ifdef HAVE_KRB5
@@ -91 +95 @@
         data_blob_free(&edata);
 
-        ndr_err = ndr_pull_struct_blob_all(&unwrapped_edata, mem_ctx, NULL,
-                        &parsed_edata,
-                        (ndr_pull_flags_fn_t)ndr_pull_KRB5_EDATA_NTSTATUS);
+        ndr_err = ndr_pull_struct_blob_all(&unwrapped_edata, mem_ctx, 
+                &parsed_edata, (ndr_pull_flags_fn_t)ndr_pull_KRB5_EDATA_NTSTATUS);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 data_blob_free(&unwrapped_edata);
@@ -191 +194 @@
                 goto out;
         }
-        
+
         if ((code = smb_krb5_parse_name(ctx, principal, &me))) {
                 goto out;
@@ -230 +233 @@
                 goto out;
         }
-        
+
         if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
                 goto out;
@@ -283 +286 @@
         }
         return code;
-}
-
-
-
-/* run kinit to setup our ccache */
-int ads_kinit_password(ADS_STRUCT *ads)
-{
-        char *s;
-        int ret;
-        const char *account_name;
-        fstring acct_name;
-
-        if (ads->auth.flags & ADS_AUTH_USER_CREDS) {
-                account_name = ads->auth.user_name;
-                goto got_accountname;
-        }
-
-        if ( IS_DC ) {
-                /* this will end up getting a ticket for DOMAIN@RUSTED.REA.LM */
-                account_name = lp_workgroup();
-        } else {
-                /* always use the sAMAccountName for security = domain */
-                /* global_myname()$@REA.LM */
-                if ( lp_security() == SEC_DOMAIN ) {
-                        fstr_sprintf( acct_name, "%s$", global_myname() );
-                        account_name = acct_name;
-                }
-                else 
-                        /* This looks like host/global_myname()@REA.LM */
-                        account_name = ads->auth.user_name;
-        }
-
- got_accountname:
-        if (asprintf(&s, "%s@%s", account_name, ads->auth.realm) == -1) {
-                return KRB5_CC_NOMEM;
-        }
-
-        if (!ads->auth.password) {
-                SAFE_FREE(s);
-                return KRB5_LIBOS_CANTREADPWD;
-        }
-        
-        ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset,
-                        &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable, 
-                        NULL);
-
-        if (ret) {
-                DEBUG(0,("kerberos_kinit_password %s failed: %s\n", 
-                         s, error_message(ret)));
-        }
-        SAFE_FREE(s);
-        return ret;
 }
 
@@ -349 +300 @@
                 return code;
         }
-  
+
         if (!cc_name) {
                 if ((code = krb5_cc_default(ctx, &cc))) {
@@ -592 +543 @@
         char *unparsed_name = NULL, *salt_princ_s = NULL;
         krb5_principal ret_princ = NULL;
-        
+
         /* lookup new key first */
 
         if ( (salt_princ_s = kerberos_secrets_fetch_des_salt()) == NULL ) {
-        
+
                 /* look under the old key.  If this fails, just use the standard key */
 
@@ -611 +562 @@
                 ret_princ = NULL;
         }
-        
+
         TALLOC_FREE(unparsed_name);
         SAFE_FREE(salt_princ_s);
-        
+
         return ret_princ;
 }
@@ -655 +606 @@
         if (smb_krb5_parse_name(context, princ_s, &princ) != 0) {
                 goto out;
-                
         }
         if (smb_krb5_unparse_name(talloc_tos(), context, princ, &unparsed_name) != 0) {

vendor/current/source3/libads/kerberos_keytab.c

@@ -28 +28 @@
 #include "includes.h"
 #include "smb_krb5.h"
+#include "ads.h"
+#include "secrets.h"
 
 #ifdef HAVE_KRB5
@@ -34 +36 @@
 **********************************************************************/
 
-int smb_krb5_kt_add_entry_ext(krb5_context context,
-                              krb5_keytab keytab,
-                              krb5_kvno kvno,
-                              const char *princ_s,
-                              krb5_enctype *enctypes,
-                              krb5_data password,
-                              bool no_salt,
-                              bool keep_old_entries)
+static krb5_error_code seek_and_delete_old_entries(krb5_context context,
+                                                   krb5_keytab keytab,
+                                                   krb5_kvno kvno,
+                                                   const char *princ_s,
+                                                   krb5_principal princ,
+                                                   bool flush,
+                                                   bool keep_old_entries)
 {
-        krb5_error_code ret = 0;
+        krb5_error_code ret;
         krb5_kt_cursor cursor;
+        krb5_kt_cursor zero_csr;
         krb5_keytab_entry kt_entry;
-        krb5_principal princ = NULL;
-        int i;
+        krb5_keytab_entry zero_kt_entry;
         char *ktprinc = NULL;
 
+        ZERO_STRUCT(cursor);
+        ZERO_STRUCT(zero_csr);
         ZERO_STRUCT(kt_entry);
-        ZERO_STRUCT(cursor);
-        
-        ret = smb_krb5_parse_name(context, princ_s, &princ);
-        if (ret) {
-                DEBUG(1,("smb_krb5_kt_add_entry_ext: smb_krb5_parse_name(%s) failed (%s)\n", princ_s, error_message(ret)));
-                goto out;
-        }
-
-        /* Seek and delete old keytab entries */
+        ZERO_STRUCT(zero_kt_entry);
+
         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
-        if (ret != KRB5_KT_END && ret != ENOENT ) {
-                DEBUG(3,("smb_krb5_kt_add_entry_ext: Will try to delete old keytab entries\n"));
-                while(!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
-                        bool compare_name_ok = False;
-
-                        ret = smb_krb5_unparse_name(talloc_tos(), context, kt_entry.principal, &ktprinc);
+        if (ret == KRB5_KT_END || ret == ENOENT ) {
+                /* no entries */
+                return 0;
+        }
+
+        DEBUG(3, (__location__ ": Will try to delete old keytab entries\n"));
+        while (!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
+                bool name_ok = False;
+
+                if (!flush && (princ_s != NULL)) {
+                        ret = smb_krb5_unparse_name(talloc_tos(), context,
+                                                    kt_entry.principal,
+                                                    &ktprinc);
                         if (ret) {
-                                DEBUG(1,("smb_krb5_kt_add_entry_ext: smb_krb5_unparse_name failed (%s)\n",
-                                        error_message(ret)));
+                                DEBUG(1, (__location__
+                                          ": smb_krb5_unparse_name failed "
+                                          "(%s)\n", error_message(ret)));
                                 goto out;
                         }
 
-                        /*---------------------------------------------------------------------------
-                         * Save the entries with kvno - 1.   This is what microsoft does
-                         * to allow people with existing sessions that have kvno - 1 to still
-                         * work.   Otherwise, when the password for the machine changes, all
-                         * kerberizied sessions will 'break' until either the client reboots or
-                         * the client's session key expires and they get a new session ticket
-                         * with the new kvno.
-                         */
-
 #ifdef HAVE_KRB5_KT_COMPARE
-                        compare_name_ok = (krb5_kt_compare(context, &kt_entry, princ, 0, 0) == True);
+                        name_ok = krb5_kt_compare(context, &kt_entry,
+                                                  princ, 0, 0);
 #else
-                        compare_name_ok = (strcmp(ktprinc, princ_s) == 0);
+                        name_ok = (strcmp(ktprinc, princ_s) == 0);
 #endif
 
-                        if (!compare_name_ok) {
-                                DEBUG(10,("smb_krb5_kt_add_entry_ext: ignoring keytab entry principal %s, kvno = %d\n",
-                                        ktprinc, kt_entry.vno));
+                        if (!name_ok) {
+                                DEBUG(10, (__location__ ": ignoring keytab "
+                                           "entry principal %s, kvno = %d\n",
+                                           ktprinc, kt_entry.vno));
+
+                                /* Not a match,
+                                 * just free this entry and continue. */
+                                ret = smb_krb5_kt_free_entry(context,
+                                                             &kt_entry);
+                                ZERO_STRUCT(kt_entry);
+                                if (ret) {
+                                        DEBUG(1, (__location__
+                                                  ": smb_krb5_kt_free_entry "
+                                                  "failed (%s)\n",
+                                                  error_message(ret)));
+                                        goto out;
+                                }
+
+                                TALLOC_FREE(ktprinc);
+                                continue;
                         }
 
                         TALLOC_FREE(ktprinc);
-
-                        if (compare_name_ok) {
-                                if (kt_entry.vno == kvno - 1) {
-                                        DEBUG(5,("smb_krb5_kt_add_entry_ext: Saving previous (kvno %d) entry for principal: %s.\n",
-                                                kvno - 1, princ_s));
-                                } else if (!keep_old_entries) {
-                                        DEBUG(5,("smb_krb5_kt_add_entry_ext: Found old entry for principal: %s (kvno %d) - trying to remove it.\n",
-                                                princ_s, kt_entry.vno));
-                                        ret = krb5_kt_end_seq_get(context, keytab, &cursor);
-                                        ZERO_STRUCT(cursor);
-                                        if (ret) {
-                                                DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_end_seq_get() failed (%s)\n",
-                                                        error_message(ret)));
-                                                goto out;
-                                        }
-                                        ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
-                                        if (ret) {
-                                                DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_remove_entry failed (%s)\n",
-                                                        error_message(ret)));
-                                                goto out;
-                                        }
-
-                                        DEBUG(5,("smb_krb5_kt_add_entry_ext: removed old entry for principal: %s (kvno %d).\n",
-                                                princ_s, kt_entry.vno));
-
-                                        ret = krb5_kt_start_seq_get(context, keytab, &cursor);
-                                        if (ret) {
-                                                DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_start_seq failed (%s)\n",
-                                                        error_message(ret)));
-                                                goto out;
-                                        }
-                                        ret = smb_krb5_kt_free_entry(context, &kt_entry);
-                                        ZERO_STRUCT(kt_entry);
-                                        if (ret) {
-                                                DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_remove_entry failed (%s)\n",
-                                                        error_message(ret)));
-                                                goto out;
-                                        }
-                                        continue;
-                                }
-                        }
-
-                        /* Not a match, just free this entry and continue. */
-                        ret = smb_krb5_kt_free_entry(context, &kt_entry);
-                        ZERO_STRUCT(kt_entry);
-                        if (ret) {
-                                DEBUG(1,("smb_krb5_kt_add_entry_ext: smb_krb5_kt_free_entry failed (%s)\n", error_message(ret)));
-                                goto out;
-                        }
-                }
+                }
+
+                /*------------------------------------------------------------
+                 * Save the entries with kvno - 1. This is what microsoft does
+                 * to allow people with existing sessions that have kvno - 1
+                 * to still work. Otherwise, when the password for the machine
+                 * changes, all kerberizied sessions will 'break' until either
+                 * the client reboots or the client's session key expires and
+                 * they get a new session ticket with the new kvno.
+                 */
+
+                if (!flush && (kt_entry.vno == kvno - 1)) {
+                        DEBUG(5, (__location__ ": Saving previous (kvno %d) "
+                                  "entry for principal: %s.\n",
+                                  kvno - 1, princ_s));
+                        continue;
+                }
+
+                if (keep_old_entries) {
+                        DEBUG(5, (__location__ ": Saving old (kvno %d) "
+                                  "entry for principal: %s.\n",
+                                  kvno, princ_s));
+                        continue;
+                }
+
+                DEBUG(5, (__location__ ": Found old entry for principal: %s "
+                          "(kvno %d) - trying to remove it.\n",
+                          princ_s, kt_entry.vno));
 
                 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
                 ZERO_STRUCT(cursor);
                 if (ret) {
-                        DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_end_seq_get failed (%s)\n",error_message(ret)));
-                        goto out;
-                }
-        }
-
-        /* Ensure we don't double free. */
-        ZERO_STRUCT(kt_entry);
-        ZERO_STRUCT(cursor);
-
-        /* If we get here, we have deleted all the old entries with kvno's not equal to the current kvno-1. */
-
-        /* Now add keytab entries for all encryption types */
-        for (i = 0; enctypes[i]; i++) {
-                krb5_keyblock *keyp;
-
-                keyp = KRB5_KT_KEY(&kt_entry);
-
-                if (create_kerberos_key_from_string(context, princ, &password, keyp, enctypes[i], no_salt)) {
-                        continue;
-                }
-
-                kt_entry.principal = princ;
-                kt_entry.vno       = kvno;
-
-                DEBUG(3,("smb_krb5_kt_add_entry_ext: adding keytab entry for (%s) with encryption type (%d) and version (%d)\n",
-                        princ_s, enctypes[i], kt_entry.vno));
-                ret = krb5_kt_add_entry(context, keytab, &kt_entry);
-                krb5_free_keyblock_contents(context, keyp);
+                        DEBUG(1, (__location__ ": krb5_kt_end_seq_get() "
+                                  "failed (%s)\n", error_message(ret)));
+                        goto out;
+                }
+                ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
+                if (ret) {
+                        DEBUG(1, (__location__ ": krb5_kt_remove_entry() "
+                                  "failed (%s)\n", error_message(ret)));
+                        goto out;
+                }
+
+                DEBUG(5, (__location__ ": removed old entry for principal: "
+                          "%s (kvno %d).\n", princ_s, kt_entry.vno));
+
+                ret = krb5_kt_start_seq_get(context, keytab, &cursor);
+                if (ret) {
+                        DEBUG(1, (__location__ ": krb5_kt_start_seq() failed "
+                                  "(%s)\n", error_message(ret)));
+                        goto out;
+                }
+                ret = smb_krb5_kt_free_entry(context, &kt_entry);
                 ZERO_STRUCT(kt_entry);
                 if (ret) {
-                        DEBUG(1,("smb_krb5_kt_add_entry_ext: adding entry to keytab failed (%s)\n", error_message(ret)));
-                        goto out;
-                }
-        }
-
+                        DEBUG(1, (__location__ ": krb5_kt_remove_entry() "
+                                  "failed (%s)\n", error_message(ret)));
+                        goto out;
+                }
+        }
 
 out:
-        {
-                krb5_keytab_entry zero_kt_entry;
-                ZERO_STRUCT(zero_kt_entry);
-                if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
-                        smb_krb5_kt_free_entry(context, &kt_entry);
-                }
-        }
-        if (princ) {
-                krb5_free_principal(context, princ);
-        }
-        
-        {
-                krb5_kt_cursor zero_csr;
-                ZERO_STRUCT(zero_csr);
-                if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
-                        krb5_kt_end_seq_get(context, keytab, &cursor);  
-                }
-        }
-        
-        return (int)ret;
+        if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
+                smb_krb5_kt_free_entry(context, &kt_entry);
+        }
+        if (keytab) {
+                if (memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) {
+                        krb5_kt_end_seq_get(context, keytab, &cursor);
+                }
+        }
+
+        return ret;
 }
 
