Changeset 740 for vendor/current/source4/auth

vendor/current/source4/auth/auth.h

-              r414
+              r740
 /*
+/*
    Unix SMB/CIFS implementation.
    Standardised Authentication types
    Copyright (C) Andrew Bartlett   2001
    Copyright (C) Stefan Metzmacher 2005
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 …
 #include "librpc/gen_ndr/ndr_krb5pac.h"
+#include "librpc/gen_ndr/auth.h"
+#include "../auth/common_auth.h"
 extern const char *krbtgt_attrs[];
 …
 #define AUTH_INTERFACE_VERSION 0
+#define USER_INFO_CASE_INSENSITIVE_USERNAME 0x01 /* username may be in any case */
+#define USER_INFO_CASE_INSENSITIVE_PASSWORD 0x02 /* password may be in any case */
+#define USER_INFO_DONT_CHECK_UNIX_ACCOUNT   0x04 /* dont check unix account status */
+#define USER_INFO_INTERACTIVE_LOGON         0x08 /* dont check unix account status */
+enum auth_password_state {
+        AUTH_PASSWORD_RESPONSE,
+        AUTH_PASSWORD_HASH,
+        AUTH_PASSWORD_PLAIN
+};
+struct auth_usersupplied_info
+{
+        const char *workstation_name;
+        struct socket_address *remote_host;
+        uint32_t logon_parameters;
+        bool mapped_state;
+        /* the values the client gives us */
+        struct {
+                const char *account_name;
+                const char *domain_name;
+        } client, mapped;
+        enum auth_password_state password_state;
+        union {
+                struct {
+                        DATA_BLOB lanman;
+                        DATA_BLOB nt;
+                } response;
+                struct {
+                        struct samr_Password *lanman;
+                        struct samr_Password *nt;
+                } hash;
+                char *plaintext;
+        } password;
+        uint32_t flags;
+};
+struct auth_serversupplied_info
+{
+        struct dom_sid *account_sid;
+        struct dom_sid *primary_group_sid;
+        size_t n_domain_groups;
+        struct dom_sid **domain_groups;
+        DATA_BLOB user_session_key;
+        DATA_BLOB lm_session_key;
+        const char *account_name;
+        const char *domain_name;
+        const char *full_name;
+        const char *logon_script;
+        const char *profile_path;
+        const char *home_directory;
+        const char *home_drive;
+        const char *logon_server;
+        NTTIME last_logon;
+        NTTIME last_logoff;
+        NTTIME acct_expiry;
+        NTTIME last_password_change;
+        NTTIME allow_password_change;
+        NTTIME force_password_change;
+        uint16_t logon_count;
+        uint16_t bad_password_count;
+        uint32_t acct_flags;
+        bool authenticated;
+        struct PAC_SIGNATURE_DATA pac_srv_sig, pac_kdc_sig;
+};
+#define AUTH_SESSION_INFO_DEFAULT_GROUPS     0x01 /* Add the user to the default world and network groups */
+#define AUTH_SESSION_INFO_AUTHENTICATED      0x02 /* Add the user to the 'authenticated users' group */
+#define AUTH_SESSION_INFO_SIMPLE_PRIVILEGES  0x04 /* Use a trivial map between users and privilages, rather than a DB */
 struct auth_method_context;
 struct auth_check_password_request;
 struct auth_context;
+struct auth_session_info;
+struct ldb_dn;
 struct auth_operations {
 …
          * that.  It is not compatible with being a PDC.  */
         NTSTATUS (*get_challenge)(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *challenge);
+        NTSTATUS (*get_challenge)(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, uint8_t chal[8]);
         /* Given the user supplied info, check if this backend want to handle the password checking */
 …
         NTSTATUS (*check_password)(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx,
                                    const struct auth_usersupplied_info *user_info,
+                                   struct auth_serversupplied_info **server_info);
+        /* Lookup a 'server info' return based only on the principal */
+        NTSTATUS (*get_server_info_principal)(TALLOC_CTX *mem_ctx,
+                                              struct auth_context *auth_context,
+                                              const char *principal,
+                                              struct auth_serversupplied_info **server_info);
+                                   struct auth_user_info_dc **interim_info);
+        /* Lookup a 'session info interim' return based only on the principal or DN */
+        NTSTATUS (*get_user_info_dc_principal)(TALLOC_CTX *mem_ctx,
+                                                       struct auth_context *auth_context,
+                                                       const char *principal,
+                                                       struct ldb_dn *user_dn,
+                                                       struct auth_user_info_dc **interim_info);
 };
 …
 struct auth_context {
         struct {
                 /* Who set this up in the first place? */
+                /* Who set this up in the first place? */
                 const char *set_by;
                 bool may_be_modified;
                 DATA_BLOB data;
+                DATA_BLOB data;
         } challenge;
 …
         struct loadparm_context *lp_ctx;
+        /* SAM database for this local machine - to fill in local groups, or to authenticate local NTLM users */
+        struct ldb_context *sam_ctx;
         NTSTATUS (*check_password)(struct auth_context *auth_ctx,
                                    TALLOC_CTX *mem_ctx,
                                    const struct auth_usersupplied_info *user_info,
                                    struct auth_serversupplied_info **server_info);
         NTSTATUS (*get_challenge)(struct auth_context *auth_ctx, const uint8_t **_chal);
+                                   const struct auth_usersupplied_info *user_info,
+                                   struct auth_user_info_dc **user_info_dc);
+        NTSTATUS (*get_challenge)(struct auth_context *auth_ctx, uint8_t chal[8]);
         bool (*challenge_may_be_modified)(struct auth_context *auth_ctx);
         NTSTATUS (*set_challenge)(struct auth_context *auth_ctx, const uint8_t chal[8], const char *set_by);
+        NTSTATUS (*get_server_info_principal)(TALLOC_CTX *mem_ctx,
+                                              struct auth_context *auth_context,
+                                              const char *principal,
+                                              struct auth_serversupplied_info **server_info);
+        NTSTATUS (*get_user_info_dc_principal)(TALLOC_CTX *mem_ctx,
+                                                       struct auth_context *auth_ctx,
+                                                       const char *principal,
+                                                       struct ldb_dn *user_dn,
+                                                       struct auth_user_info_dc **user_info_dc);
+        NTSTATUS (*generate_session_info)(TALLOC_CTX *mem_ctx,
+                                          struct auth_context *auth_context,
+                                          struct auth_user_info_dc *user_info_dc,
+                                          uint32_t session_info_flags,
+                                          struct auth_session_info **session_info);
 };
 …
         int sizeof_auth_context;
         int sizeof_auth_usersupplied_info;
         int sizeof_auth_serversupplied_info;
 };
  NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth_context *auth_context,
+        int sizeof_auth_user_info_dc;
+};
+ NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth_context *auth_context,
                            enum auth_password_state to_state,
                            const struct auth_usersupplied_info *user_info_in,
 …
 #include "auth/session.h"
 #include "auth/system_session_proto.h"
+#include "libcli/security/security.h"
 struct ldb_message;
 struct ldb_context;
-struct ldb_dn;
 struct gensec_security;
+NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, const uint8_t **_chal);
+struct cli_credentials;
+NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, uint8_t chal[8]);
 NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
                             struct ldb_context *sam_ctx,
 …
                             bool allow_domain_trust,
                             bool password_change);
+struct auth_session_info *system_session(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
+NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
+NTSTATUS authsam_expand_nested_groups(struct ldb_context *sam_ctx,
+                                      struct ldb_val *dn_val, const bool only_childs, const char *filter,
+                                      TALLOC_CTX *res_sids_ctx, struct dom_sid ***res_sids,
+                                      unsigned int *num_res_sids);
+struct auth_session_info *system_session(struct loadparm_context *lp_ctx);
+NTSTATUS authsam_make_user_info_dc(TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
                                            const char *netbios_name,
                                            const char *domain_name,
                                            struct ldb_dn *domain_dn,
+                                           struct ldb_dn *domain_dn,
                                            struct ldb_message *msg,
                                            DATA_BLOB user_sess_key, DATA_BLOB lm_sess_key,
                                   struct auth_serversupplied_info **_server_info);
 NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx,
+                                  struct auth_user_info_dc **_user_info_dc);
+NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx,
                                            struct loadparm_context *lp_ctx,
                                            struct auth_session_info **_session_info) ;
+NTSTATUS auth_nt_status_squash(NTSTATUS nt_status);
+NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods,
+NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods,
                                      struct tevent_context *ev,
                                      struct messaging_context *msg,
                                      struct loadparm_context *lp_ctx,
+                                     struct ldb_context *sam_ctx,
                                      struct auth_context **auth_ctx);
+NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx,
+const char **auth_methods_from_lp(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
+NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx,
                              struct tevent_context *ev,
                              struct messaging_context *msg,
                              struct loadparm_context *lp_ctx,
                              struct auth_context **auth_ctx);
+NTSTATUS auth_context_create_from_ldb(TALLOC_CTX *mem_ctx, struct ldb_context *ldb, struct auth_context **auth_ctx);
 NTSTATUS auth_check_password(struct auth_context *auth_ctx,
                              TALLOC_CTX *mem_ctx,
                              const struct auth_usersupplied_info *user_info,
                              struct auth_serversupplied_info **server_info);
 NTSTATUS auth_init(void);
+                             const struct auth_usersupplied_info *user_info,
+                             struct auth_user_info_dc **user_info_dc);
+NTSTATUS auth4_init(void);
 NTSTATUS auth_register(const struct auth_operations *ops);
+NTSTATUS server_service_auth_init(void);
 NTSTATUS authenticate_username_pw(TALLOC_CTX *mem_ctx,
+                                           struct tevent_context *ev,
+                                           struct messaging_context *msg,
+                                           struct loadparm_context *lp_ctx,
+                                           const char *nt4_domain,
+                                           const char *nt4_username,
+                                           const char *password,
+                                           struct auth_session_info **session_info);
+NTSTATUS auth_check_password_recv(struct auth_check_password_request *req,
+                                  struct tevent_context *ev,
+                                  struct messaging_context *msg,
+                                  struct loadparm_context *lp_ctx,
+                                  const char *nt4_domain,
+                                  const char *nt4_username,
+                                  const char *password,
+                                  const uint32_t logon_parameters,
+                                  struct auth_session_info **session_info);
+struct tevent_req *auth_check_password_send(TALLOC_CTX *mem_ctx,
+                                            struct tevent_context *ev,
+                                            struct auth_context *auth_ctx,
+                                            const struct auth_usersupplied_info *user_info);
+NTSTATUS auth_check_password_recv(struct tevent_req *req,
                                   TALLOC_CTX *mem_ctx,
+                                  struct auth_serversupplied_info **server_info);
+void auth_check_password_send(struct auth_context *auth_ctx,
+                              const struct auth_usersupplied_info *user_info,
+                              void (*callback)(struct auth_check_password_request *req, void *private_data),
+                              void *private_data);
+                                  struct auth_user_info_dc **user_info_dc);
+bool auth_challenge_may_be_modified(struct auth_context *auth_ctx);
 NTSTATUS auth_context_set_challenge(struct auth_context *auth_ctx, const uint8_t chal[8], const char *set_by);
+NTSTATUS auth_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
+                                        struct auth_context *auth_ctx,
+                                        const char *principal,
+                                        struct ldb_dn *user_dn,
+                                        struct auth_user_info_dc **user_info_dc);
 NTSTATUS samba_server_gensec_start(TALLOC_CTX *mem_ctx,

vendor/current/source4/auth/credentials/credentials.c

-              r414
+              r740
 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
 #include "auth/credentials/credentials.h"
-#include "auth/credentials/credentials_krb5.h"
-#include "auth/credentials/credentials_proto.h"
 #include "libcli/auth/libcli_auth.h"
 #include "lib/events/events.h"
 #include "param/param.h"
+#include "system/filesys.h"
 /**
 …
+{
         struct cli_credentials *cred = talloc(mem_ctx, struct cli_credentials);
         if (!cred) {
+        if (cred == NULL) {
                 return cred;
+        }
-        cred->netlogon_creds = NULL;
-        cred->machine_account_pending = false;
         cred->workstation_obtained = CRED_UNINITIALISED;
         cred->username_obtained = CRED_UNINITIALISED;
 …
         cred->ccache_obtained = CRED_UNINITIALISED;
         cred->client_gss_creds_obtained = CRED_UNINITIALISED;
+        cred->principal_obtained = CRED_UNINITIALISED;
+        cred->keytab_obtained = CRED_UNINITIALISED;
         cred->server_gss_creds_obtained = CRED_UNINITIALISED;
-        cred->keytab_obtained = CRED_UNINITIALISED;
-        cred->principal_obtained = CRED_UNINITIALISED;
         cred->ccache_threshold = CRED_UNINITIALISED;
         cred->client_gss_creds_threshold = CRED_UNINITIALISED;
+        cred->workstation = NULL;
+        cred->username = NULL;
+        cred->password = NULL;
         cred->old_password = NULL;
+        cred->domain = NULL;
+        cred->realm = NULL;
+        cred->principal = NULL;
+        cred->salt_principal = NULL;
+        cred->impersonate_principal = NULL;
+        cred->target_service = NULL;
+        cred->bind_dn = NULL;
+        cred->nt_hash = NULL;
+        cred->lm_response.data = NULL;
+        cred->lm_response.length = 0;
+        cred->nt_response.data = NULL;
+        cred->nt_response.length = 0;
+        cred->ccache = NULL;
+        cred->client_gss_creds = NULL;
+        cred->keytab = NULL;
+        cred->server_gss_creds = NULL;
+        cred->workstation_cb = NULL;
+        cred->password_cb = NULL;
+        cred->username_cb = NULL;
+        cred->domain_cb = NULL;
+        cred->realm_cb = NULL;
+        cred->principal_cb = NULL;
+        cred->priv_data = NULL;
+        cred->netlogon_creds = NULL;
+        cred->secure_channel_type = SEC_CHAN_NULL;
+        cred->kvno = 0;
+        cred->password_last_changed_time = 0;
         cred->smb_krb5_context = NULL;
+        cred->salt_principal = NULL;
+        cred->machine_account_pending = false;
+        cred->machine_account_pending_lp_ctx = NULL;
         cred->machine_account = false;
-        cred->bind_dn = NULL;
         cred->tries = 3;
         cred->callback_running = false;
         cli_credentials_set_kerberos_state(cred, CRED_AUTO_USE_KERBEROS);
         cli_credentials_set_gensec_features(cred, 0);
+        cli_credentials_set_krb_forwardable(cred, CRED_AUTO_KRB_FORWARDABLE);
         return cred;
 …
+}
+_PUBLIC_ void cli_credentials_set_krb_forwardable(struct cli_credentials *creds,
+                                                  enum credentials_krb_forwardable krb_forwardable)
+{
+        creds->krb_forwardable = krb_forwardable;
+}
 _PUBLIC_ enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds)
+{
         return creds->use_kerberos;
+}
+_PUBLIC_ enum credentials_krb_forwardable cli_credentials_get_krb_forwardable(struct cli_credentials *creds)
+{
+        return creds->krb_forwardable;
+}
 …
  * @note Return value will never be NULL except by programmer error.
  */
 _PUBLIC_ const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
+const char *cli_credentials_get_principal_and_obtained(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, enum credentials_obtained *obtained)
+{
         if (cred->machine_account_pending) {
 …
+        }
+        if (cred->principal_obtained < cred->username_obtained) {
+        if (cred->principal_obtained < cred->username_obtained
+            || cred->principal_obtained < MAX(cred->domain_obtained, cred->realm_obtained)) {
                 if (cred->domain_obtained > cred->realm_obtained) {
+                        *obtained = MIN(cred->domain_obtained, cred->username_obtained);
                         return talloc_asprintf(mem_ctx, "%s@%s",
                                                cli_credentials_get_username(cred),
                                                cli_credentials_get_domain(cred));
                 } else {
+                        *obtained = MIN(cred->domain_obtained, cred->username_obtained);
                         return talloc_asprintf(mem_ctx, "%s@%s",
                                                cli_credentials_get_username(cred),
 …
+                }
+        }
+        *obtained = cred->principal_obtained;
         return talloc_reference(mem_ctx, cred->principal);
+}
+/**
+ * Obtain the client principal for this credentials context.
+ * @param cred credentials context
+ * @retval The username set on this context.
+ * @note Return value will never be NULL except by programmer error.
+ */
+_PUBLIC_ const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
+{
+        enum credentials_obtained obtained;
+        return cli_credentials_get_principal_and_obtained(cred, mem_ctx, &obtained);
+}
 …
+{
         cli_credentials_set_username(cred, "", CRED_UNINITIALISED);
         cli_credentials_set_domain(cred, lp_workgroup(lp_ctx), CRED_UNINITIALISED);
         cli_credentials_set_workstation(cred, lp_netbios_name(lp_ctx), CRED_UNINITIALISED);
         cli_credentials_set_realm(cred, lp_realm(lp_ctx), CRED_UNINITIALISED);
+        cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_UNINITIALISED);
+        cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_UNINITIALISED);
+        cli_credentials_set_realm(cred, lpcfg_realm(lp_ctx), CRED_UNINITIALISED);
+}
 …
+{
         char *p;
+        const char *error_string;
         if (lp_ctx != NULL) {
 …
         if (cli_credentials_get_kerberos_state(cred) != CRED_DONT_USE_KERBEROS) {
+                cli_credentials_set_ccache(cred, event_context_find(cred), lp_ctx, NULL, CRED_GUESS_FILE);
+                cli_credentials_set_ccache(cred, lp_ctx, NULL, CRED_GUESS_FILE,
+                                           &error_string);
+        }
+}
 …
+{
         cred->secure_channel_type = secure_channel_type;
+}
+/**
+ * Return NETLOGON secure chanel type
+ */
+_PUBLIC_ time_t cli_credentials_get_password_last_changed_time(struct cli_credentials *cred)
+{
+        return cred->password_last_changed_time;
+}
+/**
+ * Set NETLOGON secure channel type
+ */
+_PUBLIC_ void cli_credentials_set_password_last_changed_time(struct cli_credentials *cred,
+                                                             time_t last_changed_time)
+{
+        cred->password_last_changed_time = last_changed_time;
+}
 …
         const char *username;
+        /* if bind dn is set it's not anonymous */
+        if (cred->bind_dn) {
+                return false;
+        }
         if (cred->machine_account_pending) {
                 cli_credentials_set_machine_account(cred,
 …
         return (cred->tries > 0);
+}
+_PUBLIC_ void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx,
+                                              const char **username,
+                                              const char **domain)
+{
+        if (cred->principal_obtained > cred->username_obtained) {
+                *domain = talloc_strdup(mem_ctx, "");
+                *username = cli_credentials_get_principal(cred, mem_ctx);
+        } else {
+                *domain = cli_credentials_get_domain(cred);
+                *username = cli_credentials_get_username(cred);
+        }
+}
+/**
+ * Read a named file, and parse it for username, domain, realm and password
+ *
+ * @param credentials Credentials structure on which to set the password
+ * @param file a named file to read the details from
+ * @param obtained This enum describes how 'specified' this password is
+ */
+_PUBLIC_ bool cli_credentials_parse_file(struct cli_credentials *cred, const char *file, enum credentials_obtained obtained)
+{
+        uint16_t len = 0;
+        char *ptr, *val, *param;
+        char **lines;
+        int i, numlines;
+        lines = file_lines_load(file, &numlines, 0, NULL);
+        if (lines == NULL)
+        {
+                /* fail if we can't open the credentials file */
+                d_printf("ERROR: Unable to open credentials file!\n");
+                return false;
+        }
+        for (i = 0; i < numlines; i++) {
+                len = strlen(lines[i]);
+                if (len == 0)
+                        continue;
+                /* break up the line into parameter & value.
+                 * will need to eat a little whitespace possibly */
+                param = lines[i];
+                if (!(ptr = strchr_m (lines[i], '=')))
+                        continue;
+                val = ptr+1;
+                *ptr = '\0';
+                /* eat leading white space */
+                while ((*val!='\0') && ((*val==' ') || (*val=='\t')))
+                        val++;
+                if (strwicmp("password", param) == 0) {
+                        cli_credentials_set_password(cred, val, obtained);
+                } else if (strwicmp("username", param) == 0) {
+                        cli_credentials_set_username(cred, val, obtained);
+                } else if (strwicmp("domain", param) == 0) {
+                        cli_credentials_set_domain(cred, val, obtained);
+                } else if (strwicmp("realm", param) == 0) {
+                        cli_credentials_set_realm(cred, val, obtained);
+                }
+                memset(lines[i], 0, len);
+        }
+        talloc_free(lines);
+        return true;
+}
+/**
+ * Read a named file, and parse it for a password
+ *
+ * @param credentials Credentials structure on which to set the password
+ * @param file a named file to read the password from
+ * @param obtained This enum describes how 'specified' this password is
+ */
+_PUBLIC_ bool cli_credentials_parse_password_file(struct cli_credentials *credentials, const char *file, enum credentials_obtained obtained)
+{
+        int fd = open(file, O_RDONLY, 0);
+        bool ret;
+        if (fd < 0) {
+                fprintf(stderr, "Error opening password file %s: %s\n",
+                                file, strerror(errno));
+                return false;
+        }
+        ret = cli_credentials_parse_password_fd(credentials, fd, obtained);
+        close(fd);
+        return ret;
+}
+/**
+ * Read a file descriptor, and parse it for a password (eg from a file or stdin)
+ *
+ * @param credentials Credentials structure on which to set the password
+ * @param fd open file descriptor to read the password from
+ * @param obtained This enum describes how 'specified' this password is
+ */
+_PUBLIC_ bool cli_credentials_parse_password_fd(struct cli_credentials *credentials,
+                                       int fd, enum credentials_obtained obtained)
+{
+        char *p;
+        char pass[128];
+        for(p = pass, *p = '\0'; /* ensure that pass is null-terminated */
+                p && p - pass < sizeof(pass);) {
+                switch (read(fd, p, 1)) {
+                case 1:
+                        if (*p != '\n' && *p != '\0') {
+                                *++p = '\0'; /* advance p, and null-terminate pass */
+                                break;
+                        }
+                        /* fall through */
+                case 0:
+                        if (p - pass) {
+                                *p = '\0'; /* null-terminate it, just in case... */
+                                p = NULL; /* then force the loop condition to become false */
+                                break;
+                        } else {
+                                fprintf(stderr, "Error reading password from file descriptor %d: %s\n", fd, "empty password\n");
+                                return false;
+                        }
+                default:
+                        fprintf(stderr, "Error reading password from file descriptor %d: %s\n",
+                                        fd, strerror(errno));
+                        return false;
+                }
+        }
+        cli_credentials_set_password(credentials, pass, obtained);
+        return true;
+}

vendor/current/source4/auth/credentials/credentials.h

-              r414
+              r740
 };
+enum credentials_krb_forwardable {
+        CRED_AUTO_KRB_FORWARDABLE = 0, /* Default, follow library defaults */
+        CRED_NO_KRB_FORWARDABLE,       /* not forwardable */
+        CRED_FORCE_KRB_FORWARDABLE     /* forwardable */
+};
 #define CLI_CRED_NTLM2       0x01
 #define CLI_CRED_NTLMv2_AUTH 0x02
 …
         const char *realm;
         const char *principal;
+        const char *salt_principal;
+        char *salt_principal;
+        char *impersonate_principal;
+        char *target_service;
         const char *bind_dn;
 …
         enum netr_SchannelType secure_channel_type;
         int kvno;
+        time_t password_last_changed_time;
         struct smb_krb5_context *smb_krb5_context;
 …
         enum credentials_use_kerberos use_kerberos;
+        /* Should we get a forwardable ticket? */
+        enum credentials_krb_forwardable krb_forwardable;
         /* gensec features which should be used for connections */
         uint32_t gensec_features;
 …
 struct ldb_context;
+struct ldb_message;
 struct loadparm_context;
 struct ccache_container;
 …
 const char *cli_credentials_get_username(struct cli_credentials *cred);
 int cli_credentials_get_krb5_context(struct cli_credentials *cred,
-                                     struct tevent_context *event_ctx,
                                      struct loadparm_context *lp_ctx,
                                      struct smb_krb5_context **smb_krb5_context);
 …
                                struct tevent_context *event_ctx,
                                struct loadparm_context *lp_ctx,
+                               struct ccache_container **ccc);
+                               struct ccache_container **ccc,
+                               const char **error_string);
+int cli_credentials_get_named_ccache(struct cli_credentials *cred,
+                                     struct tevent_context *event_ctx,
+                                     struct loadparm_context *lp_ctx,
+                                     char *ccache_name,
+                                     struct ccache_container **ccc, const char **error_string);
 int cli_credentials_get_keytab(struct cli_credentials *cred,
-                               struct tevent_context *event_ctx,
                                struct loadparm_context *lp_ctx,
                                struct keytab_container **_ktc);
 …
 const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx);
 int cli_credentials_get_server_gss_creds(struct cli_credentials *cred,
-                                         struct tevent_context *event_ctx,
                                          struct loadparm_context *lp_ctx,
                                          struct gssapi_creds_container **_gcc);
 …
                                          struct tevent_context *event_ctx,
                                          struct loadparm_context *lp_ctx,
+                                         struct gssapi_creds_container **_gcc);
+                                         struct gssapi_creds_container **_gcc,
+                                         const char **error_string);
 void cli_credentials_set_kerberos_state(struct cli_credentials *creds,
                                         enum credentials_use_kerberos use_kerberos);
+void cli_credentials_set_krb_forwardable(struct cli_credentials *creds,
+                                         enum credentials_krb_forwardable krb_forwardable);
 bool cli_credentials_set_domain(struct cli_credentials *cred,
                                 const char *val,
 …
 void cli_credentials_set_secure_channel_type(struct cli_credentials *cred,
                                      enum netr_SchannelType secure_channel_type);
+void cli_credentials_set_password_last_changed_time(struct cli_credentials *cred,
+                                                             time_t last_change_time);
 void cli_credentials_set_netlogon_creds(struct cli_credentials *cred,
                                         struct netlogon_creds_CredentialState *netlogon_creds);
 …
                                           struct smb_krb5_context *smb_krb5_context);
 NTSTATUS cli_credentials_set_stored_principal(struct cli_credentials *cred,
-                                              struct tevent_context *event_ctx,
                                               struct loadparm_context *lp_ctx,
                                               const char *serviceprincipal);
 …
                                            const char *(*password_cb) (struct cli_credentials *));
 enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_credentials *cred);
+time_t cli_credentials_get_password_last_changed_time(struct cli_credentials *cred);
 void cli_credentials_set_kvno(struct cli_credentials *cred,
                               int kvno);
 …
                                        enum credentials_obtained obtained);
 int cli_credentials_set_keytab_name(struct cli_credentials *cred,
-                                    struct tevent_context *event_ctx,
                                     struct loadparm_context *lp_ctx,
                                     const char *keytab_name,
                                     enum credentials_obtained obtained);
-int cli_credentials_update_keytab(struct cli_credentials *cred,
-                                  struct tevent_context *event_ctx,
-                                  struct loadparm_context *lp_ctx);
 void cli_credentials_set_gensec_features(struct cli_credentials *creds, uint32_t gensec_features);
 uint32_t cli_credentials_get_gensec_features(struct cli_credentials *creds);
 int cli_credentials_set_ccache(struct cli_credentials *cred,
-                               struct tevent_context *event_ctx,
                                struct loadparm_context *lp_ctx,
                                const char *name,
+                               enum credentials_obtained obtained);
+                               enum credentials_obtained obtained,
+                               const char **error_string);
 bool cli_credentials_parse_password_file(struct cli_credentials *credentials, const char *file, enum credentials_obtained obtained);
 bool cli_credentials_parse_password_fd(struct cli_credentials *credentials,
 …
                                        enum credentials_obtained obtained);
 void cli_credentials_set_salt_principal(struct cli_credentials *cred, const char *principal);
+void cli_credentials_set_impersonate_principal(struct cli_credentials *cred, const char *principal);
+void cli_credentials_set_target_service(struct cli_credentials *cred, const char *principal);
+const char *cli_credentials_get_salt_principal(struct cli_credentials *cred);
+const char *cli_credentials_get_impersonate_principal(struct cli_credentials *cred);
+const char *cli_credentials_get_target_service(struct cli_credentials *cred);
 enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds);
+enum credentials_krb_forwardable cli_credentials_get_krb_forwardable(struct cli_credentials *creds);
 NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred,
-                                     struct tevent_context *event_ctx,
                                      struct loadparm_context *lp_ctx,
                                      struct ldb_context *ldb,
                                      const char *base,
+                                     const char *filter);
+                                     const char *filter,
+                                     char **error_string);
  int cli_credentials_get_kvno(struct cli_credentials *cred);
 #endif /* __CREDENTIALS_H__ */