@@ -212 +186 @@
                                  const char *princ_s,
                                  krb5_enctype *enctypes,
-                                 krb5_data password)
+                                 krb5_data password,
+                                 bool no_salt,
+                                 bool keep_old_entries)
 {
-        return smb_krb5_kt_add_entry_ext(context,
-                                         keytab,
-                                         kvno,
-                                         princ_s,
-                                         enctypes,
-                                         password,
-                                         false,
-                                         false);
+        krb5_error_code ret;
+        krb5_keytab_entry kt_entry;
+        krb5_principal princ = NULL;
+        int i;
+
+        ZERO_STRUCT(kt_entry);
+
+        ret = smb_krb5_parse_name(context, princ_s, &princ);
+        if (ret) {
+                DEBUG(1, (__location__ ": smb_krb5_parse_name(%s) "
+                          "failed (%s)\n", princ_s, error_message(ret)));
+                goto out;
+        }
+
+        /* Seek and delete old keytab entries */
+        ret = seek_and_delete_old_entries(context, keytab, kvno,
+                                          princ_s, princ, false,
+                                          keep_old_entries);
+        if (ret) {
+                goto out;
+        }
+
+        /* If we get here, we have deleted all the old entries with kvno's
+         * not equal to the current kvno-1. */
+
+        /* Now add keytab entries for all encryption types */
+        for (i = 0; enctypes[i]; i++) {
+                krb5_keyblock *keyp;
+
+                keyp = KRB5_KT_KEY(&kt_entry);
+
+                if (create_kerberos_key_from_string(context, princ,
+                                                    &password, keyp,
+                                                    enctypes[i], no_salt)) {
+                        continue;
+                }
+
+                kt_entry.principal = princ;
+                kt_entry.vno       = kvno;
+
+                DEBUG(3, (__location__ ": adding keytab entry for (%s) with "
+                          "encryption type (%d) and version (%d)\n",
+                          princ_s, enctypes[i], kt_entry.vno));
+                ret = krb5_kt_add_entry(context, keytab, &kt_entry);
+                krb5_free_keyblock_contents(context, keyp);
+                ZERO_STRUCT(kt_entry);
+                if (ret) {
+                        DEBUG(1, (__location__ ": adding entry to keytab "
+                                  "failed (%s)\n", error_message(ret)));
+                        goto out;
+                }
+        }
+
+out:
+        if (princ) {
+                krb5_free_principal(context, princ);
+        }
+
+        return (int)ret;
 }
 
@@ -235 +262 @@
         krb5_data password;
         krb5_kvno kvno;
-        krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 };
-        char *princ_s = NULL, *short_princ_s = NULL;
+        krb5_enctype enctypes[4] = {
+                ENCTYPE_DES_CBC_CRC,
+                ENCTYPE_DES_CBC_MD5,
+                ENCTYPE_ARCFOUR_HMAC,
+                0
+        };
+        char *princ_s = NULL;
+        char *short_princ_s = NULL;
         char *password_s = NULL;
         char *my_fqdn;
-        TALLOC_CTX *ctx = NULL;
+        TALLOC_CTX *tmpctx = NULL;
         char *machine_name;
-
-#if defined(ENCTYPE_ARCFOUR_HMAC)
-        enctypes[2] = ENCTYPE_ARCFOUR_HMAC;
-#endif
+        ADS_STATUS aderr;
 
         initialize_krb5_error_table();
         ret = krb5_init_context(&context);
         if (ret) {
-                DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret)));
+                DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
+                          error_message(ret)));
                 return -1;
         }
@@ -255 +286 @@
         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
         if (ret) {
-                DEBUG(1,("ads_keytab_add_entry: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
+                DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
+                          error_message(ret)));
                 goto out;
         }
@@ -261 +293 @@
         /* retrieve the password */
         if (!secrets_init()) {
-                DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n"));
+                DEBUG(1, (__location__ ": secrets_init failed\n"));
                 ret = -1;
                 goto out;
@@ -267 +299 @@
         password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
         if (!password_s) {
-                DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n"));
+                DEBUG(1, (__location__ ": failed to fetch machine password\n"));
                 ret = -1;
                 goto out;
@@ -276 +308 @@
 
         /* we need the dNSHostName value here */
-        
-        if ( (ctx = talloc_init("ads_keytab_add_entry")) == NULL ) {
-                DEBUG(0,("ads_keytab_add_entry: talloc() failed!\n"));
-                ret = -1;
-                goto out;
-        }
-        
-        if ( (my_fqdn = ads_get_dnshostname( ads, ctx, global_myname())) == NULL ) {
-                DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's dns name in AD!\n"));
-                ret = -1;
-                goto out;       
-        }
-        
-        if ( (machine_name = ads_get_samaccountname( ads, ctx, global_myname())) == NULL ) {
-                DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's short name in AD!\n"));
-                ret = -1;
-                goto out;       
+        tmpctx = talloc_init(__location__);
+        if (!tmpctx) {
+                DEBUG(0, (__location__ ": talloc_init() failed!\n"));
+                ret = -1;
+                goto out;
+        }
+
+        my_fqdn = ads_get_dnshostname(ads, tmpctx, global_myname());
+        if (!my_fqdn) {
+                DEBUG(0, (__location__ ": unable to determine machine "
+                          "account's dns name in AD!\n"));
+                ret = -1;
+                goto out;
+        }
+
+        machine_name = ads_get_samaccountname(ads, tmpctx, global_myname());
+        if (!machine_name) {
+                DEBUG(0, (__location__ ": unable to determine machine "
+                          "account's short name in AD!\n"));
+                ret = -1;
+                goto out;
         }
         /*strip the trailing '$' */
         machine_name[strlen(machine_name)-1] = '\0';
-                
+
         /* Construct our principal */
-
         if (strchr_m(srvPrinc, '@')) {
                 /* It's a fully-named principal. */
-                if (asprintf(&princ_s, "%s", srvPrinc) == -1) {
+                princ_s = talloc_asprintf(tmpctx, "%s", srvPrinc);
+                if (!princ_s) {
                         ret = -1;
                         goto out;
@@ -307 +343 @@
         } else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
                 /* It's the machine account, as used by smbclient clients. */
-                if (asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm()) == -1) {
+                princ_s = talloc_asprintf(tmpctx, "%s@%s",
+                                          srvPrinc, lp_realm());
+                if (!princ_s) {
                         ret = -1;
                         goto out;
@@ -315 +353 @@
                  * can obtain credentials for it and double-check the salt value
                  * used to generate the service's keys. */
-                 
-                if (asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm()) == -1) {
+
+                princ_s = talloc_asprintf(tmpctx, "%s/%s@%s",
+                                          srvPrinc, my_fqdn, lp_realm());
+                if (!princ_s) {
                         ret = -1;
                         goto out;
                 }
-                if (asprintf(&short_princ_s, "%s/%s@%s", srvPrinc, machine_name, lp_realm()) == -1) {
+                short_princ_s = talloc_asprintf(tmpctx, "%s/%s@%s",
+                                                srvPrinc, machine_name,
+                                                lp_realm());
+                if (!princ_s) {
                         ret = -1;
                         goto out;
                 }
-                
-                /* According to http://support.microsoft.com/kb/326985/en-us, 
-                   certain principal names are automatically mapped to the host/...
-                   principal in the AD account.  So only create these in the 
-                   keytab, not in AD.  --jerry */
-                   
-                if ( !strequal( srvPrinc, "cifs" ) && !strequal(srvPrinc, "host" ) ) {
-                        DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s));
-                        
-                        if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), my_fqdn, srvPrinc))) {
-                                DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n"));
+
+                /* According to http://support.microsoft.com/kb/326985/en-us,
+                   certain principal names are automatically mapped to the
+                   host/... principal in the AD account.
+                   So only create these in the keytab, not in AD.  --jerry */
+
+                if (!strequal(srvPrinc, "cifs") &&
+                    !strequal(srvPrinc, "host")) {
+                        DEBUG(3, (__location__ ": Attempting to add/update "
+                                  "'%s'\n", princ_s));
+
+                        aderr = ads_add_service_principal_name(ads,
+                                        global_myname(), my_fqdn, srvPrinc);
+                        if (!ADS_ERR_OK(aderr)) {
+                                DEBUG(1, (__location__ ": failed to "
+                                         "ads_add_service_principal_name.\n"));
                                 goto out;
                         }
@@ -340 +388 @@
         }
 
-        kvno = (krb5_kvno) ads_get_machine_kvno(ads, global_myname());
-        if (kvno == -1) {       /* -1 indicates failure, everything else is OK */
-                DEBUG(1,("ads_keytab_add_entry: ads_get_machine_kvno failed to determine the system's kvno.\n"));
-                ret = -1;
-                goto out;
-        }
-        
+        kvno = (krb5_kvno)ads_get_machine_kvno(ads, global_myname());
+        if (kvno == -1) {
+                /* -1 indicates failure, everything else is OK */
+                DEBUG(1, (__location__ ": ads_get_machine_kvno failed to "
+                         "determine the system's kvno.\n"));
+                ret = -1;
+                goto out;
+        }
+
         /* add the fqdn principal to the keytab */
-        
-        ret = smb_krb5_kt_add_entry( context, keytab, kvno, princ_s, enctypes, password );
-        if ( ret ) {
-                DEBUG(1,("ads_keytab_add_entry: Failed to add entry to keytab file\n"));
-                goto out;
-        }
-        
+        ret = smb_krb5_kt_add_entry(context, keytab, kvno,
+                                    princ_s, enctypes, password,
+                                    false, false);
+        if (ret) {
+                DEBUG(1, (__location__ ": Failed to add entry to keytab\n"));
+                goto out;
+        }
+
         /* add the short principal name if we have one */
-        
-        if ( short_princ_s ) {
-                ret = smb_krb5_kt_add_entry( context, keytab, kvno, short_princ_s, enctypes, password );
-                if ( ret ) {
-                        DEBUG(1,("ads_keytab_add_entry: Failed to add short entry to keytab file\n"));
+        if (short_princ_s) {
+                ret = smb_krb5_kt_add_entry(context, keytab, kvno,
+                                            short_princ_s, enctypes, password,
+                                            false, false);
+                if (ret) {
+                        DEBUG(1, (__location__
+                                  ": Failed to add short entry to keytab\n"));
                         goto out;
                 }
@@ -366 +419 @@
 
 out:
-        SAFE_FREE( princ_s );
-        SAFE_FREE( short_princ_s );
-        TALLOC_FREE( ctx );
-        
+        TALLOC_FREE(tmpctx);
+
         if (keytab) {
                 krb5_kt_close(context, keytab);
@@ -388 +439 @@
         krb5_context context = NULL;
         krb5_keytab keytab = NULL;
-        krb5_kt_cursor cursor;
-        krb5_keytab_entry kt_entry;
         krb5_kvno kvno;
-
-        ZERO_STRUCT(kt_entry);
-        ZERO_STRUCT(cursor);
+        ADS_STATUS aderr;
 
         initialize_krb5_error_table();
         ret = krb5_init_context(&context);
         if (ret) {
-                DEBUG(1,("ads_keytab_flush: could not krb5_init_context: %s\n",error_message(ret)));
+                DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
+                          error_message(ret)));
                 return ret;
         }
@@ -404 +452 @@
         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
         if (ret) {
-                DEBUG(1,("ads_keytab_flush: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
-                goto out;
-        }
-
-        kvno = (krb5_kvno) ads_get_machine_kvno(ads, global_myname());
-        if (kvno == -1) {       /* -1 indicates a failure */
-                DEBUG(1,("ads_keytab_flush: Error determining the system's kvno.\n"));
-                goto out;
-        }
-
-        ret = krb5_kt_start_seq_get(context, keytab, &cursor);
-        if (ret != KRB5_KT_END && ret != ENOENT) {
-                while (!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
-                        ret = krb5_kt_end_seq_get(context, keytab, &cursor);
-                        ZERO_STRUCT(cursor);
-                        if (ret) {
-                                DEBUG(1,("ads_keytab_flush: krb5_kt_end_seq_get() failed (%s)\n",error_message(ret)));
-                                goto out;
-                        }
-                        ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
-                        if (ret) {
-                                DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret)));
-                                goto out;
-                        }
-                        ret = krb5_kt_start_seq_get(context, keytab, &cursor);
-                        if (ret) {
-                                DEBUG(1,("ads_keytab_flush: krb5_kt_start_seq failed (%s)\n",error_message(ret)));
-                                goto out;
-                        }
-                        ret = smb_krb5_kt_free_entry(context, &kt_entry);
-                        ZERO_STRUCT(kt_entry);
-                        if (ret) {
-                                DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret)));
-                                goto out;
-                        }
-                }
-        }
-
-        /* Ensure we don't double free. */
-        ZERO_STRUCT(kt_entry);
-        ZERO_STRUCT(cursor);
-
-        if (!ADS_ERR_OK(ads_clear_service_principal_names(ads, global_myname()))) {
-                DEBUG(1,("ads_keytab_flush: Error while clearing service principal listings in LDAP.\n"));
+                DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
+                          error_message(ret)));
+                goto out;
+        }
+
+        kvno = (krb5_kvno)ads_get_machine_kvno(ads, global_myname());
+        if (kvno == -1) {
+                /* -1 indicates a failure */
+                DEBUG(1, (__location__ ": Error determining the kvno.\n"));
+                goto out;
+        }
+
+        /* Seek and delete old keytab entries */
+        ret = seek_and_delete_old_entries(context, keytab, kvno,
+                                          NULL, NULL, true, false);
+        if (ret) {
+                goto out;
+        }
+
+        aderr = ads_clear_service_principal_names(ads, global_myname());
+        if (!ADS_ERR_OK(aderr)) {
+                DEBUG(1, (__location__ ": Error while clearing service "
+                          "principal listings in LDAP.\n"));
                 goto out;
         }
 
 out:
-
-        {
-                krb5_keytab_entry zero_kt_entry;
-                ZERO_STRUCT(zero_kt_entry);
-                if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
-                        smb_krb5_kt_free_entry(context, &kt_entry);
-                }
-        }
-        {
-                krb5_kt_cursor zero_csr;
-                ZERO_STRUCT(zero_csr);
-                if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
-                        krb5_kt_end_seq_get(context, keytab, &cursor);  
-                }
-        }
         if (keytab) {
                 krb5_kt_close(context, keytab);
@@ -491 +503 @@
         char *sam_account_name, *upn;
         char **oldEntries = NULL, *princ_s[26];
-        TALLOC_CTX *ctx = NULL;
-        fstring machine_name;
+        TALLOC_CTX *tmpctx = NULL;
+        char *machine_name;
+
+        /* these are the main ones we need */
+        ret = ads_keytab_add_entry(ads, "host");
+        if (ret != 0) {
+                DEBUG(1, (__location__ ": ads_keytab_add_entry failed while "
+                          "adding 'host' principal.\n"));
+                return ret;
+        }
+
+
+#if 0   /* don't create the CIFS/... keytab entries since no one except smbd
+           really needs them and we will fall back to verifying against
+           secrets.tdb */
+
+        ret = ads_keytab_add_entry(ads, "cifs"));
+        if (ret != 0 ) {
+                DEBUG(1, (__location__ ": ads_keytab_add_entry failed while "
+                          "adding 'cifs'.\n"));
+                return ret;
+        }
+#endif
 
         memset(princ_s, '\0', sizeof(princ_s));
-
-        fstrcpy( machine_name, global_myname() );
-
-        /* these are the main ones we need */
-        
-        if ( (ret = ads_keytab_add_entry(ads, "host") ) != 0 ) {
-                DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'host'.\n"));
-                return ret;
-        }
-
-
-#if 0   /* don't create the CIFS/... keytab entries since no one except smbd 
-           really needs them and we will fall back to verifying against secrets.tdb */
-           
-        if ( (ret = ads_keytab_add_entry(ads, "cifs")) != 0 ) {
-                DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'cifs'.\n"));
-                return ret;
-        }
-#endif
-
-        if ( (ctx = talloc_init("ads_keytab_create_default")) == NULL ) {
-                DEBUG(0,("ads_keytab_create_default: talloc() failed!\n"));
-                return -1;
-        }
-
-        /* now add the userPrincipalName and sAMAccountName entries */
-
-        if ( (sam_account_name = ads_get_samaccountname( ads, ctx, machine_name)) == NULL ) {
-                DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's name in AD!\n"));
-                TALLOC_FREE( ctx );
-                return -1;      
-        }
-
-        /* upper case the sAMAccountName to make it easier for apps to 
-           know what case to use in the keytab file */
-
-        strupper_m( sam_account_name ); 
-
-        if ( (ret = ads_keytab_add_entry(ads, sam_account_name )) != 0 ) {
-                DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding sAMAccountName (%s)\n",
-                        sam_account_name));
-                return ret;
-        }
-        
-        /* remember that not every machine account will have a upn */
-                
-        upn = ads_get_upn( ads, ctx, machine_name);
-        if ( upn ) {
-                if ( (ret = ads_keytab_add_entry(ads, upn)) != 0 ) {
-                        DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding UPN (%s)\n",
-                                upn));
-                        TALLOC_FREE( ctx );
-                        return ret;
-                }
-        }
-
-        /* Now loop through the keytab and update any other existing entries... */
-        
-        kvno = (krb5_kvno) ads_get_machine_kvno(ads, machine_name);
-        if (kvno == -1) {
-                DEBUG(1,("ads_keytab_create_default: ads_get_machine_kvno failed to determine the system's kvno.\n"));
-                TALLOC_FREE(ctx);
-                return -1;
-        }
-        
-        DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to "
-                "preserve and update.\n"));
-
         ZERO_STRUCT(kt_entry);
         ZERO_STRUCT(cursor);
@@ -569 +534 @@
         ret = krb5_init_context(&context);
         if (ret) {
-                DEBUG(1,("ads_keytab_create_default: could not krb5_init_context: %s\n",error_message(ret)));
-                TALLOC_FREE(ctx);
+                DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
+                          error_message(ret)));
                 return ret;
         }
 
+        tmpctx = talloc_init(__location__);
+        if (!tmpctx) {
+                DEBUG(0, (__location__ ": talloc_init() failed!\n"));
+                ret = -1;
+                goto done;
+        }
+
+        machine_name = talloc_strdup(tmpctx, global_myname());
+        if (!machine_name) {
+                ret = -1;
+                goto done;
+        }
+
+        /* now add the userPrincipalName and sAMAccountName entries */
+        sam_account_name = ads_get_samaccountname(ads, tmpctx, machine_name);
+        if (!sam_account_name) {
+                DEBUG(0, (__location__ ": unable to determine machine "
+                          "account's name in AD!\n"));
+                ret = -1;
+                goto done;
+        }
+
+        /* upper case the sAMAccountName to make it easier for apps to
+           know what case to use in the keytab file */
+        strupper_m(sam_account_name);
+
+        ret = ads_keytab_add_entry(ads, sam_account_name);
+        if (ret != 0) {
+                DEBUG(1, (__location__ ": ads_keytab_add_entry() failed "
+                          "while adding sAMAccountName (%s)\n",
+                          sam_account_name));
+                goto done;
+        }
+
+        /* remember that not every machine account will have a upn */
+        upn = ads_get_upn(ads, tmpctx, machine_name);
+        if (upn) {
+                ret = ads_keytab_add_entry(ads, upn);
+                if (ret != 0) {
+                        DEBUG(1, (__location__ ": ads_keytab_add_entry() "
+                                  "failed while adding UPN (%s)\n", upn));
+                        goto done;
+                }
+        }
+
+        /* Now loop through the keytab and update any other existing entries */
+        kvno = (krb5_kvno)ads_get_machine_kvno(ads, machine_name);
+        if (kvno == -1) {
+                DEBUG(1, (__location__ ": ads_get_machine_kvno() failed to "
+                          "determine the system's kvno.\n"));
+                goto done;
+        }
+
+        DEBUG(3, (__location__ ": Searching for keytab entries to preserve "
+                  "and update.\n"));
+
         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
         if (ret) {
-                DEBUG(1,("ads_keytab_create_default: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
+                DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
+                          error_message(ret)));
                 goto done;
         }
@@ -582 +604 @@
         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
         if (ret != KRB5_KT_END && ret != ENOENT ) {
-                while ((ret = krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) == 0) {
+                while ((ret = krb5_kt_next_entry(context, keytab,
+                                                 &kt_entry, &cursor)) == 0) {
                         smb_krb5_kt_free_entry(context, &kt_entry);
                         ZERO_STRUCT(kt_entry);
@@ -592 +615 @@
 
         /*
-         * Hmmm. There is no "rewind" function for the keytab. This means we have a race condition
-         * where someone else could add entries after we've counted them. Re-open asap to minimise
-         * the race. JRA.
+         * Hmmm. There is no "rewind" function for the keytab. This means we
+         * have a race condition where someone else could add entries after
+         * we've counted them. Re-open asap to minimise the race. JRA.
          */
-        
-        DEBUG(3, ("ads_keytab_create_default: Found %d entries in the keytab.\n", found));
+        DEBUG(3, (__location__ ": Found %d entries in the keytab.\n", found));
         if (!found) {
                 goto done;
         }
-        oldEntries = talloc_array(ctx, char *, found );
+
+        oldEntries = talloc_array(tmpctx, char *, found);
         if (!oldEntries) {
-                DEBUG(1,("ads_keytab_create_default: Failed to allocate space to store the old keytab entries (malloc failed?).\n"));
+                DEBUG(1, (__location__ ": Failed to allocate space to store "
+                          "the old keytab entries (talloc failed?).\n"));
                 ret = -1;
                 goto done;
@@ -610 +634 @@
 
         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
-        if (ret != KRB5_KT_END && ret != ENOENT ) {
-                while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
-                        if (kt_entry.vno != kvno) {
-                                char *ktprinc = NULL;
-                                char *p;
-
-                                /* This returns a malloc'ed string in ktprinc. */
-                                ret = smb_krb5_unparse_name(oldEntries, context, kt_entry.principal, &ktprinc);
-                                if (ret) {
-                                        DEBUG(1,("smb_krb5_unparse_name failed (%s)\n", error_message(ret)));
-                                        goto done;
+        if (ret == KRB5_KT_END || ret == ENOENT) {
+                krb5_kt_end_seq_get(context, keytab, &cursor);
+                ZERO_STRUCT(cursor);
+                goto done;
+        }
+
+        while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
+                if (kt_entry.vno != kvno) {
+                        char *ktprinc = NULL;
+                        char *p;
+
+                        /* This returns a malloc'ed string in ktprinc. */
+                        ret = smb_krb5_unparse_name(oldEntries, context,
+                                                    kt_entry.principal,
+                                                    &ktprinc);
+                        if (ret) {
+                                DEBUG(1, (__location__
+                                         ": smb_krb5_unparse_name failed "
+                                         "(%s)\n", error_message(ret)));
+                                goto done;
+                        }
+                        /*
+                         * From looking at the krb5 source they don't seem to
+                         * take locale or mb strings into account.
+                         * Maybe this is because they assume utf8 ?
+                         * In this case we may need to convert from utf8 to
+                         * mb charset here ? JRA.
+                         */
+                        p = strchr_m(ktprinc, '@');
+                        if (p) {
+                                *p = '\0';
+                        }
+
+                        p = strchr_m(ktprinc, '/');
+                        if (p) {
+                                *p = '\0';
+                        }
+                        for (i = 0; i < found; i++) {
+                                if (!oldEntries[i]) {
+                                        oldEntries[i] = ktprinc;
+                                        break;
                                 }
-                                /*
-                                 * From looking at the krb5 source they don't seem to take locale
-                                 * or mb strings into account. Maybe this is because they assume utf8 ?
-                                 * In this case we may need to convert from utf8 to mb charset here ? JRA.
-                                 */
-                                p = strchr_m(ktprinc, '@');
-                                if (p) {
-                                        *p = '\0';
-                                }
-
-                                p = strchr_m(ktprinc, '/');
-                                if (p) {
-                                        *p = '\0';
-                                }
-                                for (i = 0; i < found; i++) {
-                                        if (!oldEntries[i]) {
-                                                oldEntries[i] = ktprinc;
-                                                break;
-                                        }
-                                        if (!strcmp(oldEntries[i], ktprinc)) {
-                                                TALLOC_FREE(ktprinc);
-                                                break;
-                                        }
-                                }
-                                if (i == found) {
+                                if (!strcmp(oldEntries[i], ktprinc)) {
                                         TALLOC_FREE(ktprinc);
+                                        break;
                                 }
                         }
-                        smb_krb5_kt_free_entry(context, &kt_entry);
-                        ZERO_STRUCT(kt_entry);
-                }
-                ret = 0;
-                for (i = 0; oldEntries[i]; i++) {
-                        ret |= ads_keytab_add_entry(ads, oldEntries[i]);
-                        TALLOC_FREE(oldEntries[i]);
-                }
-                krb5_kt_end_seq_get(context, keytab, &cursor);
-        }
+                        if (i == found) {
+                                TALLOC_FREE(ktprinc);
+                        }
+                }
+                smb_krb5_kt_free_entry(context, &kt_entry);
+                ZERO_STRUCT(kt_entry);
+        }
+        ret = 0;
+        for (i = 0; oldEntries[i]; i++) {
+                ret |= ads_keytab_add_entry(ads, oldEntries[i]);
+                TALLOC_FREE(oldEntries[i]);
+        }
+        krb5_kt_end_seq_get(context, keytab, &cursor);
         ZERO_STRUCT(cursor);
 
 done:
-
         TALLOC_FREE(oldEntries);
-        TALLOC_FREE(ctx);
+        TALLOC_FREE(tmpctx);
 
         {
                 krb5_keytab_entry zero_kt_entry;
                 ZERO_STRUCT(zero_kt_entry);
-                if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
+                if (memcmp(&zero_kt_entry, &kt_entry,
+                                sizeof(krb5_keytab_entry))) {
                         smb_krb5_kt_free_entry(context, &kt_entry);
                 }
@@ -677 +711 @@
                 krb5_kt_cursor zero_csr;
                 ZERO_STRUCT(zero_csr);
-                if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
-                        krb5_kt_end_seq_get(context, keytab, &cursor);  
+                if ((memcmp(&cursor, &zero_csr,
+                                sizeof(krb5_kt_cursor)) != 0) && keytab) {
+                        krb5_kt_end_seq_get(context, keytab, &cursor);
                 }
         }
@@ -708 +743 @@
         ret = krb5_init_context(&context);
         if (ret) {
-                DEBUG(1,("ads_keytab_list: could not krb5_init_context: %s\n",error_message(ret)));
+                DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
+                          error_message(ret)));
                 return ret;
         }
@@ -714 +750 @@
         ret = smb_krb5_open_keytab(context, keytab_name, False, &keytab);
         if (ret) {
-                DEBUG(1,("ads_keytab_list: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
+                DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
+                          error_message(ret)));
                 goto out;
         }
@@ -720 +757 @@
         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
         if (ret) {
+                ZERO_STRUCT(cursor);
                 goto out;
         }
@@ -726 +764 @@
 
         while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
-        
+
                 char *princ_s = NULL;
                 char *etype_s = NULL;
                 krb5_enctype enctype = 0;
 