vendor/current/source4/auth/credentials/credentials_krb5.c

-              r414
+              r740
 #include "auth/credentials/credentials_proto.h"
 #include "auth/credentials/credentials_krb5.h"
+#include "auth/kerberos/kerberos_credentials.h"
+#include "auth/kerberos/kerberos_util.h"
 #include "param/param.h"
 _PUBLIC_ int cli_credentials_get_krb5_context(struct cli_credentials *cred,
-                                              struct tevent_context *event_ctx,
                                      struct loadparm_context *lp_ctx,
                                      struct smb_krb5_context **smb_krb5_context)
 …
+        }
+        ret = smb_krb5_init_context(cred, event_ctx, lp_ctx, &cred->smb_krb5_context);
+        ret = smb_krb5_init_context(cred, NULL, lp_ctx,
+                                    &cred->smb_krb5_context);
         if (ret) {
                 cred->smb_krb5_context = NULL;
 …
+}
+/* This needs to be called directly after the cli_credentials_init(),
+ * otherwise we might have problems with the krb5 context already
+ * being here.
+/* For most predictable behaviour, this needs to be called directly after the cli_credentials_init(),
+ * otherwise we may still have references to the old smb_krb5_context in a credential cache etc
  */
 _PUBLIC_ NTSTATUS cli_credentials_set_krb5_context(struct cli_credentials *cred,
                                           struct smb_krb5_context *smb_krb5_context)
+{
+        if (smb_krb5_context == NULL) {
+                talloc_unlink(cred, cred->smb_krb5_context);
+                cred->smb_krb5_context = NULL;
+                return NT_STATUS_OK;
+        }
         if (!talloc_reference(cred, smb_krb5_context)) {
                 return NT_STATUS_NO_MEMORY;
 …
 static int cli_credentials_set_from_ccache(struct cli_credentials *cred,
+                                    struct ccache_container *ccache,
+                                    enum credentials_obtained obtained)
+                                           struct ccache_container *ccache,
+                                           enum credentials_obtained obtained,
+                                           const char **error_string)
+{
 …
         if (ret) {
+                char *err_mess = smb_get_krb5_error_message(ccache->smb_krb5_context->krb5_context,
+                                                            ret, cred);
+                DEBUG(1,("failed to get principal from ccache: %s\n",
+                         err_mess));
+                talloc_free(err_mess);
+                (*error_string) = talloc_asprintf(cred, "failed to get principal from ccache: %s\n",
+                                                  smb_get_krb5_error_message(ccache->smb_krb5_context->krb5_context,
+                                                                             ret, cred));
                 return ret;
+        }
 …
         ret = krb5_unparse_name(ccache->smb_krb5_context->krb5_context, princ, &name);
         if (ret) {
+                char *err_mess = smb_get_krb5_error_message(ccache->smb_krb5_context->krb5_context, ret, cred);
+                DEBUG(1,("failed to unparse principal from ccache: %s\n",
+                         err_mess));
+                talloc_free(err_mess);
+                (*error_string) = talloc_asprintf(cred, "failed to unparse principal from ccache: %s\n",
+                                                  smb_get_krb5_error_message(ccache->smb_krb5_context->krb5_context,
+                                                                             ret, cred));
                 return ret;
+        }
 …
 _PUBLIC_ int cli_credentials_set_ccache(struct cli_credentials *cred,
                                         struct tevent_context *event_ctx,
                                struct loadparm_context *lp_ctx,
                                const char *name,
                                enum credentials_obtained obtained)
+                                        struct loadparm_context *lp_ctx,
+                                        const char *name,
+                                        enum credentials_obtained obtained,
+                                        const char **error_string)
+{
         krb5_error_code ret;
 …
         ccc = talloc(cred, struct ccache_container);
         if (!ccc) {
+                return ENOMEM;
+        }
+        ret = cli_credentials_get_krb5_context(cred, event_ctx, lp_ctx,
+                (*error_string) = error_message(ENOMEM);
+                return ENOMEM;
+        }
+        ret = cli_credentials_get_krb5_context(cred, lp_ctx,
                                                &ccc->smb_krb5_context);
         if (ret) {
+                (*error_string) = error_message(ret);
                 talloc_free(ccc);
                 return ret;
 …
         if (!talloc_reference(ccc, ccc->smb_krb5_context)) {
                 talloc_free(ccc);
+                (*error_string) = error_message(ENOMEM);
                 return ENOMEM;
+        }
 …
                 ret = krb5_cc_resolve(ccc->smb_krb5_context->krb5_context, name, &ccc->ccache);
                 if (ret) {
+                        DEBUG(1,("failed to read krb5 ccache: %s: %s\n",
+                                 name,
+                                 smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context, ret, ccc)));
+                        (*error_string) = talloc_asprintf(cred, "failed to read krb5 ccache: %s: %s\n",
+                                                          name,
+                                                          smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context,
+                                                                                     ret, ccc));
                         talloc_free(ccc);
                         return ret;
 …
                 ret = krb5_cc_default(ccc->smb_krb5_context->krb5_context, &ccc->ccache);
                 if (ret) {
+                        DEBUG(3,("failed to read default krb5 ccache: %s\n",
+                                 smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context, ret, ccc)));
+                        (*error_string) = talloc_asprintf(cred, "failed to read default krb5 ccache: %s\n",
+                                                          smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context,
+                                                                                     ret, ccc));
                         talloc_free(ccc);
                         return ret;
 …
         ret = krb5_cc_get_principal(ccc->smb_krb5_context->krb5_context, ccc->ccache, &princ);
+        if (ret) {
+                DEBUG(3,("failed to get principal from default ccache: %s\n",
+                         smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context, ret, ccc)));
+                talloc_free(ccc);
+                return ret;
+        }
+        krb5_free_principal(ccc->smb_krb5_context->krb5_context, princ);
+        ret = cli_credentials_set_from_ccache(cred, ccc, obtained);
+        if (ret) {
+                return ret;
+        }
+        cred->ccache = ccc;
+        cred->ccache_obtained = obtained;
+        talloc_steal(cred, ccc);
+        cli_credentials_invalidate_client_gss_creds(cred, cred->ccache_obtained);
+        if (ret == 0) {
+                krb5_free_principal(ccc->smb_krb5_context->krb5_context, princ);
+                ret = cli_credentials_set_from_ccache(cred, ccc, obtained, error_string);
+                if (ret) {
+                        (*error_string) = error_message(ret);
+                        return ret;
+                }
+                cred->ccache = ccc;
+                cred->ccache_obtained = obtained;
+                talloc_steal(cred, ccc);
+                cli_credentials_invalidate_client_gss_creds(cred, cred->ccache_obtained);
+                return 0;
+        }
         return 0;
+}
 …
 static int cli_credentials_new_ccache(struct cli_credentials *cred,
-                                      struct tevent_context *event_ctx,
                                       struct loadparm_context *lp_ctx,
+                                      struct ccache_container **_ccc)
+{
+                                      char *ccache_name,
+                                      struct ccache_container **_ccc,
+                                      const char **error_string)
+{
+        bool must_free_cc_name = false;
         krb5_error_code ret;
         struct ccache_container *ccc = talloc(cred, struct ccache_container);
-        char *ccache_name;
         if (!ccc) {
                 return ENOMEM;
+        }
+        ccache_name = talloc_asprintf(ccc, "MEMORY:%p",
+                                      ccc);
+        if (!ccache_name) {
+        ret = cli_credentials_get_krb5_context(cred, lp_ctx,
+                                               &ccc->smb_krb5_context);
+        if (ret) {
                 talloc_free(ccc);
+                return ENOMEM;
+        }
+        ret = cli_credentials_get_krb5_context(cred, event_ctx, lp_ctx,
+                                               &ccc->smb_krb5_context);
+        if (ret) {
+                talloc_free(ccc);
+                (*error_string) = talloc_asprintf(cred, "Failed to get krb5_context: %s",
+                                                  error_message(ret));
                 return ret;
+        }
         if (!talloc_reference(ccc, ccc->smb_krb5_context)) {
                 talloc_free(ccc);
+                return ENOMEM;
+                (*error_string) = strerror(ENOMEM);
+                return ENOMEM;
+        }
+        if (!ccache_name) {
+                must_free_cc_name = true;
+                ccache_name = talloc_asprintf(ccc, "MEMORY:%p",
+                                              ccc);
+                if (!ccache_name) {
+                        talloc_free(ccc);
+                        (*error_string) = strerror(ENOMEM);
+                        return ENOMEM;
+                }
+        }
 …
                               &ccc->ccache);
         if (ret) {
+                DEBUG(1,("failed to generate a new krb5 ccache (%s): %s\n",
+                         ccache_name,
+                         smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context, ret, ccc)));
+                (*error_string) = talloc_asprintf(cred, "failed to resolve a krb5 ccache (%s): %s\n",
+                                                  ccache_name,
+                                                  smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context,
+                                                                             ret, ccc));
                 talloc_free(ccache_name);
                 talloc_free(ccc);
 …
+        }
+        talloc_set_destructor(ccc, free_mccache);
+        talloc_free(ccache_name);
+        if (strncasecmp(ccache_name, "MEMORY:", 7) == 0) {
+                talloc_set_destructor(ccc, free_mccache);
+        } else {
+                talloc_set_destructor(ccc, free_dccache);
+        }
+        if (must_free_cc_name) {
+                talloc_free(ccache_name);
+        }
         *_ccc = ccc;
+        return ret;
+}
+_PUBLIC_ int cli_credentials_get_ccache(struct cli_credentials *cred,
+                                        struct tevent_context *event_ctx,
+                               struct loadparm_context *lp_ctx,
+                               struct ccache_container **ccc)
+        return 0;
+}
+_PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred,
+                                              struct tevent_context *event_ctx,
+                                              struct loadparm_context *lp_ctx,
+                                              char *ccache_name,
+                                              struct ccache_container **ccc,
+                                              const char **error_string)
+{
         krb5_error_code ret;
+        enum credentials_obtained obtained;
         if (cred->machine_account_pending) {
 …
+        }
         if (cli_credentials_is_anonymous(cred)) {
+                (*error_string) = "Cannot get anonymous kerberos credentials";
                 return EINVAL;
+        }
         ret = cli_credentials_new_ccache(cred, event_ctx, lp_ctx, ccc);
         if (ret) {
                 return ret;
+        }
         ret = kinit_to_ccache(cred, cred, (*ccc)->smb_krb5_context, (*ccc)->ccache);
+        ret = cli_credentials_new_ccache(cred, lp_ctx, ccache_name, ccc, error_string);
+        if (ret) {
+                return ret;
+        }
+        ret = kinit_to_ccache(cred, cred, (*ccc)->smb_krb5_context, event_ctx, (*ccc)->ccache, &obtained, error_string);
         if (ret) {
                 return ret;
 …
         ret = cli_credentials_set_from_ccache(cred, *ccc,
+                                              (MAX(MAX(cred->principal_obtained,
+                                                       cred->username_obtained),
+                                                   cred->password_obtained)));
+                                              obtained, error_string);
         cred->ccache = *ccc;
 …
+        }
         cli_credentials_invalidate_client_gss_creds(cred, cred->ccache_obtained);
+        return ret;
+        return 0;
+}
+_PUBLIC_ int cli_credentials_get_ccache(struct cli_credentials *cred,
+                                        struct tevent_context *event_ctx,
+                                        struct loadparm_context *lp_ctx,
+                                        struct ccache_container **ccc,
+                                        const char **error_string)
+{
+        return cli_credentials_get_named_ccache(cred, event_ctx, lp_ctx, NULL, ccc, error_string);
+}
+/* We have good reason to think the ccache in these credentials is invalid - blow it away */
+static void cli_credentials_unconditionally_invalidate_client_gss_creds(struct cli_credentials *cred)
+{
+        if (cred->client_gss_creds_obtained > CRED_UNINITIALISED) {
+                talloc_unlink(cred, cred->client_gss_creds);
+                cred->client_gss_creds = NULL;
+        }
+        cred->client_gss_creds_obtained = CRED_UNINITIALISED;
+}
 …
+}
+/* We have good reason to think this CCACHE is invalid.  Blow it away */
+static void cli_credentials_unconditionally_invalidate_ccache(struct cli_credentials *cred)
+{
+        if (cred->ccache_obtained > CRED_UNINITIALISED) {
+                talloc_unlink(cred, cred->ccache);
+                cred->ccache = NULL;
+        }
+        cred->ccache_obtained = CRED_UNINITIALISED;
+        cli_credentials_unconditionally_invalidate_client_gss_creds(cred);
+}
 _PUBLIC_ void cli_credentials_invalidate_ccache(struct cli_credentials *cred,
                                        enum credentials_obtained obtained)
 …
 _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
+                                         struct tevent_context *event_ctx,
+                                         struct loadparm_context *lp_ctx,
+                                         struct gssapi_creds_container **_gcc)
+                                                  struct tevent_context *event_ctx,
+                                                  struct loadparm_context *lp_ctx,
+                                                  struct gssapi_creds_container **_gcc,
+                                                  const char **error_string)
+{
         int ret = 0;
 …
+        }
         ret = cli_credentials_get_ccache(cred, event_ctx, lp_ctx,
                                          &ccache);
+        ret = cli_credentials_get_ccache(cred, event_ctx, lp_ctx,
+                                         &ccache, error_string);
         if (ret) {
                 DEBUG(1, ("Failed to get CCACHE for GSSAPI client: %s\n", error_message(ret)));
 …
         gcc = talloc(cred, struct gssapi_creds_container);
         if (!gcc) {
+                (*error_string) = error_message(ENOMEM);
                 return ENOMEM;
+        }
 …
         maj_stat = gss_krb5_import_cred(&min_stat, ccache->ccache, NULL, NULL,
                                         &gcc->creds);
+        if ((maj_stat == GSS_S_FAILURE) && (min_stat == (OM_uint32)KRB5_CC_END || min_stat == (OM_uint32) KRB5_CC_NOTFOUND)) {
+                /* This CCACHE is no good.  Ensure we don't use it again */
+                cli_credentials_unconditionally_invalidate_ccache(cred);
+                /* Now try again to get a ccache */
+                ret = cli_credentials_get_ccache(cred, event_ctx, lp_ctx,
+                                                 &ccache, error_string);
+                if (ret) {
+                        DEBUG(1, ("Failed to re-get CCACHE for GSSAPI client: %s\n", error_message(ret)));
+                        return ret;
+                }
+                maj_stat = gss_krb5_import_cred(&min_stat, ccache->ccache, NULL, NULL,
+                                                &gcc->creds);
+        }
         if (maj_stat) {
                 talloc_free(gcc);
 …
                         ret = EINVAL;
+                }
+                (*error_string) = talloc_asprintf(cred, "gss_krb5_import_cred failed: %s", error_message(ret));
                 return ret;
+        }
 …
                 maj_stat = gss_krb5_set_allowable_enctypes(&min_stat, gcc->creds,
+                                                           num_ktypes, etypes);
+                                                           num_ktypes,
+                                                           (int32_t *) etypes);
                 krb5_xfree (etypes);
                 if (maj_stat) {
 …
                                 ret = EINVAL;
+                        }
+                        (*error_string) = talloc_asprintf(cred, "gss_krb5_set_allowable_enctypes failed: %s", error_message(ret));
                         return ret;
+                }
 …
                         ret = EINVAL;
+                }
+                (*error_string) = talloc_asprintf(cred, "gss_set_cred_option failed: %s", error_message(ret));
                 return ret;
+        }
 …
  int cli_credentials_set_client_gss_creds(struct cli_credentials *cred,
-                                          struct tevent_context *event_ctx,
                                           struct loadparm_context *lp_ctx,
                                           gss_cred_id_t gssapi_cred,
+                                          enum credentials_obtained obtained)
+                                          enum credentials_obtained obtained,
+                                          const char **error_string)
+{
         int ret;
 …
         gcc = talloc(cred, struct gssapi_creds_container);
         if (!gcc) {
+                return ENOMEM;
+        }
+        ret = cli_credentials_new_ccache(cred, event_ctx, lp_ctx, &ccc);
+                (*error_string) = error_message(ENOMEM);
+                return ENOMEM;
+        }
+        ret = cli_credentials_new_ccache(cred, lp_ctx, NULL, &ccc, error_string);
         if (ret != 0) {
                 return ret;
 …
                         ret = EINVAL;
+                }
+                if (ret) {
+                        (*error_string) = error_message(ENOMEM);
+                }
+        }
         if (ret == 0) {
                 ret = cli_credentials_set_from_ccache(cred, ccc, obtained);
+                ret = cli_credentials_set_from_ccache(cred, ccc, obtained, error_string);
+        }
         cred->ccache = ccc;
 …
  */
 _PUBLIC_ int cli_credentials_get_keytab(struct cli_credentials *cred,
+                                        struct tevent_context *event_ctx,
+                               struct loadparm_context *lp_ctx,
+                               struct keytab_container **_ktc)
+                                        struct loadparm_context *lp_ctx,
+                                        struct keytab_container **_ktc)
+{
         krb5_error_code ret;
         struct keytab_container *ktc;
         struct smb_krb5_context *smb_krb5_context;
-        const char **enctype_strings;
         TALLOC_CTX *mem_ctx;
 …
+        }
         ret = cli_credentials_get_krb5_context(cred, event_ctx, lp_ctx,
+        ret = cli_credentials_get_krb5_context(cred, lp_ctx,
                                                &smb_krb5_context);
         if (ret) {
 …
+        }
-        enctype_strings = cli_credentials_get_enctype_strings(cred);
         ret = smb_krb5_create_memory_keytab(mem_ctx, cred,
+                                            smb_krb5_context,
+                                            enctype_strings, &ktc);
+                                            smb_krb5_context, &ktc);
         if (ret) {
                 talloc_free(mem_ctx);
 …
 _PUBLIC_ int cli_credentials_set_keytab_name(struct cli_credentials *cred,
+                                             struct tevent_context *event_ctx,
+                                    struct loadparm_context *lp_ctx,
+                                    const char *keytab_name,
+                                    enum credentials_obtained obtained)
+                                             struct loadparm_context *lp_ctx,
+                                             const char *keytab_name,
+                                             enum credentials_obtained obtained)
+{
         krb5_error_code ret;
 …
+        }
         ret = cli_credentials_get_krb5_context(cred, event_ctx, lp_ctx, &smb_krb5_context);
+        ret = cli_credentials_get_krb5_context(cred, lp_ctx, &smb_krb5_context);
         if (ret) {
                 return ret;
 …
+}
-_PUBLIC_ int cli_credentials_update_keytab(struct cli_credentials *cred,
-                                           struct tevent_context *event_ctx,
-                                  struct loadparm_context *lp_ctx)
+{
-        krb5_error_code ret;
-        struct keytab_container *ktc;
-        struct smb_krb5_context *smb_krb5_context;
-        const char **enctype_strings;
-        TALLOC_CTX *mem_ctx;
-        mem_ctx = talloc_new(cred);
-        if (!mem_ctx) {
-                return ENOMEM;
+        }
-        ret = cli_credentials_get_krb5_context(cred, event_ctx, lp_ctx, &smb_krb5_context);
-        if (ret) {
-                talloc_free(mem_ctx);
-                return ret;
+        }
-        enctype_strings = cli_credentials_get_enctype_strings(cred);
-        ret = cli_credentials_get_keytab(cred, event_ctx, lp_ctx, &ktc);
-        if (ret != 0) {
-                talloc_free(mem_ctx);
-                return ret;
+        }
-        ret = smb_krb5_update_keytab(mem_ctx, cred, smb_krb5_context, enctype_strings, ktc);
-        talloc_free(mem_ctx);
-        return ret;
+}
 /* Get server gss credentials (in gsskrb5, this means the keytab) */
 _PUBLIC_ int cli_credentials_get_server_gss_creds(struct cli_credentials *cred,
+                                                  struct tevent_context *event_ctx,
+                                         struct loadparm_context *lp_ctx,
+                                         struct gssapi_creds_container **_gcc)
+                                                  struct loadparm_context *lp_ctx,
+                                                  struct gssapi_creds_container **_gcc)
+{
         int ret = 0;
 …
         TALLOC_CTX *mem_ctx;
         krb5_principal princ;
+        if (cred->server_gss_creds_obtained >= (MAX(cred->keytab_obtained,
+                                                    MAX(cred->principal_obtained,
+                                                        cred->username_obtained)))) {
+                *_gcc = cred->server_gss_creds;
+                return 0;
+        }
+        ret = cli_credentials_get_krb5_context(cred, event_ctx, lp_ctx, &smb_krb5_context);
+        if (ret) {
+                return ret;
+        }
+        ret = cli_credentials_get_keytab(cred, event_ctx, lp_ctx, &ktc);
+        if (ret) {
+                DEBUG(1, ("Failed to get keytab for GSSAPI server: %s\n", error_message(ret)));
+                return ret;
+        }
+        const char *error_string;
+        enum credentials_obtained obtained;
         mem_ctx = talloc_new(cred);
 …
+        }
+        ret = principal_from_credentials(mem_ctx, cred, smb_krb5_context, &princ);
+        if (ret) {
+                DEBUG(1,("cli_credentials_get_server_gss_creds: makeing krb5 principal failed (%s)\n",
+                         smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                    ret, mem_ctx)));
+        ret = cli_credentials_get_krb5_context(cred, lp_ctx, &smb_krb5_context);
+        if (ret) {
+                return ret;
+        }
+        ret = principal_from_credentials(mem_ctx, cred, smb_krb5_context, &princ, &obtained, &error_string);
+        if (ret) {
+                DEBUG(1,("cli_credentials_get_server_gss_creds: making krb5 principal failed (%s)\n",
+                         error_string));
                 talloc_free(mem_ctx);
+                return ret;
+        }
+        if (cred->server_gss_creds_obtained >= (MAX(cred->keytab_obtained, obtained))) {
+                talloc_free(mem_ctx);
+                *_gcc = cred->server_gss_creds;
+                return 0;
+        }
+        ret = cli_credentials_get_keytab(cred, lp_ctx, &ktc);
+        if (ret) {
+                DEBUG(1, ("Failed to get keytab for GSSAPI server: %s\n", error_message(ret)));
                 return ret;
+        }
 …
-const char **cli_credentials_get_enctype_strings(struct cli_credentials *cred)
+{
-        /* If this is ever made user-configurable, we need to add code
-         * to remove/hide the other entries from the generated
-         * keytab */
-        static const char *default_enctypes[] = {
-                "des-cbc-md5",
-                "aes256-cts-hmac-sha1-96",
-                "des3-cbc-sha1",
-                "arcfour-hmac-md5",
-                NULL
-        };
-        return default_enctypes;
+}
 const char *cli_credentials_get_salt_principal(struct cli_credentials *cred)
+{
 …
 _PUBLIC_ void cli_credentials_set_salt_principal(struct cli_credentials *cred, const char *principal)
+{
+        talloc_free(cred->salt_principal);
         cred->salt_principal = talloc_strdup(cred, principal);
+}
+/* The 'impersonate_principal' is used to allow on Kerberos principal
+ * (and it's associated keytab etc) to impersonate another.  The
+ * ability to do this is controlled by the KDC, but it is generally
+ * permitted to impersonate anyone to yourself.  This allows any
+ * member of the domain to get the groups of a user.  This is also
+ * known as S4U2Self */
+const char *cli_credentials_get_impersonate_principal(struct cli_credentials *cred)
+{
+        return cred->impersonate_principal;
+}
+_PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials *cred, const char *principal)
+{
+        talloc_free(cred->impersonate_principal);
+        cred->impersonate_principal = talloc_strdup(cred, principal);
+}
+/* when impersonating for S4U2Self we need to set the target principal
+ * to ourself, as otherwise we would need additional rights.
+ * Similarly, we may only be authorized to do general impersonation to
+ * some particular services.
+ *
+ * Likewise, password changes typically require a ticket to kpasswd/realm directly, not via a TGT
+ *
+ * NULL means that tickets will be obtained for the krbtgt service.
+*/
+const char *cli_credentials_get_target_service(struct cli_credentials *cred)
+{
+        return cred->target_service;
+}
+_PUBLIC_ void cli_credentials_set_target_service(struct cli_credentials *cred, const char *target_service)
+{
+        talloc_free(cred->target_service);
+        cred->target_service = talloc_strdup(cred, target_service);
+}

vendor/current/source4/auth/credentials/credentials_krb5.h

-              r414
+              r740
 /* Manually prototyped here to avoid needing gss headers in most callers */
 int cli_credentials_set_client_gss_creds(struct cli_credentials *cred,
-                                         struct tevent_context *event_ctx,
                                          struct loadparm_context *lp_ctx,
                                          gss_cred_id_t gssapi_cred,
+                                         enum credentials_obtained obtained);
+                                         enum credentials_obtained obtained,
+                                         const char **error_string);
 /* Manually prototyped here to avoid needing krb5 headers in most callers */
 …
                                            struct cli_credentials *credentials,
                                            struct smb_krb5_context *smb_krb5_context,
+                                           krb5_principal *princ);
+                                           krb5_principal *princ,
+                                           enum credentials_obtained *obtained,
+                                           const char **error_string);
+krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
+                                                       struct cli_credentials *credentials,
+                                                       struct smb_krb5_context *smb_krb5_context,
+                                                       krb5_principal *princ,
+                                                       const char **error_string);
+void cli_credentials_invalidate_client_gss_creds(struct cli_credentials *cred,
+                                                 enum credentials_obtained obtained);
 #endif /* __CREDENTIALS_KRB5_H__ */

vendor/current/source4/auth/credentials/credentials_ntlm.c

-              r414
+              r740
 #include "libcli/auth/libcli_auth.h"
 #include "auth/credentials/credentials.h"
-_PUBLIC_ void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx,
-                                              const char **username,
-                                              const char **domain)
+{
-        if (cred->principal_obtained > cred->username_obtained) {
-                *domain = talloc_strdup(mem_ctx, "");
-                *username = cli_credentials_get_principal(cred, mem_ctx);
-        } else {
-                *domain = cli_credentials_get_domain(cred);
-                *username = cli_credentials_get_username(cred);
+        }
+}
 _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_CTX *mem_ctx,

vendor/current/source4/auth/credentials/pycredentials.c

-              r414
+              r740
 */
+#include <Python.h>
 #include "includes.h"
-#include <Python.h>
 #include "pycredentials.h"
 #include "param/param.h"
 …
 #include "libcli/util/pyerrors.h"
 #include "param/pyparam.h"
+#ifndef Py_RETURN_NONE
+#define Py_RETURN_NONE return Py_INCREF(Py_None), Py_None
+#endif
+#include <tevent.h>
 static PyObject *PyString_FromStringOrNULL(const char *str)
 …
+}
+static PyObject *py_creds_set_krb_forwardable(py_talloc_Object *self, PyObject *args)
+{
+        int state;
+        if (!PyArg_ParseTuple(args, "i", &state))
+                return NULL;
+        cli_credentials_set_krb_forwardable(PyCredentials_AsCliCredentials(self), state);
+        Py_RETURN_NONE;
+}
 static PyObject *py_creds_guess(py_talloc_Object *self, PyObject *args)
+{
         PyObject *py_lp_ctx = Py_None;
         struct loadparm_context *lp_ctx;
+        TALLOC_CTX *mem_ctx;
+        struct cli_credentials *creds;
+        creds = PyCredentials_AsCliCredentials(self);
         if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
                 return NULL;
+        lp_ctx = lp_from_py_object(py_lp_ctx);
+        if (lp_ctx == NULL)
+                return NULL;
+        cli_credentials_guess(PyCredentials_AsCliCredentials(self), lp_ctx);
+        mem_ctx = talloc_new(NULL);
+        if (mem_ctx == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
+        if (lp_ctx == NULL) {
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+        cli_credentials_guess(creds, lp_ctx);
+        talloc_free(mem_ctx);
         Py_RETURN_NONE;
 …
         struct loadparm_context *lp_ctx;
         NTSTATUS status;
+        struct cli_credentials *creds;
+        TALLOC_CTX *mem_ctx;
+        creds = PyCredentials_AsCliCredentials(self);
         if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
                 return NULL;
+        lp_ctx = lp_from_py_object(py_lp_ctx);
+        if (lp_ctx == NULL)
+                return NULL;
+        status = cli_credentials_set_machine_account(PyCredentials_AsCliCredentials(self), lp_ctx);
+        mem_ctx = talloc_new(NULL);
+        if (mem_ctx == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
+        if (lp_ctx == NULL) {
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+        status = cli_credentials_set_machine_account(creds, lp_ctx);
+        talloc_free(mem_ctx);
         PyErr_NTSTATUS_IS_ERR_RAISE(status);
         Py_RETURN_NONE;
+}
+PyObject *PyCredentialCacheContainer_from_ccache_container(struct ccache_container *ccc)
+{
+        PyCredentialCacheContainerObject *py_ret;
+        if (ccc == NULL) {
+                Py_RETURN_NONE;
+        }
+        py_ret = (PyCredentialCacheContainerObject *)PyCredentialCacheContainer.tp_alloc(&PyCredentialCacheContainer, 0);
+        if (py_ret == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        py_ret->mem_ctx = talloc_new(NULL);
+        py_ret->ccc = talloc_reference(py_ret->mem_ctx, ccc);
+        return (PyObject *)py_ret;
+}
+static PyObject *py_creds_get_named_ccache(py_talloc_Object *self, PyObject *args)
+{
+        PyObject *py_lp_ctx = Py_None;
+        char *ccache_name;
+        struct loadparm_context *lp_ctx;
+        struct ccache_container *ccc;
+        struct tevent_context *event_ctx;
+        int ret;
+        const char *error_string;
+        struct cli_credentials *creds;
+        TALLOC_CTX *mem_ctx;
+        creds = PyCredentials_AsCliCredentials(self);
+        if (!PyArg_ParseTuple(args, "|Os", &py_lp_ctx, &ccache_name))
+                return NULL;
+        mem_ctx = talloc_new(NULL);
+        if (mem_ctx == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
+        if (lp_ctx == NULL) {
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+        event_ctx = tevent_context_init(mem_ctx);
+        ret = cli_credentials_get_named_ccache(creds, event_ctx, lp_ctx,
+                                               ccache_name, &ccc, &error_string);
+        talloc_unlink(mem_ctx, lp_ctx);
+        if (ret == 0) {
+                talloc_steal(ccc, event_ctx);
+                talloc_free(mem_ctx);
+                return PyCredentialCacheContainer_from_ccache_container(ccc);
+        }
+        PyErr_SetString(PyExc_RuntimeError, error_string?error_string:"NULL");
+        talloc_free(mem_ctx);
+        return NULL;
+}
+static PyObject *py_creds_set_gensec_features(py_talloc_Object *self, PyObject *args)
+{
+        unsigned int gensec_features;
+        if (!PyArg_ParseTuple(args, "I", &gensec_features))
+                return NULL;
+        cli_credentials_set_gensec_features(PyCredentials_AsCliCredentials(self), gensec_features);
+        Py_RETURN_NONE;
+}
+static PyObject *py_creds_get_gensec_features(py_talloc_Object *self, PyObject *args)
+{
+        unsigned int gensec_features;
+        gensec_features = cli_credentials_get_gensec_features(PyCredentials_AsCliCredentials(self));
+        return PyInt_FromLong(gensec_features);
+}
 static PyMethodDef py_creds_methods[] = {
 …
         { "set_kerberos_state", (PyCFunction)py_creds_set_kerberos_state, METH_VARARGS,
                 NULL },
+        { "set_krb_forwardable", (PyCFunction)py_creds_set_krb_forwardable, METH_VARARGS,
+                NULL },
         { "guess", (PyCFunction)py_creds_guess, METH_VARARGS, NULL },
         { "set_machine_account", (PyCFunction)py_creds_set_machine_account, METH_VARARGS, NULL },
+        { "get_named_ccache", (PyCFunction)py_creds_get_named_ccache, METH_VARARGS, NULL },
+        { "set_gensec_features", (PyCFunction)py_creds_set_gensec_features, METH_VARARGS, NULL },
+        { "get_gensec_features", (PyCFunction)py_creds_get_gensec_features, METH_NOARGS, NULL },
         { NULL }
 };
 …
         .tp_name = "Credentials",
         .tp_basicsize = sizeof(py_talloc_Object),
-        .tp_dealloc = py_talloc_dealloc,
         .tp_new = py_creds_new,
         .tp_flags = Py_TPFLAGS_DEFAULT,
 …
 };
+PyTypeObject PyCredentialCacheContainer = {
+        .tp_name = "CredentialCacheContainer",
+        .tp_basicsize = sizeof(py_talloc_Object),
+        .tp_flags = Py_TPFLAGS_DEFAULT,
+};
 void initcredentials(void)
+{
         PyObject *m;
+        PyTypeObject *talloc_type = PyTalloc_GetObjectType();
+        if (talloc_type == NULL)
+                return;
+        PyCredentials.tp_base = PyCredentialCacheContainer.tp_base = talloc_type;
         if (PyType_Ready(&PyCredentials) < 0)
+                return;
+        if (PyType_Ready(&PyCredentialCacheContainer) < 0)
                 return;
 …
         PyModule_AddObject(m, "MUST_USE_KERBEROS", PyInt_FromLong(CRED_MUST_USE_KERBEROS));
+        PyModule_AddObject(m, "AUTO_KRB_FORWARDABLE",  PyInt_FromLong(CRED_AUTO_KRB_FORWARDABLE));
+        PyModule_AddObject(m, "NO_KRB_FORWARDABLE",    PyInt_FromLong(CRED_NO_KRB_FORWARDABLE));
+        PyModule_AddObject(m, "FORCE_KRB_FORWARDABLE", PyInt_FromLong(CRED_FORCE_KRB_FORWARDABLE));
         Py_INCREF(&PyCredentials);
         PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials);
+}
+        Py_INCREF(&PyCredentialCacheContainer);
+        PyModule_AddObject(m, "CredentialCacheContainer", (PyObject *)&PyCredentialCacheContainer);
+}

vendor/current/source4/auth/credentials/pycredentials.h

-              r414
+              r740
 #include "auth/credentials/credentials.h"
 #include "pytalloc.h"
+#include <pytalloc.h>
+PyAPI_DATA(PyTypeObject) PyCredentials;
+extern PyTypeObject PyCredentials;
+extern PyTypeObject PyCredentialCacheContainer;
+typedef struct {
+        PyObject_HEAD
+        TALLOC_CTX *mem_ctx;
+        struct ccache_container *ccc;
+} PyCredentialCacheContainerObject;
 #define PyCredentials_Check(py_obj) PyObject_TypeCheck(py_obj, &PyCredentials)
 #define PyCredentials_AsCliCredentials(py_obj) py_talloc_get_type(py_obj, struct cli_credentials)

vendor/current/source4/auth/credentials/tests/simple.c

-              r414
+              r740
 struct torture_suite *torture_local_credentials(TALLOC_CTX *mem_ctx)
+{
+        struct torture_suite *suite = torture_suite_create(mem_ctx,
+                                                           "CREDENTIALS");
+        struct torture_suite *suite = torture_suite_create(mem_ctx, "credentials");
         torture_suite_add_simple_test(suite, "init", test_init);

vendor/current/source4/auth/gensec/cyrus_sasl.c

-              r414
+              r740
 #include "includes.h"
 #include "auth/auth.h"
+#include "lib/tsocket/tsocket.h"
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
 #include "auth/gensec/gensec_proto.h"
-#include "lib/socket/socket.h"
 #include <sasl/sasl.h>
 …
         sasl_conn_t *conn;
         int step;
+        bool wrap;
 };
 …
         const char *service = gensec_get_target_service(gensec_security);
         const char *target_name = gensec_get_target_hostname(gensec_security);
         struct socket_address *local_socket_addr = gensec_get_my_addr(gensec_security);
         struct socket_address *remote_socket_addr = gensec_get_peer_addr(gensec_security);
+        const struct tsocket_address *tlocal_addr = gensec_get_local_address(gensec_security);
+        const struct tsocket_address *tremote_addr = gensec_get_remote_address(gensec_security);
         char *local_addr = NULL;
         char *remote_addr = NULL;
 …
         sasl_callback_t *callbacks;
         gensec_sasl_state = talloc(gensec_security, struct gensec_sasl_state);
+        gensec_sasl_state = talloc_zero(gensec_security, struct gensec_sasl_state);
         if (!gensec_sasl_state) {
                 return NT_STATUS_NO_MEMORY;
 …
         gensec_security->private_data = gensec_sasl_state;
         if (local_socket_addr) {
                 local_addr = talloc_asprintf(gensec_sasl_state,
                                              "%s;%d",
                                              local_socket_addr->addr,
                                              local_socket_addr->port);
+        }
         if (remote_socket_addr) {
                 remote_addr = talloc_asprintf(gensec_sasl_state,
                                              "%s;%d",
                                              remote_socket_addr->addr,
                                              remote_socket_addr->port);
+        if (tlocal_addr) {
+                local_addr = talloc_asprintf(gensec_sasl_state,
+                                "%s;%d",
+                                tsocket_address_inet_addr_string(tlocal_addr, gensec_sasl_state),
+                                tsocket_address_inet_port(tlocal_addr));
+        }
+        if (tremote_addr) {
+                remote_addr = talloc_asprintf(gensec_sasl_state,
+                                "%s;%d",
+                                tsocket_address_inet_addr_string(tremote_addr, gensec_sasl_state),
+                                tsocket_address_inet_port(tremote_addr));
+        }
         gensec_sasl_state->step = 0;
 …
                                    &gensec_sasl_state->conn);
         if (sasl_ret == SASL_OK || sasl_ret == SASL_CONTINUE) {
+        if (sasl_ret == SASL_OK) {
                 sasl_security_properties_t props;
                 talloc_set_destructor(gensec_sasl_state, gensec_sasl_dispose);
                 ZERO_STRUCT(props);
                 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
                         props.min_ssf = 1;
+                        props.max_ssf = 1;
+                        props.maxbufsize = 65536;
+                        gensec_sasl_state->wrap = true;
+                }
                 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
                         props.min_ssf = 40;
+                }
+                props.max_ssf = UINT_MAX;
+                props.maxbufsize = 65536;
+                        props.max_ssf = UINT_MAX;
+                        props.maxbufsize = 65536;
+                        gensec_sasl_state->wrap = true;
+                }
                 sasl_ret = sasl_setprop(gensec_sasl_state->conn, SASL_SEC_PROPS, &props);
+                if (sasl_ret != SASL_OK) {
+                        return sasl_nt_status(sasl_ret);
+                }
+        } else {
+        }
+        if (sasl_ret != SASL_OK) {
                 DEBUG(1, ("GENSEC SASL: client_new failed: %s\n", sasl_errdetail(gensec_sasl_state->conn)));
+        }
 …
         const char *out_data;
         unsigned int out_len;
+        int sasl_ret = sasl_encode(gensec_sasl_state->conn,
+                                   (char*)in->data, in->length, &out_data,
+                                   &out_len);
+        unsigned len_permitted;
+        int sasl_ret = sasl_getprop(gensec_sasl_state->conn, SASL_SSF,
+                        (const void**)&len_permitted);
+        if (sasl_ret != SASL_OK) {
+                return sasl_nt_status(sasl_ret);
+        }
+        len_permitted = MIN(len_permitted, in->length);
+        sasl_ret = sasl_encode(gensec_sasl_state->conn,
+                               (char*)in->data, len_permitted, &out_data,
+                               &out_len);
         if (sasl_ret == SASL_OK) {
                 *out = data_blob_talloc(out_mem_ctx, out_data, out_len);
 …
                                                                       struct gensec_sasl_state);
         sasl_ssf_t ssf;
+        int sasl_ret = sasl_getprop(gensec_sasl_state->conn, SASL_SSF,
+        int sasl_ret;
+        /* If we did not elect to wrap, then we have neither sign nor seal, no matter what the SSF claims */
+        if (!gensec_sasl_state->wrap) {
+                return false;
+        }
+        sasl_ret = sasl_getprop(gensec_sasl_state->conn, SASL_SSF,
                         (const void**)&ssf);
         if (sasl_ret != SASL_OK) {