-                ret = smb_krb5_unparse_name(talloc_tos(), context, kt_entry.principal, &princ_s);
+                ret = smb_krb5_unparse_name(talloc_tos(), context,
+                                            kt_entry.principal, &princ_s);
                 if (ret) {
                         goto out;
@@ -739 +778 @@
 
                 ret = smb_krb5_enctype_to_string(context, enctype, &etype_s);
-                if (ret) {
-                        if (asprintf(&etype_s, "UNKNOWN: %d\n", enctype) == -1)
-                        {
-                                TALLOC_FREE(princ_s);
-                                goto out;
-                        }
+                if (ret &&
+                    (asprintf(&etype_s, "UNKNOWN: %d\n", enctype) == -1)) {
+                        TALLOC_FREE(princ_s);
+                        goto out;
                 }
 
@@ -771 +808 @@
                 krb5_keytab_entry zero_kt_entry;
                 ZERO_STRUCT(zero_kt_entry);
-                if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
+                if (memcmp(&zero_kt_entry, &kt_entry,
+                                sizeof(krb5_keytab_entry))) {
                         smb_krb5_kt_free_entry(context, &kt_entry);
                 }
@@ -778 +816 @@
                 krb5_kt_cursor zero_csr;
                 ZERO_STRUCT(zero_csr);
-                if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
-                        krb5_kt_end_seq_get(context, keytab, &cursor);  
+                if ((memcmp(&cursor, &zero_csr,
+                                sizeof(krb5_kt_cursor)) != 0) && keytab) {
+                        krb5_kt_end_seq_get(context, keytab, &cursor);
                 }
         }

vendor/current/source3/libads/kerberos_verify.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
    kerberos utility library
    Copyright (C) Andrew Tridgell 2001
    Copyright (C) Remus Koos 2001
-   Copyright (C) Luke Howard 2003   
+   Copyright (C) Luke Howard 2003
    Copyright (C) Guenther Deschner 2003, 2005
    Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
    Copyright (C) Jeremy Allison 2007
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -26 +26 @@
 #include "includes.h"
 #include "smb_krb5.h"
+#include "libads/kerberos_proto.h"
+#include "secrets.h"
+#include "../librpc/gen_ndr/krb5pac.h"
 
 #ifdef HAVE_KRB5
@@ -114 +117 @@
 }
 
-/**********************************************************************************
- Try to verify a ticket using the system keytab... the system keytab has kvno -1 entries, so
- it's more like what microsoft does... see comment in utils/net_ads.c in the
- ads_keytab_add_entry function for details.
-***********************************************************************************/
+/******************************************************************************
+ Try to verify a ticket using the system keytab... the system keytab has
+ kvno -1 entries, so it's more like what microsoft does... see comment in
+ utils/net_ads.c in the ads_keytab_add_entry function for details.
+******************************************************************************/
 
 static bool ads_keytab_verify_ticket(krb5_context context,
@@ -132 +135 @@
         krb5_kt_cursor kt_cursor;
         krb5_keytab_entry kt_entry;
-        char *valid_princ_formats[7] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL };
+        char *valid_princ_formats[7] = { NULL, NULL, NULL,
+                                         NULL, NULL, NULL, NULL };
         char *entry_princ_s = NULL;
         fstring my_name, my_fqdn;
@@ -138 +142 @@
         int number_matched_principals = 0;
         krb5_data packet;
+        int err;
 
         *pp_tkt = NULL;
@@ -152 +157 @@
         name_to_fqdn(my_fqdn, global_myname());
 
-        if (asprintf(&valid_princ_formats[0], "%s$@%s", my_name, lp_realm()) == -1) {
-                goto out;
-        }
-        if (asprintf(&valid_princ_formats[1], "host/%s@%s", my_name, lp_realm()) == -1) {
-                goto out;
-        }
-        if (asprintf(&valid_princ_formats[2], "host/%s@%s", my_fqdn, lp_realm()) == -1) {
-                goto out;
-        }
-        if (asprintf(&valid_princ_formats[3], "host/%s.%s@%s", my_name, lp_realm(), lp_realm()) == -1) {
-                goto out;
-        }
-        if (asprintf(&valid_princ_formats[4], "cifs/%s@%s", my_name, lp_realm()) == -1) {
-                goto out;
-        }
-        if (asprintf(&valid_princ_formats[5], "cifs/%s@%s", my_fqdn, lp_realm()) == -1) {
-                goto out;
-        }
-        if (asprintf(&valid_princ_formats[6], "cifs/%s.%s@%s", my_name, lp_realm(), lp_realm()) == -1) {
+        err = asprintf(&valid_princ_formats[0],
+                        "%s$@%s", my_name, lp_realm());
+        if (err == -1) {
+                goto out;
+        }
+        err = asprintf(&valid_princ_formats[1],
+                        "host/%s@%s", my_name, lp_realm());
+        if (err == -1) {
+                goto out;
+        }
+        err = asprintf(&valid_princ_formats[2],
+                        "host/%s@%s", my_fqdn, lp_realm());
+        if (err == -1) {
+                goto out;
+        }
+        err = asprintf(&valid_princ_formats[3],
+                        "host/%s.%s@%s", my_name, lp_realm(), lp_realm());
+        if (err == -1) {
+                goto out;
+        }
+        err = asprintf(&valid_princ_formats[4],
+                        "cifs/%s@%s", my_name, lp_realm());
+        if (err == -1) {
+                goto out;
+        }
+        err = asprintf(&valid_princ_formats[5],
+                        "cifs/%s@%s", my_fqdn, lp_realm());
+        if (err == -1) {
+                goto out;
+        }
+        err = asprintf(&valid_princ_formats[6],
+                        "cifs/%s.%s@%s", my_name, lp_realm(), lp_realm());
+        if (err == -1) {
                 goto out;
         }
@@ -179 +198 @@
         ret = smb_krb5_open_keytab(context, NULL, False, &keytab);
         if (ret) {
-                DEBUG(1, ("ads_keytab_verify_ticket: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
+                DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
+                          error_message(ret)));
                 goto out;
         }
@@ -189 +209 @@
         ret = krb5_kt_start_seq_get(context, keytab, &kt_cursor);
         if (ret) {
-                DEBUG(1, ("ads_keytab_verify_ticket: krb5_kt_start_seq_get failed (%s)\n", error_message(ret)));
+                DEBUG(1, (__location__ ": krb5_kt_start_seq_get failed (%s)\n",
+                          error_message(ret)));
                 goto out;
         }
   
-        while (!auth_ok && (krb5_kt_next_entry(context, keytab, &kt_entry, &kt_cursor) == 0)) {
-                ret = smb_krb5_unparse_name(talloc_tos(), context, kt_entry.principal, &entry_princ_s);
+        while (!auth_ok &&
+               (krb5_kt_next_entry(context, keytab,
+                                   &kt_entry, &kt_cursor) == 0)) {
+                ret = smb_krb5_unparse_name(talloc_tos(), context,
+                                            kt_entry.principal,
+                                            &entry_princ_s);
                 if (ret) {
-                        DEBUG(1, ("ads_keytab_verify_ticket: smb_krb5_unparse_name failed (%s)\n",
-                                error_message(ret)));
+                        DEBUG(1, (__location__ ": smb_krb5_unparse_name "
+                                  "failed (%s)\n", error_message(ret)));
                         goto out;
                 }
@@ -212 +237 @@
                         *pp_tkt = NULL;
 
-                        ret = krb5_rd_req_return_keyblock_from_keytab(context, &auth_context, &packet,
-                                                                      kt_entry.principal, keytab,
-                                                                      NULL, pp_tkt, keyblock);
+                        ret = krb5_rd_req_return_keyblock_from_keytab(context,
+                                                &auth_context, &packet,
+                                                kt_entry.principal, keytab,
+                                                NULL, pp_tkt, keyblock);
 
                         if (ret) {
-                                DEBUG(10,("ads_keytab_verify_ticket: "
-                                        "krb5_rd_req_return_keyblock_from_keytab(%s) failed: %s\n",
-                                        entry_princ_s, error_message(ret)));
-
-                                /* workaround for MIT: 
+                                DEBUG(10, (__location__ ": krb5_rd_req_return"
+                                           "_keyblock_from_keytab(%s) "
+                                           "failed: %s\n", entry_princ_s,
+                                           error_message(ret)));
+
+                                /* workaround for MIT:
                                 * as krb5_ktfile_get_entry will explicitly
                                 * close the krb5_keytab as soon as krb5_rd_req
@@ -228 +255 @@
                                 * there is no point in querying more keytab
                                 * entries - Guenther */
-                                        
-                                if (ret == KRB5KRB_AP_ERR_TKT_NYV || 
+
+                                if (ret == KRB5KRB_AP_ERR_TKT_NYV ||
                                     ret == KRB5KRB_AP_ERR_TKT_EXPIRED ||
                                     ret == KRB5KRB_AP_ERR_SKEW) {
@@ -235 +262 @@
                                 }
                         } else {
-                                DEBUG(3,("ads_keytab_verify_ticket: "
-                                        "krb5_rd_req_return_keyblock_from_keytab succeeded for principal %s\n",
-                                        entry_princ_s));
+                                DEBUG(3, (__location__ ": krb5_rd_req_return"
+                                          "_keyblock_from_keytab succeeded "
+                                          "for principal %s\n",
+                                          entry_princ_s));
                                 auth_ok = True;
                                 break;
@@ -254 +282 @@
         ZERO_STRUCT(kt_cursor);
 
-  out:
-        
+out:
+
         for (i = 0; i < ARRAY_SIZE(valid_princ_formats); i++) {
                 SAFE_FREE(valid_princ_formats[i]);
         }
-        
+
         if (!auth_ok) {
                 if (!number_matched_principals) {
-                        DEBUG(3, ("ads_keytab_verify_ticket: no keytab principals matched expected file service name.\n"));
+                        DEBUG(3, (__location__ ": no keytab principals "
+                                  "matched expected file service name.\n"));
                 } else {
-                        DEBUG(3, ("ads_keytab_verify_ticket: krb5_rd_req failed for all %d matched keytab principals\n",
-                                number_matched_principals));
+                        DEBUG(3, (__location__ ": krb5_rd_req failed for "
+                                  "all %d matched keytab principals\n",
+                                  number_matched_principals));
                 }
         }
@@ -274 +304 @@
                 krb5_keytab_entry zero_kt_entry;
                 ZERO_STRUCT(zero_kt_entry);
-                if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
+                if (memcmp(&zero_kt_entry, &kt_entry,
+                           sizeof(krb5_keytab_entry))) {
                         smb_krb5_kt_free_entry(context, &kt_entry);
                 }
@@ -282 +313 @@
                 krb5_kt_cursor zero_csr;
                 ZERO_STRUCT(zero_csr);
-                if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
+                if ((memcmp(&kt_cursor, &zero_csr,
+                            sizeof(krb5_kt_cursor)) != 0) && keytab) {
                         krb5_kt_end_seq_get(context, keytab, &kt_cursor);
                 }
@@ -294 +326 @@
 }
 
-/**********************************************************************************
+/*****************************************************************************
  Try to verify a ticket using the secrets.tdb.
-***********************************************************************************/
+******************************************************************************/
 
 static krb5_error_code ads_secrets_verify_ticket(krb5_context context,
@@ -312 +344 @@
         /* Let's make some room for 2 password (old and new)*/
         krb5_data passwords[2];
-        krb5_enctype enctypes[] = { 
-#if defined(ENCTYPE_ARCFOUR_HMAC)
+        krb5_enctype enctypes[] = {
                 ENCTYPE_ARCFOUR_HMAC,
-#endif
-                ENCTYPE_DES_CBC_CRC, 
-                ENCTYPE_DES_CBC_MD5, 
+                ENCTYPE_DES_CBC_CRC,
+                ENCTYPE_DES_CBC_MD5,
                 ENCTYPE_NULL
         };
@@ -335 +365 @@
         }
 
-        password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
+        password_s = secrets_fetch_machine_password(lp_workgroup(),
+                                                    NULL, NULL);
         if (!password_s) {
-                DEBUG(1,("ads_secrets_verify_ticket: failed to fetch machine password\n"));
+                DEBUG(1,(__location__ ": failed to fetch machine password\n"));
                 *perr = KRB5_LIBOS_CANTREADPWD;
                 return False;
@@ -347 +378 @@
         password_s = secrets_fetch_prev_machine_password(lp_workgroup());
         if (password_s) {
-                DEBUG(10,("ads_secrets_verify_ticket: found previous password\n"));
+                DEBUG(10, (__location__ ": found previous password\n"));
                 passwords[1].data = password_s;
                 passwords[1].length = strlen(password_s);
@@ -357 +388 @@
         packet.data = (char *)ticket->data;
 
-        /* We need to setup a auth context with each possible encoding type in turn. */
+        /* We need to setup a auth context with each possible encoding type
+         * in turn. */
         for (j=0; j<2 && passwords[j].length; j++) {
 
@@ -368 +400 @@
                         }
 
-                        if (create_kerberos_key_from_string(context, host_princ, &passwords[j], key, enctypes[i], false)) {
+                        if (create_kerberos_key_from_string(context,
+                                                host_princ, &passwords[j],
+                                                key, enctypes[i], false)) {
                                 SAFE_FREE(key);
                                 continue;
                         }
 
-                        krb5_auth_con_setuseruserkey(context, auth_context, key);
-
-                        if (!(ret = krb5_rd_req(context, &auth_context, &packet,
-                                                NULL,
-                                                NULL, NULL, pp_tkt))) {
-                                DEBUG(10,("ads_secrets_verify_ticket: enc type [%u] decrypted message !\n",
-                                        (unsigned int)enctypes[i] ));
+                        krb5_auth_con_setuseruserkey(context,
+                                                        auth_context, key);
+
+                        if (!(ret = krb5_rd_req(context, &auth_context,
+                                                &packet, NULL, NULL,
+                                                NULL, pp_tkt))) {
+                                DEBUG(10, (__location__ ": enc type [%u] "
+                                           "decrypted message !\n",
+                                           (unsigned int)enctypes[i]));
                                 auth_ok = True;
                                 cont = false;
@@ -388 +424 @@
 
                         DEBUG((ret != KRB5_BAD_ENCTYPE) ? 3 : 10,
-                                        ("ads_secrets_verify_ticket: enc type [%u] failed to decrypt with error %s\n",
-                                        (unsigned int)enctypes[i], error_message(ret)));
-
-                        /* successfully decrypted but ticket is just not valid at the moment */
+                                (__location__ ": enc type [%u] failed to "
+                                 "decrypt with error %s\n",
+                                 (unsigned int)enctypes[i],
+                                 error_message(ret)));
+
+                        /* successfully decrypted but ticket is just not
+                         * valid at the moment */
                         if (ret == KRB5KRB_AP_ERR_TKT_NYV ||
                             ret == KRB5KRB_AP_ERR_TKT_EXPIRED ||
@@ -417 +456 @@
 }
 
-/**********************************************************************************
- Verify an incoming ticket and parse out the principal name and 
+/*****************************************************************************
+ Verify an incoming ticket and parse out the principal name and
  authorization_data if available.
-***********************************************************************************/
+******************************************************************************/
 
 NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
@@ -427 +466 @@
                            const DATA_BLOB *ticket,
                            char **principal,
-                           struct PAC_DATA **pac_data,
+                           struct PAC_LOGON_INFO **logon_info,
                            DATA_BLOB *ap_rep,
                            DATA_BLOB *session_key,
@@ -443 +482 @@
         time_t authtime;
         krb5_error_code ret = 0;
-        int flags = 0;  
+        int flags = 0;
         krb5_principal host_princ = NULL;
         krb5_const_principal client_principal = NULL;
@@ -455 +494 @@
 
         *principal = NULL;
-        *pac_data = NULL;
+        *logon_info = NULL;
         *ap_rep = data_blob_null;
         *session_key = data_blob_null;
@@ -462 +501 @@
         ret = krb5_init_context(&context);
         if (ret) {
-                DEBUG(1,("ads_verify_ticket: krb5_init_context failed (%s)\n", error_message(ret)));
+                DEBUG(1, (__location__ ": krb5_init_context failed (%s)\n",
+                          error_message(ret)));
                 return NT_STATUS_LOGON_FAILURE;
         }
@@ -472 +512 @@
         ret = krb5_set_default_realm(context, realm);
         if (ret) {
-                DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret)));
+                DEBUG(1, (__location__ ": krb5_set_default_realm "
+                          "failed (%s)\n", error_message(ret)));
                 goto out;
         }
@@ -482 +523 @@
         ret = krb5_auth_con_init(context, &auth_context);
         if (ret) {
-                DEBUG(1,("ads_verify_ticket: krb5_auth_con_init failed (%s)\n", error_message(ret)));
+                DEBUG(1, (__location__ ": krb5_auth_con_init failed (%s)\n",
+                          error_message(ret)));
                 goto out;
         }
@@ -500 +542 @@
         ret = smb_krb5_parse_name(context, host_princ_s, &host_princ);
         if (ret) {
-                DEBUG(1,("ads_verify_ticket: smb_krb5_parse_name(%s) failed (%s)\n",
-                                        host_princ_s, error_message(ret)));
-                goto out;
-        }
-
-
-        if ( use_replay_cache ) {
-                
-                /* Lock a mutex surrounding the replay as there is no 
-                   locking in the MIT krb5 code surrounding the replay 
+                DEBUG(1, (__location__ ": smb_krb5_parse_name(%s) "
+                          "failed (%s)\n", host_princ_s, error_message(ret)));
+                goto out;
+        }
+
+
+        if (use_replay_cache) {
+
+                /* Lock a mutex surrounding the replay as there is no
+                   locking in the MIT krb5 code surrounding the replay
                    cache... */
 
-                mutex = grab_named_mutex(talloc_tos(), "replay cache mutex",
-                                         10);
+                mutex = grab_named_mutex(talloc_tos(),
+                                         "replay cache mutex", 10);
                 if (mutex == NULL) {
-                        DEBUG(1,("ads_verify_ticket: unable to protect "
-                                 "replay cache with mutex.\n"));
+                        DEBUG(1, (__location__ ": unable to protect replay "
+                                  "cache with mutex.\n"));
                         ret = KRB5_CC_IO;
                         goto out;
                 }
 
-                /* JRA. We must set the rcache here. This will prevent 
+                /* JRA. We must set the rcache here. This will prevent
                    replay attacks. */
-                
-                ret = krb5_get_server_rcache(context, 
-                                             krb5_princ_component(context, host_princ, 0), 
-                                             &rcache);
+
+                ret = krb5_get_server_rcache(
+                                context,
+                                krb5_princ_component(context, host_princ, 0),
+                                &rcache);
                 if (ret) {
-                        DEBUG(1,("ads_verify_ticket: krb5_get_server_rcache "
-                                 "failed (%s)\n", error_message(ret)));
+                        DEBUG(1, (__location__ ": krb5_get_server_rcache "
+                                  "failed (%s)\n", error_message(ret)));
                         goto out;
                 }
@@ -535 +578 @@
                 ret = krb5_auth_con_setrcache(context, auth_context, rcache);
                 if (ret) {
-                        DEBUG(1,("ads_verify_ticket: krb5_auth_con_setrcache "
-                                 "failed (%s)\n", error_message(ret)));
+                        DEBUG(1, (__location__ ": krb5_auth_con_setrcache "
+                                  "failed (%s)\n", error_message(ret)));
                         goto out;
                 }
@@ -575 +618 @@
         }
 
-        if ( use_replay_cache ) {               
+        if (use_replay_cache) {
                 TALLOC_FREE(mutex);
 #if 0
@@ -583 +626 @@
                 }
 #endif
-        }       
+        }
 
         if (!auth_ok) {
-                DEBUG(3,("ads_verify_ticket: krb5_rd_req with auth failed (%s)\n", 
-                         error_message(ret)));
+                DEBUG(3, (__location__ ": krb5_rd_req with auth "
+                          "failed (%s)\n", error_message(ret)));
                 /* Try map the error return in case it's something like
                  * a clock skew error.
                  */
                 sret = krb5_to_nt_status(ret);
-                if (NT_STATUS_IS_OK(sret) || NT_STATUS_EQUAL(sret,NT_STATUS_UNSUCCESSFUL)) {
+                if (NT_STATUS_IS_OK(sret) ||
+                    NT_STATUS_EQUAL(sret,NT_STATUS_UNSUCCESSFUL)) {
                         sret = NT_STATUS_LOGON_FAILURE;
                 }
-                DEBUG(10,("ads_verify_ticket: returning error %s\n",
-                        nt_errstr(sret) ));
-                goto out;
-        } 
-        
+                DEBUG(10, (__location__ ": returning error %s\n",
+                           nt_errstr(sret) ));
+                goto out;
+        }
+
         authtime = get_authtime_from_tkt(tkt);
         client_principal = get_principal_from_tkt(tkt);
@@ -605 +649 @@
         ret = krb5_mk_rep(context, auth_context, &packet);
         if (ret) {
-                DEBUG(3,("ads_verify_ticket: Failed to generate mutual authentication reply (%s)\n",
-                        error_message(ret)));
+                DEBUG(3, (__location__ ": Failed to generate mutual "
+                          "authentication reply (%s)\n", error_message(ret)));
                 goto out;
         }
@@ -616 +660 @@
         }
 
-        get_krb5_smb_session_key(context, auth_context, session_key, True);
-        dump_data_pw("SMB session key (from ticket)\n", session_key->data, session_key->length);
+        get_krb5_smb_session_key(mem_ctx, context,
+                                 auth_context, session_key, true);
+        dump_data_pw("SMB session key (from ticket)\n",
+                     session_key->data, session_key->length);
 
 #if 0
@@ -623 +669 @@
 #endif
 
-        /* continue when no PAC is retrieved or we couldn't decode the PAC 
+        /* continue when no PAC is retrieved or we couldn't decode the PAC
            (like accounts that have the UF_NO_AUTH_DATA_REQUIRED flag set, or
            Kerberos tickets encrypted using a DES key) - Guenther */
@@ -629 +675 @@
         got_auth_data = get_auth_data_from_tkt(mem_ctx, &auth_data, tkt);
         if (!got_auth_data) {
-                DEBUG(3,("ads_verify_ticket: did not retrieve auth data. continuing without PAC\n"));
+                DEBUG(3, (__location__ ": did not retrieve auth data. "
+                          "continuing without PAC\n"));
         }
 
         if (got_auth_data) {
-                pac_ret = decode_pac_data(mem_ctx, &auth_data, context, keyblock, client_principal, authtime, pac_data);
+                struct PAC_DATA *pac_data;
+                pac_ret = decode_pac_data(mem_ctx, &auth_data, context,
+                                          keyblock, client_principal,
+                                          authtime, &pac_data);
+                data_blob_free(&auth_data);
                 if (!NT_STATUS_IS_OK(pac_ret)) {
-                        DEBUG(3,("ads_verify_ticket: failed to decode PAC_DATA: %s\n", nt_errstr(pac_ret)));
-                        *pac_data = NULL;
-                }
-                data_blob_free(&auth_data);
+                        DEBUG(3, (__location__ ": failed to decode "
+                                  "PAC_DATA: %s\n", nt_errstr(pac_ret)));
+                } else {
+                        uint32_t i;
+                        for (i = 0; i < pac_data->num_buffers; i++) {
+
+                                if (pac_data->buffers[i].type != PAC_TYPE_LOGON_INFO) {
+                                        continue;
+                                }
+
+                                *logon_info = pac_data->buffers[i].info->logon_info.info;
+                        }
+
+                        if (!*logon_info) {
+                                DEBUG(1, ("correctly decoded PAC but found "
+                                          "no logon_info! "
+                                          "This should not happen\n"));
+                                return NT_STATUS_INVALID_USER_BUFFER;
+                        }
+                }
         }
 
@@ -659 +726 @@
 #endif
 
-        if ((ret = smb_krb5_unparse_name(mem_ctx, context, client_principal, principal))) {
-                DEBUG(3,("ads_verify_ticket: smb_krb5_unparse_name failed (%s)\n", 
-                         error_message(ret)));
+        ret = smb_krb5_unparse_name(mem_ctx, context,
+                                    client_principal, principal);
+        if (ret) {
+                DEBUG(3, (__location__ ": smb_krb5_unparse_name "
+                          "failed (%s)\n", error_message(ret)));
                 sret = NT_STATUS_LOGON_FAILURE;
                 goto out;
@@ -668 +737 @@
         sret = NT_STATUS_OK;
 
- out:
+out:
 
         TALLOC_FREE(mutex);

vendor/current/source3/libads/krb5_setpw.c

@@ -21 +21 @@
 #include "includes.h"
 #include "smb_krb5.h"
+#include "libads/kerberos_proto.h"
+#include "../lib/util/asn1.h"
 
 #ifdef HAVE_KRB5
@@ -574 +576 @@
         krb5_error_code ret = 0;
         krb5_context context = NULL;
-        krb5_principal principal = NULL;
-        char *princ_name = NULL;
-        char *realm = NULL;
+        const char *realm = NULL;
+        unsigned int realm_len = 0;
         krb5_creds creds, *credsp = NULL;
-#if KRB5_PRINC_REALM_RETURNS_REALM
-        krb5_realm orig_realm;
-#else
-        krb5_data orig_realm;
-#endif
         krb5_ccache ccache = NULL;
 
@@ -605 +601 @@
         }
 
-        realm = strchr_m(princ, '@');
-        if (!realm) {
-                krb5_cc_close(context, ccache);
-                krb5_free_context(context);
-                DEBUG(1,("Failed to get realm\n"));
-                return ADS_ERROR_KRB5(-1);
-        }
-        realm++;
-
-        if (asprintf(&princ_name, "kadmin/changepw@%s", realm) == -1) {
+        ret = krb5_cc_get_principal(context, ccache, &creds.client);
+        if (ret) {
                 krb5_cc_close(context, ccache);
                 krb5_free_context(context);
-                DEBUG(1,("asprintf failed\n"));
-                return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-        }
-
-        ret = smb_krb5_parse_name(context, princ_name, &creds.server);
-        if (ret) {
-                krb5_cc_close(context, ccache);
-                krb5_free_context(context);
-                DEBUG(1,("Failed to parse kadmin/changepw (%s)\n", error_message(ret)));
-                return ADS_ERROR_KRB5(ret);
-        }
-
-        /* parse the principal we got as a function argument */
-        ret = smb_krb5_parse_name(context, princ, &principal);
-        if (ret) {
-                krb5_cc_close(context, ccache);
-                krb5_free_principal(context, creds.server);
-                krb5_free_context(context);
-                DEBUG(1,("Failed to parse %s (%s)\n", princ_name, error_message(ret)));
-                free(princ_name);
-                return ADS_ERROR_KRB5(ret);
-        }
-
-        free(princ_name);
-
-        /* The creds.server principal takes ownership of this memory.
-                Remember to set back to original value before freeing. */
-        orig_realm = *krb5_princ_realm(context, creds.server);
-        krb5_princ_set_realm(context, creds.server, krb5_princ_realm(context, principal));
-        
-        ret = krb5_cc_get_principal(context, ccache, &creds.client);
-        if (ret) {
-                krb5_cc_close(context, ccache);
-                krb5_princ_set_realm(context, creds.server, &orig_realm);
-                krb5_free_principal(context, creds.server);
-                krb5_free_principal(context, principal);
-                krb5_free_context(context);
-                DEBUG(1,("Failed to get principal from ccache (%s)\n", 
+                DEBUG(1,("Failed to get principal from ccache (%s)\n",
                          error_message(ret)));
                 return ADS_ERROR_KRB5(ret);
         }
-        
-        ret = krb5_get_credentials(context, 0, ccache, &creds, &credsp); 
+
+        realm = smb_krb5_principal_get_realm(context, creds.client);
+        realm_len = strlen(realm);
+        ret = krb5_build_principal(context,
+                                   &creds.server,
+                                   realm_len,
+                                   realm, "kadmin", "changepw", NULL);
+
+        ret = krb5_get_credentials(context, 0, ccache, &creds, &credsp);
         if (ret) {
                 krb5_cc_close(context, ccache);
                 krb5_free_principal(context, creds.client);
-                krb5_princ_set_realm(context, creds.server, &orig_realm);
                 krb5_free_principal(context, creds.server);
-                krb5_free_principal(context, principal);
+                krb5_free_context(context);
+                DEBUG(1,("krb5_build_prinipal_ext (%s)\n", error_message(ret)));
+                return ADS_ERROR_KRB5(ret);
+        }
+        
+        ret = krb5_get_credentials(context, 0, ccache, &creds, &credsp); 
+        if (ret) {
+                krb5_cc_close(context, ccache);
+                krb5_free_principal(context, creds.client);
+                krb5_free_principal(context, creds.server);
                 krb5_free_context(context);
                 DEBUG(1,("krb5_get_credentials failed (%s)\n", error_message(ret)));
@@ -679 +645 @@
         krb5_free_creds(context, credsp);
         krb5_free_principal(context, creds.client);
-        krb5_princ_set_realm(context, creds.server, &orig_realm);
         krb5_free_principal(context, creds.server);
-        krb5_free_principal(context, principal);
         krb5_cc_close(context, ccache);
         krb5_free_context(context);
@@ -729 +693 @@
     krb5_creds creds;
     char *chpw_princ = NULL, *password;
+    const char *realm = NULL;
 
     initialize_krb5_error_table();
@@ -750 +715 @@
     krb5_get_init_creds_opt_set_proxiable(&opts, 0);
 