vendor/current/source4/auth/gensec/gensec.c

-              r414
+              r740
 #include "includes.h"
 #include "auth/auth.h"
+#include "system/network.h"
 #include "lib/events/events.h"
+#include "lib/socket/socket.h"
+#include "lib/tsocket/tsocket.h"
+#include "../lib/util/tevent_ntstatus.h"
 #include "librpc/rpc/dcerpc.h"
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
+#include "auth/auth.h"
+#include "auth/system_session_proto.h"
 #include "param/param.h"
+#include "lib/util/tsort.h"
 /* the list of currently registered GENSEC backends */
 …
 bool gensec_security_ops_enabled(struct gensec_security_ops *ops, struct gensec_security *security)
+{
         return lp_parm_bool(security->settings->lp_ctx, NULL, "gensec", ops->name, ops->enabled);
+        return lpcfg_parm_bool(security->settings->lp_ctx, NULL, "gensec", ops->name, ops->enabled);
+}
 …
   @param gensec_security Returned GENSEC context pointer.
   @note  The mem_ctx is only a parent and may be NULL.
   @note, the auth context is moved to be a child of the
+  @note, the auth context is moved to be a referenced pointer of the
   @ gensec_security return
 */
 …
+        }
         (*gensec_security) = talloc(mem_ctx, struct gensec_security);
+        (*gensec_security) = talloc_zero(mem_ctx, struct gensec_security);
         NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
-        (*gensec_security)->ops = NULL;
-        (*gensec_security)->private_data = NULL;
-        ZERO_STRUCT((*gensec_security)->target);
-        ZERO_STRUCT((*gensec_security)->peer_addr);
-        ZERO_STRUCT((*gensec_security)->my_addr);
-        (*gensec_security)->subcontext = false;
-        (*gensec_security)->want_features = 0;
         (*gensec_security)->event_ctx = ev;
         SMB_ASSERT(settings->lp_ctx != NULL);
         (*gensec_security)->settings = talloc_reference(*gensec_security, settings);
+        (*gensec_security)->auth_context = talloc_steal(*gensec_security, auth_context);
+        /* We need to reference this, not steal, as the caller may be
+         * python, which won't like it if we steal it's object away
+         * from it */
+        (*gensec_security)->auth_context = talloc_reference(*gensec_security, auth_context);
         return NT_STATUS_OK;
 …
                                  struct gensec_security **gensec_security)
+{
         (*gensec_security) = talloc(mem_ctx, struct gensec_security);
+        (*gensec_security) = talloc_zero(mem_ctx, struct gensec_security);
         NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
 …
         return status;
+}
 /**
 …
         return oid_string;
+}
+/**
+ * Start a GENSEC sub-mechanism with a specifed mechansim structure, used in SPNEGO
+/**
+ * Start a GENSEC sub-mechanism with a specified mechansim structure, used in SPNEGO
+ *
  */
 …
+}
+static void gensec_update_async_timed_handler(struct tevent_context *ev, struct tevent_timer *te,
+                                              struct timeval t, void *ptr)
+{
+        struct gensec_update_request *req = talloc_get_type(ptr, struct gensec_update_request);
+        req->status = req->gensec_security->ops->update(req->gensec_security, req, req->in, &req->out);
+        req->callback.fn(req, req->callback.private_data);
+}
+struct gensec_update_state {
+        struct tevent_immediate *im;
+        struct gensec_security *gensec_security;
+        DATA_BLOB in;
+        DATA_BLOB out;
+};
+static void gensec_update_async_trigger(struct tevent_context *ctx,
+                                        struct tevent_immediate *im,
+                                        void *private_data);
 /**
  * Next state function for the GENSEC state machine async version
+ *
+ *
+ * @param mem_ctx The memory context for the request
+ * @param ev The event context for the request
  * @param gensec_security GENSEC State
  * @param in The request, as a DATA_BLOB
+ * @param callback The function that will be called when the operation is
+ *                 finished, it should return gensec_update_recv() to get output
+ * @param private_data A private pointer that will be passed to the callback function
+ */
+_PUBLIC_ void gensec_update_send(struct gensec_security *gensec_security, const DATA_BLOB in,
+                                 void (*callback)(struct gensec_update_request *req, void *private_data),
+                                 void *private_data)
+{
+        struct gensec_update_request *req = NULL;
+        struct tevent_timer *te = NULL;
+        req = talloc(gensec_security, struct gensec_update_request);
+        if (!req) goto failed;
+        req->gensec_security            = gensec_security;
+        req->in                         = in;
+        req->out                        = data_blob(NULL, 0);
+        req->callback.fn                = callback;
+        req->callback.private_data      = private_data;
+        te = event_add_timed(gensec_security->event_ctx, req,
+                             timeval_zero(),
+                             gensec_update_async_timed_handler, req);
+        if (!te) goto failed;
+        return;
+failed:
+        talloc_free(req);
+        callback(NULL, private_data);
+ *
+ * @return The request handle or NULL on no memory failure
+ */
+_PUBLIC_ struct tevent_req *gensec_update_send(TALLOC_CTX *mem_ctx,
+                                               struct tevent_context *ev,
+                                               struct gensec_security *gensec_security,
+                                               const DATA_BLOB in)
+{
+        struct tevent_req *req;
+        struct gensec_update_state *state = NULL;
+        req = tevent_req_create(mem_ctx, &state,
+                                struct gensec_update_state);
+        if (req == NULL) {
+                return NULL;
+        }
+        state->gensec_security          = gensec_security;
+        state->in                       = in;
+        state->out                      = data_blob(NULL, 0);
+        state->im                       = tevent_create_immediate(state);
+        if (tevent_req_nomem(state->im, req)) {
+                return tevent_req_post(req, ev);
+        }
+        tevent_schedule_immediate(state->im, ev,
+                                  gensec_update_async_trigger,
+                                  req);
+        return req;
+}
+static void gensec_update_async_trigger(struct tevent_context *ctx,
+                                        struct tevent_immediate *im,
+                                        void *private_data)
+{
+        struct tevent_req *req =
+                talloc_get_type_abort(private_data, struct tevent_req);
+        struct gensec_update_state *state =
+                tevent_req_data(req, struct gensec_update_state);
+        NTSTATUS status;
+        status = gensec_update(state->gensec_security, state,
+                               state->in, &state->out);
+        if (tevent_req_nterror(req, status)) {
+                return;
+        }
+        tevent_req_done(req);
+}
 …
  * Next state function for the GENSEC state machine
+ *
  * @param req GENSEC update request state
+ * @param req request state
  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 …
  *                or NT_STATUS_OK if the user is authenticated.
  */
+_PUBLIC_ NTSTATUS gensec_update_recv(struct gensec_update_request *req, TALLOC_CTX *out_mem_ctx, DATA_BLOB *out)
+{
+_PUBLIC_ NTSTATUS gensec_update_recv(struct tevent_req *req,
+                                     TALLOC_CTX *out_mem_ctx,
+                                     DATA_BLOB *out)
+{
+        struct gensec_update_state *state =
+                tevent_req_data(req, struct gensec_update_state);
         NTSTATUS status;
+        NT_STATUS_HAVE_NO_MEMORY(req);
+        *out = req->out;
+        if (tevent_req_is_nterror(req, &status)) {
+                if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+                        tevent_req_received(req);
+                        return status;
+                }
+        } else {
+                status = NT_STATUS_OK;
+        }
+        *out = state->out;
         talloc_steal(out_mem_ctx, out->data);
+        status = req->status;
+        talloc_free(req);
+        tevent_req_received(req);
         return status;
+}
 …
+}
+/**
+ * Set (and talloc_reference) local and peer socket addresses onto a socket context on the GENSEC context
+/**
+ * Set (and talloc_reference) local and peer socket addresses onto a socket
+ * context on the GENSEC context.
+ *
  * This is so that kerberos can include these addresses in
 …
  */
+_PUBLIC_ NTSTATUS gensec_set_my_addr(struct gensec_security *gensec_security, struct socket_address *my_addr)
+{
+        gensec_security->my_addr = my_addr;
+        if (my_addr && !talloc_reference(gensec_security, my_addr)) {
+/**
+ * @brief Set the local gensec address.
+ *
+ * @param  gensec_security   The gensec security context to use.
+ *
+ * @param  remote       The local address to set.
+ *
+ * @return              On success NT_STATUS_OK is returned or an NT_STATUS
+ *                      error.
+ */
+_PUBLIC_ NTSTATUS gensec_set_local_address(struct gensec_security *gensec_security,
+                const struct tsocket_address *local)
+{
+        TALLOC_FREE(gensec_security->local_addr);
+        if (local == NULL) {
+                return NT_STATUS_OK;
+        }
+        gensec_security->local_addr = tsocket_address_copy(local, gensec_security);
+        if (gensec_security->local_addr == NULL) {
                 return NT_STATUS_NO_MEMORY;
+        }
         return NT_STATUS_OK;
+}
+_PUBLIC_ NTSTATUS gensec_set_peer_addr(struct gensec_security *gensec_security, struct socket_address *peer_addr)
+{
+        gensec_security->peer_addr = peer_addr;
+        if (peer_addr && !talloc_reference(gensec_security, peer_addr)) {
+/**
+ * @brief Set the remote gensec address.
+ *
+ * @param  gensec_security   The gensec security context to use.
+ *
+ * @param  remote       The remote address to set.
+ *
+ * @return              On success NT_STATUS_OK is returned or an NT_STATUS
+ *                      error.
+ */
+_PUBLIC_ NTSTATUS gensec_set_remote_address(struct gensec_security *gensec_security,
+                const struct tsocket_address *remote)
+{
+        TALLOC_FREE(gensec_security->remote_addr);
+        if (remote == NULL) {
+                return NT_STATUS_OK;
+        }
+        gensec_security->remote_addr = tsocket_address_copy(remote, gensec_security);
+        if (gensec_security->remote_addr == NULL) {
                 return NT_STATUS_NO_MEMORY;
+        }
         return NT_STATUS_OK;
+}
+struct socket_address *gensec_get_my_addr(struct gensec_security *gensec_security)
+{
+        if (gensec_security->my_addr) {
+                return gensec_security->my_addr;
+        }
+        /* We could add a 'set sockaddr' call, and do a lookup.  This
+         * would avoid needing to do system calls if nothing asks. */
+        return NULL;
+}
+_PUBLIC_ struct socket_address *gensec_get_peer_addr(struct gensec_security *gensec_security)
+{
+        if (gensec_security->peer_addr) {
+                return gensec_security->peer_addr;
+        }
+        /* We could add a 'set sockaddr' call, and do a lookup.  This
+         * would avoid needing to do system calls if nothing asks.
+         * However, this is not appropriate for the peer addres on
+         * datagram sockets */
+        return NULL;
+}
+/**
+ * @brief Get the local address from a gensec security context.
+ *
+ * @param  gensec_security   The security context to get the address from.
+ *
+ * @return              The address as tsocket_address which could be NULL if
+ *                      no address is set.
+ */
+_PUBLIC_ const struct tsocket_address *gensec_get_local_address(struct gensec_security *gensec_security)
+{
+        if (gensec_security == NULL) {
+                return NULL;
+        }
+        return gensec_security->local_addr;
+}
+/**
+ * @brief Get the remote address from a gensec security context.
+ *
+ * @param  gensec_security   The security context to get the address from.
+ *
+ * @return              The address as tsocket_address which could be NULL if
+ *                      no address is set.
+ */
+_PUBLIC_ const struct tsocket_address *gensec_get_remote_address(struct gensec_security *gensec_security)
+{
+        if (gensec_security == NULL) {
+                return NULL;
+        }
+        return gensec_security->remote_addr;
+}
 /**
 …
  */
+NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal)
+_PUBLIC_ NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal)
+{
         gensec_security->target.principal = talloc_strdup(gensec_security, principal);
 …
         return NULL;
+}
+NTSTATUS gensec_generate_session_info(TALLOC_CTX *mem_ctx,
+                                      struct gensec_security *gensec_security,
+                                      struct auth_user_info_dc *user_info_dc,
+                                      struct auth_session_info **session_info)
+{
+        NTSTATUS nt_status;
+        uint32_t flags = AUTH_SESSION_INFO_DEFAULT_GROUPS;
+        if (user_info_dc->info->authenticated) {
+                flags |= AUTH_SESSION_INFO_AUTHENTICATED;
+        }
+        if (gensec_security->auth_context) {
+                nt_status = gensec_security->auth_context->generate_session_info(mem_ctx, gensec_security->auth_context,
+                                                                                 user_info_dc,
+                                                                                 flags,
+                                                                                 session_info);
+        } else {
+                flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
+                nt_status = auth_generate_session_info(mem_ctx,
+                                                       NULL,
+                                                       NULL,
+                                                       user_info_dc, flags,
+                                                       session_info);
+        }
+        return nt_status;
+}
 …
 int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value)
+{
         return lp_parm_int(settings->lp_ctx, NULL, mechanism, name, default_value);
+        return lpcfg_parm_int(settings->lp_ctx, NULL, mechanism, name, default_value);
+}
 bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value)
+{
         return lp_parm_bool(settings->lp_ctx, NULL, mechanism, name, default_value);
+        return lpcfg_parm_bool(settings->lp_ctx, NULL, mechanism, name, default_value);
+}
 …
+{
         static bool initialized = false;
+        extern NTSTATUS gensec_sasl_init(void);
+        extern NTSTATUS gensec_krb5_init(void);
+        extern NTSTATUS gensec_schannel_init(void);
+        extern NTSTATUS gensec_spnego_init(void);
+        extern NTSTATUS gensec_gssapi_init(void);
+        extern NTSTATUS gensec_ntlmssp_init(void);
+#define _MODULE_PROTO(init) extern NTSTATUS init(void);
+        STATIC_gensec_MODULES_PROTO;
         init_module_fn static_init[] = { STATIC_gensec_MODULES };
         init_module_fn *shared_init;
 …
         talloc_free(shared_init);
         qsort(generic_security_ops, gensec_num_backends, sizeof(*generic_security_ops), QSORT_CAST sort_gensec);
+        TYPESAFE_QSORT(generic_security_ops, gensec_num_backends, sort_gensec);
         return NT_STATUS_OK;

vendor/current/source4/auth/gensec/gensec.h

-              r414
+              r740
 #include "libcli/util/ntstatus.h"
+#define GENSEC_SASL_NAME_NTLMSSP "NTLM"
 #define GENSEC_OID_NTLMSSP "1.3.6.1.4.1.311.2.2.10"
 #define GENSEC_OID_SPNEGO "1.3.6.1.5.5.2"
 …
 struct gensec_settings;
 struct tevent_context;
+struct gensec_update_request {
+        struct gensec_security *gensec_security;
+        void *private_data;
+        DATA_BLOB in;
+        DATA_BLOB out;
+        NTSTATUS status;
+        struct {
+                void (*fn)(struct gensec_update_request *req, void *private_data);
+                void *private_data;
+        } callback;
+};
+struct tevent_req;
 struct gensec_settings {
         struct loadparm_context *lp_ctx;
-        struct smb_iconv_convenience *iconv_convenience;
         const char *target_hostname;
 };
 …
         uint32_t want_features;
         struct tevent_context *event_ctx;
         struct socket_address *my_addr, *peer_addr;
+        struct tsocket_address *local_addr, *remote_addr;
         struct gensec_settings *settings;
 …
 struct socket_context;
 struct auth_context;
+struct auth_user_info_dc;
 NTSTATUS gensec_socket_init(struct gensec_security *gensec_security,
 …
 NTSTATUS gensec_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
                        const DATA_BLOB in, DATA_BLOB *out);
+void gensec_update_send(struct gensec_security *gensec_security, const DATA_BLOB in,
+                                 void (*callback)(struct gensec_update_request *req, void *private_data),
+                                 void *private_data);
+NTSTATUS gensec_update_recv(struct gensec_update_request *req, TALLOC_CTX *out_mem_ctx, DATA_BLOB *out);
+struct tevent_req *gensec_update_send(TALLOC_CTX *mem_ctx,
+                                      struct tevent_context *ev,
+                                      struct gensec_security *gensec_security,
+                                      const DATA_BLOB in);
+NTSTATUS gensec_update_recv(struct tevent_req *req, TALLOC_CTX *out_mem_ctx, DATA_BLOB *out);
 void gensec_want_feature(struct gensec_security *gensec_security,
                          uint32_t feature);
 …
 const char *gensec_get_name_by_oid(struct gensec_security *gensec_security, const char *oid_string);
 struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security);
-struct socket_address *gensec_get_peer_addr(struct gensec_security *gensec_security);
 NTSTATUS gensec_init(struct loadparm_context *lp_ctx);
 NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
 …
 NTSTATUS gensec_session_info(struct gensec_security *gensec_security,
                              struct auth_session_info **session_info);
 NTSTATUS auth_nt_status_squash(NTSTATUS nt_status);
+NTSTATUS nt_status_squash(NTSTATUS nt_status);
 struct netlogon_creds_CredentialState;
 NTSTATUS dcerpc_schannel_creds(struct gensec_security *gensec_security,
                                TALLOC_CTX *mem_ctx,
                                struct netlogon_creds_CredentialState **creds);
+NTSTATUS gensec_set_peer_addr(struct gensec_security *gensec_security, struct socket_address *peer_addr);
+NTSTATUS gensec_set_my_addr(struct gensec_security *gensec_security, struct socket_address *my_addr);
+NTSTATUS gensec_set_local_address(struct gensec_security *gensec_security,
+                const struct tsocket_address *local);
+NTSTATUS gensec_set_remote_address(struct gensec_security *gensec_security,
+                const struct tsocket_address *remote);
+const struct tsocket_address *gensec_get_local_address(struct gensec_security *gensec_security);
+const struct tsocket_address *gensec_get_remote_address(struct gensec_security *gensec_security);
 NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
 …
 bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value);
+NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal);
 #endif /* __GENSEC_H__ */

vendor/current/source4/auth/gensec/gensec.pc.in

-              r414
+              r740
 Name: gensec
 Description: Generic Security Library
 Version: 0.0.1
 Libs: -L${libdir} -lgensec
+Version: @PACKAGE_VERSION@
+Libs: @LIB_RPATH@ -L${libdir} -lgensec
 Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1

vendor/current/source4/auth/gensec/gensec_gssapi.c

-              r414
+              r740
 #include "librpc/gen_ndr/krb5pac.h"
 #include "auth/auth.h"
 #include "lib/ldb/include/ldb.h"
+#include <ldb.h>
 #include "auth/auth_sam.h"
 #include "librpc/rpc/dcerpc.h"
 …
 #include <gssapi/gssapi_spnego.h>
 #include "auth/gensec/gensec_gssapi.h"
+#include "lib/util/util_net.h"
 static size_t gensec_gssapi_max_input_size(struct gensec_security *gensec_security);
 …
         struct gensec_gssapi_state *gensec_gssapi_state;
         krb5_error_code ret;
         struct gsskrb5_send_to_kdc send_to_kdc;
         gensec_gssapi_state = talloc(gensec_security, struct gensec_gssapi_state);
+        const char *realm;
+        gensec_gssapi_state = talloc_zero(gensec_security, struct gensec_gssapi_state);
         if (!gensec_gssapi_state) {
                 return NT_STATUS_NO_MEMORY;
+        }
-        gensec_gssapi_state->gss_exchange_count = 0;
-        gensec_gssapi_state->max_wrap_buf_size
-                = gensec_setting_int(gensec_security->settings, "gensec_gssapi", "max wrap buf size", 65536);
-        gensec_gssapi_state->sasl = false;
-        gensec_gssapi_state->sasl_state = STAGE_GSS_NEG;
         gensec_security->private_data = gensec_gssapi_state;
         gensec_gssapi_state->gssapi_context = GSS_C_NO_CONTEXT;
+        /* TODO: Fill in channel bindings */
+        gensec_gssapi_state->input_chan_bindings = GSS_C_NO_CHANNEL_BINDINGS;
         gensec_gssapi_state->server_name = GSS_C_NO_NAME;
         gensec_gssapi_state->client_name = GSS_C_NO_NAME;
-        gensec_gssapi_state->lucid = NULL;
-        /* TODO: Fill in channel bindings */
-        gensec_gssapi_state->input_chan_bindings = GSS_C_NO_CHANNEL_BINDINGS;
         gensec_gssapi_state->want_flags = 0;
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation_by_kdc_policy", true)) {
                 gensec_gssapi_state->want_flags |= GSS_C_DELEG_POLICY_FLAG;
 …
+        }
-        gensec_gssapi_state->got_flags = 0;
-        gensec_gssapi_state->session_key = data_blob(NULL, 0);
-        gensec_gssapi_state->pac = data_blob(NULL, 0);
-        gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
-        gensec_gssapi_state->sig_size = 0;
-        talloc_set_destructor(gensec_gssapi_state, gensec_gssapi_destructor);
         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
                 gensec_gssapi_state->want_flags |= GSS_C_INTEG_FLAG;
 …
                 gensec_gssapi_state->want_flags |= GSS_C_DCE_STYLE;
+        }
+        gensec_gssapi_state->got_flags = 0;
         switch (gensec_security->ops->auth_type) {
 …
+        }
+        send_to_kdc.func = smb_krb5_send_and_recv_func;
+        send_to_kdc.ptr = gensec_security->event_ctx;
+        ret = gsskrb5_set_send_to_kdc(&send_to_kdc);
+        if (ret) {
+                DEBUG(1,("gensec_krb5_start: gsskrb5_set_send_to_kdc failed\n"));
+                talloc_free(gensec_gssapi_state);
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        if (lp_realm(gensec_security->settings->lp_ctx) && *lp_realm(gensec_security->settings->lp_ctx)) {
+                char *upper_realm = strupper_talloc(gensec_gssapi_state, lp_realm(gensec_security->settings->lp_ctx));
+                if (!upper_realm) {
+                        DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm(gensec_security->settings->lp_ctx)));
+                        talloc_free(gensec_gssapi_state);
+                        return NT_STATUS_NO_MEMORY;
+                }
+                ret = gsskrb5_set_default_realm(upper_realm);
+                talloc_free(upper_realm);
+                if (ret) {
+                        DEBUG(1,("gensec_krb5_start: gsskrb5_set_default_realm failed\n"));
+                        talloc_free(gensec_gssapi_state);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+        }
+        /* don't do DNS lookups of any kind, it might/will fail for a netbios name */
+        ret = gsskrb5_set_dns_canonicalize(gensec_setting_bool(gensec_security->settings, "krb5", "set_dns_canonicalize", false));
+        if (ret) {
+                DEBUG(1,("gensec_krb5_start: gsskrb5_set_dns_canonicalize failed\n"));
+                talloc_free(gensec_gssapi_state);
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        ret = smb_krb5_init_context(gensec_gssapi_state,
+                                    gensec_security->event_ctx,
+        gensec_gssapi_state->session_key = data_blob(NULL, 0);
+        gensec_gssapi_state->pac = data_blob(NULL, 0);
+        ret = smb_krb5_init_context(gensec_gssapi_state,
+                                    NULL,
                                     gensec_security->settings->lp_ctx,
                                     &gensec_gssapi_state->smb_krb5_context);
 …
                 return NT_STATUS_INTERNAL_ERROR;
+        }
+        gensec_gssapi_state->client_cred = NULL;
+        gensec_gssapi_state->server_cred = NULL;
+        gensec_gssapi_state->lucid = NULL;
+        gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
+        gensec_gssapi_state->sasl = false;
+        gensec_gssapi_state->sasl_state = STAGE_GSS_NEG;
+        gensec_gssapi_state->sasl_protection = 0;
+        gensec_gssapi_state->max_wrap_buf_size
+                = gensec_setting_int(gensec_security->settings, "gensec_gssapi", "max wrap buf size", 65536);
+        gensec_gssapi_state->gss_exchange_count = 0;
+        gensec_gssapi_state->sig_size = 0;
+        talloc_set_destructor(gensec_gssapi_state, gensec_gssapi_destructor);
+        realm = lpcfg_realm(gensec_security->settings->lp_ctx);
+        if (realm != NULL) {
+                ret = gsskrb5_set_default_realm(realm);
+                if (ret) {
+                        DEBUG(1,("gensec_krb5_start: gsskrb5_set_default_realm failed\n"));
+                        talloc_free(gensec_gssapi_state);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+        }
+        /* don't do DNS lookups of any kind, it might/will fail for a netbios name */
+        ret = gsskrb5_set_dns_canonicalize(gensec_setting_bool(gensec_security->settings, "krb5", "set_dns_canonicalize", false));
+        if (ret) {
+                DEBUG(1,("gensec_krb5_start: gsskrb5_set_dns_canonicalize failed\n"));
+                talloc_free(gensec_gssapi_state);
+                return NT_STATUS_INTERNAL_ERROR;
+        }
         return NT_STATUS_OK;
+}
 …
         } else {
                 ret = cli_credentials_get_server_gss_creds(machine_account,
-                                                           gensec_security->event_ctx,
                                                            gensec_security->settings->lp_ctx, &gcc);
                 if (ret) {
 …
         OM_uint32 maj_stat, min_stat;
         const char *hostname = gensec_get_target_hostname(gensec_security);
-        const char *principal;
         struct gssapi_creds_container *gcc;
+        const char *error_string;
         if (!hostname) {
 …
         gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
         principal = gensec_get_target_principal(gensec_security);
         if (principal && lp_client_use_spnego_principal(gensec_security->settings->lp_ctx)) {
+        gensec_gssapi_state->target_principal = gensec_get_target_principal(gensec_security);
+        if (gensec_gssapi_state->target_principal) {
                 name_type = GSS_C_NULL_OID;
         } else {
                 principal = talloc_asprintf(gensec_gssapi_state, "%s@%s",
+                gensec_gssapi_state->target_principal = talloc_asprintf(gensec_gssapi_state, "%s/%s@%s",
                                             gensec_get_target_service(gensec_security),
                                             hostname);
                 name_type = GSS_C_NT_HOSTBASED_SERVICE;
+        }
         name_token.value  = discard_const_p(uint8_t, principal);
         name_token.length = strlen(principal);
+                                            hostname, lpcfg_realm(gensec_security->settings->lp_ctx));
+                name_type = GSS_C_NT_USER_NAME;
+        }
+        name_token.value  = discard_const_p(uint8_t, gensec_gssapi_state->target_principal);
+        name_token.length = strlen(gensec_gssapi_state->target_principal);
 …
         ret = cli_credentials_get_client_gss_creds(creds,
                                                    gensec_security->event_ctx,
                                                    gensec_security->settings->lp_ctx, &gcc);
+                                                   gensec_security->settings->lp_ctx, &gcc, &error_string);
         switch (ret) {
         case 0:
                 break;
         case KRB5KDC_ERR_PREAUTH_FAILED:
+        case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
+                DEBUG(1, ("Wrong username or password: %s\n", error_string));
                 return NT_STATUS_LOGON_FAILURE;
         case KRB5_KDC_UNREACH:
+                DEBUG(3, ("Cannot reach a KDC we require to contact %s\n", principal));
+                return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
+                DEBUG(3, ("Cannot reach a KDC we require to contact %s : %s\n", gensec_gssapi_state->target_principal, error_string));
+                return NT_STATUS_NO_LOGON_SERVERS;
+        case KRB5_CC_NOTFOUND:
+        case KRB5_CC_END:
+                DEBUG(2, ("Error obtaining ticket we require to contact %s: (possibly due to clock skew between us and the KDC) %s\n", gensec_gssapi_state->target_principal, error_string));
+                return NT_STATUS_TIME_DIFFERENCE_AT_DC;
         default:
                 DEBUG(1, ("Aquiring initiator credentials failed\n"));
+                DEBUG(1, ("Aquiring initiator credentials failed: %s\n", error_string));
                 return NT_STATUS_UNSUCCESSFUL;
+        }
 …
                 case GENSEC_CLIENT:
+                {
+                        struct gsskrb5_send_to_kdc send_to_kdc;
+                        krb5_error_code ret;
+                        send_to_kdc.func = smb_krb5_send_and_recv_func;
+                        send_to_kdc.ptr = gensec_security->event_ctx;
+                        min_stat = gsskrb5_set_send_to_kdc(&send_to_kdc);
+                        if (min_stat) {
+                                DEBUG(1,("gensec_krb5_start: gsskrb5_set_send_to_kdc failed\n"));
+                                return NT_STATUS_INTERNAL_ERROR;
+                        }
                         maj_stat = gss_init_sec_context(&min_stat,
                                                         gensec_gssapi_state->client_cred->creds,
 …
                                 gensec_gssapi_state->gss_oid = gss_oid_p;
+                        }
+                        send_to_kdc.func = smb_krb5_send_and_recv_func;
+                        send_to_kdc.ptr = NULL;
+                        ret = gsskrb5_set_send_to_kdc(&send_to_kdc);
+                        if (ret) {
+                                DEBUG(1,("gensec_krb5_start: gsskrb5_set_send_to_kdc failed\n"));
+                                return NT_STATUS_INTERNAL_ERROR;
+                        }
                         break;
+                }
 …
                          * is more work to do */
                         if (gensec_gssapi_state->sasl) {
-                                /* Due to a very subtle interaction
-                                 * with SASL and the LDAP libs, we
-                                 * must ensure the data pointer is
-                                 * != NULL, but the length is 0.
+                                 *
-                                 * This ensures we send a 'zero
-                                 * length' (rather than NULL) response
-                                 */
-                                if (!out->data) {
-                                        out->data = (uint8_t *)talloc_strdup(out_mem_ctx, "\0");
+                                }
                                 gensec_gssapi_state->sasl_state = STAGE_SASL_SSF_NEG;
                                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
 …
                                 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
                                         DEBUG(5, ("GSSAPI Connection will be cryptographicly sealed\n"));
+                                        DEBUG(5, ("GSSAPI Connection will be cryptographically sealed\n"));
                                 } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
                                         DEBUG(5, ("GSSAPI Connection will be cryptographicly signed\n"));
+                                        DEBUG(5, ("GSSAPI Connection will be cryptographically signed\n"));
                                 } else {
                                         DEBUG(5, ("GSSAPI Connection will have no cryptographic protection\n"));
 …
                 } else if (gss_oid_equal(gensec_gssapi_state->gss_oid, gss_mech_krb5)) {
                         switch (min_stat) {
+                        case KRB5KRB_AP_ERR_TKT_NYV:
+                                DEBUG(1, ("Error with ticket to contact %s: possible clock skew between us and the KDC or target server: %s\n",
+                                          gensec_gssapi_state->target_principal,
+                                          gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                                return NT_STATUS_TIME_DIFFERENCE_AT_DC; /* Make SPNEGO ignore us, we can't go any further here */
+                        case KRB5KRB_AP_ERR_TKT_EXPIRED:
+                                DEBUG(1, ("Error with ticket to contact %s: ticket is expired, possible clock skew between us and the KDC or target server: %s\n",
+                                          gensec_gssapi_state->target_principal,
+                                          gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                                return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
                         case KRB5_KDC_UNREACH:
+                                DEBUG(3, ("Cannot reach a KDC we require: %s\n",
+                                          gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                                return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
+                                DEBUG(3, ("Cannot reach a KDC we require in order to obtain a ticetk to %s: %s\n",
+                                          gensec_gssapi_state->target_principal,
+                                          gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                                return NT_STATUS_NO_LOGON_SERVERS; /* Make SPNEGO ignore us, we can't go any further here */
                         case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
+                                DEBUG(3, ("Server is not registered with our KDC: %s\n",
+                                          gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                                DEBUG(3, ("Server %s is not registered with our KDC: %s\n",
+                                          gensec_gssapi_state->target_principal,
+                                          gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
                                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
                         case KRB5KRB_AP_ERR_MSG_TYPE:
 …
                                 return NT_STATUS_INVALID_PARAMETER;
                         default:
+                                DEBUG(1, ("GSS Update(krb5)(%d) Update failed: %s\n",
+                                DEBUG(1, ("GSS %s Update(krb5)(%d) Update failed: %s\n",
+                                          gensec_security->gensec_role == GENSEC_CLIENT ? "client" : "server",
                                           gensec_gssapi_state->gss_exchange_count,
                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 …
+                        }
                 } else {
+                        DEBUG(1, ("GSS Update(%d) failed: %s\n",
+                        DEBUG(1, ("GSS %s Update(%d) failed: %s\n",
+                                  gensec_security->gensec_role == GENSEC_CLIENT ? "client" : "server",
                                   gensec_gssapi_state->gss_exchange_count,
                                   gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 …
                                                                      gensec_gssapi_state->max_wrap_buf_size);
                         gensec_gssapi_state->sasl_protection = 0;
                         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
                                 if (security_supported & NEG_SEAL) {
+                        if (security_supported & NEG_SEAL) {
+                                if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
                                         gensec_gssapi_state->sasl_protection |= NEG_SEAL;
+                                }
+                        } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
+                                if (security_supported & NEG_SIGN) {
+                        }
+                        if (security_supported & NEG_SIGN) {
+                                if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
                                         gensec_gssapi_state->sasl_protection |= NEG_SIGN;
+                                }
+                        } else if (security_supported & NEG_NONE) {
+                        }
+                        if (security_supported & NEG_NONE) {
                                 gensec_gssapi_state->sasl_protection |= NEG_NONE;
+                        } else {
+                                DEBUG(1, ("Remote server does not support unprotected connections"));
+                        }
+                        if (gensec_gssapi_state->sasl_protection == 0) {
+                                DEBUG(1, ("Remote server does not support unprotected connections\n"));
                                 return NT_STATUS_ACCESS_DENIED;
+                        }
 …
                         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
                                 DEBUG(3, ("SASL/GSSAPI Connection to server will be cryptographicly sealed\n"));
+                                DEBUG(3, ("SASL/GSSAPI Connection to server will be cryptographically sealed\n"));
                         } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
                                 DEBUG(3, ("SASL/GSSAPI Connection to server will be cryptographicly signed\n"));
+                                DEBUG(3, ("SASL/GSSAPI Connection to server will be cryptographically signed\n"));
                         } else {
                                 DEBUG(3, ("SASL/GSSAPI Connection to server will have no cryptographicly protection\n"));
+                                DEBUG(3, ("SASL/GSSAPI Connection to server will have no cryptographically protection\n"));
+                        }
 …
                 security_accepted = maxlength_accepted[0];
                 maxlength_accepted[0] = '\0';
                 /* Rest is the proposed max wrap length */
                 gensec_gssapi_state->max_wrap_buf_size = MIN(RIVAL(maxlength_accepted, 0),
 …
                 gensec_gssapi_state->sasl_protection = 0;
+                if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
+                        if (security_accepted & NEG_SEAL) {
+                                gensec_gssapi_state->sasl_protection |= NEG_SEAL;
+                        }
+                } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
+                        if (security_accepted & NEG_SIGN) {
+                                gensec_gssapi_state->sasl_protection |= NEG_SIGN;
+                        }
+                } else if (security_accepted & NEG_NONE) {
+                if (security_accepted & NEG_SEAL) {
+                        if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
+                                DEBUG(1, ("Remote client wanted seal, but gensec refused\n"));
+                                return NT_STATUS_ACCESS_DENIED;
+                        }
+                        gensec_gssapi_state->sasl_protection |= NEG_SEAL;
+                }
+                if (security_accepted & NEG_SIGN) {
+                        if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
+                                DEBUG(1, ("Remote client wanted sign, but gensec refused\n"));
+                                return NT_STATUS_ACCESS_DENIED;
+                        }
+                        gensec_gssapi_state->sasl_protection |= NEG_SIGN;
+                }
+                if (security_accepted & NEG_NONE) {
                         gensec_gssapi_state->sasl_protection |= NEG_NONE;
-                } else {
-                        DEBUG(1, ("Remote client does not support unprotected connections, but we failed to negotiate anything better"));
-                        return NT_STATUS_ACCESS_DENIED;
+                }
 …
                 gensec_gssapi_state->sasl_state = STAGE_DONE;
                 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
                         DEBUG(5, ("SASL/GSSAPI Connection from client will be cryptographicly sealed\n"));
+                        DEBUG(5, ("SASL/GSSAPI Connection from client will be cryptographically sealed\n"));
                 } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
                         DEBUG(5, ("SASL/GSSAPI Connection from client will be cryptographicly signed\n"));
+                        DEBUG(5, ("SASL/GSSAPI Connection from client will be cryptographically signed\n"));
                 } else {
                         DEBUG(5, ("SASL/GSSAPI Connection from client will have no cryptographic protection\n"));
 …
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
         struct auth_serversupplied_info *server_info = NULL;
+        struct auth_user_info_dc *user_info_dc = NULL;
         struct auth_session_info *session_info = NULL;
         OM_uint32 maj_stat, min_stat;
         gss_buffer_desc pac;
         DATA_BLOB pac_blob;
+        struct PAC_SIGNATURE_DATA *pac_srv_sig = NULL;
+        struct PAC_SIGNATURE_DATA *pac_kdc_sig = NULL;
         if ((gensec_gssapi_state->gss_oid->length != gss_mech_krb5->length)
 …
          */
         if (pac_blob.length) {
+                nt_status = kerberos_pac_blob_to_server_info(mem_ctx,
+                                                             gensec_security->settings->iconv_convenience,
+                                                             pac_blob,
+                                                             gensec_gssapi_state->smb_krb5_context->krb5_context,
+                                                             &server_info);
+                pac_srv_sig = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
+                if (!pac_srv_sig) {
+                        talloc_free(mem_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
+                pac_kdc_sig = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
+                if (!pac_kdc_sig) {
+                        talloc_free(mem_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
+                nt_status = kerberos_pac_blob_to_user_info_dc(mem_ctx,
+                                                              pac_blob,
+                                                              gensec_gssapi_state->smb_krb5_context->krb5_context,
+                                                              &user_info_dc,
+                                                              pac_srv_sig,
+                                                              pac_kdc_sig);
                 if (!NT_STATUS_IS_OK(nt_status)) {
                         talloc_free(mem_ctx);
 …
                         DEBUG(1, ("Unable to find PAC, resorting to local user lookup: %s\n",
                                   gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
                         nt_status = gensec_security->auth_context->get_server_info_principal(mem_ctx,
+                        nt_status = gensec_security->auth_context->get_user_info_dc_principal(mem_ctx,
                                                                                              gensec_security->auth_context,
                                                                                              principal_string,
+                                                                                             &server_info);
+                                                                                             NULL,
+                                                                                             &user_info_dc);
                         if (!NT_STATUS_IS_OK(nt_status)) {
 …
+        }
         /* references the server_info into the session_info */
         nt_status = auth_generate_session_info(mem_ctx, gensec_security->event_ctx,
                                                gensec_security->settings->lp_ctx, server_info, &session_info);
+        /* references the user_info_dc into the session_info */
+        nt_status = gensec_generate_session_info(mem_ctx, gensec_security,
+                                                 user_info_dc, &session_info);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(mem_ctx);
 …
+        }
+        /* Allow torture tests to check the PAC signatures */
+        if (session_info->torture) {
+                session_info->torture->pac_srv_sig = talloc_steal(session_info->torture, pac_srv_sig);
+                session_info->torture->pac_kdc_sig = talloc_steal(session_info->torture, pac_kdc_sig);
+        }
         if (!(gensec_gssapi_state->got_flags & GSS_C_DELEG_FLAG)) {
                 DEBUG(10, ("gensec_gssapi: NO delegated credentials supplied by client\n"));
         } else {
                 krb5_error_code ret;
+                const char *error_string;
                 DEBUG(10, ("gensec_gssapi: delegated credentials supplied by client\n"));
                 session_info->credentials = cli_credentials_init(session_info);
 …
                 ret = cli_credentials_set_client_gss_creds(session_info->credentials,
+                                                           gensec_security->event_ctx,
+                                                           gensec_security->settings->lp_ctx,
+                                                           gensec_security->settings->lp_ctx,
                                                            gensec_gssapi_state->delegated_cred_handle,
                                                            CRED_SPECIFIED);
+                                                           CRED_SPECIFIED, &error_string);
                 if (ret) {
                         talloc_free(mem_ctx);
+                        DEBUG(2,("Failed to get gss creds: %s\n", error_string));
                         return NT_STATUS_NO_MEMORY;
+                }

vendor/current/source4/auth/gensec/gensec_gssapi.h

r414	r740
65	65	int gss_exchange_count;
66	66	size_t sig_size;
	67
	68	const char *target_principal;
67	69	};
68	70

vendor/current/source4/auth/gensec/gensec_krb5.c

-              r414
+              r740
 #include "system/kerberos.h"
 #include "auth/kerberos/kerberos.h"
-#include "librpc/gen_ndr/krb5pac.h"
 #include "auth/auth.h"
-#include "lib/ldb/include/ldb.h"
-#include "auth/auth_sam.h"
 #include "lib/socket/socket.h"
+#include "lib/tsocket/tsocket.h"
 #include "librpc/rpc/dcerpc.h"
 #include "auth/credentials/credentials.h"
 #include "auth/credentials/credentials_krb5.h"
+#include "auth/kerberos/kerberos_credentials.h"
 #include "auth/gensec/gensec.h"
 #include "auth/gensec/gensec_proto.h"
 #include "param/param.h"
-#include "auth/session_proto.h"
 #include "auth/auth_sam_reply.h"
+#include "lib/util/util_net.h"
 enum GENSEC_KRB5_STATE {
 …
         struct gensec_krb5_state *gensec_krb5_state;
         struct cli_credentials *creds;
         const struct socket_address *my_addr, *peer_addr;
+        const struct tsocket_address *tlocal_addr, *tremote_addr;
         krb5_address my_krb5_addr, peer_krb5_addr;
 …
         if (cli_credentials_get_krb5_context(creds,
-                                             gensec_security->event_ctx,
                                              gensec_security->settings->lp_ctx, &gensec_krb5_state->smb_krb5_context)) {
                 talloc_free(gensec_krb5_state);
 …
+        }
+        my_addr = gensec_get_my_addr(gensec_security);
+        if (my_addr && my_addr->sockaddr) {
+                ret = krb5_sockaddr2address(gensec_krb5_state->smb_krb5_context->krb5_context,
+                                            my_addr->sockaddr, &my_krb5_addr);
+        tlocal_addr = gensec_get_local_address(gensec_security);
+        if (tlocal_addr) {
+                ssize_t socklen;
+                struct sockaddr_storage ss;
+                socklen = tsocket_address_bsd_sockaddr(tlocal_addr,
+                                (struct sockaddr *) &ss,
+                                sizeof(struct sockaddr_storage));
+                if (socklen < 0) {
+                        talloc_free(gensec_krb5_state);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+                ret = krb5_sockaddr2address(gensec_krb5_state->smb_krb5_context->krb5_context,
+                                (const struct sockaddr *) &ss, &my_krb5_addr);
                 if (ret) {
                         DEBUG(1,("gensec_krb5_start: krb5_sockaddr2address (local) failed (%s)\n",
 …
+        }
+        peer_addr = gensec_get_peer_addr(gensec_security);
+        if (peer_addr && peer_addr->sockaddr) {
+                ret = krb5_sockaddr2address(gensec_krb5_state->smb_krb5_context->krb5_context,
+                                            peer_addr->sockaddr, &peer_krb5_addr);
+        tremote_addr = gensec_get_remote_address(gensec_security);
+        if (tremote_addr) {
+                ssize_t socklen;
+                struct sockaddr_storage ss;
+                socklen = tsocket_address_bsd_sockaddr(tremote_addr,
+                                (struct sockaddr *) &ss,
+                                sizeof(struct sockaddr_storage));
+                if (socklen < 0) {
+                        talloc_free(gensec_krb5_state);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+                ret = krb5_sockaddr2address(gensec_krb5_state->smb_krb5_context->krb5_context,
+                                (const struct sockaddr *) &ss, &peer_krb5_addr);
                 if (ret) {
                         DEBUG(1,("gensec_krb5_start: krb5_sockaddr2address (local) failed (%s)\n",
 …
         ret = krb5_auth_con_setaddrs(gensec_krb5_state->smb_krb5_context->krb5_context,
                                      gensec_krb5_state->auth_context,
                                      my_addr ? &my_krb5_addr : NULL,
                                      peer_addr ? &peer_krb5_addr : NULL);
+                                     tlocal_addr ? &my_krb5_addr : NULL,
+                                     tremote_addr ? &peer_krb5_addr : NULL);
         if (ret) {
                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setaddrs failed (%s)\n",
 …
         struct ccache_container *ccache_container;
         const char *hostname;
+        const char *error_string;
         const char *principal;
         krb5_data in_data;
+        struct tevent_context *previous_ev;
         hostname = gensec_get_target_hostname(gensec_security);
 …
         ret = cli_credentials_get_ccache(gensec_get_credentials(gensec_security),
                                          gensec_security->event_ctx,
                                          gensec_security->settings->lp_ctx, &ccache_container);
+                                         gensec_security->settings->lp_ctx, &ccache_container, &error_string);
         switch (ret) {
         case 0:
                 break;
         case KRB5KDC_ERR_PREAUTH_FAILED:
+        case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
                 return NT_STATUS_LOGON_FAILURE;
         case KRB5_KDC_UNREACH:
+                DEBUG(3, ("Cannot reach a KDC we require to contact %s\n", principal));
+                DEBUG(3, ("Cannot reach a KDC we require to contact %s: %s\n", principal, error_string));
+                return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
+        case KRB5_CC_NOTFOUND:
+        case KRB5_CC_END:
+                DEBUG(3, ("Error preparing credentials we require to contact %s : %s\n", principal, error_string));
                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
         default:
                 DEBUG(1, ("gensec_krb5_start: Aquiring initiator credentials failed: %s\n", error_message(ret)));
+                DEBUG(1, ("gensec_krb5_start: Aquiring initiator credentials failed: %s\n", error_string));
                 return NT_STATUS_UNSUCCESSFUL;
+        }
         in_data.length = 0;
+        if (principal && lp_client_use_spnego_principal(gensec_security->settings->lp_ctx)) {
+        /* Do this every time, in case we have weird recursive issues here */
+        ret = smb_krb5_context_set_event_ctx(gensec_krb5_state->smb_krb5_context, gensec_security->event_ctx, &previous_ev);
+        if (ret != 0) {
+                DEBUG(1, ("gensec_krb5_start: Setting event context failed\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
+        if (principal) {
                 krb5_principal target_principal;
                 ret = krb5_parse_name(gensec_krb5_state->smb_krb5_context->krb5_context, principal,
 …
                                   &gensec_krb5_state->enc_ticket);
+        }
+        smb_krb5_context_remove_event_ctx(gensec_krb5_state->smb_krb5_context, previous_ev, gensec_security->event_ctx);
         switch (ret) {
         case 0:
 …
                 struct keytab_container *keytab;
                 krb5_principal server_in_keytab;
+                const char *error_string;
+                enum credentials_obtained obtained;
                 if (!in.data) {
 …
                 /* Grab the keytab, however generated */
                 ret = cli_credentials_get_keytab(gensec_get_credentials(gensec_security),
-                                                 gensec_security->event_ctx,
                                                  gensec_security->settings->lp_ctx, &keytab);
                 if (ret) {
 …
                 ret = principal_from_credentials(out_mem_ctx, gensec_get_credentials(gensec_security),
                                                  gensec_krb5_state->smb_krb5_context,
                                                  &server_in_keytab);
+                                                 &server_in_keytab, &obtained, &error_string);
                 if (ret) {
+                        DEBUG(2,("Failed to make credentials from principal: %s\n", error_string));
                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+                }
 …
         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
         struct auth_serversupplied_info *server_info = NULL;
+        struct auth_user_info_dc *user_info_dc = NULL;
         struct auth_session_info *session_info = NULL;
         struct PAC_LOGON_INFO *logon_info;
 …
                           smb_get_krb5_error_message(context,
                                                      ret, mem_ctx)));
+                krb5_free_principal(context, client_principal);
                 talloc_free(mem_ctx);
                 return NT_STATUS_NO_MEMORY;
 …
                           smb_get_krb5_error_message(context,
                                                      ret, mem_ctx)));
+                free(principal_string);
                 krb5_free_principal(context, client_principal);
                 free(principal_string);
+                talloc_free(mem_ctx);
                 return NT_STATUS_ACCESS_DENIED;
         } else if (ret) {
 …
                                   principal_string, smb_get_krb5_error_message(context,
                                                      ret, mem_ctx)));
                         nt_status = gensec_security->auth_context->get_server_info_principal(mem_ctx,
+                        nt_status = gensec_security->auth_context->get_user_info_dc_principal(mem_ctx,
                                                                                              gensec_security->auth_context,
                                                                                              principal_string,
                                                                                              &server_info);
+                                                                                             NULL, &user_info_dc);
                         if (!NT_STATUS_IS_OK(nt_status)) {
+                                free(principal_string);
+                                krb5_free_principal(context, client_principal);
                                 talloc_free(mem_ctx);
                                 return nt_status;
 …
                         DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access\n",
                                   principal_string));
+                        free(principal_string);
+                        krb5_free_principal(context, client_principal);
+                        talloc_free(mem_ctx);
                         return NT_STATUS_ACCESS_DENIED;
+                }
-                krb5_free_principal(context, client_principal);
-                free(principal_string);
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        talloc_free(mem_ctx);
-                        return nt_status;
+                }
         } else {
                 /* Found pac */
                 union netr_Validation validation;
-                free(principal_string);
                 pac = data_blob_talloc(mem_ctx, pac_data.data, pac_data.length);
                 if (!pac.data) {
+                        free(principal_string);
                         krb5_free_principal(context, client_principal);
                         talloc_free(mem_ctx);
 …
                 /* decode and verify the pac */
                 nt_status = kerberos_pac_logon_info(gensec_krb5_state,
-                                                    gensec_security->settings->iconv_convenience,
                                                     &logon_info, pac,
                                                     gensec_krb5_state->smb_krb5_context->krb5_context,
 …
                                                     client_principal,
                                                     gensec_krb5_state->ticket->ticket.authtime, NULL);
-                krb5_free_principal(context, client_principal);
                 if (!NT_STATUS_IS_OK(nt_status)) {
+                        free(principal_string);
+                        krb5_free_principal(context, client_principal);
                         talloc_free(mem_ctx);
                         return nt_status;
 …
                 validation.sam3 = &logon_info->info3;
                 nt_status = make_server_info_netlogon_validation(mem_ctx,
+                nt_status = make_user_info_dc_netlogon_validation(mem_ctx,
                                                                  NULL,
 , &validation,
                                                                  &server_info);
+                                                                 &user_info_dc);
                 if (!NT_STATUS_IS_OK(nt_status)) {
+                        free(principal_string);
+                        krb5_free_principal(context, client_principal);
                         talloc_free(mem_ctx);
                         return nt_status;
 …
+        }
+        /* references the server_info into the session_info */
+        nt_status = auth_generate_session_info(mem_ctx, gensec_security->event_ctx, gensec_security->settings->lp_ctx, server_info, &session_info);
+        free(principal_string);
+        krb5_free_principal(context, client_principal);
+        /* references the user_info_dc into the session_info */
+        nt_status = gensec_generate_session_info(mem_ctx, gensec_security, user_info_dc, &session_info);
         if (!NT_STATUS_IS_OK(nt_status)) {

vendor/current/source4/auth/gensec/pygensec.c

-              r414
+              r740
 */
+#include <Python.h>
 #include "includes.h"
+#include <Python.h>
+#include "param/param.h"
+#include "param/pyparam.h"
 #include "auth/gensec/gensec.h"
+#include "auth/credentials/pycredentials.h"
 #include "libcli/util/pyerrors.h"
+#include "pytalloc.h"
+#include "scripting/python/modules.h"
+#include "lib/talloc/pytalloc.h"
 #include <tevent.h>
+#ifndef Py_RETURN_NONE
+#define Py_RETURN_NONE return Py_INCREF(Py_None), Py_None
+#endif
+#include "librpc/rpc/pyrpc_util.h"
 static PyObject *py_get_name_by_authtype(PyObject *self, PyObject *args)
 …
                 return NULL;
         security = (struct gensec_security *)py_talloc_get_ptr(self);
+        security = py_talloc_get_type(self, struct gensec_security);
         name = gensec_get_name_by_authtype(security, type);
 …
+}
+static struct gensec_settings *settings_from_object(PyObject *object)
+{
+        return NULL; /* FIXME */
+static struct gensec_settings *settings_from_object(TALLOC_CTX *mem_ctx, PyObject *object)
+{
+        struct gensec_settings *s;
+        PyObject *py_hostname, *py_lp_ctx;
+        if (!PyDict_Check(object)) {
+                PyErr_SetString(PyExc_ValueError, "settings should be a dictionary");
+                return NULL;
+        }
+        s = talloc_zero(mem_ctx, struct gensec_settings);
+        if (!s) return NULL;
+        py_hostname = PyDict_GetItemString(object, "target_hostname");
+        if (!py_hostname) {
+                PyErr_SetString(PyExc_ValueError, "settings.target_hostname not found");
+                return NULL;
+        }
+        py_lp_ctx = PyDict_GetItemString(object, "lp_ctx");
+        if (!py_lp_ctx) {
+                PyErr_SetString(PyExc_ValueError, "settings.lp_ctx not found");
+                return NULL;
+        }
+        s->target_hostname = PyString_AsString(py_hostname);
+        s->lp_ctx = lpcfg_from_py_object(s, py_lp_ctx);
+        return s;
+}
 …
         PyObject *py_settings;
         struct tevent_context *ev;
+        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O", kwnames, &py_settings))
+                return NULL;
+        settings = settings_from_object(py_settings);
+        if (settings == NULL)
+                return NULL;
+        struct gensec_security *gensec;
+        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|O", discard_const_p(char *, kwnames), &py_settings))
+                return NULL;
         self = (py_talloc_Object*)type->tp_alloc(type, 0);
         if (self == NULL) {
 …
                 return NULL;
+        }
+        if (py_settings != Py_None) {
+                settings = settings_from_object(self->talloc_ctx, py_settings);
+                if (settings == NULL) {
+                        PyObject_DEL(self);
+                        return NULL;
+                }
+        } else {
+                settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
+                if (settings == NULL) {
+                        PyObject_DEL(self);
+                        return NULL;
+                }
+                settings->lp_ctx = loadparm_init_global(true);
+        }
         ev = tevent_context_init(self->talloc_ctx);
         if (ev == NULL) {
 …
                 return NULL;
+        }
+        status = gensec_client_start(self->talloc_ctx,
                 (struct gensec_security **)&self->ptr, ev, settings);
+        status = gensec_init(settings->lp_ctx);
         if (!NT_STATUS_IS_OK(status)) {
                 PyErr_SetNTSTATUS(status);
 …
                 return NULL;
+        }
+        status = gensec_client_start(self->talloc_ctx, &gensec, ev, settings);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                PyObject_DEL(self);
+                return NULL;
+        }
+        self->ptr = gensec;
         return (PyObject *)self;
+}
+static PyObject *py_gensec_start_server(PyTypeObject *type, PyObject *args, PyObject *kwargs)
+{
+        NTSTATUS status;
+        py_talloc_Object *self;
+        struct gensec_settings *settings = NULL;
+        const char *kwnames[] = { "settings", "auth_context", NULL };
+        PyObject *py_settings = Py_None;
+        PyObject *py_auth_context = Py_None;
+        struct tevent_context *ev;
+        struct gensec_security *gensec;
+        struct auth_context *auth_context = NULL;
+        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OO", discard_const_p(char *, kwnames), &py_settings, &py_auth_context))
+                return NULL;
+        self = (py_talloc_Object*)type->tp_alloc(type, 0);
+        if (self == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        self->talloc_ctx = talloc_new(NULL);
+        if (self->talloc_ctx == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        if (py_settings != Py_None) {
+                settings = settings_from_object(self->talloc_ctx, py_settings);
+                if (settings == NULL) {
+                        PyObject_DEL(self);
+                        return NULL;
+                }
+        } else {
+                settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
+                if (settings == NULL) {
+                        PyObject_DEL(self);
+                        return NULL;
+                }
+                settings->lp_ctx = loadparm_init_global(true);
+        }
+        ev = tevent_context_init(self->talloc_ctx);
+        if (ev == NULL) {
+                PyErr_NoMemory();
+                PyObject_Del(self);
+                return NULL;
+        }
+        if (py_auth_context != Py_None) {
+                auth_context = py_talloc_get_type(py_auth_context, struct auth_context);
+                if (!auth_context) {
+                        PyErr_Format(PyExc_TypeError,
+                                     "Expected auth.AuthContext for auth_context argument, got %s",
+                                     talloc_get_name(py_talloc_get_ptr(py_auth_context)));
+                        return NULL;
+                }
+        }
+        status = gensec_init(settings->lp_ctx);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                PyObject_DEL(self);
+                return NULL;
+        }
+        status = gensec_server_start(self->talloc_ctx, ev, settings, auth_context, &gensec);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                PyObject_DEL(self);
+                return NULL;
+        }
+        self->ptr = gensec;
+        return (PyObject *)self;
+}
+static PyObject *py_gensec_set_credentials(PyObject *self, PyObject *args)
+{
+        PyObject *py_creds = Py_None;
+        struct cli_credentials *creds;
+        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        NTSTATUS status;
+        if (!PyArg_ParseTuple(args, "O", &py_creds))
+                return NULL;
+        creds = PyCredentials_AsCliCredentials(py_creds);
+        if (!creds) {
+                PyErr_Format(PyExc_TypeError,
+                             "Expected samba.credentaials for credentials argument got  %s",
+                             talloc_get_name(py_talloc_get_ptr(py_creds)));
+        }
+        status = gensec_set_credentials(security, creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+        Py_RETURN_NONE;
+}
 static PyObject *py_gensec_session_info(PyObject *self)
+{
         NTSTATUS status;
+        struct gensec_security *security = (struct gensec_security *)py_talloc_get_ptr(self);
+        PyObject *py_session_info;
+        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
         struct auth_session_info *info;
+        if (security->ops == NULL) {
+                PyErr_SetString(PyExc_RuntimeError, "no mechanism selected");
+                return NULL;
+        }
         status = gensec_session_info(security, &info);
         if (NT_STATUS_IS_ERR(status)) {
 …
+        }
+        /* FIXME */
+        py_session_info = py_return_ndr_struct("samba.auth", "AuthSession",
+                                                 info, info);
+        return py_session_info;
+}
+static PyObject *py_gensec_start_mech_by_name(PyObject *self, PyObject *args)
+{
+        char *name;
+        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        NTSTATUS status;
+        if (!PyArg_ParseTuple(args, "s", &name))
+                return NULL;
+        status = gensec_start_mech_by_name(security, name);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
         Py_RETURN_NONE;
+}
+static PyObject *py_gensec_start_mech_by_sasl_name(PyObject *self, PyObject *args)
+{
+        char *sasl_name;
+        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        NTSTATUS status;
+        if (!PyArg_ParseTuple(args, "s", &sasl_name))
+                return NULL;
+        status = gensec_start_mech_by_sasl_name(security, sasl_name);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+        Py_RETURN_NONE;
+}
+static PyObject *py_gensec_start_mech_by_authtype(PyObject *self, PyObject *args)
+{
+        int authtype, level;
+        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        NTSTATUS status;
+        if (!PyArg_ParseTuple(args, "ii", &authtype, &level))
+                return NULL;
+        status = gensec_start_mech_by_authtype(security, authtype, level);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+        Py_RETURN_NONE;
+}
+static PyObject *py_gensec_want_feature(PyObject *self, PyObject *args)
+{
+        int feature;
+        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
+        if (!PyArg_ParseTuple(args, "i", &feature))
+                return NULL;
+        gensec_want_feature(security, feature);
+        Py_RETURN_NONE;
+}
+static PyObject *py_gensec_have_feature(PyObject *self, PyObject *args)
+{
+        int feature;
+        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
+        if (!PyArg_ParseTuple(args, "i", &feature))
+                return NULL;
+        if (gensec_have_feature(security, feature)) {
+                return Py_True;
+        }
+        return Py_False;
+}
+static PyObject *py_gensec_update(PyObject *self, PyObject *args)
+{
+        NTSTATUS status;
+        TALLOC_CTX *mem_ctx;
+        DATA_BLOB in, out;
+        PyObject *ret, *py_in;
+        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        PyObject *finished_processing;
+        if (!PyArg_ParseTuple(args, "O", &py_in))
+                return NULL;
+        mem_ctx = talloc_new(NULL);
+        if (!PyString_Check(py_in)) {
+                PyErr_Format(PyExc_TypeError, "expected a string");
+                return NULL;
+        }
+        in.data = (uint8_t *)PyString_AsString(py_in);
+        in.length = PyString_Size(py_in);
+        status = gensec_update(security, mem_ctx, in, &out);
+        if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)
+            && !NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+        ret = PyString_FromStringAndSize((const char *)out.data, out.length);
+        talloc_free(mem_ctx);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+                finished_processing = Py_False;
+        } else {
+                finished_processing = Py_True;
+        }
+        return PyTuple_Pack(2, finished_processing, ret);
+}
+static PyObject *py_gensec_wrap(PyObject *self, PyObject *args)
+{
+        NTSTATUS status;
+        TALLOC_CTX *mem_ctx;
+        DATA_BLOB in, out;
+        PyObject *ret, *py_in;
+        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        if (!PyArg_ParseTuple(args, "O", &py_in))
+                return NULL;
+        mem_ctx = talloc_new(NULL);
+        if (!PyString_Check(py_in)) {
+                PyErr_Format(PyExc_TypeError, "expected a string");
+                return NULL;
+        }
+        in.data = (uint8_t *)PyString_AsString(py_in);
+        in.length = PyString_Size(py_in);
+        status = gensec_wrap(security, mem_ctx, &in, &out);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+        ret = PyString_FromStringAndSize((const char *)out.data, out.length);
+        talloc_free(mem_ctx);
+        return ret;
+}
+static PyObject *py_gensec_unwrap(PyObject *self, PyObject *args)
+{
+        NTSTATUS status;
+        TALLOC_CTX *mem_ctx;
+        DATA_BLOB in, out;
+        PyObject *ret, *py_in;
+        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        if (!PyArg_ParseTuple(args, "O", &py_in))
+                return NULL;
+        mem_ctx = talloc_new(NULL);
+        if (!PyString_Check(py_in)) {
+                PyErr_Format(PyExc_TypeError, "expected a string");
+                return NULL;
+        }
+        in.data = (uint8_t *)PyString_AsString(py_in);
+        in.length = PyString_Size(py_in);
+        status = gensec_unwrap(security, mem_ctx, &in, &out);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+        ret = PyString_FromStringAndSize((const char *)out.data, out.length);
+        talloc_free(mem_ctx);
+        return ret;
+}
 …
         { "start_client", (PyCFunction)py_gensec_start_client, METH_VARARGS|METH_KEYWORDS|METH_CLASS,
                 "S.start_client(settings) -> gensec" },
+/*      { "start_server", (PyCFunction)py_gensec_start_server, METH_VARARGS|METH_KEYWORDS|METH_CLASS,
+                "S.start_server(auth_ctx, settings) -> gensec" },*/
+        { "start_server", (PyCFunction)py_gensec_start_server, METH_VARARGS|METH_KEYWORDS|METH_CLASS,
+                "S.start_server(auth_ctx, settings) -> gensec" },
+        { "set_credentials", (PyCFunction)py_gensec_set_credentials, METH_VARARGS,
+                "S.start_client(credentials)" },
         { "session_info", (PyCFunction)py_gensec_session_info, METH_NOARGS,
+                "S.session_info() -> info" },
+                "S.session_info() -> info" },
+        { "start_mech_by_name", (PyCFunction)py_gensec_start_mech_by_name, METH_VARARGS,
+        "S.start_mech_by_name(name)" },
+        { "start_mech_by_sasl_name", (PyCFunction)py_gensec_start_mech_by_sasl_name, METH_VARARGS,
+        "S.start_mech_by_sasl_name(name)" },
+        { "start_mech_by_authtype", (PyCFunction)py_gensec_start_mech_by_authtype, METH_VARARGS, "S.start_mech_by_authtype(authtype, level)" },
         { "get_name_by_authtype", (PyCFunction)py_get_name_by_authtype, METH_VARARGS,
                 "S.get_name_by_authtype(authtype) -> name\nLookup an auth type." },
+        { "want_feature", (PyCFunction)py_gensec_want_feature, METH_VARARGS,
+          "S.want_feature(feature)\n Request that GENSEC negotiate a particular feature." },
+        { "have_feature", (PyCFunction)py_gensec_have_feature, METH_VARARGS,
+          "S.have_feature()\n Return True if GENSEC negotiated a particular feature." },
+        { "update",  (PyCFunction)py_gensec_update, METH_VARARGS,
+                "S.update(blob_in) -> (finished, blob_out)\nPerform one step in a GENSEC dance.  Repeat with new packets until finished is true or exception." },
+        { "wrap",  (PyCFunction)py_gensec_wrap, METH_VARARGS,
+                "S.wrap(blob_in) -> blob_out\nPackage one clear packet into a wrapped GENSEC packet." },
+        { "unwrap",  (PyCFunction)py_gensec_unwrap, METH_VARARGS,
+                "S.unwrap(blob_in) -> blob_out\nPerform one wrapped GENSEC packet into a clear packet." },
         { NULL }
 };
 …
         .tp_methods = py_gensec_security_methods,
         .tp_basicsize = sizeof(py_talloc_Object),
-        .tp_dealloc = py_talloc_dealloc,
 };
+void initgensec(void);
 void initgensec(void)
+{
         PyObject *m;
+        Py_Security.tp_base = PyTalloc_GetObjectType();
+        if (Py_Security.tp_base == NULL)
+                return;
         if (PyType_Ready(&Py_Security) < 0)
 …
                 return;
+        PyModule_AddObject(m, "FEATURE_SESSION_KEY",     PyInt_FromLong(GENSEC_FEATURE_SESSION_KEY));
+        PyModule_AddObject(m, "FEATURE_SIGN",            PyInt_FromLong(GENSEC_FEATURE_SIGN));
+        PyModule_AddObject(m, "FEATURE_SEAL",            PyInt_FromLong(GENSEC_FEATURE_SEAL));
+        PyModule_AddObject(m, "FEATURE_DCE_STYLE",       PyInt_FromLong(GENSEC_FEATURE_DCE_STYLE));
+        PyModule_AddObject(m, "FEATURE_ASYNC_REPLIES",   PyInt_FromLong(GENSEC_FEATURE_ASYNC_REPLIES));
+        PyModule_AddObject(m, "FEATURE_DATAGRAM_MODE",   PyInt_FromLong(GENSEC_FEATURE_DATAGRAM_MODE));
+        PyModule_AddObject(m, "FEATURE_SIGN_PKT_HEADER", PyInt_FromLong(GENSEC_FEATURE_SIGN_PKT_HEADER));
+        PyModule_AddObject(m, "FEATURE_NEW_SPNEGO",      PyInt_FromLong(GENSEC_FEATURE_NEW_SPNEGO));
         Py_INCREF(&Py_Security);
         PyModule_AddObject(m, "Security", (PyObject *)&Py_Security);

vendor/current/source4/auth/gensec/schannel.c

-              r414
+              r740
 #include "auth/gensec/gensec_proto.h"
 #include "../libcli/auth/schannel.h"
-#include "auth/gensec/schannel_state.h"
 #include "librpc/rpc/dcerpc.h"
 #include "param/param.h"
-#include "auth/session_proto.h"
 static size_t schannel_sig_size(struct gensec_security *gensec_security, size_t data_size)
+{
+        return 32;
+        struct schannel_state *state = (struct schannel_state *)gensec_security->private_data;
+        uint32_t sig_size;
+        sig_size = netsec_outgoing_sig_size(state);
+        return sig_size;
+}
 …
         struct NL_AUTH_MESSAGE bind_schannel_ack;
         struct netlogon_creds_CredentialState *creds;
-        struct ldb_context *schannel_ldb;
         const char *workstation;
         const char *domain;
-        uint32_t required_flags;
         *out = data_blob(NULL, 0);
 …
 #endif
+                ndr_err = ndr_push_struct_blob(out, out_mem_ctx,
+                                               gensec_security->settings->iconv_convenience, &bind_schannel,
+                ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel,
                                                (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 …
         case GENSEC_SERVER:
-                required_flags = NL_FLAG_OEM_NETBIOS_COMPUTER_NAME |
-                                 NL_FLAG_OEM_NETBIOS_DOMAIN_NAME;
                 if (state->state != SCHANNEL_STATE_START) {
                         /* no third leg on this protocol */
 …
                 /* parse the schannel startup blob */
+                ndr_err = ndr_pull_struct_blob(&in, out_mem_ctx,
+                        gensec_security->settings->iconv_convenience,
+                        &bind_schannel,
+                ndr_err = ndr_pull_struct_blob(&in, out_mem_ctx, &bind_schannel,
                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 …
+                }
+                if (!(required_flags == (bind_schannel.Flags & required_flags))) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+                workstation = bind_schannel.oem_netbios_computer.a;
+                domain = bind_schannel.oem_netbios_domain.a;
+                if (strcasecmp_m(domain, lp_workgroup(gensec_security->settings->lp_ctx)) != 0) {
+                        DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
+                                  domain, lp_workgroup(gensec_security->settings->lp_ctx)));
+                if (bind_schannel.Flags & NL_FLAG_OEM_NETBIOS_DOMAIN_NAME) {
+                        domain = bind_schannel.oem_netbios_domain.a;
+                        if (strcasecmp_m(domain, lpcfg_workgroup(gensec_security->settings->lp_ctx)) != 0) {
+                                DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
+                                          domain, lpcfg_workgroup(gensec_security->settings->lp_ctx)));
+                                return NT_STATUS_LOGON_FAILURE;
+                        }
+                } else if (bind_schannel.Flags & NL_FLAG_UTF8_DNS_DOMAIN_NAME) {
+                        domain = bind_schannel.utf8_dns_domain.u;
+                        if (strcasecmp_m(domain, lpcfg_dnsdomain(gensec_security->settings->lp_ctx)) != 0) {
+                                DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
+                                          domain, lpcfg_dnsdomain(gensec_security->settings->lp_ctx)));
+                                return NT_STATUS_LOGON_FAILURE;
+                        }
+                } else {
+                        DEBUG(3, ("Request for schannel to without domain\n"));
                         return NT_STATUS_LOGON_FAILURE;
+                }
+                schannel_ldb = schannel_db_connect(out_mem_ctx, gensec_security->event_ctx,
+                                                   gensec_security->settings->lp_ctx);
+                if (!schannel_ldb) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+                /* pull the session key for this client */
+                status = schannel_fetch_session_key_ldb(schannel_ldb,
+                                                        out_mem_ctx, workstation, &creds);
+                talloc_free(schannel_ldb);
+                if (bind_schannel.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME) {
+                        workstation = bind_schannel.oem_netbios_computer.a;
+                } else if (bind_schannel.Flags & NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME) {
+                        workstation = bind_schannel.utf8_netbios_computer.u;
+                } else {
+                        DEBUG(3, ("Request for schannel to without netbios workstation\n"));
+                        return NT_STATUS_LOGON_FAILURE;
+                }
+                status = schannel_get_creds_state(out_mem_ctx,
+                                                  lpcfg_private_dir(gensec_security->settings->lp_ctx),
+                                                  workstation, &creds);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(3, ("Could not find session key for attempted schannel connection from %s: %s\n",
 …
+                }
                 state->creds = talloc_reference(state, creds);
+                state->creds = talloc_steal(state, creds);
                 bind_schannel_ack.MessageType = NL_NEGOTIATE_RESPONSE;
 …
                                                             * - gd */
+                ndr_err = ndr_push_struct_blob(out, out_mem_ctx,
+                                               gensec_security->settings->iconv_convenience, &bind_schannel_ack,
+                ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel_ack,
                                                (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 …
+{
         struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
         return auth_anonymous_session_info(state, gensec_security->event_ctx, gensec_security->settings->lp_ctx, _session_info);
+        return auth_anonymous_session_info(state, gensec_security->settings->lp_ctx, _session_info);
+}

vendor/current/source4/auth/gensec/socket.c

r414	r740
78	78	&unwrapped, &wrapped);
79	79	if (!NT_STATUS_IS_OK(nt_status)) {
80		~~talloc_free(mem_ctx);~~
81	80	return nt_status;
82	81	}

vendor/current/source4/auth/gensec/spnego.c

-              r414
+              r740
 #include "auth/gensec/gensec.h"
 #include "auth/gensec/gensec_proto.h"
+#include "param/param.h"
 enum spnego_state_position {
 …
         if (spnego_state->state_position == SPNEGO_SERVER_START) {
                 for (i=0; all_sec && all_sec[i].op; i++) {
                         /* optomisitic token */
                         if (strcmp(all_sec[i].oid, mechType[0]) == 0) {
+                uint32_t j;
+                for (j=0; mechType && mechType[j]; j++) {
+                        for (i=0; all_sec && all_sec[i].op; i++) {
                                 nt_status = gensec_subcontext_start(spnego_state,
                                                                     gensec_security,
 …
                                         break;
+                                }
+                                if (j > 0) {
+                                        /* no optimistic token */
+                                        spnego_state->neg_oid = all_sec[i].oid;
+                                        *unwrapped_out = data_blob_null;
+                                        nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
+                                        break;
+                                }
                                 nt_status = gensec_update(spnego_state->sub_sec_security,
                                                           out_mem_ctx,
 …
                                 break;
+                        }
+                }
+        }
+        /* Having tried any optomisitc token from the client (if we
+                        if (spnego_state->sub_sec_security) {
+                                break;
+                        }
+                }
+                if (!spnego_state->sub_sec_security) {
+                        DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+        }
+        /* Having tried any optimistic token from the client (if we
          * were the server), if we didn't get anywhere, walk our list
          * in our preference order */
 …
                         if (spnego_state->state_position != SPNEGO_SERVER_START) {
                                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) ||
+                                    NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_LOGON_SERVERS) ||
+                                    NT_STATUS_EQUAL(nt_status, NT_STATUS_TIME_DIFFERENCE_AT_DC) ||
                                     NT_STATUS_EQUAL(nt_status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
                                         /* Pretend we never started it (lets the first run find some incompatible demand) */
 …
         DATA_BLOB unwrapped_out = data_blob(NULL, 0);
         const struct gensec_security_ops_wrapper *all_sec;
-        const char *principal = NULL;
         mechTypes = gensec_security_oids(gensec_security,
 …
                 if (spnego_state->state_position == SPNEGO_SERVER_START) {
-                        /* server credentials */
-                        struct cli_credentials *creds = gensec_get_credentials(gensec_security);
-                        if (creds) {
-                                principal = cli_credentials_get_principal(creds, out_mem_ctx);
+                        }
+                }
-                if (principal) {
                         spnego_out.negTokenInit.mechListMIC
                                 = data_blob_string_const(principal);
+                                = data_blob_string_const(ADS_IGNORE_PRINCIPAL);
                 } else {
                         spnego_out.negTokenInit.mechListMIC = null_data_blob;
 …
+                }
+                if (spnego.negTokenInit.targetPrincipal) {
+                if (spnego.negTokenInit.targetPrincipal
+                    && strcmp(spnego.negTokenInit.targetPrincipal, ADS_IGNORE_PRINCIPAL) != 0) {
                         DEBUG(5, ("Server claims it's principal name is %s\n", spnego.negTokenInit.targetPrincipal));
+                        gensec_set_target_principal(gensec_security, spnego.negTokenInit.targetPrincipal);
+                        if (lpcfg_client_use_spnego_principal(gensec_security->settings->lp_ctx)) {
+                                gensec_set_target_principal(gensec_security, spnego.negTokenInit.targetPrincipal);
+                        }
+                }

vendor/current/source4/auth/kerberos/kerberos.c

-              r414
+              r740
   This version is built to use a keyblock, rather than needing the
   original password.
+  The impersonate_principal is the principal if NULL, or the principal to impersonate
+  The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self)
 */
  krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
+                                krb5_principal principal, krb5_keyblock *keyblock,
+                                time_t *expire_time, time_t *kdc_time)
+                                            krb5_principal principal, krb5_keyblock *keyblock,
+                                            const char *target_service,
+                                            krb5_get_init_creds_opt *krb_options,
+                                            time_t *expire_time, time_t *kdc_time)
+{
         krb5_error_code code = 0;
         krb5_creds my_creds;
-        krb5_get_init_creds_opt *options;
-        if ((code = krb5_get_init_creds_opt_alloc(ctx, &options))) {
-                return code;
+        }
-        krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, options);
         if ((code = krb5_get_init_creds_keyblock(ctx, &my_creds, principal, keyblock,
 , NULL, options))) {
+, target_service, krb_options))) {
                 return code;
+        }
         if ((code = krb5_cc_initialize(ctx, cc, principal))) {
-                krb5_get_init_creds_opt_free(ctx, options);
                 krb5_free_cred_contents(ctx, &my_creds);
                 return code;
 …
         if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
-                krb5_get_init_creds_opt_free(ctx, options);
                 krb5_free_cred_contents(ctx, &my_creds);
                 return code;
 …
+        }
-        krb5_get_init_creds_opt_free(ctx, options);
         krb5_free_cred_contents(ctx, &my_creds);
 …
   simulate a kinit, putting the tgt in the given credentials cache.
   Orignally by remus@snapserver.com
+  The impersonate_principal is the principal if NULL, or the principal to impersonate
+  The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self)
 */
  krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
+                                krb5_principal principal, const char *password,
+                                time_t *expire_time, time_t *kdc_time)
+                                            krb5_principal principal, const char *password,
+                                            krb5_principal impersonate_principal, const char *target_service,
+                                            krb5_get_init_creds_opt *krb_options,
+                                            time_t *expire_time, time_t *kdc_time)
+{
         krb5_error_code code = 0;
         krb5_creds my_creds;
+        krb5_get_init_creds_opt *options;
+        krb5_creds *impersonate_creds;
+        krb5_get_creds_opt options;
+        if ((code = krb5_get_init_creds_opt_alloc(ctx, &options))) {
+        /* If we are not impersonating, then get this ticket for the
+         * target service, otherwise a krbtgt, and get the next ticket
+         * for the target */
+        if ((code = krb5_get_init_creds_password(ctx, &my_creds, principal, password,
+                                                 NULL, NULL,
+,
+                                                 impersonate_principal ? NULL : target_service,
+                                                 krb_options))) {
                 return code;
+        }
-        krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, options);
-        if ((code = krb5_get_init_creds_password(ctx, &my_creds, principal, password,
-                                                 NULL,
-                                                 NULL, 0, NULL, options))) {
-                return code;
+        }
         if ((code = krb5_cc_initialize(ctx, cc, principal))) {
-                krb5_get_init_creds_opt_free(ctx, options);
                 krb5_free_cred_contents(ctx, &my_creds);
                 return code;
 …
         if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
-                krb5_get_init_creds_opt_free(ctx, options);
                 krb5_free_cred_contents(ctx, &my_creds);
                 return code;
 …
+        }
-        krb5_get_init_creds_opt_free(ctx, options);
         krb5_free_cred_contents(ctx, &my_creds);
+        if (code == 0 && impersonate_principal) {
+                krb5_principal target_princ;
+                if ((code = krb5_get_creds_opt_alloc(ctx, &options))) {
+                        return code;
+                }
+                if ((code = krb5_get_creds_opt_set_impersonate(ctx, options, impersonate_principal))) {
+                        krb5_get_creds_opt_free(ctx, options);
+                        return code;
+                }
+                if ((code = krb5_parse_name(ctx, target_service, &target_princ))) {
+                        krb5_get_creds_opt_free(ctx, options);
+                        return code;
+                }
+                if ((code = krb5_principal_set_realm(ctx, target_princ, krb5_principal_get_realm(ctx, principal)))) {
+                        krb5_get_creds_opt_free(ctx, options);
+                        krb5_free_principal(ctx, target_princ);
+                        return code;
+                }
+                if ((code = krb5_get_creds(ctx, options, cc, target_princ, &impersonate_creds))) {
+                        krb5_free_principal(ctx, target_princ);
+                        krb5_get_creds_opt_free(ctx, options);
+                        return code;
+                }
+                krb5_free_principal(ctx, target_princ);
+                code = krb5_cc_store_cred(ctx, cc, impersonate_creds);
+                krb5_get_creds_opt_free(ctx, options);
+                krb5_free_creds(ctx, impersonate_creds);
+        }
         return 0;
+}