+    realm = smb_krb5_principal_get_realm(context, princ);
+
     /* We have to obtain an INITIAL changepw ticket for changing password */
-    if (asprintf(&chpw_princ, "kadmin/changepw@%s",
-                                (char *) krb5_princ_realm(context, princ)) == -1) {
+    if (asprintf(&chpw_princ, "kadmin/changepw@%s", realm) == -1) {
         krb5_free_context(context);
         DEBUG(1,("ads_krb5_chg_password: asprintf fail\n"));
@@ -807 +773 @@
 }
 
-
-/**
- * Set the machine account password
- * @param ads connection to ads server
- * @param hostname machine whose password is being set
- * @param password new password
- * @return status of password change
- **/
-ADS_STATUS ads_set_machine_password(ADS_STRUCT *ads,
-                                    const char *machine_account,
-                                    const char *password)
-{
-        ADS_STATUS status;
-        char *principal = NULL; 
-
-        /*
-          we need to use the '$' form of the name here (the machine account name), 
-          as otherwise the server might end up setting the password for a user
-          instead
-         */
-        if (asprintf(&principal, "%s@%s", machine_account, ads->config.realm) < 0) {
-                return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-        }
-        
-        status = ads_krb5_set_password(ads->auth.kdc_server, principal, 
-                                       password, ads->auth.time_offset);
-        
-        SAFE_FREE(principal);
-        return status;
-}
 #endif

vendor/current/source3/libads/ldap.c

@@ -23 +23 @@
 
 #include "includes.h"
-#include "lib/ldb/include/ldb.h"
+#include "ads.h"
+#include "libads/sitename_cache.h"
+#include "libads/cldap.h"
+#include "libads/dns.h"
+#include "../libds/common/flags.h"
+#include "smbldap.h"
+#include "../libcli/security/security.h"
 
 #ifdef HAVE_LDAP
@@ -49 +55 @@
 ****************************************************************/
 
-static void gotalarm_sig(void)
+static void gotalarm_sig(int signum)
 {
         gotalarm = 1;
@@ -64 +70 @@
         /* Setup timeout */
         gotalarm = 0;
-        CatchSignal(SIGALRM, SIGNAL_CAST gotalarm_sig);
+        CatchSignal(SIGALRM, gotalarm_sig);
         alarm(to);
         /* End setup timeout. */
@@ -78 +84 @@
 
         /* Teardown timeout. */
-        CatchSignal(SIGALRM, SIGNAL_CAST SIG_IGN);
+        CatchSignal(SIGALRM, SIG_IGN);
         alarm(0);
 
@@ -104 +110 @@
         /* Setup alarm timeout.... Do we need both of these ? JRA. */
         gotalarm = 0;
-        CatchSignal(SIGALRM, SIGNAL_CAST gotalarm_sig);
+        CatchSignal(SIGALRM, gotalarm_sig);
         alarm(lp_ldap_timeout());
         /* End setup timeout. */
@@ -113 +119 @@
 
         /* Teardown timeout. */
-        CatchSignal(SIGALRM, SIGNAL_CAST SIG_IGN);
+        CatchSignal(SIGALRM, SIG_IGN);
         alarm(0);
 
@@ -265 +271 @@
                         SMB_STRDUP(cldap_reply.client_site);
         }
-        ads->server.workgroup          = SMB_STRDUP(cldap_reply.domain);
+        ads->server.workgroup          = SMB_STRDUP(cldap_reply.domain_name);
 
         ads->ldap.port = gc ? LDAP_GC_PORT : LDAP_PORT;
@@ -277 +283 @@
 
         /* Store our site name. */
-        sitename_store( cldap_reply.domain, cldap_reply.client_site);
+        sitename_store( cldap_reply.domain_name, cldap_reply.client_site);
         sitename_store( cldap_reply.dns_domain, cldap_reply.client_site);
 
@@ -593 +599 @@
 
         ZERO_STRUCT(ads->ldap);
-        ads->ldap.last_attempt  = time(NULL);
+        ads->ldap.last_attempt  = time_mono(NULL);
         ads->ldap.wrap_type     = ADS_SASLWRAP_TYPE_PLAIN;
 
@@ -1602 +1608 @@
         if (!org_unit || !*org_unit) {
 
-                ret = ads_default_ou_string(ads, WELL_KNOWN_GUID_COMPUTERS);
+                ret = ads_default_ou_string(ads, DS_GUID_COMPUTERS_CONTAINER);
 
                 /* samba4 might not yet respond to a wellknownobject-query */
@@ -2123 +2129 @@
         int i;
         for (i=0; values[i]; i++) {
-
-                UUID_FLAT guid;
-                struct GUID tmp;
-
-                memcpy(guid.info, values[i]->bv_val, sizeof(guid.info));
-                smb_uuid_unpack(guid, &tmp);
-                printf("%s: %s\n", field, GUID_string(talloc_tos(), &tmp));
+                NTSTATUS status;
+                DATA_BLOB in = data_blob_const(values[i]->bv_val, values[i]->bv_len);
+                struct GUID guid;
+
+                status = GUID_from_ndr_blob(&in, &guid);
+                if (NT_STATUS_IS_OK(status)) {
+                        printf("%s: %s\n", field, GUID_string(talloc_tos(), &guid));
+                } else {
+                        printf("%s: INVALID GUID\n", field);
+                }
         }
 }
@@ -2140 +2149 @@
         int i;
         for (i=0; values[i]; i++) {
-                DOM_SID sid;
+                struct dom_sid sid;
                 fstring tmp;
                 if (!sid_parse(values[i]->bv_val, values[i]->bv_len, &sid)) {
-                        continue;
+                        return;
                 }
                 printf("%s: %s\n", field, sid_to_fstring(tmp, &sid));
@@ -2605 +2614 @@
  bool ads_pull_guid(ADS_STRUCT *ads, LDAPMessage *msg, struct GUID *guid)
 {
-        char **values;
-        UUID_FLAT flat_guid;
-
-        values = ldap_get_values(ads->ldap.ld, msg, "objectGUID");
-        if (!values)
-                return False;
-
-        if (values[0]) {
-                memcpy(&flat_guid.info, values[0], sizeof(UUID_FLAT));
-                smb_uuid_unpack(flat_guid, guid);
-                ldap_value_free(values);
-                return True;
-        }
-        ldap_value_free(values);
-        return False;
-
-}
-
-
-/**
- * pull a single DOM_SID from a ADS result
+        DATA_BLOB blob;
+        NTSTATUS status;
+
+        if (!smbldap_talloc_single_blob(talloc_tos(), ads->ldap.ld, msg, "objectGUID",
+                                        &blob)) {
+                return false;
+        }
+
+        status = GUID_from_ndr_blob(&blob, guid);
+        talloc_free(blob.data);
+        return NT_STATUS_IS_OK(status);
+}
+
+
+/**
+ * pull a single struct dom_sid from a ADS result
  * @param ads connection to ads server
  * @param msg Results of search
@@ -2633 +2637 @@
 */
  bool ads_pull_sid(ADS_STRUCT *ads, LDAPMessage *msg, const char *field,
-                   DOM_SID *sid)
+                   struct dom_sid *sid)
 {
         return smbldap_pull_sid(ads->ldap.ld, msg, field, sid);
@@ -2639 +2643 @@
 
 /**
- * pull an array of DOM_SIDs from a ADS result
+ * pull an array of struct dom_sids from a ADS result
  * @param ads connection to ads server
  * @param mem_ctx TALLOC_CTX for allocating sid array
@@ -2648 +2652 @@
  **/
  int ads_pull_sids(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
-                   LDAPMessage *msg, const char *field, DOM_SID **sids)
+                   LDAPMessage *msg, const char *field, struct dom_sid **sids)
 {
         struct berval **values;
@@ -2663 +2667 @@
 
         if (i) {
-                (*sids) = TALLOC_ARRAY(mem_ctx, DOM_SID, i);
+                (*sids) = TALLOC_ARRAY(mem_ctx, struct dom_sid, i);
                 if (!(*sids)) {
                         ldap_value_free_len(values);
@@ -2687 +2691 @@
 
 /**
- * pull a SEC_DESC from a ADS result
+ * pull a struct security_descriptor from a ADS result
  * @param ads connection to ads server
  * @param mem_ctx TALLOC_CTX for allocating sid array
  * @param msg Results of search
  * @param field Attribute to retrieve
- * @param sd Pointer to *SEC_DESC to store result (talloc()ed)
+ * @param sd Pointer to *struct security_descriptor to store result (talloc()ed)
  * @return boolean inidicating success
 */
  bool ads_pull_sd(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
-                  LDAPMessage *msg, const char *field, SEC_DESC **sd)
+                  LDAPMessage *msg, const char *field,
+                  struct security_descriptor **sd)
 {
         struct berval **values;
@@ -2928 +2933 @@
  * @return status of search
  **/
-ADS_STATUS ads_domain_sid(ADS_STRUCT *ads, DOM_SID *sid)
+ADS_STATUS ads_domain_sid(ADS_STRUCT *ads, struct dom_sid *sid)
 {
         const char *attrs[] = {"objectSid", NULL};
@@ -3167 +3172 @@
 
 /**
- * pull a DOM_SID from an extended dn string
+ * pull a struct dom_sid from an extended dn string
  * @param mem_ctx TALLOC_CTX
  * @param extended_dn string
  * @param flags string type of extended_dn
- * @param sid pointer to a DOM_SID
+ * @param sid pointer to a struct dom_sid
  * @return NT_STATUS_OK on success,
  *         NT_INVALID_PARAMETER on error,
@@ -3179 +3184 @@
                                         const char *extended_dn,
                                         enum ads_extended_dn_flags flags,
-                                        DOM_SID *sid)
+                                        struct dom_sid *sid)
 {
         char *p, *q, *dn;
@@ -3254 +3259 @@
 
 /**
- * pull an array of DOM_SIDs from a ADS result
+ * pull an array of struct dom_sids from a ADS result
  * @param ads connection to ads server
  * @param mem_ctx TALLOC_CTX for allocating sid array
@@ -3268 +3273 @@
                                    const char *field,
                                    enum ads_extended_dn_flags flags,
-                                   DOM_SID **sids)
+                                   struct dom_sid **sids)
 {
         int i;
@@ -3280 +3285 @@
         }
 
-        (*sids) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, dn_count + 1);
+        (*sids) = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, dn_count + 1);
         if (!(*sids)) {
                 TALLOC_FREE(dn_strings);
@@ -3498 +3503 @@
 
         hostnameDN = ads_get_dn(ads, talloc_tos(), (LDAPMessage *)msg);
+        if (hostnameDN == NULL) {
+                SAFE_FREE(host);
+                return ADS_ERROR_SYSTEM(ENOENT);
+        }
 
         rc = ldap_delete_ext_s(ads->ldap.ld, hostnameDN, pldap_control, NULL);
@@ -3585 +3594 @@
  * @param mem_ctx TALLOC_CTX for allocating sid array
  * @param dn of LDAP object
- * @param user_sid pointer to DOM_SID (objectSid)
- * @param primary_group_sid pointer to DOM_SID (self composed)
+ * @param user_sid pointer to struct dom_sid (objectSid)
+ * @param primary_group_sid pointer to struct dom_sid (self composed)
  * @param sids pointer to sid array to allocate
  * @param num_sids counter of SIDs pulled
@@ -3594 +3603 @@
                               TALLOC_CTX *mem_ctx,
                               const char *dn,
-                              DOM_SID *user_sid,
-                              DOM_SID *primary_group_sid,
-                              DOM_SID **sids,
+                              struct dom_sid *user_sid,
+                              struct dom_sid *primary_group_sid,
+                              struct dom_sid **sids,
                               size_t *num_sids)
 {
@@ -3603 +3612 @@
         int count = 0;
         size_t tmp_num_sids;
-        DOM_SID *tmp_sids;
-        DOM_SID tmp_user_sid;
-        DOM_SID tmp_primary_group_sid;
+        struct dom_sid *tmp_sids;
+        struct dom_sid tmp_user_sid;
+        struct dom_sid tmp_primary_group_sid;
         uint32 pgid;
         const char *attrs[] = {
@@ -3639 +3648 @@
                  * domsid */
 
-                DOM_SID domsid;
-                uint32 dummy_rid;
+                struct dom_sid domsid;
 
                 sid_copy(&domsid, &tmp_user_sid);
 
-                if (!sid_split_rid(&domsid, &dummy_rid)) {
+                if (!sid_split_rid(&domsid, NULL)) {
                         ads_msgfree(ads, res);
                         return ADS_ERROR_LDAP(LDAP_NO_MEMORY);

vendor/current/source3/libads/ldap_printer.c

@@ -19 +19 @@
 
 #include "includes.h"
-#include "../librpc/gen_ndr/cli_spoolss.h"
+#include "ads.h"
+#include "rpc_client/rpc_client.h"
+#include "../librpc/gen_ndr/ndr_spoolss_c.h"
+#include "rpc_client/cli_spoolss.h"
+#include "registry/reg_objects.h"
 
 #ifdef HAVE_ADS
@@ -43 +47 @@
         }
         if (ads_count_replies(ads, *res) != 1) {
-                if (res) {
-                        ads_msgfree(ads, *res);
-                        *res = NULL;
-                }
+                ads_msgfree(ads, *res);
+                *res = NULL;
                 return ADS_ERROR(LDAP_NO_SUCH_OBJECT);
         }
         srv_dn = ldap_get_dn(ads->ldap.ld, *res);
         if (srv_dn == NULL) {
-                if (res) {
-                        ads_msgfree(ads, *res);
-                        *res = NULL;
-                }
+                ads_msgfree(ads, *res);
+                *res = NULL;
                 return ADS_ERROR(LDAP_NO_MEMORY);
         }
@@ -60 +60 @@
         if (srv_cn == NULL) {
                 ldap_memfree(srv_dn);
-                if (res) {
-                        ads_msgfree(ads, *res);
-                        *res = NULL;
-                }
-                return ADS_ERROR(LDAP_INVALID_DN_SYNTAX);
-        }
-        if (res) {
                 ads_msgfree(ads, *res);
                 *res = NULL;
-        }
+                return ADS_ERROR(LDAP_INVALID_DN_SYNTAX);
+        }
+        ads_msgfree(ads, *res);
+        *res = NULL;
 
         if (asprintf(&s, "(cn=%s-%s)", srv_cn[0], printer) == -1) {
@@ -120 +116 @@
 */
 static bool map_sz(TALLOC_CTX *ctx, ADS_MODLIST *mods, 
-                   const struct regval_blob *value)
+                   struct regval_blob *value)
 {
         char *str_value = NULL;
@@ -126 +122 @@
         ADS_STATUS status;
 
-        if (value->type != REG_SZ)
+        if (regval_type(value) != REG_SZ)
                 return false;
 
-        if (value->size && *((smb_ucs2_t *) value->data_p)) {
+        if (regval_size(value) && *((smb_ucs2_t *) regval_data_p(value))) {
                 if (!pull_ucs2_talloc(ctx, &str_value,
-                                      (const smb_ucs2_t *) value->data_p,
+                                      (const smb_ucs2_t *) regval_data_p(value),
                                       &converted_size))
                 {
                         return false;
                 }
-                status = ads_mod_str(ctx, mods, value->valuename, str_value);
+                status = ads_mod_str(ctx, mods, regval_name(value), str_value);
                 return ADS_ERR_OK(status);
         }
@@ -147 +143 @@
 */
 static bool map_dword(TALLOC_CTX *ctx, ADS_MODLIST *mods, 
-                      const struct regval_blob *value)
+                      struct regval_blob *value)
 {
         char *str_value = NULL;
         ADS_STATUS status;
 
-        if (value->type != REG_DWORD)
-                return False;
-        str_value = talloc_asprintf(ctx, "%d", *((uint32 *) value->data_p));
+        if (regval_type(value) != REG_DWORD)
+                return False;
+        str_value = talloc_asprintf(ctx, "%d", *((uint32 *) regval_data_p(value)));
         if (!str_value) {
                 return False;
         }
-        status = ads_mod_str(ctx, mods, value->valuename, str_value);
+        status = ads_mod_str(ctx, mods, regval_name(value), str_value);
         return ADS_ERR_OK(status);
 }
@@ -166 +162 @@
 */
 static bool map_bool(TALLOC_CTX *ctx, ADS_MODLIST *mods,
-                     const struct regval_blob *value)
+                     struct regval_blob *value)
 {
         char *str_value;
         ADS_STATUS status;
 
-        if ((value->type != REG_BINARY) || (value->size != 1))
+        if ((regval_type(value) != REG_BINARY) || (regval_size(value) != 1))
                 return False;
         str_value =  talloc_asprintf(ctx, "%s", 
-                                     *(value->data_p) ? "TRUE" : "FALSE");
+                                     *(regval_data_p(value)) ? "TRUE" : "FALSE");
         if (!str_value) {
                 return False;
         }
-        status = ads_mod_str(ctx, mods, value->valuename, str_value);
+        status = ads_mod_str(ctx, mods, regval_name(value), str_value);
         return ADS_ERR_OK(status);
 }
@@ -186 +182 @@
 */
 static bool map_multi_sz(TALLOC_CTX *ctx, ADS_MODLIST *mods,
-                         const struct regval_blob *value)
+                         struct regval_blob *value)
 {
         char **str_values = NULL;
         size_t converted_size;
-        smb_ucs2_t *cur_str = (smb_ucs2_t *) value->data_p;
+        smb_ucs2_t *cur_str = (smb_ucs2_t *) regval_data_p(value);
         uint32 size = 0, num_vals = 0, i=0;
         ADS_STATUS status;
 
-        if (value->type != REG_MULTI_SZ)
-                return False;
-
-        while(cur_str && *cur_str && (size < value->size)) {            
+        if (regval_type(value) != REG_MULTI_SZ)
+                return False;
+
+        while(cur_str && *cur_str && (size < regval_size(value))) {
                 size += 2 * (strlen_w(cur_str) + 1);
                 cur_str += strlen_w(cur_str) + 1;
@@ -211 +207 @@
                        (num_vals + 1) * sizeof(char *));
 
-                cur_str = (smb_ucs2_t *) value->data_p;
+                cur_str = (smb_ucs2_t *) regval_data_p(value);
                 for (i=0; i < num_vals; i++) {
                         cur_str += pull_ucs2_talloc(ctx, &str_values[i],
@@ -218 +214 @@
                 }
 
-                status = ads_mod_strlist(ctx, mods, value->valuename, 
+                status = ads_mod_strlist(ctx, mods, regval_name(value),
                                          (const char **) str_values);
                 return ADS_ERR_OK(status);
@@ -227 +223 @@
 struct valmap_to_ads {
         const char *valname;
-        bool (*fn)(TALLOC_CTX *, ADS_MODLIST *, const struct regval_blob *);
+        bool (*fn)(TALLOC_CTX *, ADS_MODLIST *, struct regval_blob *);
 };
 
@@ -294 +290 @@
 
         for (i=0; map[i].valname; i++) {
-                if (StrCaseCmp(map[i].valname, value->valuename) == 0) {
+                if (StrCaseCmp(map[i].valname, regval_name(value)) == 0) {
                         if (!map[i].fn(ctx, mods, value)) {
-                                DEBUG(5, ("Add of value %s to modlist failed\n", value->valuename));
+                                DEBUG(5, ("Add of value %s to modlist failed\n", regval_name(value)));
                         } else {
-                                DEBUG(7, ("Mapped value %s\n", value->valuename));
+                                DEBUG(7, ("Mapped value %s\n", regval_name(value)));
                         }
                         
@@ -311 +307 @@
                                           const char *printer)
 {
+        struct dcerpc_binding_handle *b = cli->binding_handle;
         WERROR result;
         char *printername;
@@ -317 +314 @@
         uint32 i;
         struct policy_handle pol;
+        WERROR werr;
 
         if ((asprintf(&printername, "%s\\%s", cli->srv_name_slash, printer) == -1)) {
@@ -346 +344 @@
                 /* Have the data we need now, so start building */
                 for (i=0; i < count; i++) {
-                        struct regval_blob v;
-
-                        fstrcpy(v.valuename, info[i].value_name);
-                        v.type = info[i].type;
-                        v.data_p = info[i].data->data;
-                        v.size = info[i].data->length;
-
-                        map_regval_to_ads(mem_ctx, mods, &v);
+                        struct regval_blob *v;
+
+                        v = regval_compose(mem_ctx, info[i].value_name,
+                                           info[i].type,
+                                           info[i].data->data,
+                                           info[i].data->length);
+                        if (v == NULL) {
+                                return WERR_NOMEM;
+                        }
+
+                        map_regval_to_ads(mem_ctx, mods, v);
+                        talloc_free(v);
                 }
         }
@@ -367 +369 @@
         } else {
                 for (i=0; i < count; i++) {
-                        struct regval_blob v;
-
-                        fstrcpy(v.valuename, info[i].value_name);
-                        v.type = info[i].type;
-                        v.data_p = info[i].data->data;
-                        v.size = info[i].data->length;
-
-                        map_regval_to_ads(mem_ctx, mods, &v);
+                        struct regval_blob *v;
+
+                        v = regval_compose(mem_ctx, info[i].value_name,
+                                           info[i].type,
+                                           info[i].data->data,
+                                           info[i].data->length);
+                        if (v == NULL) {
+                                return WERR_NOMEM;
+                        }
+
+                        map_regval_to_ads(mem_ctx, mods, v);
+                        talloc_free(v);
                 }
         }
@@ -380 +386 @@
         ads_mod_str(mem_ctx, mods, SPOOL_REG_PRINTERNAME, printer);
 
-        rpccli_spoolss_ClosePrinter(cli, mem_ctx, &pol, NULL);
+        dcerpc_spoolss_ClosePrinter(b, mem_ctx, &pol, &werr);
         SAFE_FREE(printername);
 
@@ -386 +392 @@
 }
 
-bool get_local_printer_publishing_data(TALLOC_CTX *mem_ctx,
-                                       ADS_MODLIST *mods,
-                                       NT_PRINTER_DATA *data)
-{
-        uint32 key,val;
-
-        for (key=0; key < data->num_keys; key++) {
-                struct regval_ctr *ctr = data->keys[key].values;
-                for (val=0; val < ctr->num_values; val++)
-                        map_regval_to_ads(mem_ctx, mods, ctr->values[val]);
-        }
-        return True;
-}
-
 #endif

vendor/current/source3/libads/ldap_schema.c

@@ -20 +20 @@
 
 #include "includes.h"
+#include "ads.h"
+#include "libads/ldap_schema.h"
+#include "../libcli/ldap/ldap_ndr.h"
 
 #ifdef HAVE_LDAP
 
-ADS_STATUS ads_get_attrnames_by_oids(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
-                                     const char *schema_path,
-                                     const char **OIDs, size_t num_OIDs, 
-                                     char ***OIDs_out, char ***names, size_t *count)
+static ADS_STATUS ads_get_attrnames_by_oids(ADS_STRUCT *ads,
+                                            TALLOC_CTX *mem_ctx,
+                                            const char *schema_path,
+                                            const char **OIDs,
+                                            size_t num_OIDs,
+                                            char ***OIDs_out, char ***names,
+                                            size_t *count)
 {
         ADS_STATUS status;
@@ -123 +129 @@
         }
 
-        guid_bin = guid_binstring(mem_ctx, schema_guid);
+        guid_bin = ldap_encode_ndr_GUID(mem_ctx, schema_guid);
         if (!guid_bin) {
                 goto done;
@@ -152 +158 @@
 }
 
-const char *ads_get_attrname_by_oid(ADS_STRUCT *ads, const char *schema_path, TALLOC_CTX *mem_ctx, const char * OID)
-{
-        ADS_STATUS rc;
-        int count = 0;
-        LDAPMessage *res = NULL;
-        char *expr = NULL;
-        const char *attrs[] = { "lDAPDisplayName", NULL };
-        char *result;
-
-        if (ads == NULL || mem_ctx == NULL || OID == NULL) {
-                goto failed;
-        }
-
-        expr = talloc_asprintf(mem_ctx, "(attributeId=%s)", OID);
-        if (expr == NULL) {
-                goto failed;
-        }
-
-        rc = ads_do_search_retry(ads, schema_path, LDAP_SCOPE_SUBTREE, 
-                expr, attrs, &res);
-        if (!ADS_ERR_OK(rc)) {
-                goto failed;
-        }
-
-        count = ads_count_replies(ads, res);
-        if (count == 0 || !res) {
-                goto failed;
-        }
-
-        result = ads_pull_string(ads, mem_ctx, res, "lDAPDisplayName");
-        ads_msgfree(ads, res);
-
-        return result;
-        
-failed:
-        DEBUG(0,("ads_get_attrname_by_oid: failed to retrieve name for oid: %s\n", 
-                OID));
-        
-        ads_msgfree(ads, res);
-        return NULL;
-}
 /*********************************************************************
 *********************************************************************/

vendor/current/source3/libads/ldap_user.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "ads.h"
+#include "../libds/common/flags.h"
 
 #ifdef HAVE_ADS

vendor/current/source3/libads/ldap_utils.c

@@ -6 +6 @@
    Copyright (C) Andrew Tridgell 2001
    Copyright (C) Guenther Deschner 2006,2007
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -22 +22 @@
 
 #include "includes.h"
+#include "ads.h"
 
 #ifdef HAVE_LDAP
+
+static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
+                                             TALLOC_CTX *mem_ctx,
+                                             int scope,
+                                             const char *base,
+                                             const char *filter,
+                                             const char **attrs,
+                                             void *args,
+                                             const char *range_attr,
+                                             char ***strings,
+                                             size_t *num_strings,
+                                             uint32 *first_usn,
+                                             int *num_retries,
+                                             bool *more_values);
+
 /*
   a wrapper around ldap_search_s that retries depending on the error code
@@ -40 +56 @@
 
         if (!ads->ldap.ld &&
-            time(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
+            time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
                 return ADS_ERROR(LDAP_SERVER_DOWN);
         }
@@ -72 +88 @@
                         ads_msgfree(ads, *res);
                 *res = NULL;
-                
+
                 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n", 
                          ads->config.realm, ads_errstr(status)));
-                         
+
                 ads_disconnect(ads);
                 status = ads_connect(ads);
-                
+
                 if (!ADS_ERR_OK(status)) {
                         DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
@@ -121 +137 @@
 }
 
- ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
-                                     int scope, const char *expr,
-                                     const char **attrs, void *args,
-                                     LDAPMessage **res)
+static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
+                                           int scope, const char *expr,
+                                           const char **attrs, void *args,
+                                           LDAPMessage **res)
 {
         return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
@@ -143 +159 @@
         return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
                                    "(objectclass=*)", attrs, res);
-}
-
- ADS_STATUS ads_search_retry_extended_dn(ADS_STRUCT *ads, LDAPMessage **res, 
-                                         const char *dn, 
-                                         const char **attrs,
-                                         enum ads_extended_dn_flags flags)
-{
-        ads_control args;
-
-        args.control = ADS_EXTENDED_DN_OID;
-        args.val = flags;
-        args.critical = True;
-
-        return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
-                                        "(objectclass=*)", attrs, &args, res);
 }
 