vendor/current/source4/auth/kerberos/kerberos.h

-              r414
+              r740
 #include "librpc/gen_ndr/krb5pac.h"
 struct auth_serversupplied_info;
+struct auth_user_info_dc;
 struct cli_credentials;
 …
 #define KRB5_KEY_DATA(k)        ((k)->contents)
 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
+#define ENC_ALL_TYPES (ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5 |     \
+                       ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256)
 #ifndef HAVE_KRB5_SET_REAL_TIME
 …
                                 krb5_data *outbuf);
 bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
+int kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
+                               krb5_principal principal, const char *password,
+                               time_t *expire_time, time_t *kdc_time);
+int kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
+                               krb5_principal principal, krb5_keyblock *keyblock,
+                               time_t *expire_time, time_t *kdc_time);
+krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
+                                           krb5_principal principal, const char *password,
+                                           krb5_principal impersonate_principal, const char *target_service,
+                                           krb5_get_init_creds_opt *krb_options,
+                                           time_t *expire_time, time_t *kdc_time);
+krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
+                                           krb5_principal principal, krb5_keyblock *keyblock,
+                                           const char *target_service,
+                                           krb5_get_init_creds_opt *krb_options,
+                                           time_t *expire_time, time_t *kdc_time);
 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
                                                         krb5_principal host_princ,
 …
 krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry);
 char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx);
- krb5_error_code kinit_to_ccache(TALLOC_CTX *parent_ctx,
-                          struct cli_credentials *credentials,
-                          struct smb_krb5_context *smb_krb5_context,
-                                 krb5_ccache ccache);
-krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
-                                           struct cli_credentials *credentials,
-                                           struct smb_krb5_context *smb_krb5_context,
-                                           krb5_principal *princ);
 NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
-                             struct smb_iconv_convenience *iconv_convenience,
                              struct PAC_DATA **pac_data_out,
                              DATA_BLOB blob,
 …
                              krb5_error_code *k5ret);
  NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
-                                  struct smb_iconv_convenience *iconv_convenience,
                                   struct PAC_LOGON_INFO **logon_info,
                                   DATA_BLOB blob,
 …
                                   krb5_error_code *k5ret);
  krb5_error_code kerberos_encode_pac(TALLOC_CTX *mem_ctx,
-                                     struct smb_iconv_convenience *iconv_convenience,
                                     struct PAC_DATA *pac_data,
                                     krb5_context context,
 …
                                     DATA_BLOB *pac);
  krb5_error_code kerberos_create_pac(TALLOC_CTX *mem_ctx,
+                                     struct smb_iconv_convenience *iconv_convenience,
+                                     struct auth_serversupplied_info *server_info,
+                                     struct auth_user_info_dc *user_info_dc,
                                      krb5_context context,
                                      const krb5_keyblock *krbtgt_keyblock,
 …
                                      DATA_BLOB *pac);
 struct loadparm_context;
+struct ldb_message;
+struct ldb_context;
+uint32_t kerberos_enctype_to_bitmap(krb5_enctype enc_type_enum);
+/* Translate between the Microsoft msDS-SupportedEncryptionTypes values and the IETF encryption type values */
+krb5_enctype kerberos_enctype_bitmap_to_enctype(uint32_t enctype_bitmap);
+krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
+                                       struct smb_krb5_context *smb_krb5_context,
+                                       struct ldb_context *ldb,
+                                       struct ldb_message *msg,
+                                       bool delete_all_kvno,
+                                       const char **error_string);
 #include "auth/kerberos/proto.h"

vendor/current/source4/auth/kerberos/kerberos_pac.c

-              r414
+              r740
 /*
+/*
    Unix SMB/CIFS implementation.
    Create and parse the krb5 PAC
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005,2008
    Copyright (C) Andrew Tridgell 2001
 …
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
 …
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 …
 #include "auth/kerberos/kerberos.h"
 #include "librpc/gen_ndr/ndr_krb5pac.h"
 #include "lib/ldb/include/ldb.h"
+#include <ldb.h>
 #include "auth/auth_sam_reply.h"
 krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
+krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
                                    DATA_BLOB pac_data,
                                    struct PAC_SIGNATURE_DATA *sig,
 …
                                &crypto);
         if (ret) {
                 DEBUG(0,("krb5_crypto_init() failed: %s\n",
+                DEBUG(0,("krb5_crypto_init() failed: %s\n",
                           smb_get_krb5_error_message(context, ret, mem_ctx)));
                 return ret;
 …
  NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
-                              struct smb_iconv_convenience *iconv_convenience,
                               struct PAC_DATA **pac_data_out,
                               DATA_BLOB blob,
 …
         NTTIME tgs_authtime_nttime;
         krb5_principal client_principal_pac;
         int i;
+        uint32_t i;
         krb5_clear_error_message(context);
 …
+        }
+        ndr_err = ndr_pull_struct_blob(&blob, pac_data,
+                        iconv_convenience, pac_data,
+                       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
+        ndr_err = ndr_pull_struct_blob(&blob, pac_data,
+                        pac_data, (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 status = ndr_map_error2ntstatus(ndr_err);
 …
+        }
         ndr_err = ndr_pull_struct_blob(&blob, pac_data_raw,
                                        iconv_convenience, pac_data_raw,
+        ndr_err = ndr_pull_struct_blob(&blob, pac_data_raw,
+                                       pac_data_raw,
                                        (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA_RAW);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 …
         /* We find the data blobs above, now we parse them to get at the exact portion we should zero */
         ndr_err = ndr_pull_struct_blob(kdc_sig_blob, kdc_sig_wipe,
                                        iconv_convenience, kdc_sig_wipe,
+        ndr_err = ndr_pull_struct_blob(kdc_sig_blob, kdc_sig_wipe,
+                                       kdc_sig_wipe,
                                        (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 …
                 return status;
+        }
         ndr_err = ndr_pull_struct_blob(srv_sig_blob, srv_sig_wipe,
                                        iconv_convenience, srv_sig_wipe,
+        ndr_err = ndr_pull_struct_blob(srv_sig_blob, srv_sig_wipe,
+                                       srv_sig_wipe,
                                        (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 …
         memset(kdc_sig_wipe->signature.data, '\0', kdc_sig_wipe->signature.length);
         memset(srv_sig_wipe->signature.data, '\0', srv_sig_wipe->signature.length);
         /* and reencode, back into the same place it came from */
+        ndr_err = ndr_push_struct_blob(kdc_sig_blob, pac_data_raw,
+                                       iconv_convenience,
+        ndr_err = ndr_push_struct_blob(kdc_sig_blob, pac_data_raw,
                                        kdc_sig_wipe,
                                        (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
 …
                 return status;
+        }
+        ndr_err = ndr_push_struct_blob(srv_sig_blob, pac_data_raw,
+                                       iconv_convenience,
+        ndr_err = ndr_push_struct_blob(srv_sig_blob, pac_data_raw,
                                        srv_sig_wipe,
                                        (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
 …
         /* push out the whole structure, but now with zero'ed signatures */
+        ndr_err = ndr_push_struct_blob(&modified_pac_blob, pac_data_raw,
+                                       iconv_convenience,
+        ndr_err = ndr_push_struct_blob(&modified_pac_blob, pac_data_raw,
                                        pac_data_raw,
                                        (ndr_push_flags_fn_t)ndr_push_PAC_DATA_RAW);
 …
         /* verify by service_key */
         ret = check_pac_checksum(mem_ctx,
                                  modified_pac_blob, srv_sig_ptr,
                                  context,
+        ret = check_pac_checksum(mem_ctx,
+                                 modified_pac_blob, srv_sig_ptr,
+                                 context,
                                  service_keyblock);
         if (ret) {
 …
         if (krbtgt_keyblock) {
                 ret = check_pac_checksum(mem_ctx,
                                             srv_sig_ptr->signature, kdc_sig_ptr,
+                ret = check_pac_checksum(mem_ctx,
+                                            srv_sig_ptr->signature, kdc_sig_ptr,
                                             context, krbtgt_keyblock);
                 if (ret) {
 …
+        }
         ret = krb5_parse_name_flags(context, logon_name->account_name, KRB5_PRINCIPAL_PARSE_NO_REALM,
+        ret = krb5_parse_name_flags(context, logon_name->account_name, KRB5_PRINCIPAL_PARSE_NO_REALM,
                                     &client_principal_pac);
         if (ret) {
                 DEBUG(2, ("Could not parse name from incoming PAC: [%s]: %s\n",
                           logon_name->account_name,
+                DEBUG(2, ("Could not parse name from incoming PAC: [%s]: %s\n",
+                          logon_name->account_name,
                           smb_get_krb5_error_message(context, ret, mem_ctx)));
                 if (k5ret) {
 …
         if (!krb5_principal_compare_any_realm(context, client_principal, client_principal_pac)) {
                 DEBUG(2, ("Name in PAC [%s] does not match principal name in ticket\n",
+                DEBUG(2, ("Name in PAC [%s] does not match principal name in ticket\n",
                           logon_name->account_name));
+                krb5_free_principal(context, client_principal_pac);
                 return NT_STATUS_ACCESS_DENIED;
+        }
+        krb5_free_principal(context, client_principal_pac);
 #if 0
         if (strcasecmp(logon_info->info3.base.account_name.string,
+        if (strcasecmp(logon_info->info3.base.account_name.string,
                        "Administrator")== 0) {
                 file_save("tmp_pac_data-admin.dat",blob.data,blob.length);
 …
         DEBUG(3,("Found account name from PAC: %s [%s]\n",
                  logon_info->info3.base.account_name.string,
+                 logon_info->info3.base.account_name.string,
                  logon_info->info3.base.full_name.string));
         *pac_data_out = pac_data;
 …
 _PUBLIC_  NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
-                                  struct smb_iconv_convenience *iconv_convenience,
                                   struct PAC_LOGON_INFO **logon_info,
                                   DATA_BLOB blob,
 …
                                   const krb5_keyblock *service_keyblock,
                                   krb5_const_principal client_principal,
                                   time_t tgs_authtime,
+                                  time_t tgs_authtime,
                                   krb5_error_code *k5ret)
+{
 …
         struct PAC_DATA *pac_data;
         int i;
+        nt_status = kerberos_decode_pac(mem_ctx,
+                                        iconv_convenience,
+        nt_status = kerberos_decode_pac(mem_ctx,
                                         &pac_data,
                                         blob,
 …
                                         krbtgt_keyblock,
                                         service_keyblock,
                                         client_principal,
+                                        client_principal,
                                         tgs_authtime,
                                         k5ret);
 …
                         continue;
+                }
                 *logon_info = pac_data->buffers[i].info->logon_info.info;
+                *logon_info = pac_data->buffers[i].info->logon_info.info;
+        }
         if (!*logon_info) {
 …
+}
 static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
+static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
                                          DATA_BLOB *pac_data,
                                          struct PAC_SIGNATURE_DATA *sig,
 …
                                    &cksum);
         if (ret) {
                 DEBUG(2, ("PAC Verification failed: %s\n",
+                DEBUG(2, ("PAC Verification failed: %s\n",
                           smb_get_krb5_error_message(context, ret, mem_ctx)));
+        }
 …
  krb5_error_code kerberos_encode_pac(TALLOC_CTX *mem_ctx,
-                                     struct smb_iconv_convenience *iconv_convenience,
                                     struct PAC_DATA *pac_data,
                                     krb5_context context,
                                     const krb5_keyblock *krbtgt_keyblock,
                                     const krb5_keyblock *service_keyblock,
                                     DATA_BLOB *pac)
+                                    DATA_BLOB *pac)
+{
         NTSTATUS nt_status;
 …
                         continue;
+                }
                 kdc_checksum = &pac_data->buffers[i].info->kdc_cksum,
+                kdc_checksum = &pac_data->buffers[i].info->kdc_cksum,
                 ret = make_pac_checksum(mem_ctx, &zero_blob,
                                         kdc_checksum,
+                                        kdc_checksum,
                                         context, krbtgt_keyblock);
                 if (ret) {
                         DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
+                        DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
                                   smb_get_krb5_error_message(context, ret, mem_ctx)));
                         talloc_free(pac_data);
 …
+                }
+        }
         for (i=0; i < pac_data->num_buffers; i++) {
                 if (pac_data->buffers[i].type != PAC_TYPE_SRV_CHECKSUM) {
                         continue;
+                }
                 srv_checksum = &pac_data->buffers[i].info->srv_cksum;
                 ret = make_pac_checksum(mem_ctx, &zero_blob,
                                         srv_checksum,
+                srv_checksum = &pac_data->buffers[i].info->srv_cksum;
+                ret = make_pac_checksum(mem_ctx, &zero_blob,
+                                        srv_checksum,
                                         context, service_keyblock);
                 if (ret) {
                         DEBUG(2, ("making service PAC checksum failed: %s\n",
+                        DEBUG(2, ("making service PAC checksum failed: %s\n",
                                   smb_get_krb5_error_message(context, ret, mem_ctx)));
                         talloc_free(pac_data);
 …
         memset(srv_checksum->signature.data, '\0', srv_checksum->signature.length);
+        ndr_err = ndr_push_struct_blob(&tmp_blob, mem_ctx,
+                                       iconv_convenience,
+        ndr_err = ndr_push_struct_blob(&tmp_blob, mem_ctx,
                                        pac_data,
                                        (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
 …
         ret = make_pac_checksum(mem_ctx, &srv_checksum->signature, kdc_checksum, context, krbtgt_keyblock);
         if (ret) {
                 DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
+                DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
                           smb_get_krb5_error_message(context, ret, mem_ctx)));
                 talloc_free(pac_data);
 …
         /* And push it out again, this time to the world.  This relies on determanistic pointer values */
+        ndr_err = ndr_push_struct_blob(&tmp_blob, mem_ctx,
+                                       iconv_convenience,
+        ndr_err = ndr_push_struct_blob(&tmp_blob, mem_ctx,
                                        pac_data,
                                        (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
 …
  krb5_error_code kerberos_create_pac(TALLOC_CTX *mem_ctx,
+                                     struct smb_iconv_convenience *iconv_convenience,
+                                     struct auth_serversupplied_info *server_info,
+                                     struct auth_user_info_dc *user_info_dc,
                                      krb5_context context,
                                      const krb5_keyblock *krbtgt_keyblock,
 …
         char *name;
         enum {
                 PAC_BUF_LOGON_INFO = 0,
 …
         pac_data->version = 0;
         pac_data->buffers = talloc_array(pac_data,
+        pac_data->buffers = talloc_array(pac_data,
                                          struct PAC_BUFFER,
                                          pac_data->num_buffers);
 …
                 return ENOMEM;
+        }
         nt_status = auth_convert_server_info_saminfo3(LOGON_INFO, server_info, &sam3);
+        nt_status = auth_convert_user_info_dc_saminfo3(LOGON_INFO, user_info_dc, &sam3);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 DEBUG(1, ("Getting Samba info failed: %s\n", nt_errstr(nt_status)));
 …
         LOGON_INFO->info3 = *sam3;
         ret = krb5_unparse_name_flags(context, client_principal,
+        ret = krb5_unparse_name_flags(context, client_principal,
                                       KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
         if (ret) {
 …
         unix_to_nt_time(&LOGON_NAME->logon_time, tgs_authtime);
+        ret = kerberos_encode_pac(mem_ctx,
+                                  iconv_convenience,
+                                  pac_data,
+        ret = kerberos_encode_pac(mem_ctx,
+                                  pac_data,
                                   context,
                                   krbtgt_keyblock,
 …
+}
+krb5_error_code kerberos_pac_to_server_info(TALLOC_CTX *mem_ctx,
+                                                struct smb_iconv_convenience *iconv_convenience,
+                                                krb5_pac pac,
+                                                krb5_context context,
+                                                struct auth_serversupplied_info **server_info)
+krb5_error_code kerberos_pac_to_user_info_dc(TALLOC_CTX *mem_ctx,
+                                             krb5_pac pac,
+                                             krb5_context context,
+                                             struct auth_user_info_dc **user_info_dc,
+                                             struct PAC_SIGNATURE_DATA *pac_srv_sig,
+                                             struct PAC_SIGNATURE_DATA *pac_kdc_sig)
+{
         NTSTATUS nt_status;
 …
         union PAC_INFO info;
+        union netr_Validation validation;
+        struct auth_serversupplied_info *server_info_out;
+        struct auth_user_info_dc *user_info_dc_out;
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 …
         pac_logon_info_in = data_blob_const(k5pac_logon_info_in.data, k5pac_logon_info_in.length);
         ndr_err = ndr_pull_union_blob(&pac_logon_info_in, tmp_ctx, iconv_convenience, &info,
+        ndr_err = ndr_pull_union_blob(&pac_logon_info_in, tmp_ctx, &info,
                                       PAC_TYPE_LOGON_INFO,
                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
 …
         /* Pull this right into the normal auth sysstem structures */
+        validation.sam3 = &info.logon_info.info->info3;
+        nt_status = make_server_info_netlogon_validation(mem_ctx,
+                                                         "",
+, &validation,
+                                                         &server_info_out);
+        nt_status = make_user_info_dc_pac(mem_ctx,
+                                         info.logon_info.info,
+                                         &user_info_dc_out);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
                 return EINVAL;
+        }
+        ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_SRV_CHECKSUM, &k5pac_srv_checksum_in);
+        if (ret != 0) {
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        pac_srv_checksum_in = data_blob_const(k5pac_srv_checksum_in.data, k5pac_srv_checksum_in.length);
+        ndr_err = ndr_pull_struct_blob(&pac_srv_checksum_in, server_info_out,
+                                       iconv_convenience, &server_info_out->pac_srv_sig,
+                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
+        krb5_data_free(&k5pac_srv_checksum_in);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                nt_status = ndr_map_error2ntstatus(ndr_err);
+                DEBUG(0,("can't parse the KDC signature: %s\n",
+                        nt_errstr(nt_status)));
+                return EINVAL;
+        }
+        ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_KDC_CHECKSUM, &k5pac_kdc_checksum_in);
+        if (ret != 0) {
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        pac_kdc_checksum_in = data_blob_const(k5pac_kdc_checksum_in.data, k5pac_kdc_checksum_in.length);
+        ndr_err = ndr_pull_struct_blob(&pac_kdc_checksum_in, server_info_out,
+                                       iconv_convenience, &server_info_out->pac_kdc_sig,
+                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
+        krb5_data_free(&k5pac_kdc_checksum_in);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                nt_status = ndr_map_error2ntstatus(ndr_err);
+                DEBUG(0,("can't parse the KDC signature: %s\n",
+                        nt_errstr(nt_status)));
+                return EINVAL;
+        }
+        *server_info = server_info_out;
+        if (pac_srv_sig) {
+                ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_SRV_CHECKSUM, &k5pac_srv_checksum_in);
+                if (ret != 0) {
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
+                pac_srv_checksum_in = data_blob_const(k5pac_srv_checksum_in.data, k5pac_srv_checksum_in.length);
+                ndr_err = ndr_pull_struct_blob(&pac_srv_checksum_in, pac_srv_sig,
+                                               pac_srv_sig,
+                                               (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
+                krb5_data_free(&k5pac_srv_checksum_in);
+                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                        nt_status = ndr_map_error2ntstatus(ndr_err);
+                        DEBUG(0,("can't parse the KDC signature: %s\n",
+                                 nt_errstr(nt_status)));
+                        return EINVAL;
+                }
+        }
+        if (pac_kdc_sig) {
+                ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_KDC_CHECKSUM, &k5pac_kdc_checksum_in);
+                if (ret != 0) {
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
+                pac_kdc_checksum_in = data_blob_const(k5pac_kdc_checksum_in.data, k5pac_kdc_checksum_in.length);
+                ndr_err = ndr_pull_struct_blob(&pac_kdc_checksum_in, pac_kdc_sig,
+                                               pac_kdc_sig,
+                                               (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
+                krb5_data_free(&k5pac_kdc_checksum_in);
+                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                        nt_status = ndr_map_error2ntstatus(ndr_err);
+                        DEBUG(0,("can't parse the KDC signature: %s\n",
+                                 nt_errstr(nt_status)));
+                        return EINVAL;
+                }
+        }
+        *user_info_dc = user_info_dc_out;
         return 0;
+}
+NTSTATUS kerberos_pac_blob_to_server_info(TALLOC_CTX *mem_ctx,
+                                                     struct smb_iconv_convenience *iconv_convenience,
+                                                     DATA_BLOB pac_blob,
+                                                     krb5_context context,
+                                                     struct auth_serversupplied_info **server_info)
+NTSTATUS kerberos_pac_blob_to_user_info_dc(TALLOC_CTX *mem_ctx,
+                                           DATA_BLOB pac_blob,
+                                           krb5_context context,
+                                           struct auth_user_info_dc **user_info_dc,
+                                           struct PAC_SIGNATURE_DATA *pac_srv_sig,
+                                           struct PAC_SIGNATURE_DATA *pac_kdc_sig)
+{
         krb5_error_code ret;
         krb5_pac pac;
         ret = krb5_pac_parse(context,
                              pac_blob.data, pac_blob.length,
+        ret = krb5_pac_parse(context,
+                             pac_blob.data, pac_blob.length,
                              &pac);
         if (ret) {
 …
         ret = kerberos_pac_to_server_info(mem_ctx, iconv_convenience, pac, context, server_info);
+        ret = kerberos_pac_to_user_info_dc(mem_ctx, pac, context, user_info_dc, pac_srv_sig, pac_kdc_sig);
         krb5_pac_free(context, pac);
         if (ret) {