@@ -200 +201 @@
 
  ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res, 
-                                 const DOM_SID *sid,
+                                 const struct dom_sid *sid,
                                  const char **attrs)
 {
         char *dn, *sid_string;
         ADS_STATUS status;
-        
+
         sid_string = sid_binstring_hex(sid);
         if (sid_string == NULL) {
@@ -278 +279 @@
 }
 
-ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads, 
+static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
                                       TALLOC_CTX *mem_ctx,
                                       int scope,
@@ -308 +309 @@
                 return status;
         }
-        
+
         if (!res) {
                 return ADS_ERROR(LDAP_NO_MEMORY);

vendor/current/source3/libads/ndr.c

@@ -21 +21 @@
 
 #include "includes.h"
+#include "ads.h"
+#include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "librpc/ndr/util.h"
 
-void ndr_print_ads_auth_flags(struct ndr_print *ndr, const char *name, uint32_t r)
+static void ndr_print_ads_auth_flags(struct ndr_print *ndr, const char *name, uint32_t r)
 {
         ndr_print_uint32(ndr, name, r);
@@ -39 +42 @@
 void ndr_print_ads_struct(struct ndr_print *ndr, const char *name, const struct ads_struct *r)
 {
-        if (!r) { return; }
-
         ndr_print_struct(ndr, name, "ads_struct");
         ndr->depth++;

vendor/current/source3/libads/sasl.c

@@ -20 +20 @@
 #include "includes.h"
 #include "../libcli/auth/spnego.h"
+#include "../libcli/auth/ntlmssp.h"
+#include "ads.h"
+#include "smb_krb5.h"
 
 #ifdef HAVE_LDAP
@@ -30 +33 @@
         NTSTATUS nt_status;
         DATA_BLOB sig;
+        TALLOC_CTX *frame;
         uint8 *dptr = ads->ldap.out.buf + (4 + NTLMSSP_SIG_SIZE);
 
+        frame = talloc_stackframe();
         /* copy the data to the right location */
         memcpy(dptr, buf, len);
@@ -38 +43 @@
         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
                 nt_status = ntlmssp_seal_packet(ntlmssp_state,
+                                                frame,
                                                 dptr, len,
                                                 dptr, len,
@@ -43 +49 @@
         } else {
                 nt_status = ntlmssp_sign_packet(ntlmssp_state,
+                                                frame,
                                                 dptr, len,
                                                 dptr, len,
@@ -54 +61 @@
                sig.data, NTLMSSP_SIG_SIZE);
 
-        data_blob_free(&sig);
+        TALLOC_FREE(frame);
 
         /* set how many bytes must be written to the underlying socket */
@@ -102 +109 @@
                 (struct ntlmssp_state *)ads->ldap.wrap_private_data;
 
-        ntlmssp_end(&ntlmssp_state);
+        TALLOC_FREE(ntlmssp_state);
 
         ads->ldap.wrap_ops = NULL;
@@ -134 +141 @@
         struct ntlmssp_state *ntlmssp_state;
 
-        if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
+        nt_status = ntlmssp_client_start(NULL,
+                                         global_myname(),
+                                         lp_workgroup(),
+                                         lp_client_ntlmv2_auth(),
+                                         &ntlmssp_state);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 return ADS_ERROR_NT(nt_status);
         }
@@ -181 +193 @@
                     && blob_out.length) {
                         if (turn == 1) {
+                                const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
                                 /* and wrap it in a SPNEGO wrapper */
-                                msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
+                                msg1 = spnego_gen_negTokenInit(talloc_tos(),
+                                                OIDs_ntlm, &blob_out, NULL);
                         } else {
                                 /* wrap it in SPNEGO */
-                                msg1 = spnego_gen_auth(blob_out);
+                                msg1 = spnego_gen_auth(talloc_tos(), blob_out);
                         }
 
@@ -200 +214 @@
                                 }
 
-                                ntlmssp_end(&ntlmssp_state);
+                                TALLOC_FREE(ntlmssp_state);
                                 return ADS_ERROR(rc);
                         }
@@ -212 +226 @@
                 } else {
 
-                        ntlmssp_end(&ntlmssp_state);
+                        TALLOC_FREE(ntlmssp_state);
                         data_blob_free(&blob_out);
                         return ADS_ERROR_NT(nt_status);
@@ -221 +235 @@
                         DATA_BLOB tmp_blob = data_blob_null;
                         /* the server might give us back two challenges */
-                        if (!spnego_parse_challenge(blob, &blob_in, 
+                        if (!spnego_parse_challenge(talloc_tos(), blob, &blob_in, 
                                                     &tmp_blob)) {
 
-                                ntlmssp_end(&ntlmssp_state);
+                                TALLOC_FREE(ntlmssp_state);
                                 data_blob_free(&blob);
                                 DEBUG(3,("Failed to parse challenges\n"));
@@ -231 +245 @@
                         data_blob_free(&tmp_blob);
                 } else if (rc == LDAP_SASL_BIND_IN_PROGRESS) {
-                        if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP, 
+                        if (!spnego_parse_auth_response(talloc_tos(), blob, nt_status, OID_NTLMSSP, 
                                                         &blob_in)) {
 
-                                ntlmssp_end(&ntlmssp_state);
+                                TALLOC_FREE(ntlmssp_state);
                                 data_blob_free(&blob);
                                 DEBUG(3,("Failed to parse auth response\n"));
@@ -257 +271 @@
                         DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
                                 ads_errstr(status)));
-                        ntlmssp_end(&ntlmssp_state);
+                        TALLOC_FREE(ntlmssp_state);
                         return status;
                 }
         } else {
-                ntlmssp_end(&ntlmssp_state);
+                TALLOC_FREE(ntlmssp_state);
         }
 
@@ -498 +512 @@
         /* and wrap that in a shiny SPNEGO wrapper */
         unwrapped = data_blob_const(output_token.value, output_token.length);
-        wrapped = gen_negTokenTarg(spnego_mechs, unwrapped);
+        wrapped = spnego_gen_negTokenInit(talloc_tos(),
+                        spnego_mechs, &unwrapped, NULL);
         gss_release_buffer(&minor_status, &output_token);
         if (unwrapped.length > wrapped.length) {
@@ -522 +537 @@
         }
 
-        ok = spnego_parse_auth_response(wrapped, NT_STATUS_OK,
+        ok = spnego_parse_auth_response(talloc_tos(), wrapped, NT_STATUS_OK,
                                         OID_KERBEROS5_OLD,
                                         &unwrapped);
@@ -630 +645 @@
 }
 
+
+static ADS_STATUS ads_guess_service_principal(ADS_STRUCT *ads,
+                                              char **returned_principal)
+{
+        char *princ = NULL;
+
+        if (ads->server.realm && ads->server.ldap_server) {
+                char *server, *server_realm;
+
+                server = SMB_STRDUP(ads->server.ldap_server);
+                server_realm = SMB_STRDUP(ads->server.realm);
+
+                if (!server || !server_realm) {
+                        SAFE_FREE(server);
+                        SAFE_FREE(server_realm);
+                        return ADS_ERROR(LDAP_NO_MEMORY);
+                }
+
+                strlower_m(server);
+                strupper_m(server_realm);
+                if (asprintf(&princ, "ldap/%s@%s", server, server_realm) == -1) {
+                        SAFE_FREE(server);
+                        SAFE_FREE(server_realm);
+                        return ADS_ERROR(LDAP_NO_MEMORY);
+                }
+
+                SAFE_FREE(server);
+                SAFE_FREE(server_realm);
+
+                if (!princ) {
+                        return ADS_ERROR(LDAP_NO_MEMORY);
+                }
+        } else if (ads->config.realm && ads->config.ldap_server_name) {
+                char *server, *server_realm;
+
+                server = SMB_STRDUP(ads->config.ldap_server_name);
+                server_realm = SMB_STRDUP(ads->config.realm);
+
+                if (!server || !server_realm) {
+                        SAFE_FREE(server);
+                        SAFE_FREE(server_realm);
+                        return ADS_ERROR(LDAP_NO_MEMORY);
+                }
+
+                strlower_m(server);
+                strupper_m(server_realm);
+                if (asprintf(&princ, "ldap/%s@%s", server, server_realm) == -1) {
+                        SAFE_FREE(server);
+                        SAFE_FREE(server_realm);
+                        return ADS_ERROR(LDAP_NO_MEMORY);
+                }
+
+                SAFE_FREE(server);
+                SAFE_FREE(server_realm);
+
+                if (!princ) {
+                        return ADS_ERROR(LDAP_NO_MEMORY);
+                }
+        }
+
+        if (!princ) {
+                return ADS_ERROR(LDAP_PARAM_ERROR);
+        }
+
+        *returned_principal = princ;
+
+        return ADS_SUCCESS;
+}
+
 static ADS_STATUS ads_generate_service_principal(ADS_STRUCT *ads,
                                                  const char *given_principal,
@@ -697 +781 @@
         }
 
-        rc = spnego_gen_negTokenTarg(principal, ads->auth.time_offset, &blob, &session_key, 0,
+        rc = spnego_gen_krb5_negTokenInit(talloc_tos(), principal,
+                                     ads->auth.time_offset, &blob, &session_key, 0,
                                      &ads->auth.tgs_expire);
 
@@ -772 +857 @@
         /* the server sent us the first part of the SPNEGO exchange in the negprot 
            reply */
-        if (!spnego_parse_negTokenInit(blob, OIDs, &given_principal) ||
+        if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &given_principal, NULL) ||
                         OIDs[0] == NULL) {
                 data_blob_free(&blob);
@@ -975 +1060 @@
         output_token.length = 4;
         output_token.value = SMB_MALLOC(output_token.length);
+        if (!output_token.value) {
+                output_token.length = 0;
+                status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+                goto failed;
+        }
         p = (uint8 *)output_token.value;
 
@@ -990 +1080 @@
 
         gss_rc = gss_wrap(&minor_status, context_handle,0,GSS_C_QOP_DEFAULT,
-                          &output_token, &conf_state,
-                          &input_token);
+                        &output_token, /* used as *input* here. */
+                        &conf_state,
+                        &input_token); /* Used as *output* here. */
         if (gss_rc) {
                 status = ADS_ERROR_GSS(gss_rc, minor_status);
-                goto failed;
-        }
-
-        free(output_token.value);
+                output_token.length = 0;
+                SAFE_FREE(output_token.value);
+                goto failed;
+        }
+
+        /* We've finished with output_token. */
+        SAFE_FREE(output_token.value);
+        output_token.length = 0;
 
         cred.bv_val = (char *)input_token.value;
@@ -1115 +1210 @@
                         if (strcmp(values[j], sasl_mechanisms[i].name) == 0) {
                                 DEBUG(4,("Found SASL mechanism %s\n", values[j]));
+retry:
                                 status = sasl_mechanisms[i].fn(ads);
+                                if (status.error_type == ENUM_ADS_ERROR_LDAP &&
+                                    status.err.rc == LDAP_STRONG_AUTH_REQUIRED &&
+                                    ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_PLAIN)
+                                {
+                                        DEBUG(3,("SASL bin got LDAP_STRONG_AUTH_REQUIRED "
+                                                 "retrying with signing enabled\n"));
+                                        ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SIGN;
+                                        goto retry;
+                                }
                                 ldap_value_free(values);
                                 ldap_msgfree(res);

vendor/current/source3/libads/sasl_wrapping.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "ads.h"
 
 #ifdef HAVE_LDAP_SASL_WRAPPING

vendor/current/source3/libads/util.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "ads.h"
+#include "secrets.h"
 
 #ifdef HAVE_KRB5
@@ -52 +54 @@
         return ret;
 }
-
-ADS_STATUS ads_guess_service_principal(ADS_STRUCT *ads,
-                                       char **returned_principal)
-{
-        char *princ = NULL;
-
-        if (ads->server.realm && ads->server.ldap_server) {
-                char *server, *server_realm;
-
-                server = SMB_STRDUP(ads->server.ldap_server);
-                server_realm = SMB_STRDUP(ads->server.realm);
-
-                if (!server || !server_realm) {
-                        SAFE_FREE(server);
-                        SAFE_FREE(server_realm);
-                        return ADS_ERROR(LDAP_NO_MEMORY);
-                }
-
-                strlower_m(server);
-                strupper_m(server_realm);
-                if (asprintf(&princ, "ldap/%s@%s", server, server_realm) == -1) {
-                        SAFE_FREE(server);
-                        SAFE_FREE(server_realm);
-                        return ADS_ERROR(LDAP_NO_MEMORY);
-                }
-
-                SAFE_FREE(server);
-                SAFE_FREE(server_realm);
-
-                if (!princ) {
-                        return ADS_ERROR(LDAP_NO_MEMORY);
-                }
-        } else if (ads->config.realm && ads->config.ldap_server_name) {
-                char *server, *server_realm;
-
-                server = SMB_STRDUP(ads->config.ldap_server_name);
-                server_realm = SMB_STRDUP(ads->config.realm);
-
-                if (!server || !server_realm) {
-                        SAFE_FREE(server);
-                        SAFE_FREE(server_realm);
-                        return ADS_ERROR(LDAP_NO_MEMORY);
-                }
-
-                strlower_m(server);
-                strupper_m(server_realm);
-                if (asprintf(&princ, "ldap/%s@%s", server, server_realm) == -1) {
-                        SAFE_FREE(server);
-                        SAFE_FREE(server_realm);
-                        return ADS_ERROR(LDAP_NO_MEMORY);
-                }
-
-                SAFE_FREE(server);
-                SAFE_FREE(server_realm);
-
-                if (!princ) {
-                        return ADS_ERROR(LDAP_NO_MEMORY);
-                }
-        }
-
-        if (!princ) {
-                return ADS_ERROR(LDAP_PARAM_ERROR);
-        }
-
-        *returned_principal = princ;
-
-        return ADS_SUCCESS;
-}
-
 #endif