vendor/current/source4/auth/kerberos/kerberos_util.c

-              r414
+              r740
 #include "auth/credentials/credentials_proto.h"
 #include "auth/credentials/credentials_krb5.h"
+#include "auth/kerberos/kerberos_credentials.h"
+#include "auth/kerberos/kerberos_util.h"
+#include <ldb.h>
+#include "param/secrets.h"
 struct principal_container {
         struct smb_krb5_context *smb_krb5_context;
         krb5_principal principal;
+        const char *string_form; /* Optional */
 };
 …
+}
+static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
+                                                       struct cli_credentials *machine_account,
+                                                       struct smb_krb5_context *smb_krb5_context,
+                                                       krb5_principal *salt_princ)
+{
+static krb5_error_code parse_principal(TALLOC_CTX *parent_ctx,
+                                       const char *princ_string,
+                                       struct smb_krb5_context *smb_krb5_context,
+                                       krb5_principal *princ,
+                                       const char **error_string)
+{
+        int ret;
+        struct principal_container *mem_ctx;
+        if (princ_string == NULL) {
+                 *princ = NULL;
+                 return 0;
+        }
+        ret = krb5_parse_name(smb_krb5_context->krb5_context,
+                              princ_string, princ);
+        if (ret) {
+                (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
+                return ret;
+        }
+        mem_ctx = talloc(parent_ctx, struct principal_container);
+        if (!mem_ctx) {
+                (*error_string) = error_message(ENOMEM);
+                return ENOMEM;
+        }
+        /* This song-and-dance effectivly puts the principal
+         * into talloc, so we can't loose it. */
+        mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+        mem_ctx->principal = *princ;
+        talloc_set_destructor(mem_ctx, free_principal);
+        return 0;
+}
+static krb5_error_code principals_from_msg(TALLOC_CTX *parent_ctx,
+                                           struct ldb_message *msg,
+                                           struct smb_krb5_context *smb_krb5_context,
+                                           struct principal_container ***principals_out,
+                                           const char **error_string)
+{
+        unsigned int i;
         krb5_error_code ret;
+        char *machine_username;
+        char *salt_body;
+        char *lower_realm;
+        const char *salt_principal;
+        struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
+        if (!mem_ctx) {
+                return ENOMEM;
+        }
+        salt_principal = cli_credentials_get_salt_principal(machine_account);
+        char *upper_realm;
+        const char *realm = ldb_msg_find_attr_as_string(msg, "realm", NULL);
+        const char *samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
+        struct ldb_message_element *spn_el = ldb_msg_find_element(msg, "servicePrincipalName");
+        TALLOC_CTX *tmp_ctx;
+        struct principal_container **principals;
+        tmp_ctx = talloc_new(parent_ctx);
+        if (!tmp_ctx) {
+                *error_string = "Cannot allocate tmp_ctx";
+                return ENOMEM;
+        }
+        if (!realm) {
+                *error_string = "Cannot have a kerberos secret in secrets.ldb without a realm";
+                return EINVAL;
+        }
+        upper_realm = strupper_talloc(tmp_ctx, realm);
+        if (!upper_realm) {
+                talloc_free(tmp_ctx);
+                *error_string = "Cannot allocate full upper case realm";
+                return ENOMEM;
+        }
+        principals = talloc_array(tmp_ctx, struct principal_container *, spn_el ? (spn_el->num_values + 2) : 2);
+        spn_el = ldb_msg_find_element(msg, "servicePrincipalName");
+        for (i=0; spn_el && i < spn_el->num_values; i++) {
+                principals[i] = talloc(principals, struct principal_container);
+                if (!principals[i]) {
+                        talloc_free(tmp_ctx);
+                        *error_string = "Cannot allocate mem_ctx";
+                        return ENOMEM;
+                }
+                principals[i]->smb_krb5_context = talloc_reference(principals[i], smb_krb5_context);
+                principals[i]->string_form = talloc_asprintf(principals[i], "%*.*s@%s",
+                                                             (int)spn_el->values[i].length,
+                                                             (int)spn_el->values[i].length,
+                                                             (const char *)spn_el->values[i].data, upper_realm);
+                if (!principals[i]->string_form) {
+                        talloc_free(tmp_ctx);
+                        *error_string = "Cannot allocate full samAccountName";
+                        return ENOMEM;
+                }
+                ret = krb5_parse_name(smb_krb5_context->krb5_context,
+                                      principals[i]->string_form, &principals[i]->principal);
+                if (ret) {
+                        talloc_free(tmp_ctx);
+                        (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
+                        return ret;
+                }
+                /* This song-and-dance effectivly puts the principal
+                 * into talloc, so we can't loose it. */
+                talloc_set_destructor(principals[i], free_principal);
+        }
+        if (samAccountName) {
+                principals[i] = talloc(principals, struct principal_container);
+                if (!principals[i]) {
+                        talloc_free(tmp_ctx);
+                        *error_string = "Cannot allocate mem_ctx";
+                        return ENOMEM;
+                }
+                principals[i]->smb_krb5_context = talloc_reference(principals[i], smb_krb5_context);
+                principals[i]->string_form = talloc_asprintf(parent_ctx, "%s@%s", samAccountName, upper_realm);
+                if (!principals[i]->string_form) {
+                        talloc_free(tmp_ctx);
+                        *error_string = "Cannot allocate full samAccountName";
+                        return ENOMEM;
+                }
+                ret = krb5_make_principal(smb_krb5_context->krb5_context, &principals[i]->principal, upper_realm, samAccountName,
+                                          NULL);
+                if (ret) {
+                        talloc_free(tmp_ctx);
+                        (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
+                        return ret;
+                }
+                /* This song-and-dance effectivly puts the principal
+                 * into talloc, so we can't loose it. */
+                talloc_set_destructor(principals[i], free_principal);
+                i++;
+        }
+        principals[i] = NULL;
+        *principals_out = talloc_steal(parent_ctx, principals);
+        talloc_free(tmp_ctx);
+        return ret;
+}
+static krb5_error_code salt_principal_from_msg(TALLOC_CTX *parent_ctx,
+                                               struct ldb_message *msg,
+                                               struct smb_krb5_context *smb_krb5_context,
+                                               krb5_principal *salt_princ,
+                                               const char **error_string)
+{
+        const char *salt_principal = ldb_msg_find_attr_as_string(msg, "saltPrincipal", NULL);
+        const char *samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
+        const char *realm = ldb_msg_find_attr_as_string(msg, "realm", NULL);
         if (salt_principal) {
+                ret = krb5_parse_name(smb_krb5_context->krb5_context, salt_principal, salt_princ);
+        } else {
+                machine_username = talloc_strdup(mem_ctx, cli_credentials_get_username(machine_account));
+                return parse_principal(parent_ctx, salt_principal, smb_krb5_context, salt_princ, error_string);
+        } else if (samAccountName) {
+                krb5_error_code ret;
+                char *machine_username;
+                char *salt_body;
+                char *lower_realm;
+                char *upper_realm;
+                TALLOC_CTX *tmp_ctx;
+                struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
+                if (!mem_ctx) {
+                        *error_string = "Cannot allocate mem_ctx";
+                        return ENOMEM;
+                }
+                tmp_ctx = talloc_new(mem_ctx);
+                if (!tmp_ctx) {
+                        talloc_free(mem_ctx);
+                        *error_string = "Cannot allocate tmp_ctx";
+                        return ENOMEM;
+                }
+                if (!realm) {
+                        *error_string = "Cannot have a kerberos secret in secrets.ldb without a realm";
+                        return EINVAL;
+                }
+                machine_username = talloc_strdup(tmp_ctx, samAccountName);
                 if (!machine_username) {
                         talloc_free(mem_ctx);
+                        *error_string = "Cannot duplicate samAccountName";
                         return ENOMEM;
+                }
 …
                         machine_username[strlen(machine_username)-1] = '\0';
+                }
+                lower_realm = strlower_talloc(mem_ctx, cli_credentials_get_realm(machine_account));
+                lower_realm = strlower_talloc(tmp_ctx, realm);
                 if (!lower_realm) {
                         talloc_free(mem_ctx);
+                        *error_string = "Cannot allocate to lower case realm";
                         return ENOMEM;
+                }
+                salt_body = talloc_asprintf(mem_ctx, "%s.%s", machine_username,
+                upper_realm = strupper_talloc(tmp_ctx, realm);
+                if (!upper_realm) {
+                        talloc_free(mem_ctx);
+                        *error_string = "Cannot allocate to upper case realm";
+                        return ENOMEM;
+                }
+                salt_body = talloc_asprintf(tmp_ctx, "%s.%s", machine_username,
                                             lower_realm);
+                talloc_free(lower_realm);
+                talloc_free(machine_username);
                 if (!salt_body) {
                         talloc_free(mem_ctx);
+                return ENOMEM;
+                        *error_string = "Cannot form salt principal body";
+                        return ENOMEM;
+                }
                 ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ,
                                           cli_credentials_get_realm(machine_account),
+                                          upper_realm,
                                           "host", salt_body, NULL);
+        }
+        if (ret == 0) {
+                /* This song-and-dance effectivly puts the principal
+                 * into talloc, so we can't loose it. */
+                mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+                mem_ctx->principal = *salt_princ;
+                talloc_set_destructor(mem_ctx, free_principal);
+        }
+        return ret;
+                if (ret == 0) {
+                        /* This song-and-dance effectivly puts the principal
+                         * into talloc, so we can't loose it. */
+                        mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+                        mem_ctx->principal = *salt_princ;
+                        talloc_set_destructor(mem_ctx, free_principal);
+                } else {
+                        (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
+                }
+                talloc_free(tmp_ctx);
+                return ret;
+        } else {
+                (*error_string) = "Cannot determine salt principal, no saltPrincipal or samAccountName specified";
+                return EINVAL;
+        }
+}
 …
  * system by means of a destructor (do *not* free). */
  krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
+krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
                                             struct cli_credentials *credentials,
                                             struct smb_krb5_context *smb_krb5_context,
+                                            krb5_principal *princ)
+                                            krb5_principal *princ,
+                                            enum credentials_obtained *obtained,
+                                            const char **error_string)
+{
         krb5_error_code ret;
         const char *princ_string;
         struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
+        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
         if (!mem_ctx) {
+                return ENOMEM;
+        }
+        princ_string = cli_credentials_get_principal(credentials, mem_ctx);
+        /* A NULL here has meaning, as the gssapi server case will
+         * then use the principal from the client */
+                (*error_string) = error_message(ENOMEM);
+                return ENOMEM;
+        }
+        princ_string = cli_credentials_get_principal_and_obtained(credentials, mem_ctx, obtained);
         if (!princ_string) {
+                talloc_free(mem_ctx);
+                princ = NULL;
+                return 0;
+        }
+        ret = krb5_parse_name(smb_krb5_context->krb5_context,
+                              princ_string, princ);
+        if (ret == 0) {
+                /* This song-and-dance effectivly puts the principal
+                 * into talloc, so we can't loose it. */
+                mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+                mem_ctx->principal = *princ;
+                talloc_set_destructor(mem_ctx, free_principal);
+        }
+                (*error_string) = error_message(ENOMEM);
+                return ENOMEM;
+        }
+        ret = parse_principal(parent_ctx, princ_string,
+                              smb_krb5_context, princ, error_string);
+        talloc_free(mem_ctx);
         return ret;
+}
+/* Obtain the principal set on this context.  Requires a
+ * smb_krb5_context because we are doing krb5 principal parsing with
+ * the library routines.  The returned princ is placed in the talloc
+ * system by means of a destructor (do *not* free). */
+ krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
+                                                        struct cli_credentials *credentials,
+                                                        struct smb_krb5_context *smb_krb5_context,
+                                                        krb5_principal *princ,
+                                                        const char **error_string)
+{
+        return parse_principal(parent_ctx, cli_credentials_get_impersonate_principal(credentials),
+                               smb_krb5_context, princ, error_string);
+}
 …
                                  struct cli_credentials *credentials,
                                  struct smb_krb5_context *smb_krb5_context,
+                                 krb5_ccache ccache)
+                                 struct tevent_context *event_ctx,
+                                 krb5_ccache ccache,
+                                 enum credentials_obtained *obtained,
+                                 const char **error_string)
+{
         krb5_error_code ret;
         const char *password;
+        const char *password, *target_service;
         time_t kdc_time = 0;
         krb5_principal princ;
+        krb5_principal impersonate_principal;
         int tries;
         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
+        krb5_get_init_creds_opt *krb_options;
         if (!mem_ctx) {
+                return ENOMEM;
+        }
+        ret = principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &princ);
+                (*error_string) = strerror(ENOMEM);
+                return ENOMEM;
+        }
+        ret = principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &princ, obtained, error_string);
         if (ret) {
                 talloc_free(mem_ctx);
 …
+        }
+        ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string);
+        if (ret) {
+                talloc_free(mem_ctx);
+                return ret;
+        }
+        target_service = cli_credentials_get_target_service(credentials);
         password = cli_credentials_get_password(credentials);
+        /* setup the krb5 options we want */
+        if ((ret = krb5_get_init_creds_opt_alloc(smb_krb5_context->krb5_context, &krb_options))) {
+                (*error_string) = talloc_asprintf(credentials, "krb5_get_init_creds_opt_alloc failed (%s)\n",
+                                                  smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                                             ret, mem_ctx));
+                talloc_free(mem_ctx);
+                return ret;
+        }
+        /* get the defaults */
+        krb5_get_init_creds_opt_set_default_flags(smb_krb5_context->krb5_context, NULL, NULL, krb_options);
+        /* set if we want a forwardable ticket */
+        switch (cli_credentials_get_krb_forwardable(credentials)) {
+        case CRED_AUTO_KRB_FORWARDABLE:
+                break;
+        case CRED_NO_KRB_FORWARDABLE:
+                krb5_get_init_creds_opt_set_forwardable(krb_options, FALSE);
+                break;
+        case CRED_FORCE_KRB_FORWARDABLE:
+                krb5_get_init_creds_opt_set_forwardable(krb_options, TRUE);
+                break;
+        }
         tries = 2;
         while (tries--) {
+                struct tevent_context *previous_ev;
+                /* Do this every time, in case we have weird recursive issues here */
+                ret = smb_krb5_context_set_event_ctx(smb_krb5_context, event_ctx, &previous_ev);
+                if (ret) {
+                        talloc_free(mem_ctx);
+                        return ret;
+                }
                 if (password) {
                         ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, ccache,
+                                                         princ,
+                                                         password, NULL, &kdc_time);
+                                                         princ, password,
+                                                         impersonate_principal, target_service,
+                                                         krb_options,
+                                                         NULL, &kdc_time);
+                } else if (impersonate_principal) {
+                        talloc_free(mem_ctx);
+                        (*error_string) = "INTERNAL error: Cannot impersonate principal with just a keyblock.  A password must be specified in the credentials";
+                        return EINVAL;
                 } else {
                         /* No password available, try to use a keyblock instead */
 …
                         if (!mach_pwd) {
                                 talloc_free(mem_ctx);
+                                DEBUG(1, ("kinit_to_ccache: No password available for kinit\n"));
+                                (*error_string) = "kinit_to_ccache: No password available for kinit\n";
+                                krb5_get_init_creds_opt_free(smb_krb5_context->krb5_context, krb_options);
+                                smb_krb5_context_remove_event_ctx(smb_krb5_context, previous_ev, event_ctx);
                                 return EINVAL;
+                        }
 …
                         if (ret == 0) {
                                 ret = kerberos_kinit_keyblock_cc(smb_krb5_context->krb5_context, ccache,
+                                                                 princ,
+                                                                 &keyblock, NULL, &kdc_time);
+                                                                 princ, &keyblock,
+                                                                 target_service, krb_options,
+                                                                 NULL, &kdc_time);
                                 krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &keyblock);
+                        }
+                }
+                smb_krb5_context_remove_event_ctx(smb_krb5_context, previous_ev, event_ctx);
                 if (ret == KRB5KRB_AP_ERR_SKEW || ret == KRB5_KDCREP_SKEW) {
 …
+        }
+        krb5_get_init_creds_opt_free(smb_krb5_context->krb5_context, krb_options);
         if (ret == KRB5KRB_AP_ERR_SKEW || ret == KRB5_KDCREP_SKEW) {
                 DEBUG(1,("kinit for %s failed (%s)\n",
                          cli_credentials_get_principal(credentials, mem_ctx),
                          smb_get_krb5_error_message(smb_krb5_context->krb5_context,
                                                     ret, mem_ctx)));
+                (*error_string) = talloc_asprintf(credentials, "kinit for %s failed (%s)\n",
+                                                  cli_credentials_get_principal(credentials, mem_ctx),
+                                                  smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                                             ret, mem_ctx));
                 talloc_free(mem_ctx);
                 return ret;
 …
                                       credentials,
                                       smb_krb5_context,
+                                      ccache);
+        }
+                                      event_ctx,
+                                      ccache, obtained,
+                                      error_string);
+        }
         if (ret) {
                 DEBUG(1,("kinit for %s failed (%s)\n",
                          cli_credentials_get_principal(credentials, mem_ctx),
                          smb_get_krb5_error_message(smb_krb5_context->krb5_context,
                                                     ret, mem_ctx)));
+                (*error_string) = talloc_asprintf(credentials, "kinit for %s failed (%s)\n",
+                                                  cli_credentials_get_principal(credentials, mem_ctx),
+                                                  smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                                             ret, mem_ctx));
                 talloc_free(mem_ctx);
                 return ret;
 …
 static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
+                                       const char *princ_string,
+                                       krb5_principal princ,
+                                       struct principal_container **principals,
                                        krb5_principal salt_princ,
                                        int kvno,
                                        const char *password_s,
                                        struct smb_krb5_context *smb_krb5_context,
+                                       const char **enctype_strings,
+                                       krb5_keytab keytab)
+{
+        int i;
+                                       krb5_enctype *enctypes,
+                                       krb5_keytab keytab,
+                                       const char **error_string)
+{
+        unsigned int i, p;
         krb5_error_code ret;
         krb5_data password;
-        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
-        if (!mem_ctx) {
-                return ENOMEM;
+        }
         password.data = discard_const_p(char *, password_s);
         password.length = strlen(password_s);
         for (i=0; enctype_strings[i]; i++) {
+        for (i=0; enctypes[i]; i++) {
                 krb5_keytab_entry entry;
+                krb5_enctype enctype;
+                ret = krb5_string_to_enctype(smb_krb5_context->krb5_context, enctype_strings[i], &enctype);
+                ZERO_STRUCT(entry);
+                ret = create_kerberos_key_from_string(smb_krb5_context->krb5_context,
+                                                      salt_princ, &password, &entry.keyblock, enctypes[i]);
                 if (ret != 0) {
-                        DEBUG(1, ("Failed to interpret %s as a krb5 encryption type: %s\n",
-                                  enctype_strings[i],
-                                  smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                             ret, mem_ctx)));
-                        talloc_free(mem_ctx);
                         return ret;
+                }
+                ret = create_kerberos_key_from_string(smb_krb5_context->krb5_context,
+                                                      salt_princ, &password, &entry.keyblock, enctype);
+                if (ret != 0) {
+                        talloc_free(mem_ctx);
+                        return ret;
+                }
+                entry.principal = princ;
+                entry.vno       = kvno;
+                ret = krb5_kt_add_entry(smb_krb5_context->krb5_context, keytab, &entry);
+                if (ret != 0) {
+                        DEBUG(1, ("Failed to add %s entry for %s(kvno %d) to keytab: %s\n",
+                                  enctype_strings[i],
+                                  princ_string,
+                                  kvno,
+                                  smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                             ret, mem_ctx)));
+                        talloc_free(mem_ctx);
+                        krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
+                        return ret;
+                }
+                DEBUG(5, ("Added %s(kvno %d) to keytab (%s)\n",
+                          princ_string, kvno,
+                          enctype_strings[i]));
+                entry.vno = kvno;
+                for (p=0; principals[p]; p++) {
+                        entry.principal = principals[p]->principal;
+                        ret = krb5_kt_add_entry(smb_krb5_context->krb5_context, keytab, &entry);
+                        if (ret != 0) {
+                                char *k5_error_string = smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                                                   ret, NULL);
+                                *error_string = talloc_asprintf(parent_ctx, "Failed to add enctype %d entry for %s(kvno %d) to keytab: %s\n",
+                                                                (int)enctypes[i],
+                                                                principals[p]->string_form,
+                                                                kvno,
+                                                                k5_error_string);
+                                talloc_free(k5_error_string);
+                                krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
+                                return ret;
+                        }
+                        DEBUG(5, ("Added %s(kvno %d) to keytab (enctype %d)\n",
+                                  principals[p]->string_form, kvno,
+                                  (int)enctypes[i]));
+                }
                 krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
+        }
-        talloc_free(mem_ctx);
         return 0;
+}
 static krb5_error_code create_keytab(TALLOC_CTX *parent_ctx,
+                         struct cli_credentials *machine_account,
+                         struct smb_krb5_context *smb_krb5_context,
+                         const char **enctype_strings,
+                         krb5_keytab keytab,
+                         bool add_old)
+                                     struct ldb_message *msg,
+                                     struct principal_container **principals,
+                                     struct smb_krb5_context *smb_krb5_context,
+                                     krb5_keytab keytab,
+                                     bool add_old,
+                                     const char **error_string)
+{
         krb5_error_code ret;
 …
         const char *old_secret;
         int kvno;
+        uint32_t enctype_bitmap;
         krb5_principal salt_princ;
+        krb5_principal princ;
+        const char *princ_string;
+        krb5_enctype *enctypes;
         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
         if (!mem_ctx) {
+                return ENOMEM;
+        }
+        princ_string = cli_credentials_get_principal(machine_account, mem_ctx);
+        /* Get the principal we will store the new keytab entries under */
+        ret = principal_from_credentials(mem_ctx, machine_account, smb_krb5_context, &princ);
+                *error_string = "unable to allocate tmp_ctx for create_keytab";
+                return ENOMEM;
+        }
+        /* The salt used to generate these entries may be different however, fetch that */
+        ret = salt_principal_from_msg(mem_ctx, msg,
+                                      smb_krb5_context,
+                                      &salt_princ, error_string);
         if (ret) {
+                DEBUG(1,("create_keytab: makeing krb5 principal failed (%s)\n",
+                         smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                    ret, mem_ctx)));
+                talloc_free(mem_ctx);
+                return ret;
+        }
+        /* The salt used to generate these entries may be different however, fetch that */
+        ret = salt_principal_from_credentials(mem_ctx, machine_account,
+                                              smb_krb5_context,
+                                              &salt_princ);
+                talloc_free(mem_ctx);
+                return ret;
+        }
+        kvno = ldb_msg_find_attr_as_int(msg, "msDS-KeyVersionNumber", 0);
+        /* Finally, do the dance to get the password to put in the entry */
+        password_s =  ldb_msg_find_attr_as_string(msg, "secret", NULL);
+        if (!password_s) {
+                /* There is no password here, so nothing to do */
+                talloc_free(mem_ctx);
+                return 0;
+        }
+        if (add_old && kvno != 0) {
+                old_secret = ldb_msg_find_attr_as_string(msg, "priorSecret", NULL);
+        } else {
+                old_secret = NULL;
+        }
+        enctype_bitmap = (uint32_t)ldb_msg_find_attr_as_int(msg, "msDS-SupportedEncryptionTypes", ENC_ALL_TYPES);
+        ret = kerberos_enctype_bitmap_to_enctypes(mem_ctx, enctype_bitmap, &enctypes);
         if (ret) {
+                DEBUG(1,("create_keytab: makeing salt principal failed (%s)\n",
+                         smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                    ret, mem_ctx)));
+                talloc_free(mem_ctx);
+                return ret;
+        }
+        /* Finally, do the dance to get the password to put in the entry */
+        password_s = cli_credentials_get_password(machine_account);
+        if (!password_s) {
+                krb5_keytab_entry entry;
+                const struct samr_Password *mach_pwd;
+                if (!str_list_check(enctype_strings, "arcfour-hmac-md5")) {
+                        DEBUG(1, ("Asked to create keytab, but with only an NT hash supplied, "
+                                  "but not listing arcfour-hmac-md5 as an enc type to include in the keytab!\n"));
+                        talloc_free(mem_ctx);
+                        return EINVAL;
+                }
+                /* If we don't have the plaintext password, try for
+                 * the MD4 password hash */
+                mach_pwd = cli_credentials_get_nt_hash(machine_account, mem_ctx);
+                if (!mach_pwd) {
+                        /* OK, nothing to do here */
+                        talloc_free(mem_ctx);
+                        return 0;
+                }
+                ret = krb5_keyblock_init(smb_krb5_context->krb5_context,
+                                         ETYPE_ARCFOUR_HMAC_MD5,
+                                         mach_pwd->hash, sizeof(mach_pwd->hash),
+                                         &entry.keyblock);
+                *error_string = talloc_asprintf(parent_ctx, "create_keytab: generating list of encryption types failed (%s)\n",
+                                                smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                                           ret, mem_ctx));
+                talloc_free(mem_ctx);
+                return ret;
+        }
+        ret = keytab_add_keys(mem_ctx, principals,
+                              salt_princ,
+                              kvno, password_s, smb_krb5_context,
+                              enctypes, keytab, error_string);
+        if (ret) {
+                talloc_free(mem_ctx);
+                return ret;
+        }
+        if (old_secret) {
+                ret = keytab_add_keys(mem_ctx, principals,
+                                      salt_princ,
+                                      kvno - 1, old_secret, smb_krb5_context,
+                                      enctypes, keytab, error_string);
                 if (ret) {
-                        DEBUG(1, ("create_keytab: krb5_keyblock_init failed: %s\n",
-                                  smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                             ret, mem_ctx)));
                         talloc_free(mem_ctx);
                         return ret;
+                }
-                entry.principal = princ;
-                entry.vno       = cli_credentials_get_kvno(machine_account);
-                ret = krb5_kt_add_entry(smb_krb5_context->krb5_context, keytab, &entry);
-                if (ret) {
-                        DEBUG(1, ("Failed to add ARCFOUR_HMAC (only) entry for %s to keytab: %s",
-                                  cli_credentials_get_principal(machine_account, mem_ctx),
-                                  smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                             ret, mem_ctx)));
-                        talloc_free(mem_ctx);
-                        krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
-                        return ret;
+                }
-                DEBUG(5, ("Added %s(kvno %d) to keytab (arcfour-hmac-md5)\n",
-                          cli_credentials_get_principal(machine_account, mem_ctx),
-                          cli_credentials_get_kvno(machine_account)));
-                krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
-                /* Can't go any further, we only have this one key */
-                talloc_free(mem_ctx);
-                return 0;
+        }
-        kvno = cli_credentials_get_kvno(machine_account);
-        /* good, we actually have the real plaintext */
-        ret = keytab_add_keys(mem_ctx, princ_string, princ, salt_princ,
-                              kvno, password_s, smb_krb5_context,
-                              enctype_strings, keytab);
-        if (!ret) {
-                talloc_free(mem_ctx);
-                return ret;
+        }
-        if (!add_old || kvno == 0) {
-                talloc_free(mem_ctx);
-                return 0;
+        }
-        old_secret = cli_credentials_get_old_password(machine_account);
-        if (!old_secret) {
-                talloc_free(mem_ctx);
-                return 0;
+        }
-        ret = keytab_add_keys(mem_ctx, princ_string, princ, salt_princ,
-                              kvno - 1, old_secret, smb_krb5_context,
-                              enctype_strings, keytab);
-        if (!ret) {
-                talloc_free(mem_ctx);
-                return ret;
+        }
         talloc_free(mem_ctx);
+        return 0;
+}
+        return ret;
+}
 /*
 …
 static krb5_error_code remove_old_entries(TALLOC_CTX *parent_ctx,
+                                          struct cli_credentials *machine_account,
+                                          struct ldb_message *msg,
+                                          struct principal_container **principals,
+                                          bool delete_all_kvno,
                                           struct smb_krb5_context *smb_krb5_context,
+                                          krb5_keytab keytab, bool *found_previous)
+                                          krb5_keytab keytab, bool *found_previous,
+                                          const char **error_string)
+{
         krb5_error_code ret, ret2;
         krb5_kt_cursor cursor;
-        krb5_principal princ;
         int kvno;
         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
+        const char *princ_string;
         if (!mem_ctx) {
                 return ENOMEM;
 …
         *found_previous = false;
+        princ_string = cli_credentials_get_principal(machine_account, mem_ctx);
+        /* Get the principal we will store the new keytab entries under */
+        ret = principal_from_credentials(mem_ctx, machine_account, smb_krb5_context, &princ);
+        if (ret) {
+                DEBUG(1,("update_keytab: makeing krb5 principal failed (%s)\n",
+                         smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                    ret, mem_ctx)));
+                talloc_free(mem_ctx);
+                return ret;
+        }
+        kvno = cli_credentials_get_kvno(machine_account);
+        kvno = ldb_msg_find_attr_as_int(msg, "msDS-KeyVersionNumber", 0);
         /* for each entry in the keytab */
 …
                 return 0;
         default:
                 DEBUG(1,("failed to open keytab for read of old entries: %s\n",
                          smb_get_krb5_error_message(smb_krb5_context->krb5_context,
                                                     ret, mem_ctx)));
+                *error_string = talloc_asprintf(parent_ctx, "failed to open keytab for read of old entries: %s\n",
+                                                smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                                           ret, mem_ctx));
                 talloc_free(mem_ctx);
                 return ret;
 …
         while (!ret) {
+                unsigned int i;
+                bool matched = false;
                 krb5_keytab_entry entry;
                 ret = krb5_kt_next_entry(smb_krb5_context->krb5_context, keytab, &entry, &cursor);
 …
                         break;
+                }
+                /* if it matches our principal */
+                if (!krb5_kt_compare(smb_krb5_context->krb5_context, &entry, princ, 0, 0)) {
+                for (i = 0; principals[i]; i++) {
+                        /* if it matches our principal */
+                        if (krb5_kt_compare(smb_krb5_context->krb5_context, &entry, principals[i]->principal, 0, 0)) {
+                                matched = true;
+                                break;
+                        }
+                }
+                if (!matched) {
                         /* Free the entry, it wasn't the one we were looking for anyway */
                         krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
 …
                 break;
         default:
+                DEBUG(1,("failed in deleting old entries for principal: %s: %s\n",
+                         princ_string,
+                         smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                    ret, mem_ctx)));
+                *error_string = talloc_asprintf(parent_ctx, "failed in deleting old entries for principal: %s\n",
+                                                smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+                                                                           ret, mem_ctx));
+        }
         talloc_free(mem_ctx);
 …
 krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
+                           struct cli_credentials *machine_account,
+                           struct smb_krb5_context *smb_krb5_context,
+                           const char **enctype_strings,
+                           struct keytab_container *keytab_container)
+                                       struct smb_krb5_context *smb_krb5_context,
+                                       struct ldb_context *ldb,
+                                       struct ldb_message *msg,
+                                       bool delete_all_kvno,
+                                       const char **error_string)
+{
         krb5_error_code ret;
         bool found_previous;
+        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
+        TALLOC_CTX *mem_ctx = talloc_new(NULL);
+        struct keytab_container *keytab_container;
+        struct principal_container **principals;
+        const char *keytab_name;
         if (!mem_ctx) {
                 return ENOMEM;
+        }
+        ret = remove_old_entries(mem_ctx, machine_account,
+                                 smb_krb5_context, keytab_container->keytab, &found_previous);
+        keytab_name = keytab_name_from_msg(mem_ctx, ldb, msg);
+        if (!keytab_name) {
+                return ENOENT;
+        }
+        ret = smb_krb5_open_keytab(mem_ctx, smb_krb5_context, keytab_name, &keytab_container);
         if (ret != 0) {
                 talloc_free(mem_ctx);
                 return ret;
+        }
+        DEBUG(5, ("Opened keytab %s\n", keytab_name));
+        /* Get the principal we will store the new keytab entries under */
+        ret = principals_from_msg(mem_ctx, msg, smb_krb5_context, &principals, error_string);
+        if (ret != 0) {
+                *error_string = talloc_asprintf(parent_ctx, "Failed to load principals from ldb message: %s\n", *error_string);
+                talloc_free(mem_ctx);
+                return ret;
+        }
+        ret = remove_old_entries(mem_ctx, msg, principals, delete_all_kvno,
+                                 smb_krb5_context, keytab_container->keytab, &found_previous, error_string);
+        if (ret != 0) {
+                *error_string = talloc_asprintf(parent_ctx, "Failed to remove old principals from keytab: %s\n", *error_string);
+                talloc_free(mem_ctx);
+                return ret;
+        }
+        /* Create a new keytab.  If during the cleanout we found
+         * entires for kvno -1, then don't try and duplicate them.
+         * Otherwise, add kvno, and kvno -1 */
+        ret = create_keytab(mem_ctx, machine_account, smb_krb5_context,
+                            enctype_strings,
+                            keytab_container->keytab,
+                            found_previous ? false : true);
+        if (!delete_all_kvno) {
+                /* Create a new keytab.  If during the cleanout we found
+                 * entires for kvno -1, then don't try and duplicate them.
+                 * Otherwise, add kvno, and kvno -1 */
+                ret = create_keytab(mem_ctx, msg, principals,
+                                    smb_krb5_context,
+                                    keytab_container->keytab,
+                                    found_previous ? false : true, error_string);
+        }
         talloc_free(mem_ctx);
         return ret;
 …
                                            struct cli_credentials *machine_account,
                                            struct smb_krb5_context *smb_krb5_context,
-                                           const char **enctype_strings,
                                            struct keytab_container **keytab_container)
+{
 …
         const char *rand_string;
         const char *keytab_name;
+        struct ldb_message *msg;
+        const char *error_string;
         if (!mem_ctx) {
                 return ENOMEM;
 …
+        }
+        ret = smb_krb5_update_keytab(mem_ctx, machine_account, smb_krb5_context, enctype_strings, *keytab_container);
+        msg = ldb_msg_new(mem_ctx);
+        if (!msg) {
+                talloc_free(mem_ctx);
+                return ENOMEM;
+        }
+        ldb_msg_add_string(msg, "krb5Keytab", keytab_name);
+        ldb_msg_add_string(msg, "secret", cli_credentials_get_password(machine_account));
+        ldb_msg_add_string(msg, "samAccountName", cli_credentials_get_username(machine_account));
+        ldb_msg_add_string(msg, "realm", cli_credentials_get_realm(machine_account));
+        ldb_msg_add_fmt(msg, "msDS-KeyVersionNumber", "%d", (int)cli_credentials_get_kvno(machine_account));
+        ret = smb_krb5_update_keytab(mem_ctx, smb_krb5_context, NULL, msg, false, &error_string);
         if (ret == 0) {
                 talloc_steal(parent_ctx, *keytab_container);
         } else {
+                DEBUG(0, ("Failed to create in-memory keytab: %s\n", error_string));
                 *keytab_container = NULL;
+        }
 …
         return ret;
+}
+/* Translate between the IETF encryption type values and the Microsoft msDS-SupportedEncryptionTypes values */
+uint32_t kerberos_enctype_to_bitmap(krb5_enctype enc_type_enum)
+{
+        switch (enc_type_enum) {
+        case ENCTYPE_DES_CBC_CRC:
+                return ENC_CRC32;
+        case ENCTYPE_DES_CBC_MD5:
+                return ENC_RSA_MD5;
+        case ENCTYPE_ARCFOUR_HMAC_MD5:
+                return ENC_RC4_HMAC_MD5;
+        case ENCTYPE_AES128_CTS_HMAC_SHA1_96:
+                return ENC_HMAC_SHA1_96_AES128;
+        case ENCTYPE_AES256_CTS_HMAC_SHA1_96:
+                return ENC_HMAC_SHA1_96_AES256;
+        default:
+                return 0;
+        }
+}
+/* Translate between the Microsoft msDS-SupportedEncryptionTypes values and the IETF encryption type values */
+krb5_enctype kerberos_enctype_bitmap_to_enctype(uint32_t enctype_bitmap)
+{
+        switch (enctype_bitmap) {
+        case ENC_CRC32:
+                return ENCTYPE_DES_CBC_CRC;
+        case ENC_RSA_MD5:
+                return ENCTYPE_DES_CBC_MD5;
+        case ENC_RC4_HMAC_MD5:
+                return ENCTYPE_ARCFOUR_HMAC_MD5;
+        case ENC_HMAC_SHA1_96_AES128:
+                return ENCTYPE_AES128_CTS_HMAC_SHA1_96;
+        case ENC_HMAC_SHA1_96_AES256:
+                return ENCTYPE_AES256_CTS_HMAC_SHA1_96;
+        default:
+                return 0;
+        }
+}
+/* Return an array of krb5_enctype values */
+krb5_error_code kerberos_enctype_bitmap_to_enctypes(TALLOC_CTX *mem_ctx, uint32_t enctype_bitmap, krb5_enctype **enctypes)
+{
+        unsigned int i, j = 0;
+        *enctypes = talloc_zero_array(mem_ctx, krb5_enctype, (8*sizeof(enctype_bitmap))+1);
+        if (!*enctypes) {
+                return ENOMEM;
+        }
+        for (i=0; i<(8*sizeof(enctype_bitmap)); i++) {
+                uint32_t bit_value = (1 << i) & enctype_bitmap;
+                if (bit_value & enctype_bitmap) {
+                        (*enctypes)[j] = kerberos_enctype_bitmap_to_enctype(bit_value);
+                        if (!(*enctypes)[j]) {
+                                continue;
+                        }
+                        j++;
+                }
+        }
+        (*enctypes)[j] = 0;
+        return 0;
+}

vendor/current/source4/auth/kerberos/krb5_init_context.c

-              r414
+              r740
 /*
+/*
    Unix SMB/CIFS implementation.
    Wrapper for krb5_init_context
 …
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 …
 #include "param/param.h"
 #include "libcli/resolve/resolve.h"
+#include "../lib/tsocket/tsocket.h"
 /*
 …
         NTSTATUS status;
         DATA_BLOB request, reply;
         struct packet_context *packet;
 …
 };
+static krb5_error_code smb_krb5_context_destroy_1(struct smb_krb5_context *ctx)
+{
+        krb5_free_context(ctx->krb5_context);
+        return 0;
+}
+static krb5_error_code smb_krb5_context_destroy_2(struct smb_krb5_context *ctx)
+static krb5_error_code smb_krb5_context_destroy(struct smb_krb5_context *ctx)
+{
         /* Otherwise krb5_free_context will try and close what we have already free()ed */
         krb5_set_warn_dest(ctx->krb5_context, NULL);
         krb5_closelog(ctx->krb5_context, ctx->logf);
         smb_krb5_context_destroy_1(ctx);
+        krb5_free_context(ctx->krb5_context);
         return 0;
+}
 …
 static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private_data)
+{
         DEBUG(2, ("Kerberos: %s\n", msg));
+        DEBUG(3, ("Kerberos: %s\n", msg));
+}
 …
                 return;
+        }
         blob = data_blob_talloc(tmp_ctx, NULL, dsize);
         if (blob.data == NULL && dsize != 0) {
 …
                 return;
+        }
         smb_krb5->status = socket_recv(smb_krb5->sock, blob.data, blob.length, &nread);
         if (!NT_STATUS_IS_OK(smb_krb5->status)) {
 …
+        }
         blob.length = nread;
         if (nread == 0) {
                 smb_krb5->status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 …
                 return;
+        }
         DEBUG(2,("Received smb_krb5 packet of length %d\n",
+        DEBUG(2,("Received smb_krb5 packet of length %d\n",
                  (int)blob.length));
         talloc_steal(smb_krb5, blob.data);
         smb_krb5->reply = blob;
 …
   handle request timeouts
 */
 static void smb_krb5_request_timeout(struct tevent_context *event_ctx,
+static void smb_krb5_request_timeout(struct tevent_context *event_ctx,
                                   struct tevent_timer *te, struct timeval t,
                                   void *private_data)
 …
         size_t len;
         len = smb_krb5->request.length;
         status = socket_send(smb_krb5->sock, &smb_krb5->request, &len);
         if (!NT_STATUS_IS_OK(status)) return;
         TEVENT_FD_READABLE(smb_krb5->fde);
 …
         krb5_error_code ret;
         NTSTATUS status;
-        struct socket_address *remote_addr;
         const char *name;
         struct addrinfo *ai, *a;
         struct smb_krb5_socket *smb_krb5;
+        struct tevent_context *ev = talloc_get_type(data, struct tevent_context);
+        DATA_BLOB send_blob = data_blob_const(send_buf->data, send_buf->length);
+        DATA_BLOB send_blob;
+        struct tevent_context *ev;
+        TALLOC_CTX *tmp_ctx = talloc_new(NULL);
+        if (!tmp_ctx) {
+                return ENOMEM;
+        }
+        if (!data) {
+                /* If no event context was available, then create one for this loop */
+                ev = tevent_context_init(tmp_ctx);
+                if (!ev) {
+                        talloc_free(tmp_ctx);
+                        return ENOMEM;
+                }
+        } else {
+                ev = talloc_get_type_abort(data, struct tevent_context);
+        }
+        send_blob = data_blob_const(send_buf->data, send_buf->length);
         ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
         if (ret) {
+                return ret;
+        }
+        for (a = ai; a; a = ai->ai_next) {
+                smb_krb5 = talloc(NULL, struct smb_krb5_socket);
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        for (a = ai; a; a = a->ai_next) {
+                struct socket_address *remote_addr;
+                smb_krb5 = talloc(tmp_ctx, struct smb_krb5_socket);
                 if (!smb_krb5) {
+                        talloc_free(tmp_ctx);
                         return ENOMEM;
+                }
                 smb_krb5->hi = hi;
                 switch (a->ai_family) {
                 case PF_INET:
 …
 #endif
                 default:
                         talloc_free(smb_krb5);
+                        talloc_free(tmp_ctx);
                         return EINVAL;
+                }
                 status = NT_STATUS_INVALID_PARAMETER;
                 switch (hi->proto) {
 …
                         break;
                 case KRB5_KRBHST_HTTP:
                         talloc_free(smb_krb5);
+                        talloc_free(tmp_ctx);
                         return EINVAL;
+                }
 …
                 talloc_steal(smb_krb5, smb_krb5->sock);
                 remote_addr = socket_address_from_sockaddr(smb_krb5, a->ai_addr, a->ai_addrlen);
+                remote_addr = socket_address_from_sockaddr(smb_krb5, a->ai_addr, a->ai_addrlen);
                 if (!remote_addr) {
                         talloc_free(smb_krb5);
 …
                         continue;
+                }
-                talloc_free(remote_addr);
                 /* Setup the FDE, start listening for read events
 …
                         break;
                 case KRB5_KRBHST_HTTP:
                         talloc_free(smb_krb5);
+                        talloc_free(tmp_ctx);
                         return EINVAL;
+                }
                 while ((NT_STATUS_IS_OK(smb_krb5->status)) && !smb_krb5->reply.length) {
                         if (tevent_loop_once(ev) != 0) {
                                 talloc_free(smb_krb5);
+                                talloc_free(tmp_ctx);
                                 return EINVAL;
+                        }
+                        /* After each and every event loop, reset the
+                         * send_to_kdc pointers to what they were when
+                         * we entered this loop.  That way, if a
+                         * nested event has invalidated them, we put
+                         * it back before we return to the heimdal
+                         * code */
+                        ret = krb5_set_send_to_kdc_func(context,
+                                                        smb_krb5_send_and_recv_func,
+                                                        data);
+                        if (ret != 0) {
+                                talloc_free(tmp_ctx);
+                                return ret;
+                        }
+                }
 …
                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
+                        DEBUG(2,("Error reading smb_krb5 reply packet: %s\n", nt_errstr(smb_krb5->status)));
+                        struct tsocket_address *addr = socket_address_to_tsocket_address(smb_krb5, remote_addr);
+                        const char *addr_string = NULL;
+                        if (addr) {
+                                addr_string = tsocket_address_inet_addr_string(addr, smb_krb5);
+                        } else {
+                                addr_string = NULL;
+                        }
+                        DEBUG(2,("Error reading smb_krb5 reply packet: %s from %s\n", nt_errstr(smb_krb5->status),
+                                 addr_string));
                         talloc_free(smb_krb5);
                         continue;
 …
                 ret = krb5_data_copy(recv_buf, smb_krb5->reply.data, smb_krb5->reply.length);
                 if (ret) {
                         talloc_free(smb_krb5);
+                        talloc_free(tmp_ctx);
                         return ret;
+                }
                 talloc_free(smb_krb5);
                 break;
+        }
+        talloc_free(tmp_ctx);
         if (a) {
                 return 0;
 …
+}
+krb5_error_code smb_krb5_init_context(void *parent_ctx,
+krb5_error_code
+smb_krb5_init_context_basic(TALLOC_CTX *tmp_ctx,
+                            struct loadparm_context *lp_ctx,
+                            krb5_context *_krb5_context)
+{
+        krb5_error_code ret;
+        char **config_files;
+        const char *config_file, *realm;
+        krb5_context krb5_ctx;
+        initialize_krb5_error_table();
+        ret = krb5_init_context(&krb5_ctx);
+        if (ret) {
+                DEBUG(1,("krb5_init_context failed (%s)\n",
+                         error_message(ret)));
+                return ret;
+        }
+        config_file = config_path(tmp_ctx, lp_ctx, "krb5.conf");
+        if (!config_file) {
+                krb5_free_context(krb5_ctx);
+                return ENOMEM;
+        }
+        /* Use our local krb5.conf file by default */
+        ret = krb5_prepend_config_files_default(config_file == NULL?"":config_file, &config_files);
+        if (ret) {
+                DEBUG(1,("krb5_prepend_config_files_default failed (%s)\n",
+                         smb_get_krb5_error_message(krb5_ctx, ret, tmp_ctx)));
+                krb5_free_context(krb5_ctx);
+                return ret;
+        }
+        ret = krb5_set_config_files(krb5_ctx, config_files);
+        krb5_free_config_files(config_files);
+        if (ret) {
+                DEBUG(1,("krb5_set_config_files failed (%s)\n",
+                         smb_get_krb5_error_message(krb5_ctx, ret, tmp_ctx)));
+                krb5_free_context(krb5_ctx);
+                return ret;
+        }
+        realm = lpcfg_realm(lp_ctx);
+        if (realm != NULL) {
+                ret = krb5_set_default_realm(krb5_ctx, realm);
+                if (ret) {
+                        DEBUG(1,("krb5_set_default_realm failed (%s)\n",
+                                 smb_get_krb5_error_message(krb5_ctx, ret, tmp_ctx)));
+                        krb5_free_context(krb5_ctx);
+                        return ret;
+                }
+        }
+        *_krb5_context = krb5_ctx;
+        return 0;
+}
+krb5_error_code smb_krb5_init_context(void *parent_ctx,
                                       struct tevent_context *ev,
                                       struct loadparm_context *lp_ctx,
                                        struct smb_krb5_context **smb_krb5_context)
+                                      struct smb_krb5_context **smb_krb5_context)
+{
         krb5_error_code ret;
         TALLOC_CTX *tmp_ctx;
+        char **config_files;
+        const char *config_file;
         initialize_krb5_error_table();
         tmp_ctx = talloc_new(parent_ctx);
         *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context);
+        *smb_krb5_context = talloc_zero(tmp_ctx, struct smb_krb5_context);
         if (!*smb_krb5_context || !tmp_ctx) {
 …
+        }
+        ret = krb5_init_context(&(*smb_krb5_context)->krb5_context);
+        if (ret) {
+                DEBUG(1,("krb5_init_context failed (%s)\n",
+        ret = smb_krb5_init_context_basic(tmp_ctx, lp_ctx,
+                                          &(*smb_krb5_context)->krb5_context);
+        if (ret) {
+                DEBUG(1,("smb_krb5_context_init_basic failed (%s)\n",
                          error_message(ret)));
                 talloc_free(tmp_ctx);
                 return ret;
+        }
-        talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_1);
-        config_file = config_path(tmp_ctx, lp_ctx, "krb5.conf");
-        if (!config_file) {
-                talloc_free(tmp_ctx);
-                return ENOMEM;
+        }
-        /* Use our local krb5.conf file by default */
-        ret = krb5_prepend_config_files_default(config_file == NULL?"":config_file, &config_files);
-        if (ret) {
-                DEBUG(1,("krb5_prepend_config_files_default failed (%s)\n",
-                         smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
-                talloc_free(tmp_ctx);
-                return ret;
+        }
-        ret = krb5_set_config_files((*smb_krb5_context)->krb5_context,
-                                    config_files);
-        krb5_free_config_files(config_files);
-        if (ret) {
-                DEBUG(1,("krb5_set_config_files failed (%s)\n",
-                         smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
-                talloc_free(tmp_ctx);
-                return ret;
+        }
-        if (lp_realm(lp_ctx) && *lp_realm(lp_ctx)) {
-                char *upper_realm = strupper_talloc(tmp_ctx, lp_realm(lp_ctx));
-                if (!upper_realm) {
-                        DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm(lp_ctx)));
-                        talloc_free(tmp_ctx);
-                        return ENOMEM;
+                }
-                ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, upper_realm);
-                if (ret) {
-                        DEBUG(1,("krb5_set_default_realm failed (%s)\n",
-                                 smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
-                        talloc_free(tmp_ctx);
-                        return ret;
+                }
+        }
         /* TODO: Should we have a different name here? */
         ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf);
         if (ret) {
                 DEBUG(1,("krb5_initlog failed (%s)\n",
+        if (ret) {
+                DEBUG(1,("krb5_initlog failed (%s)\n",
                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_2);
+        ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */,
+                krb5_free_context((*smb_krb5_context)->krb5_context);
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy);
+        ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */,
                                smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL);
         if (ret) {
                 DEBUG(1,("krb5_addlog_func failed (%s)\n",
+                DEBUG(1,("krb5_addlog_func failed (%s)\n",
                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
                 talloc_free(tmp_ctx);
 …
         /* Set use of our socket lib */
         ret = krb5_set_send_to_kdc_func((*smb_krb5_context)->krb5_context,
                                         smb_krb5_send_and_recv_func,
                                         ev);
         if (ret) {
                 DEBUG(1,("krb5_set_send_recv_func failed (%s)\n",
                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
                 talloc_free(tmp_ctx);
                 return ret;
+        if (ev) {
+                struct tevent_context *previous_ev;
+                ret = smb_krb5_context_set_event_ctx(*smb_krb5_context,
+                                                     ev, &previous_ev);
+                if (ret) {
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
+        }
 …
         krb5_set_dns_canonicalize_hostname((*smb_krb5_context)->krb5_context,
                                            lp_parm_bool(lp_ctx, NULL, "krb5", "set_dns_canonicalize", false));
+                                           lpcfg_parm_bool(lp_ctx, NULL, "krb5", "set_dns_canonicalize", false));
         return 0;
+}
+krb5_error_code smb_krb5_context_set_event_ctx(struct smb_krb5_context *smb_krb5_context,
+                                               struct tevent_context *ev,
+                                               struct tevent_context **previous_ev)
+{
+        int ret;
+        if (!ev) {
+                return EINVAL;
+        }
+        *previous_ev = smb_krb5_context->current_ev;
+        smb_krb5_context->current_ev = talloc_reference(smb_krb5_context, ev);
+        if (!smb_krb5_context->current_ev) {
+                return ENOMEM;
+        }
+        /* Set use of our socket lib */
+        ret = krb5_set_send_to_kdc_func(smb_krb5_context->krb5_context,
+                                        smb_krb5_send_and_recv_func,
+                                        ev);
+        if (ret) {
+                TALLOC_CTX *tmp_ctx = talloc_new(NULL);
+                DEBUG(1,("krb5_set_send_recv_func failed (%s)\n",
+                         smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, tmp_ctx)));
+                talloc_free(tmp_ctx);
+                talloc_unlink(smb_krb5_context, smb_krb5_context->current_ev);
+                smb_krb5_context->current_ev = NULL;
+                return ret;
+        }
+        return 0;
+}
+krb5_error_code smb_krb5_context_remove_event_ctx(struct smb_krb5_context *smb_krb5_context,
+                                                  struct tevent_context *previous_ev,
+                                                  struct tevent_context *ev)
+{
+        int ret;
+        talloc_unlink(smb_krb5_context, ev);
+        /* If there was a mismatch with things happening on a stack, then don't wipe things */
+        smb_krb5_context->current_ev = previous_ev;
+        /* Set use of our socket lib */
+        ret = krb5_set_send_to_kdc_func(smb_krb5_context->krb5_context,
+                                        smb_krb5_send_and_recv_func,
+                                        previous_ev);
+        if (ret) {
+                TALLOC_CTX *tmp_ctx = talloc_new(NULL);
+                DEBUG(1,("krb5_set_send_recv_func failed (%s)\n",
+                         smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, tmp_ctx)));
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        return 0;
+}

vendor/current/source4/auth/kerberos/krb5_init_context.h

-              r414
+              r740
         krb5_context krb5_context;
         krb5_log_facility *logf;
+        struct tevent_context *current_ev;
 };
 struct tevent_context;
 struct loadparm_context;
+krb5_error_code
+smb_krb5_init_context_basic(TALLOC_CTX *tmp_ctx,
+                            struct loadparm_context *lp_ctx,
+                            krb5_context *_krb5_context);
 krb5_error_code smb_krb5_init_context(void *parent_ctx, struct tevent_context *ev,
                                       struct loadparm_context *lp_ctx,
                                       struct smb_krb5_context **smb_krb5_context);
-void smb_krb5_free_context(struct smb_krb5_context *smb_krb5_context);
 krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,

vendor/current/source4/auth/ntlm/auth.c

-              r414
+              r740
 #include "includes.h"
+#include <tevent.h>
+#include "../lib/util/tevent_ntstatus.h"
 #include "../lib/util/dlinklist.h"
 #include "auth/auth.h"
 #include "auth/ntlm/auth_proto.h"
-#include "lib/events/events.h"
 #include "param/param.h"
+#include "dsdb/samdb/samdb.h"
 /***************************************************************************
 …
  Set a fixed challenge
 ***************************************************************************/
+bool auth_challenge_may_be_modified(struct auth_context *auth_ctx)
+_PUBLIC_ bool auth_challenge_may_be_modified(struct auth_context *auth_ctx)
+{
         return auth_ctx->challenge.may_be_modified;
 …
  Returns a const char of length 8 bytes.
 ****************************************************************************/
 _PUBLIC_ NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, const uint8_t **_chal)
+_PUBLIC_ NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, uint8_t chal[8])
+{
         NTSTATUS nt_status;
         struct auth_method_context *method;
         if (auth_ctx->challenge.data.length) {
+        if (auth_ctx->challenge.data.length == 8) {
                 DEBUG(5, ("auth_get_challenge: returning previous challenge by module %s (normal)\n",
                           auth_ctx->challenge.set_by));
                 *_chal = auth_ctx->challenge.data.data;
+                memcpy(chal, auth_ctx->challenge.data.data, 8);
                 return NT_STATUS_OK;
+        }
         for (method = auth_ctx->methods; method; method = method->next) {
+                DATA_BLOB challenge = data_blob(NULL,0);
+                nt_status = method->ops->get_challenge(method, auth_ctx, &challenge);
+                nt_status = method->ops->get_challenge(method, auth_ctx, chal);
                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOT_IMPLEMENTED)) {
                         continue;
 …
                 NT_STATUS_NOT_OK_RETURN(nt_status);
+                if (challenge.length != 8) {
+                        DEBUG(0, ("auth_get_challenge: invalid challenge (length %u) by mothod [%s]\n",
+                                (unsigned)challenge.length, method->ops->name));
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+                auth_ctx->challenge.data        = challenge;
+                auth_ctx->challenge.data        = data_blob_talloc(auth_ctx, chal, 8);
+                NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.data.data);
                 auth_ctx->challenge.set_by      = method->ops->name;
 …
         if (!auth_ctx->challenge.set_by) {
-                uint8_t chal[8];
                 generate_random_buffer(chal, 8);
 …
                  auth_ctx->challenge.set_by));
-        *_chal = auth_ctx->challenge.data.data;
         return NT_STATUS_OK;
+}
 /****************************************************************************
+ Try to get a challenge out of the various authentication modules.
+ Returns a const char of length 8 bytes.
+Used in the gensec_gssapi and gensec_krb5 server-side code, where the
+PAC isn't available, and for tokenGroups in the DSDB stack.
+ Supply either a principal or a DN
 ****************************************************************************/
+_PUBLIC_ NTSTATUS auth_get_server_info_principal(TALLOC_CTX *mem_ctx,
+                                                  struct auth_context *auth_ctx,
+                                                  const char *principal,
+                                                  struct auth_serversupplied_info **server_info)
+_PUBLIC_ NTSTATUS auth_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
+                                                 struct auth_context *auth_ctx,
+                                                 const char *principal,
+                                                 struct ldb_dn *user_dn,
+                                                 struct auth_user_info_dc **user_info_dc)
+{
         NTSTATUS nt_status;
 …
         for (method = auth_ctx->methods; method; method = method->next) {
                 if (!method->ops->get_server_info_principal) {
+                if (!method->ops->get_user_info_dc_principal) {
                         continue;
+                }
                 nt_status = method->ops->get_server_info_principal(mem_ctx, auth_ctx, principal, server_info);
+                nt_status = method->ops->get_user_info_dc_principal(mem_ctx, auth_ctx, principal, user_dn, user_info_dc);
                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOT_IMPLEMENTED)) {
                         continue;
+                }
+                NT_STATUS_NOT_OK_RETURN(nt_status);
+                break;
+        }
+        return NT_STATUS_OK;
+}
+struct auth_check_password_sync_state {
+        bool finished;
+        NTSTATUS status;
+        struct auth_serversupplied_info *server_info;
+};
+static void auth_check_password_sync_callback(struct auth_check_password_request *req,
+                                              void *private_data)
+{
+        struct auth_check_password_sync_state *s = talloc_get_type(private_data,
+                                                   struct auth_check_password_sync_state);
+        s->finished = true;
+        s->status = auth_check_password_recv(req, s, &s->server_info);
+                return nt_status;
+        }
+        return NT_STATUS_NOT_IMPLEMENTED;
+}
 …
+ *
  * Check a user's password, as given in the user_info struct and return various
  * interesting details in the server_info struct.
+ *
  * The return value takes precedence over the contents of the server_info
+ * interesting details in the user_info_dc struct.
+ *
+ * The return value takes precedence over the contents of the user_info_dc
  * struct.  When the return is other than NT_STATUS_OK the contents
  * of that structure is undefined.
 …
  * @param user_info Contains the user supplied components, including the passwords.
+ *
  * @param mem_ctx The parent memory context for the server_info structure
+ *
  * @param server_info If successful, contains information about the authentication,
+ * @param mem_ctx The parent memory context for the user_info_dc structure
+ *
+ * @param user_info_dc If successful, contains information about the authentication,
  *                    including a SAM_ACCOUNT struct describing the user.
+ *
 …
                              TALLOC_CTX *mem_ctx,
                              const struct auth_usersupplied_info *user_info,
+                             struct auth_serversupplied_info **server_info)
+{
+        struct auth_check_password_sync_state *sync_state;
+                             struct auth_user_info_dc **user_info_dc)
+{
+        struct tevent_req *subreq;
+        struct tevent_context *ev;
+        bool ok;
         NTSTATUS status;
+        sync_state = talloc_zero(auth_ctx, struct auth_check_password_sync_state);
+        NT_STATUS_HAVE_NO_MEMORY(sync_state);
+        auth_check_password_send(auth_ctx, user_info, auth_check_password_sync_callback, sync_state);
+        while (!sync_state->finished) {
+                event_loop_once(auth_ctx->event_ctx);
+        }
+        status = sync_state->status;
+        if (NT_STATUS_IS_OK(status)) {
+                *server_info = talloc_steal(mem_ctx, sync_state->server_info);
+        }
+        talloc_free(sync_state);
+        /*TODO: create a new event context here! */
+        ev = auth_ctx->event_ctx;
+        subreq = auth_check_password_send(mem_ctx,
+                                          ev,
+                                          auth_ctx,
+                                          user_info);
+        if (subreq == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        ok = tevent_req_poll(subreq, ev);
+        if (!ok) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        status = auth_check_password_recv(subreq, mem_ctx, user_info_dc);
+        TALLOC_FREE(subreq);
         return status;
+}
 struct auth_check_password_request {
+struct auth_check_password_state {
         struct auth_context *auth_ctx;
         const struct auth_usersupplied_info *user_info;
         struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
         struct auth_method_context *method;
-        NTSTATUS status;
-        struct {
-                void (*fn)(struct auth_check_password_request *req, void *private_data);
-                void *private_data;
-        } callback;
 };
+static void auth_check_password_async_timed_handler(struct tevent_context *ev, struct tevent_timer *te,
+                                                    struct timeval t, void *ptr)
+{
+        struct auth_check_password_request *req = talloc_get_type(ptr, struct auth_check_password_request);
+        req->status = req->method->ops->check_password(req->method, req, req->user_info, &req->server_info);
+        req->callback.fn(req, req->callback.private_data);
+}
+static void auth_check_password_async_trigger(struct tevent_context *ev,
+                                              struct tevent_immediate *im,
+                                              void *private_data);
 /**
  * Check a user's Plaintext, LM or NTLM password.
 …
+ *
  * Check a user's password, as given in the user_info struct and return various
  * interesting details in the server_info struct.
+ *
  * The return value takes precedence over the contents of the server_info
+ * interesting details in the user_info_dc struct.
+ *
+ * The return value takes precedence over the contents of the user_info_dc
  * struct.  When the return is other than NT_STATUS_OK the contents
  * of that structure is undefined.
+ *
+ * @param mem_ctx The memory context the request should operate on
+ *
+ * @param ev The tevent context the request should operate on
+ *
  * @param auth_ctx Supplies the challenges and some other data.
 …
  * @param user_info Contains the user supplied components, including the passwords.
+ *
+ * @param callback A callback function which will be called when the operation is finished.
+ *                 The callback function needs to call auth_check_password_recv() to get the return values
+ *
+ * @param private_data A private pointer which will ba passed to the callback function
+ * @return The request handle or NULL on no memory error.
+ *
  **/
+_PUBLIC_ void auth_check_password_send(struct auth_context *auth_ctx,
+                              const struct auth_usersupplied_info *user_info,
+                              void (*callback)(struct auth_check_password_request *req, void *private_data),
+                              void *private_data)
+{
+_PUBLIC_ struct tevent_req *auth_check_password_send(TALLOC_CTX *mem_ctx,
+                                struct tevent_context *ev,
+                                struct auth_context *auth_ctx,
+                                const struct auth_usersupplied_info *user_info)
+{
+        struct tevent_req *req;
+        struct auth_check_password_state *state;
         /* if all the modules say 'not for me' this is reasonable */
         NTSTATUS nt_status;
+        uint8_t chal[8];
+        struct auth_usersupplied_info *user_info_tmp;
+        struct tevent_immediate *im;
+        DEBUG(3,("auth_check_password_send: "
+                 "Checking password for unmapped user [%s]\\[%s]@[%s]\n",
+                 user_info->client.domain_name, user_info->client.account_name,
+                 user_info->workstation_name));
+        req = tevent_req_create(mem_ctx, &state,
+                                struct auth_check_password_state);
+        if (req == NULL) {
+                return NULL;
+        }
+        state->auth_ctx         = auth_ctx;
+        state->user_info        = user_info;
+        if (!user_info->mapped_state) {
+                nt_status = map_user_info(req, lpcfg_workgroup(auth_ctx->lp_ctx),
+                                          user_info, &user_info_tmp);
+                if (tevent_req_nterror(req, nt_status)) {
+                        return tevent_req_post(req, ev);
+                }
+                user_info = user_info_tmp;
+                state->user_info = user_info_tmp;
+        }
+        DEBUGADD(3,("auth_check_password_send: "
+                    "mapped user is: [%s]\\[%s]@[%s]\n",
+                    user_info->mapped.domain_name,
+                    user_info->mapped.account_name,
+                    user_info->workstation_name));
+        nt_status = auth_get_challenge(auth_ctx, chal);
+        if (tevent_req_nterror(req, nt_status)) {
+                DEBUG(0,("auth_check_password_send: "
+                         "Invalid challenge (length %u) stored for "
+                         "this auth context set_by %s - cannot continue: %s\n",
+                        (unsigned)auth_ctx->challenge.data.length,
+                        auth_ctx->challenge.set_by,
+                        nt_errstr(nt_status)));
+                return tevent_req_post(req, ev);
+        }
+        if (auth_ctx->challenge.set_by) {
+                DEBUG(10,("auth_check_password_send: "
+                          "auth_context challenge created by %s\n",
+                          auth_ctx->challenge.set_by));
+        }
+        DEBUG(10, ("auth_check_password_send: challenge is: \n"));
+        dump_data(5, auth_ctx->challenge.data.data,
+                  auth_ctx->challenge.data.length);
+        im = tevent_create_immediate(state);
+        if (tevent_req_nomem(im, req)) {
+                return tevent_req_post(req, ev);
+        }
+        tevent_schedule_immediate(im,
+                                  auth_ctx->event_ctx,
+                                  auth_check_password_async_trigger,
+                                  req);
+        return req;
+}
+static void auth_check_password_async_trigger(struct tevent_context *ev,
+                                              struct tevent_immediate *im,
+                                              void *private_data)
+{
+        struct tevent_req *req =
+                talloc_get_type_abort(private_data, struct tevent_req);
+        struct auth_check_password_state *state =
+                tevent_req_data(req, struct auth_check_password_state);
+        NTSTATUS status;
         struct auth_method_context *method;
+        const uint8_t *challenge;
+        struct auth_usersupplied_info *user_info_tmp;
+        struct auth_check_password_request *req = NULL;
+        DEBUG(3,   ("auth_check_password_send:  Checking password for unmapped user [%s]\\[%s]@[%s]\n",
+                    user_info->client.domain_name, user_info->client.account_name, user_info->workstation_name));
+        req = talloc_zero(auth_ctx, struct auth_check_password_request);
+        if (!req) {
+                callback(NULL, private_data);
+        status = NT_STATUS_OK;
+        for (method=state->auth_ctx->methods; method; method = method->next) {
+                /* we fill in state->method here so debug messages in
+                   the callers know which method failed */
+                state->method = method;
+                /* check if the module wants to check the password */
+                status = method->ops->want_check(method, req, state->user_info);
+                if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+                        DEBUG(11,("auth_check_password_send: "
+                                  "%s had nothing to say\n",
+                                  method->ops->name));
+                        continue;
+                }
+                if (tevent_req_nterror(req, status)) {
+                        return;
+                }
+                status = method->ops->check_password(method,
+                                                     state,
+                                                     state->user_info,
+                                                     &state->user_info_dc);
+                if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+                        /* the backend has handled the request */
+                        break;
+                }
+        }
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+                /* don't expose the NT_STATUS_NOT_IMPLEMENTED
+                   internals */
+                status = NT_STATUS_NO_SUCH_USER;
+        }
+        if (tevent_req_nterror(req, status)) {
                 return;
+        }
+        req->auth_ctx                   = auth_ctx;
+        req->user_info                  = user_info;
+        req->callback.fn                = callback;
+        req->callback.private_data      = private_data;
+        if (!user_info->mapped_state) {
+                nt_status = map_user_info(req, lp_workgroup(auth_ctx->lp_ctx), user_info, &user_info_tmp);
+                if (!NT_STATUS_IS_OK(nt_status)) goto failed;
+                user_info = user_info_tmp;
+                req->user_info  = user_info_tmp;
+        }
+        DEBUGADD(3,("auth_check_password_send:  mapped user is: [%s]\\[%s]@[%s]\n",
+                    user_info->mapped.domain_name, user_info->mapped.account_name, user_info->workstation_name));
+        nt_status = auth_get_challenge(auth_ctx, &challenge);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                DEBUG(0, ("auth_check_password_send:  Invalid challenge (length %u) stored for this auth context set_by %s - cannot continue: %s\n",
+                        (unsigned)auth_ctx->challenge.data.length, auth_ctx->challenge.set_by, nt_errstr(nt_status)));
+                goto failed;
+        }
+        if (auth_ctx->challenge.set_by) {
+                DEBUG(10, ("auth_check_password_send: auth_context challenge created by %s\n",
+                                        auth_ctx->challenge.set_by));
+        }
+        DEBUG(10, ("auth_check_password_send: challenge is: \n"));
+        dump_data(5, auth_ctx->challenge.data.data, auth_ctx->challenge.data.length);
+        nt_status = NT_STATUS_NO_SUCH_USER; /* If all the modules say 'not for me', then this is reasonable */
+        for (method = auth_ctx->methods; method; method = method->next) {
+                NTSTATUS result;
+                struct tevent_timer *te = NULL;
+                /* check if the module wants to chek the password */
+                result = method->ops->want_check(method, req, user_info);
+                if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
+                        DEBUG(11,("auth_check_password_send: %s had nothing to say\n", method->ops->name));
+                        continue;
+                }
+                nt_status = result;
+                req->method     = method;
+                if (!NT_STATUS_IS_OK(nt_status)) break;
+                te = event_add_timed(auth_ctx->event_ctx, req,
+                                     timeval_zero(),
+                                     auth_check_password_async_timed_handler, req);
+                if (!te) {
+                        nt_status = NT_STATUS_NO_MEMORY;
+                        goto failed;
+                }
+                return;
+        }
+failed:
+        req->status = nt_status;
+        req->callback.fn(req, req->callback.private_data);
+        tevent_req_done(req);
+}
 …
  * async receive function
+ *
  * The return value takes precedence over the contents of the server_info
+ * The return value takes precedence over the contents of the user_info_dc
  * struct.  When the return is other than NT_STATUS_OK the contents
  * of that structure is undefined.
+ *
+ *
  * @param req The async auth_check_password state, passes to the callers callback function
+ *
  * @param mem_ctx The parent memory context for the server_info structure
+ *
  * @param server_info If successful, contains information about the authentication,
+ * @param req The async request state
+ *
+ * @param mem_ctx The parent memory context for the user_info_dc structure
+ *
+ * @param user_info_dc If successful, contains information about the authentication,
  *                    including a SAM_ACCOUNT struct describing the user.
+ *
 …
  **/
 _PUBLIC_ NTSTATUS auth_check_password_recv(struct auth_check_password_request *req,
+_PUBLIC_ NTSTATUS auth_check_password_recv(struct tevent_req *req,
                                   TALLOC_CTX *mem_ctx,
+                                  struct auth_serversupplied_info **server_info)
+{
+                                  struct auth_user_info_dc **user_info_dc)
+{
+        struct auth_check_password_state *state =
+                tevent_req_data(req, struct auth_check_password_state);
         NTSTATUS status;
+        NT_STATUS_HAVE_NO_MEMORY(req);
+        if (NT_STATUS_IS_OK(req->status)) {
+                DEBUG(5,("auth_check_password_recv: %s authentication for user [%s\\%s] succeeded\n",
+                         req->method->ops->name, req->server_info->domain_name, req->server_info->account_name));
+                *server_info = talloc_steal(mem_ctx, req->server_info);
+        } else {
+                DEBUG(2,("auth_check_password_recv: %s authentication for user [%s\\%s] FAILED with error %s\n",
+                         (req->method ? req->method->ops->name : "NO_METHOD"),
+                         req->user_info->mapped.domain_name,
+                         req->user_info->mapped.account_name,
+                         nt_errstr(req->status)));
+        }
+        status = req->status;
+        talloc_free(req);
+        return status;
+        if (tevent_req_is_nterror(req, &status)) {
+                DEBUG(2,("auth_check_password_recv: "
+                         "%s authentication for user [%s\\%s] "
+                         "FAILED with error %s\n",
+                         (state->method ? state->method->ops->name : "NO_METHOD"),
+                         state->user_info->mapped.domain_name,
+                         state->user_info->mapped.account_name,
+                         nt_errstr(status)));
+                tevent_req_received(req);
+                return status;
+        }
+        DEBUG(5,("auth_check_password_recv: "
+                 "%s authentication for user [%s\\%s] succeeded\n",
+                 state->method->ops->name,
+                 state->user_info_dc->info->domain_name,
+                 state->user_info_dc->info->account_name));
+        *user_info_dc = talloc_move(mem_ctx, &state->user_info_dc);
+        tevent_req_received(req);
+        return NT_STATUS_OK;
+}
+/* Wrapper because we don't want to expose all callers to needing to
+ * know that session_info is generated from the main ldb */
+static NTSTATUS auth_generate_session_info_wrapper(TALLOC_CTX *mem_ctx,
+                                                   struct auth_context *auth_context,
+                                                   struct auth_user_info_dc *user_info_dc,
+                                                   uint32_t session_info_flags,
+                                                   struct auth_session_info **session_info)
+{
+        return auth_generate_session_info(mem_ctx, auth_context->lp_ctx,
+                                          auth_context->sam_ctx, user_info_dc,
+                                          session_info_flags, session_info);
+}
 /***************************************************************************
  Make a auth_info struct for the auth subsystem
  - Allow the caller to specify the methods to use
+ - Allow the caller to specify the methods to use, including optionally the SAM to use
 ***************************************************************************/
 _PUBLIC_ NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods,
+                                     struct tevent_context *ev,
+                                     struct messaging_context *msg,
+                                     struct loadparm_context *lp_ctx,
+                                     struct auth_context **auth_ctx)
+                                              struct tevent_context *ev,
+                                              struct messaging_context *msg,
+                                              struct loadparm_context *lp_ctx,
+                                              struct ldb_context *sam_ctx,
+                                              struct auth_context **auth_ctx)
+{
         int i;
         struct auth_context *ctx;
+        auth_init();
+        if (!methods) {
+                DEBUG(0,("auth_context_create: No auth method list!?\n"));
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        auth4_init();
         if (!ev) {
                 DEBUG(0,("auth_context_create: called with out event context\n"));
-                return NT_STATUS_INTERNAL_ERROR;
+        }
-        if (!msg) {
-                DEBUG(0,("auth_context_create: called with out messaging context\n"));
                 return NT_STATUS_INTERNAL_ERROR;
+        }
 …
         ctx->lp_ctx                     = lp_ctx;
+        for (i=0; methods[i] ; i++) {
+        if (sam_ctx) {
+                ctx->sam_ctx = sam_ctx;
+        } else {
+                ctx->sam_ctx = samdb_connect(ctx, ctx->event_ctx, ctx->lp_ctx, system_session(ctx->lp_ctx), 0);
+        }
+        for (i=0; methods && methods[i] ; i++) {
                 struct auth_method_context *method;
 …
+        }
-        if (!ctx->methods) {
-                return NT_STATUS_INTERNAL_ERROR;
+        }
         ctx->check_password = auth_check_password;
         ctx->get_challenge = auth_get_challenge;
         ctx->set_challenge = auth_context_set_challenge;
         ctx->challenge_may_be_modified = auth_challenge_may_be_modified;
+        ctx->get_server_info_principal = auth_get_server_info_principal;
+        ctx->get_user_info_dc_principal = auth_get_user_info_dc_principal;
+        ctx->generate_session_info = auth_generate_session_info_wrapper;
         *auth_ctx = ctx;
 …
         return NT_STATUS_OK;
+}
+const char **auth_methods_from_lp(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
+{
+        const char **auth_methods = NULL;
+        switch (lpcfg_server_role(lp_ctx)) {
+        case ROLE_STANDALONE:
+                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "standalone", NULL);
+                break;
+        case ROLE_DOMAIN_MEMBER:
+                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "member server", NULL);
+                break;
+        case ROLE_DOMAIN_CONTROLLER:
+                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "domain controller", NULL);
+                break;
+        }
+        return auth_methods;
+}
 /***************************************************************************
  Make a auth_info struct for the auth subsystem
  - Uses default auth_methods, depending on server role and smb.conf settings
 ***************************************************************************/
 _PUBLIC_ NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx,
+_PUBLIC_ NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx,
                              struct tevent_context *ev,
                              struct messaging_context *msg,
 …
                              struct auth_context **auth_ctx)
+{
+        const char **auth_methods = NULL;
+        switch (lp_server_role(lp_ctx)) {
+        case ROLE_STANDALONE:
+                auth_methods = lp_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "standalone", NULL);
+                break;
+        case ROLE_DOMAIN_MEMBER:
+                auth_methods = lp_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "member server", NULL);
+                break;
+        case ROLE_DOMAIN_CONTROLLER:
+                auth_methods = lp_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "domain controller", NULL);
+                break;
+        }
+        return auth_context_create_methods(mem_ctx, auth_methods, ev, msg, lp_ctx, auth_ctx);
+}
+        NTSTATUS status;
+        const char **auth_methods;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        auth_methods = auth_methods_from_lp(tmp_ctx, lp_ctx);
+        if (!auth_methods) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        status = auth_context_create_methods(mem_ctx, auth_methods, ev, msg, lp_ctx, NULL, auth_ctx);
+        talloc_free(tmp_ctx);
+        return status;
+}
+/* Create an auth context from an open LDB.
+   This allows us not to re-open the LDB when we need to do a some authentication logic (such as tokenGroups)
+ */
+NTSTATUS auth_context_create_from_ldb(TALLOC_CTX *mem_ctx, struct ldb_context *ldb, struct auth_context **auth_ctx)
+{
+        NTSTATUS status;
+        const char **auth_methods;
+        struct loadparm_context *lp_ctx = talloc_get_type_abort(ldb_get_opaque(ldb, "loadparm"), struct loadparm_context);
+        struct tevent_context *ev = ldb_get_event_context(ldb);
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        auth_methods = auth_methods_from_lp(tmp_ctx, lp_ctx);
+        if (!auth_methods) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        status = auth_context_create_methods(mem_ctx, auth_methods, ev, NULL, lp_ctx, ldb, auth_ctx);
+        talloc_free(tmp_ctx);
+        return status;
+}
 /* the list of currently registered AUTH backends */
 …
                 sizeof(struct auth_context),
                 sizeof(struct auth_usersupplied_info),
                 sizeof(struct auth_serversupplied_info)
+                sizeof(struct auth_user_info_dc)
         };
 …
+}
 _PUBLIC_ NTSTATUS auth_init(void)
+_PUBLIC_ NTSTATUS auth4_init(void)
+{
         static bool initialized = false;
+        extern NTSTATUS auth_developer_init(void);
+        extern NTSTATUS auth_winbind_init(void);
+        extern NTSTATUS auth_anonymous_init(void);
+        extern NTSTATUS auth_unix_init(void);
+        extern NTSTATUS auth_sam_init(void);
+        extern NTSTATUS auth_server_init(void);
+        init_module_fn static_init[] = { STATIC_auth_MODULES };
+#define _MODULE_PROTO(init) extern NTSTATUS init(void);
+        STATIC_auth4_MODULES_PROTO;
+        init_module_fn static_init[] = { STATIC_auth4_MODULES };
         if (initialized) return NT_STATUS_OK;
 …
         return NT_STATUS_OK;
+}
-NTSTATUS server_service_auth_init(void)
+{
-        return auth_init();
+}

vendor/current/source4/auth/ntlm/auth_anonymous.c

r414	r740
53	53	TALLOC_CTX *mem_ctx,
54	54	const struct auth_usersupplied_info *user_info,
55		struct auth_~~serversupplied_info **_server_info~~)
	55	struct auth_user_info_dc **_user_info_dc)
56	56	{
57		return auth_anonymous_~~server_info(mem_ctx, lp_netbios_name(ctx->auth_ctx->lp_ctx), _server_info~~);
	57	return auth_anonymous_user_info_dc(mem_ctx, lpcfg_netbios_name(ctx->auth_ctx->lp_ctx), _user_info_dc);
58	58	}
59	59

vendor/current/source4/auth/ntlm/auth_developer.c

-              r414
+              r740
 #include "auth/ntlm/auth_proto.h"
 #include "libcli/security/security.h"
-#include "librpc/gen_ndr/ndr_samr.h"
 static NTSTATUS name_to_ntstatus_want_check(struct auth_method_context *ctx,
 …
                                                 TALLOC_CTX *mem_ctx,
                                                 const struct auth_usersupplied_info *user_info,
                                                 struct auth_serversupplied_info **_server_info)
+                                                struct auth_user_info_dc **_user_info_dc)
+{
         NTSTATUS nt_status;
+        struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
         uint32_t error_num;
         const char *user;
 …
         NT_STATUS_NOT_OK_RETURN(nt_status);
+        server_info = talloc(mem_ctx, struct auth_serversupplied_info);
+        NT_STATUS_HAVE_NO_MEMORY(server_info);
+        server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_ANONYMOUS);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
+        /* is this correct? */
+        server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_GUESTS);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
+        server_info->n_domain_groups = 0;
+        server_info->domain_groups = NULL;
+        user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+        /* This returns a pointer to a struct dom_sid, which is the
+         * same as a 1 element list of struct dom_sid */
+        user_info_dc->num_sids = 1;
+        user_info_dc->sids = dom_sid_parse_talloc(user_info_dc, SID_NT_ANONYMOUS);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->sids);
         /* annoying, but the Anonymous really does have a session key,
            and it is all zeros! */
+        server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
+        server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
+        data_blob_clear(&server_info->user_session_key);
+        data_blob_clear(&server_info->lm_session_key);
+        server_info->account_name = talloc_asprintf(server_info, "NAME TO NTSTATUS %s ANONYMOUS LOGON", user);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+        server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+        server_info->full_name = talloc_asprintf(server_info, "NAME TO NTSTATUS %s Anonymous Logon", user);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
+        server_info->logon_script = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
+        server_info->profile_path = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
+        server_info->home_directory = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
+        server_info->home_drive = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
+        server_info->last_logon = 0;
+        server_info->last_logoff = 0;
+        server_info->acct_expiry = 0;
+        server_info->last_password_change = 0;
+        server_info->allow_password_change = 0;
+        server_info->force_password_change = 0;
+        server_info->logon_count = 0;
+        server_info->bad_password_count = 0;
+        server_info->acct_flags = ACB_NORMAL;
+        server_info->authenticated = false;
+        *_server_info = server_info;
+        user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->user_session_key.data);
+        user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->lm_session_key.data);
+        data_blob_clear(&user_info_dc->user_session_key);
+        data_blob_clear(&user_info_dc->lm_session_key);
+        user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+        info->account_name = talloc_asprintf(user_info_dc, "NAME TO NTSTATUS %s ANONYMOUS LOGON", user);
+        NT_STATUS_HAVE_NO_MEMORY(info->account_name);
+        info->domain_name = talloc_strdup(user_info_dc, "NT AUTHORITY");
+        NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
+        info->full_name = talloc_asprintf(user_info_dc, "NAME TO NTSTATUS %s Anonymous Logon", user);
+        NT_STATUS_HAVE_NO_MEMORY(info->full_name);
+        info->logon_script = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
+        info->profile_path = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
+        info->home_directory = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
+        info->home_drive = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
+        info->last_logon = 0;
+        info->last_logoff = 0;
+        info->acct_expiry = 0;
+        info->last_password_change = 0;
+        info->allow_password_change = 0;
+        info->force_password_change = 0;
+        info->logon_count = 0;
+        info->bad_password_count = 0;
+        info->acct_flags = ACB_NORMAL;
+        info->authenticated = true;
+        *_user_info_dc = user_info_dc;
         return nt_status;
 …
  * @return NT_STATUS_UNSUCCESSFUL
  **/
+static NTSTATUS fixed_challenge_get_challenge(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *_blob)
+{
+        DATA_BLOB blob;
+static NTSTATUS fixed_challenge_get_challenge(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, uint8_t chal[8])
+{
         const char *challenge = "I am a teapot";
+        blob = data_blob_talloc(mem_ctx, challenge, 8);
+        NT_STATUS_HAVE_NO_MEMORY(blob.data);
+        *_blob = blob;
+        memcpy(chal, challenge, 8);
         return NT_STATUS_OK;
+}
 …
                                                TALLOC_CTX *mem_ctx,
                                                const struct auth_usersupplied_info *user_info,
                                                struct auth_serversupplied_info **_server_info)
+                                               struct auth_user_info_dc **_user_info_dc)
+{
         /* don't handle any users */

vendor/current/source4/auth/ntlm/auth_sam.c

-              r414
+              r740
 #include "includes.h"
-#include "librpc/gen_ndr/ndr_netlogon.h"
 #include "system/time.h"
+#include "lib/ldb/include/ldb.h"
+#include "../lib/util/util_ldb.h"
+#include <ldb.h>
+#include "libcli/ldap/ldap_ndr.h"
+#include "libcli/security/security.h"
 #include "auth/auth.h"
 #include "../libcli/auth/ntlm_check.h"
 …
 #include "auth/auth_sam.h"
 #include "dsdb/samdb/samdb.h"
+#include "libcli/security/security.h"
+#include "libcli/ldap/ldap_ndr.h"
+#include "dsdb/common/util.h"
 #include "param/param.h"
+#include "librpc/gen_ndr/ndr_irpc_c.h"
+#include "lib/messaging/irpc.h"
 extern const char *user_attrs[];
 …
         /* pull the user attributes */
+        ret = gendb_search_single_extended_dn(sam_ctx, mem_ctx, domain_dn, LDB_SCOPE_SUBTREE,
+                                              ret_msg, user_attrs,
+                                              "(&(sAMAccountName=%s)(objectclass=user))",
+                                              ldb_binary_encode_string(mem_ctx, account_name));
+        ret = dsdb_search_one(sam_ctx, mem_ctx, ret_msg, domain_dn, LDB_SCOPE_SUBTREE,
+                              user_attrs,
+                              DSDB_SEARCH_SHOW_EXTENDED_DN,
+                              "(&(sAMAccountName=%s)(objectclass=user))",
+                              ldb_binary_encode_string(mem_ctx, account_name));
         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
                 DEBUG(3,("sam_search_user: Couldn't find user [%s] in samdb, under %s\n",
 …
                 *user_sess_key = data_blob(NULL, 0);
                 status = hash_password_check(mem_ctx,
                                              lp_lanman_auth(auth_context->lp_ctx),
+                                             lpcfg_lanman_auth(auth_context->lp_ctx),
                                              user_info->password.hash.lanman,
                                              user_info->password.hash.nt,
 …
         case AUTH_PASSWORD_RESPONSE:
                 status = ntlm_password_check(mem_ctx,
                                              lp_lanman_auth(auth_context->lp_ctx),
                                                  lp_ntlm_auth(auth_context->lp_ctx),
+                                             lpcfg_lanman_auth(auth_context->lp_ctx),
+                                                 lpcfg_ntlm_auth(auth_context->lp_ctx),
                                              user_info->logon_parameters,
                                              &auth_context->challenge.data,
 …
+/*
+  send a message to the drepl server telling it to initiate a
+  REPL_SECRET getncchanges extended op to fetch the users secrets
+ */
+static void auth_sam_trigger_repl_secret(TALLOC_CTX *mem_ctx, struct auth_context *auth_context,
+                                         struct ldb_dn *user_dn)
+{
+        struct dcerpc_binding_handle *irpc_handle;
+        struct drepl_trigger_repl_secret r;
+        struct tevent_req *req;
+        irpc_handle = irpc_binding_handle_by_name(mem_ctx, auth_context->msg_ctx,
+                                                  "dreplsrv",
+                                                  &ndr_table_irpc);
+        if (irpc_handle == NULL) {
+                DEBUG(1,(__location__ ": Unable to get binding handle for dreplsrv\n"));
+                return;
+        }
+        r.in.user_dn = ldb_dn_get_linearized(user_dn);
+        req = dcerpc_drepl_trigger_repl_secret_r_send(mem_ctx,
+                                                      auth_context->event_ctx,
+                                                      irpc_handle,
+                                                      &r);
+        /* we aren't interested in a reply */
+        talloc_free(req);
+        talloc_free(irpc_handle);
+}
 static NTSTATUS authsam_authenticate(struct auth_context *auth_context,
 …
         NTSTATUS nt_status;
         uint16_t acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, domain_dn);
+        uint16_t acct_flags = samdb_result_acct_flags(auth_context->sam_ctx, mem_ctx, msg, domain_dn);
         /* Quit if the account was locked out. */
 …
         NT_STATUS_NOT_OK_RETURN(nt_status);
+        if (lm_pwd == NULL && nt_pwd == NULL) {
+                bool am_rodc;
+                if (samdb_rodc(auth_context->sam_ctx, &am_rodc) == LDB_SUCCESS && am_rodc) {
+                        /* we don't have passwords for this
+                         * account. We are an RODC, and this account
+                         * may be one for which we either are denied
+                         * REPL_SECRET replication or we haven't yet
+                         * done the replication. We return
+                         * NT_STATUS_NOT_IMPLEMENTED which tells the
+                         * auth code to try the next authentication
+                         * mechanism. We also send a message to our
+                         * drepl server to tell it to try and
+                         * replicate the secrets for this account.
+                         */
+                        auth_sam_trigger_repl_secret(mem_ctx, auth_context, msg->dn);
+                        return NT_STATUS_NOT_IMPLEMENTED;
+                }
+        }
         nt_status = authsam_password_ok(auth_context, mem_ctx,
                                         acct_flags, lm_pwd, nt_pwd,
 …
         NT_STATUS_NOT_OK_RETURN(nt_status);
         nt_status = authsam_account_ok(mem_ctx, sam_ctx,
+        nt_status = authsam_account_ok(mem_ctx, auth_context->sam_ctx,
                                        user_info->logon_parameters,
                                        domain_dn,
 …
                                                  TALLOC_CTX *mem_ctx,
                                                  const struct auth_usersupplied_info *user_info,
                                                  struct auth_serversupplied_info **server_info)
+                                                 struct auth_user_info_dc **user_info_dc)
+{
         NTSTATUS nt_status;
         const char *account_name = user_info->mapped.account_name;
         struct ldb_message *msg;
-        struct ldb_context *sam_ctx;
         struct ldb_dn *domain_dn;
         DATA_BLOB user_sess_key, lm_sess_key;
         TALLOC_CTX *tmp_ctx;
+        if (ctx->auth_ctx->sam_ctx == NULL) {
+                DEBUG(0, ("No SAM available, cannot log in users\n"));
+                return NT_STATUS_INVALID_SYSTEM_SERVICE;
+        }
         if (!account_name || !*account_name) {
                 /* 'not for me' */
 …
+        }
+        sam_ctx = samdb_connect(tmp_ctx, ctx->auth_ctx->event_ctx, ctx->auth_ctx->lp_ctx, system_session(mem_ctx, ctx->auth_ctx->lp_ctx));
+        if (sam_ctx == NULL) {
+                talloc_free(tmp_ctx);
+                return NT_STATUS_INVALID_SYSTEM_SERVICE;
+        }
+        domain_dn = ldb_get_default_basedn(sam_ctx);
+        domain_dn = ldb_get_default_basedn(ctx->auth_ctx->sam_ctx);
         if (domain_dn == NULL) {
                 talloc_free(tmp_ctx);
 …
+        }
         nt_status = authsam_search_account(tmp_ctx, sam_ctx, account_name, domain_dn, &msg);
+        nt_status = authsam_search_account(tmp_ctx, ctx->auth_ctx->sam_ctx, account_name, domain_dn, &msg);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
 …
+        }
         nt_status = authsam_authenticate(ctx->auth_ctx, tmp_ctx, sam_ctx, domain_dn, msg, user_info,
+        nt_status = authsam_authenticate(ctx->auth_ctx, tmp_ctx, ctx->auth_ctx->sam_ctx, domain_dn, msg, user_info,
                                          &user_sess_key, &lm_sess_key);
         if (!NT_STATUS_IS_OK(nt_status)) {
 …
+        }
         nt_status = authsam_make_server_info(tmp_ctx, sam_ctx, lp_netbios_name(ctx->auth_ctx->lp_ctx),
                                              lp_sam_name(ctx->auth_ctx->lp_ctx),
+        nt_status = authsam_make_user_info_dc(tmp_ctx, ctx->auth_ctx->sam_ctx, lpcfg_netbios_name(ctx->auth_ctx->lp_ctx),
+                                             lpcfg_sam_name(ctx->auth_ctx->lp_ctx),
                                              domain_dn,
                                              msg,
                                              user_sess_key, lm_sess_key,
                                              server_info);
+                                             user_info_dc);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
 …
+        }
         talloc_steal(mem_ctx, *server_info);
+        talloc_steal(mem_ctx, *user_info_dc);
         talloc_free(tmp_ctx);
 …
+        }
         is_local_name = lp_is_myname(ctx->auth_ctx->lp_ctx,
+        is_local_name = lpcfg_is_myname(ctx->auth_ctx->lp_ctx,
                                   user_info->mapped.domain_name);
         is_my_domain  = lp_is_mydomain(ctx->auth_ctx->lp_ctx,
+        is_my_domain  = lpcfg_is_mydomain(ctx->auth_ctx->lp_ctx,
                                        user_info->mapped.domain_name);
         /* check whether or not we service this domain/workgroup name */
         switch (lp_server_role(ctx->auth_ctx->lp_ctx)) {
+        switch (lpcfg_server_role(ctx->auth_ctx->lp_ctx)) {
                 case ROLE_STANDALONE:
                         return NT_STATUS_OK;
 …
+        }
         DEBUG(6,("authsam_check_password: lp_server_role() has an undefined value\n"));
+        DEBUG(6,("authsam_check_password: lpcfg_server_role() has an undefined value\n"));
         return NT_STATUS_NOT_IMPLEMENTED;
+}
+/* Used in the gensec_gssapi and gensec_krb5 server-side code, where the PAC isn't available */
+NTSTATUS authsam_get_server_info_principal(TALLOC_CTX *mem_ctx,
+                                           struct auth_context *auth_context,
+                                           const char *principal,
+                                           struct auth_serversupplied_info **server_info)
+{
+        NTSTATUS nt_status;
+        DATA_BLOB user_sess_key = data_blob(NULL, 0);
+        DATA_BLOB lm_sess_key = data_blob(NULL, 0);
+        struct ldb_message *msg;
+        struct ldb_context *sam_ctx;
+        struct ldb_dn *domain_dn;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        sam_ctx = samdb_connect(tmp_ctx, auth_context->event_ctx, auth_context->lp_ctx,
+                                system_session(tmp_ctx, auth_context->lp_ctx));
+        if (sam_ctx == NULL) {
+                talloc_free(tmp_ctx);
+                return NT_STATUS_INVALID_SYSTEM_SERVICE;
+        }
+        nt_status = sam_get_results_principal(sam_ctx, tmp_ctx, principal,
+                                              user_attrs, &domain_dn, &msg);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+        nt_status = authsam_make_server_info(tmp_ctx, sam_ctx,
+                                             lp_netbios_name(auth_context->lp_ctx),
+                                             lp_workgroup(auth_context->lp_ctx),
+                                             domain_dn,
+                                             msg,
+                                             user_sess_key, lm_sess_key,
+                                             server_info);
+        if (NT_STATUS_IS_OK(nt_status)) {
+                talloc_steal(mem_ctx, *server_info);
+        }
+        talloc_free(tmp_ctx);
+        return nt_status;
+}
+/* Wrapper for the auth subsystem pointer */
+static NTSTATUS authsam_get_user_info_dc_principal_wrapper(TALLOC_CTX *mem_ctx,
+                                                          struct auth_context *auth_context,
+                                                          const char *principal,
+                                                          struct ldb_dn *user_dn,
+                                                          struct auth_user_info_dc **user_info_dc)
+{
+        return authsam_get_user_info_dc_principal(mem_ctx, auth_context->lp_ctx, auth_context->sam_ctx,
+                                                 principal, user_dn, user_info_dc);
+}
 static const struct auth_operations sam_ignoredomain_ops = {
         .name                      = "sam_ignoredomain",
 …
         .want_check                = authsam_ignoredomain_want_check,
         .check_password            = authsam_check_password_internals,
         .get_server_info_principal = authsam_get_server_info_principal
+        .get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper
 };
 …
         .want_check                = authsam_want_check,
         .check_password            = authsam_check_password_internals,
         .get_server_info_principal = authsam_get_server_info_principal
+        .get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper
 };

vendor/current/source4/auth/ntlm/auth_server.c

-              r414
+              r740
 #include "includes.h"
 #include "auth/auth.h"
-#include "auth/ntlm/auth_proto.h"
 #include "auth/credentials/credentials.h"
 #include "libcli/security/security.h"
-#include "librpc/gen_ndr/ndr_samr.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "param/param.h"
 …
  * The challenge from the target server, when operating in security=server
  **/
 static NTSTATUS server_get_challenge(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *_blob)
+static NTSTATUS server_get_challenge(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, uint8_t chal[8])
+{
         struct smb_composite_connect io;
 …
         /* Make a connection to the target server, found by 'password server' in smb.conf */
         lp_smbcli_options(ctx->auth_ctx->lp_ctx, &smb_options);
+        lpcfg_smbcli_options(ctx->auth_ctx->lp_ctx, &smb_options);
         /* Make a negprot, WITHOUT SPNEGO, so we get a challenge nice an easy */
 …
         /* Hope we don't get * (the default), as this won't work... */
         host_list = lp_passwordserver(ctx->auth_ctx->lp_ctx);
+        host_list = lpcfg_passwordserver(ctx->auth_ctx->lp_ctx);
         if (!host_list) {
                 return NT_STATUS_INTERNAL_ERROR;
 …
                 return NT_STATUS_INTERNAL_ERROR;
+        }
         io.in.dest_ports = lp_smb_ports(ctx->auth_ctx->lp_ctx);
         io.in.socket_options = lp_socket_options(ctx->auth_ctx->lp_ctx);
         io.in.gensec_settings = lp_gensec_settings(mem_ctx, ctx->auth_ctx->lp_ctx);
+        io.in.dest_ports = lpcfg_smb_ports(ctx->auth_ctx->lp_ctx);
+        io.in.socket_options = lpcfg_socket_options(ctx->auth_ctx->lp_ctx);
+        io.in.gensec_settings = lpcfg_gensec_settings(mem_ctx, ctx->auth_ctx->lp_ctx);
         io.in.called_name = strupper_talloc(mem_ctx, io.in.dest_host);
 …
         io.in.credentials = cli_credentials_init_anon(mem_ctx);
         cli_credentials_set_workstation(io.in.credentials,
                                         lp_netbios_name(ctx->auth_ctx->lp_ctx),
+                                        lpcfg_netbios_name(ctx->auth_ctx->lp_ctx),
                                         CRED_SPECIFIED);
 …
         io.in.options = smb_options;
+        io.in.iconv_convenience = lp_iconv_convenience(ctx->auth_ctx->lp_ctx);
+        lp_smbcli_session_options(ctx->auth_ctx->lp_ctx, &io.in.session_options);
+        status = smb_composite_connect(&io, mem_ctx, lp_resolve_context(ctx->auth_ctx->lp_ctx),
+        lpcfg_smbcli_session_options(ctx->auth_ctx->lp_ctx, &io.in.session_options);
+        status = smb_composite_connect(&io, mem_ctx, lpcfg_resolve_context(ctx->auth_ctx->lp_ctx),
                                        ctx->auth_ctx->event_ctx);
         NT_STATUS_NOT_OK_RETURN(status);
+        *_blob = io.out.tree->session->transport->negotiate.secblob;
+        if (io.out.tree->session->transport->negotiate.secblob.length != 8) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        memcpy(chal, io.out.tree->session->transport->negotiate.secblob.data, 8);
         ctx->private_data = talloc_steal(ctx, io.out.tree->session);
         return NT_STATUS_OK;
 …
                                       TALLOC_CTX *mem_ctx,
                                       const struct auth_usersupplied_info *user_info,
                                       struct auth_serversupplied_info **_server_info)
+                                      struct auth_user_info_dc **_user_info_dc)
+{
         NTSTATUS nt_status;
+        struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
         struct cli_credentials *creds;
         struct smb_composite_sesssetup session_setup;
 …
         session_setup.in.credentials = creds;
         session_setup.in.workgroup = ""; /* Only used with SPNEGO, which we are not doing */
         session_setup.in.gensec_settings = lp_gensec_settings(session, ctx->auth_ctx->lp_ctx);
+        session_setup.in.gensec_settings = lpcfg_gensec_settings(session, ctx->auth_ctx->lp_ctx);
         /* Check password with remove server - this should be async some day */
 …
+        }
+        server_info = talloc(mem_ctx, struct auth_serversupplied_info);
+        NT_STATUS_HAVE_NO_MEMORY(server_info);
+        server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_ANONYMOUS);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
+        /* is this correct? */
+        server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_GUESTS);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
+        server_info->n_domain_groups = 0;
+        server_info->domain_groups = NULL;
+        user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+        user_info_dc->num_sids = 1;
+        /* This returns a pointer to a struct dom_sid, which is the
+         * same as a 1 element list of struct dom_sid */
+        user_info_dc->sids = dom_sid_parse_talloc(user_info_dc, SID_NT_ANONYMOUS);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->sids);
         /* annoying, but the Anonymous really does have a session key,
            and it is all zeros! */
+        server_info->user_session_key = data_blob(NULL, 0);
+        server_info->lm_session_key = data_blob(NULL, 0);
+        server_info->account_name = talloc_strdup(server_info, user_info->client.account_name);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+        server_info->domain_name = talloc_strdup(server_info, user_info->client.domain_name);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+        server_info->full_name = NULL;
+        server_info->logon_script = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
+        server_info->profile_path = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
+        server_info->home_directory = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
+        server_info->home_drive = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
+        server_info->last_logon = 0;
+        server_info->last_logoff = 0;
+        server_info->acct_expiry = 0;
+        server_info->last_password_change = 0;
+        server_info->allow_password_change = 0;
+        server_info->force_password_change = 0;
+        server_info->logon_count = 0;
+        server_info->bad_password_count = 0;
+        server_info->acct_flags = ACB_NORMAL;
+        server_info->authenticated = false;
+        *_server_info = server_info;
+        user_info_dc->user_session_key = data_blob(NULL, 0);
+        user_info_dc->lm_session_key = data_blob(NULL, 0);
+        user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+        info->account_name = talloc_strdup(user_info_dc, user_info->client.account_name);
+        NT_STATUS_HAVE_NO_MEMORY(info->account_name);
+        info->domain_name = talloc_strdup(user_info_dc, user_info->client.domain_name);
+        NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
+        info->full_name = NULL;
+        info->logon_script = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
+        info->profile_path = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
+        info->home_directory = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
+        info->home_drive = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
+        info->last_logon = 0;
+        info->last_logoff = 0;
+        info->acct_expiry = 0;
+        info->last_password_change = 0;
+        info->allow_password_change = 0;
+        info->force_password_change = 0;
+        info->logon_count = 0;
+        info->bad_password_count = 0;
+        info->acct_flags = ACB_NORMAL;
+        info->authenticated = false;
+        *_user_info_dc = user_info_dc;
         return nt_status;

vendor/current/source4/auth/ntlm/auth_simple.c

-              r414
+              r740
 #include "includes.h"
 #include "auth/auth.h"
-#include "lib/events/events.h"
-#include "param/param.h"
-#include "auth/session_proto.h"
 /*
 …
                                            const char *nt4_username,
                                            const char *password,
+                                           const uint32_t logon_parameters,
                                            struct auth_session_info **session_info)
+{
         struct auth_context *auth_context;
         struct auth_usersupplied_info *user_info;
         struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
         NTSTATUS nt_status;
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 …
+        }
         user_info = talloc(tmp_ctx, struct auth_usersupplied_info);
+        user_info = talloc_zero(tmp_ctx, struct auth_usersupplied_info);
         if (!user_info) {
                 talloc_free(tmp_ctx);
 …
                 USER_INFO_DONT_CHECK_UNIX_ACCOUNT;
+        user_info->logon_parameters = 0;
+        user_info->logon_parameters = logon_parameters |
+                MSV1_0_CLEARTEXT_PASSWORD_ALLOWED |
+                MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED;
         nt_status = auth_check_password(auth_context, tmp_ctx, user_info, &server_info);
+        nt_status = auth_check_password(auth_context, tmp_ctx, user_info, &user_info_dc);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
 …
         if (session_info) {
+                nt_status = auth_generate_session_info(tmp_ctx, ev, lp_ctx, server_info, session_info);
+                uint32_t flags = AUTH_SESSION_INFO_DEFAULT_GROUPS;
+                if (user_info_dc->info->authenticated) {
+                        flags |= AUTH_SESSION_INFO_AUTHENTICATED;
+                }
+                nt_status = auth_context->generate_session_info(tmp_ctx, auth_context,
+                                                                user_info_dc,
+                                                                flags,
+                                                                session_info);
                 if (NT_STATUS_IS_OK(nt_status)) {

vendor/current/source4/auth/ntlm/auth_unix.c

-              r414
+              r740
 #include "auth/ntlm/auth_proto.h"
 #include "system/passwd.h" /* needed by some systems for struct passwd */
+#include "lib/socket/socket.h"
+#include "auth/ntlm/pam_errors.h"
+#include "lib/socket/socket.h"
+#include "lib/tsocket/tsocket.h"
+#include "../libcli/auth/pam_errors.h"
 #include "param/param.h"
 …
  * except in case USER_INFO_DONT_CHECK_UNIX_ACCOUNT is set
  */
 static NTSTATUS authunix_make_server_info(TALLOC_CTX *mem_ctx,
+static NTSTATUS authunix_make_user_info_dc(TALLOC_CTX *mem_ctx,
                                           const char *netbios_name,
                                           const struct auth_usersupplied_info *user_info,
                                           struct passwd *pwd,
+                                          struct auth_serversupplied_info **_server_info)
+{
+        struct auth_serversupplied_info *server_info;
+                                          struct auth_user_info_dc **_user_info_dc)
+{
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
         NTSTATUS status;
         /* This is a real, real hack */
         if (pwd->pw_uid == 0) {
                 status = auth_system_server_info(mem_ctx, netbios_name, &server_info);
+                status = auth_system_user_info_dc(mem_ctx, netbios_name, &user_info_dc);
                 if (!NT_STATUS_IS_OK(status)) {
                         return status;
+                }
+                server_info->account_name = talloc_steal(server_info, pwd->pw_name);
+                NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+                user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+                NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+                info->account_name = talloc_steal(info, pwd->pw_name);
+                NT_STATUS_HAVE_NO_MEMORY(info->account_name);
                 server_info->domain_name = talloc_strdup(server_info, "unix");
                 NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+                info->domain_name = talloc_strdup(info, "unix");
+                NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
         } else {
                 server_info = talloc(mem_ctx, struct auth_serversupplied_info);
                 NT_STATUS_HAVE_NO_MEMORY(server_info);
+                user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+                NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+                server_info->authenticated = true;
+                user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+                NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+                info->authenticated = true;
                 server_info->account_name = talloc_steal(server_info, pwd->pw_name);
                 NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+                info->account_name = talloc_steal(info, pwd->pw_name);
+                NT_STATUS_HAVE_NO_MEMORY(info->account_name);
                 server_info->domain_name = talloc_strdup(server_info, "unix");
                 NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+                info->domain_name = talloc_strdup(info, "unix");
+                NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
                 /* This isn't in any way correct.. */
+                server_info->account_sid = NULL;
+                server_info->primary_group_sid = NULL;
+                server_info->n_domain_groups = 0;
+                server_info->domain_groups = NULL;
+        }
+        server_info->user_session_key = data_blob(NULL,0);
+        server_info->lm_session_key = data_blob(NULL,0);
+        server_info->full_name = talloc_steal(server_info, pwd->pw_gecos);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
+        server_info->logon_script = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
+        server_info->profile_path = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
+        server_info->home_directory = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
+        server_info->home_drive = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
+        server_info->last_logon = 0;
+        server_info->last_logoff = 0;
+        server_info->acct_expiry = 0;
+        server_info->last_password_change = 0;
+        server_info->allow_password_change = 0;
+        server_info->force_password_change = 0;
+        server_info->logon_count = 0;
+        server_info->bad_password_count = 0;
+        server_info->acct_flags = 0;
+        *_server_info = server_info;
+                user_info_dc->num_sids = 0;
+                user_info_dc->sids = NULL;
+        }
+        user_info_dc->user_session_key = data_blob(NULL,0);
+        user_info_dc->lm_session_key = data_blob(NULL,0);
+        info->full_name = talloc_steal(info, pwd->pw_gecos);
+        NT_STATUS_HAVE_NO_MEMORY(info->full_name);
+        info->logon_script = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
+        info->profile_path = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
+        info->home_directory = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
+        info->home_drive = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
+        info->last_logon = 0;
+        info->last_logoff = 0;
+        info->acct_expiry = 0;
+        info->last_password_change = 0;
+        info->allow_password_change = 0;
+        info->force_password_change = 0;
+        info->logon_count = 0;
+        info->bad_password_count = 0;
+        info->acct_flags = 0;
+        *_user_info_dc = user_info_dc;
         return NT_STATUS_OK;
 …
+}
 static NTSTATUS check_unix_password(TALLOC_CTX *ctx, struct loadparm_context *lp_ctx,
+static NTSTATUS check_unix_password(TALLOC_CTX *ctx, struct loadparm_context *lp_ctx,
                                     const struct auth_usersupplied_info *user_info, struct passwd **pws)
+{
 …
          */
+        nt_status = smb_pam_start(&pamh, user_info->mapped.account_name, user_info->remote_host ? user_info->remote_host->addr : NULL, pamconv);
+        nt_status = smb_pam_start(&pamh, user_info->mapped.account_name,
+                        user_info->remote_host ? tsocket_address_inet_addr_string(user_info->remote_host, ctx) : NULL, pamconv);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
+        }
         nt_status = smb_pam_auth(pamh, lp_null_passwords(lp_ctx), user_info->mapped.account_name);
+        nt_status = smb_pam_auth(pamh, lpcfg_null_passwords(lp_ctx), user_info->mapped.account_name);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 smb_pam_end(pamh);
 …
         struct passwd *pws;
         NTSTATUS nt_status;
         int level = lp_passwordlevel(lp_ctx);
+        int level = lpcfg_passwordlevel(lp_ctx);
         *ret_passwd = NULL;
 …
         if (crypted[0] == '\0') {
                 if (!lp_null_passwords(lp_ctx)) {
+                if (!lpcfg_null_passwords(lp_ctx)) {
                         DEBUG(2, ("Disallowing %s with null password\n", username));
                         return NT_STATUS_LOGON_FAILURE;
 …
                                         TALLOC_CTX *mem_ctx,
                                         const struct auth_usersupplied_info *user_info,
                                         struct auth_serversupplied_info **server_info)
+                                        struct auth_user_info_dc **user_info_dc)
+{
         TALLOC_CTX *check_ctx;
 …
+        }
         nt_status = authunix_make_server_info(mem_ctx, lp_netbios_name(ctx->auth_ctx->lp_ctx),
                                               user_info, pwd, server_info);
+        nt_status = authunix_make_user_info_dc(mem_ctx, lpcfg_netbios_name(ctx->auth_ctx->lp_ctx),
+                                              user_info, pwd, user_info_dc);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(check_ctx);

vendor/current/source4/auth/ntlm/auth_util.c

-              r414
+              r740
 #include "includes.h"
 #include "auth/auth.h"
-#include "auth/auth_proto.h"
-#include "libcli/security/security.h"
 #include "libcli/auth/libcli_auth.h"
-#include "dsdb/samdb/samdb.h"
-#include "auth/credentials/credentials.h"
 #include "param/param.h"
 …
  * which don't want to set a challenge
  */
 NTSTATUS auth_get_challenge_not_implemented(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *challenge)
+NTSTATUS auth_get_challenge_not_implemented(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, uint8_t chal[8])
+{
         /* we don't want to set a challenge */
 …
+        }
         *user_info_mapped = talloc(mem_ctx, struct auth_usersupplied_info);
+        *user_info_mapped = talloc_zero(mem_ctx, struct auth_usersupplied_info);
         if (!*user_info_mapped) {
                 return NT_STATUS_NO_MEMORY;
 …
                 case AUTH_PASSWORD_HASH:
+                {
                         const uint8_t *challenge;
+                        uint8_t chal[8];
                         DATA_BLOB chall_blob;
                         user_info_temp = talloc(mem_ctx, struct auth_usersupplied_info);
+                        user_info_temp = talloc_zero(mem_ctx, struct auth_usersupplied_info);
                         if (!user_info_temp) {
                                 return NT_STATUS_NO_MEMORY;
 …
                         user_info_temp->mapped_state = to_state;
                         nt_status = auth_get_challenge(auth_context, &challenge);
+                        nt_status = auth_get_challenge(auth_context, chal);
                         if (!NT_STATUS_IS_OK(nt_status)) {
                                 return nt_status;
+                        }
                         chall_blob = data_blob_talloc(mem_ctx, challenge, 8);
                         if (lp_client_ntlmv2_auth(auth_context->lp_ctx)) {
                                 DATA_BLOB names_blob = NTLMv2_generate_names_blob(mem_ctx,  lp_netbios_name(auth_context->lp_ctx), lp_workgroup(auth_context->lp_ctx));
+                        chall_blob = data_blob_talloc(mem_ctx, chal, 8);
+                        if (lpcfg_client_ntlmv2_auth(auth_context->lp_ctx)) {
+                                DATA_BLOB names_blob = NTLMv2_generate_names_blob(mem_ctx,  lpcfg_netbios_name(auth_context->lp_ctx), lpcfg_workgroup(auth_context->lp_ctx));
                                 DATA_BLOB lmv2_response, ntlmv2_response, lmv2_session_key, ntlmv2_session_key;
 …
                         } else {
                                 DATA_BLOB blob = data_blob_talloc(mem_ctx, NULL, 24);
                                 SMBOWFencrypt(user_info_in->password.hash.nt->hash, challenge, blob.data);
+                                SMBOWFencrypt(user_info_in->password.hash.nt->hash, chal, blob.data);
                                 user_info_temp->password.response.nt = blob;
                                 if (lp_client_lanman_auth(auth_context->lp_ctx) && user_info_in->password.hash.lanman) {
+                                if (lpcfg_client_lanman_auth(auth_context->lp_ctx) && user_info_in->password.hash.lanman) {
                                         DATA_BLOB lm_blob = data_blob_talloc(mem_ctx, NULL, 24);
                                         SMBOWFencrypt(user_info_in->password.hash.lanman->hash, challenge, blob.data);
+                                        SMBOWFencrypt(user_info_in->password.hash.lanman->hash, chal, blob.data);
                                         user_info_temp->password.response.lanman = lm_blob;
                                 } else {
 …
                         struct samr_Password nt;
                         user_info_temp = talloc(mem_ctx, struct auth_usersupplied_info);
+                        user_info_temp = talloc_zero(mem_ctx, struct auth_usersupplied_info);
                         if (!user_info_temp) {
                                 return NT_STATUS_NO_MEMORY;
 …
         return NT_STATUS_OK;
+}
-/**
- * Squash an NT_STATUS in line with security requirements.
- * In an attempt to avoid giving the whole game away when users
- * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
- * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
- * (session setups in particular).
+ *
- * @param nt_status NTSTATUS input for squashing.
- * @return the 'squashed' nt_status
- **/
-_PUBLIC_ NTSTATUS auth_nt_status_squash(NTSTATUS nt_status)
+{
-        if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
-                /* Match WinXP and don't give the game away */
-                return NT_STATUS_LOGON_FAILURE;
-        } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
-                /* Match WinXP and don't give the game away */
-                return NT_STATUS_LOGON_FAILURE;
+        }
-        return nt_status;
+}

vendor/current/source4/auth/ntlm/auth_winbind.c

-              r414
+              r740
 #include "auth/ntlm/auth_proto.h"
 #include "auth/auth_sam_reply.h"
+#include "nsswitch/winbind_client.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
+#include "librpc/gen_ndr/ndr_winbind.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "lib/messaging/irpc.h"
 #include "param/param.h"
 #include "nsswitch/libwbclient/wbclient.h"
+#include "libcli/security/dom_sid.h"
+static NTSTATUS get_info3_from_ndr(TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, struct winbindd_response *response, struct netr_SamInfo3 *info3)
+{
+        size_t len = response->length - sizeof(struct winbindd_response);
+        if (len > 4) {
+                enum ndr_err_code ndr_err;
+                DATA_BLOB blob;
+                blob.length = len - 4;
+                blob.data = (uint8_t *)(((char *)response->extra_data.data) + 4);
+                ndr_err = ndr_pull_struct_blob(&blob, mem_ctx,
+                               iconv_convenience, info3,
+                              (ndr_pull_flags_fn_t)ndr_pull_netr_SamInfo3);
+                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                        return ndr_map_error2ntstatus(ndr_err);
+                }
+                return NT_STATUS_OK;
+        } else {
+                DEBUG(2, ("get_info3_from_ndr: No info3 struct found!\n"));
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+}
+#include "libcli/security/security.h"
 static NTSTATUS get_info3_from_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
-                                               struct smb_iconv_convenience *ic,
                                                struct wbcAuthUserInfo *info,
                                                struct netr_SamInfo3 *info3)
 …
         int i, j;
         struct samr_RidWithAttribute *rids = NULL;
+        struct dom_sid *user_sid;
+        struct dom_sid *group_sid;
+        user_sid = (struct dom_sid *)(void *)&info->sids[0].sid;
+        group_sid = (struct dom_sid *)(void *)&info->sids[1].sid;
         info3->base.last_logon = info->logon_time;
 …
+        }
         dom_sid_split_rid(mem_ctx, (struct dom_sid2 *) &info->sids[0].sid,
+        dom_sid_split_rid(mem_ctx, user_sid,
                           &info3->base.domain_sid,
                           &info3->base.rid);
         dom_sid_split_rid(mem_ctx, (struct dom_sid2 *) &info->sids[1].sid, NULL,
+        dom_sid_split_rid(mem_ctx, group_sid, NULL,
                           &info3->base.primary_gid);
 …
         for (i = 2, j = 0; i < info->num_sids; ++i, ++j) {
+                struct dom_sid *tmp_sid;
+                tmp_sid = (struct dom_sid *)(void *)&info->sids[1].sid;
                 rids[j].attributes = info->sids[i].attributes;
+                dom_sid_split_rid(mem_ctx,
+                                  (struct dom_sid2 *) &info->sids[i].sid,
+                dom_sid_split_rid(mem_ctx, tmp_sid,
                                   NULL, &rids[j].rid);
+        }
 …
         /* TODO: maybe limit the user scope to remote users only */
         return NT_STATUS_OK;
+}
-/*
- Authenticate a user with a challenge/response
- using the samba3 winbind protocol
-*/
-static NTSTATUS winbind_check_password_samba3(struct auth_method_context *ctx,
-                                              TALLOC_CTX *mem_ctx,
-                                              const struct auth_usersupplied_info *user_info,
-                                              struct auth_serversupplied_info **server_info)
+{
-        struct winbindd_request request;
-        struct winbindd_response response;
-        NSS_STATUS result;
-        NTSTATUS nt_status;
-        struct netr_SamInfo3 info3;
-        /* Send off request */
-        const struct auth_usersupplied_info *user_info_temp;
-        nt_status = encrypt_user_info(mem_ctx, ctx->auth_ctx,
-                                      AUTH_PASSWORD_RESPONSE,
-                                      user_info, &user_info_temp);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                return nt_status;
+        }
-        user_info = user_info_temp;
-        ZERO_STRUCT(request);
-        ZERO_STRUCT(response);
-        request.flags = WBFLAG_PAM_INFO3_NDR;
-        request.data.auth_crap.logon_parameters = user_info->logon_parameters;
-        safe_strcpy(request.data.auth_crap.user,
-                       user_info->client.account_name, sizeof(fstring));
-        safe_strcpy(request.data.auth_crap.domain,
-                       user_info->client.domain_name, sizeof(fstring));
-        safe_strcpy(request.data.auth_crap.workstation,
-                       user_info->workstation_name, sizeof(fstring));
-        memcpy(request.data.auth_crap.chal, ctx->auth_ctx->challenge.data.data, sizeof(request.data.auth_crap.chal));
-        request.data.auth_crap.lm_resp_len = MIN(user_info->password.response.lanman.length,
-                                                 sizeof(request.data.auth_crap.lm_resp));
-        request.data.auth_crap.nt_resp_len = MIN(user_info->password.response.nt.length,
-                                                 sizeof(request.data.auth_crap.nt_resp));
-        memcpy(request.data.auth_crap.lm_resp, user_info->password.response.lanman.data,
-               request.data.auth_crap.lm_resp_len);
-        memcpy(request.data.auth_crap.nt_resp, user_info->password.response.nt.data,
-               request.data.auth_crap.nt_resp_len);
-        result = winbindd_request_response(WINBINDD_PAM_AUTH_CRAP, &request, &response);
-        nt_status = NT_STATUS(response.data.auth.nt_status);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
-        if (result == NSS_STATUS_SUCCESS && response.extra_data.data) {
-                union netr_Validation validation;
-                nt_status = get_info3_from_ndr(mem_ctx, lp_iconv_convenience(ctx->auth_ctx->lp_ctx), &response, &info3);
-                SAFE_FREE(response.extra_data.data);
-                NT_STATUS_NOT_OK_RETURN(nt_status);
-                validation.sam3 = &info3;
-                nt_status = make_server_info_netlogon_validation(mem_ctx,
-                                                                 user_info->client.account_name,
-, &validation,
-                                                                 server_info);
-                return nt_status;
-        } else if (result == NSS_STATUS_SUCCESS && !response.extra_data.data) {
-                DEBUG(0, ("Winbindd authenticated the user [%s]\\[%s], "
-                          "but did not include the required info3 reply!\n",
-                          user_info->client.domain_name, user_info->client.account_name));
-                return NT_STATUS_INSUFFICIENT_LOGON_INFO;
-        } else if (NT_STATUS_IS_OK(nt_status)) {
-                DEBUG(1, ("Winbindd authentication for [%s]\\[%s] failed, "
-                          "but no error code is available!\n",
-                          user_info->client.domain_name, user_info->client.account_name));
-                return NT_STATUS_NO_LOGON_SERVERS;
+        }
-        return nt_status;
+}
 …
                                        TALLOC_CTX *mem_ctx,
                                        const struct auth_usersupplied_info *user_info,
                                        struct auth_serversupplied_info **server_info)
+                                       struct auth_user_info_dc **user_info_dc)
+{
         NTSTATUS status;
         struct server_id *winbind_servers;
+        struct dcerpc_binding_handle *irpc_handle;
         struct winbind_check_password_state *s;
         const struct auth_usersupplied_info *user_info_new;
         struct netr_IdentityInfo *identity_info;
+        if (!ctx->auth_ctx->msg_ctx) {
+                DEBUG(0,("winbind_check_password: auth_context_create was called with out messaging context\n"));
+                return NT_STATUS_INTERNAL_ERROR;
+        }
         s = talloc(mem_ctx, struct winbind_check_password_state);
         NT_STATUS_HAVE_NO_MEMORY(s);
+        winbind_servers = irpc_servers_byname(ctx->auth_ctx->msg_ctx, s, "winbind_server");
+        if ((winbind_servers == NULL) || (winbind_servers[0].id == 0)) {
+        irpc_handle = irpc_binding_handle_by_name(s, ctx->auth_ctx->msg_ctx,
+                                                  "winbind_server",
+                                                  &ndr_table_winbind);
+        if (irpc_handle == NULL) {
                 DEBUG(0, ("Winbind authentication for [%s]\\[%s] failed, "
                           "no winbind_server running!\n",
 …
         } else {
                 struct netr_NetworkInfo *network_info;
                 const uint8_t *challenge;
+                uint8_t chal[8];
                 status = encrypt_user_info(s, ctx->auth_ctx, AUTH_PASSWORD_RESPONSE,
 …
                 NT_STATUS_HAVE_NO_MEMORY(network_info);
                 status = auth_get_challenge(ctx->auth_ctx, &challenge);
+                status = auth_get_challenge(ctx->auth_ctx, chal);
                 NT_STATUS_NOT_OK_RETURN(status);
                 memcpy(network_info->challenge, challenge, sizeof(network_info->challenge));
+                memcpy(network_info->challenge, chal, sizeof(network_info->challenge));
                 network_info->nt.length = user_info->password.response.nt.length;
 …
         s->req.in.validation_level      = 3;
+        status = IRPC_CALL(ctx->auth_ctx->msg_ctx, winbind_servers[0],
+                           winbind, WINBIND_SAMLOGON,
+                           &s->req, s);
+        status = dcerpc_winbind_SamLogon_r(irpc_handle, s, &s->req);
         NT_STATUS_NOT_OK_RETURN(status);
         status = make_server_info_netlogon_validation(mem_ctx,
+        status = make_user_info_dc_netlogon_validation(mem_ctx,
                                                       user_info->client.account_name,
                                                       s->req.in.validation_level,
                                                       &s->req.out.validation,
                                                       server_info);
+                                                      user_info_dc);
         NT_STATUS_NOT_OK_RETURN(status);
 …
                                                 TALLOC_CTX *mem_ctx,
                                                 const struct auth_usersupplied_info *user_info,
                                                 struct auth_serversupplied_info **server_info)
+                                                struct auth_user_info_dc **user_info_dc)
+{
         struct wbcAuthUserParams params;
 …
         wbc_status = wbcAuthenticateUserEx(&params, &info, &err);
         if (!WBC_ERROR_IS_OK(wbc_status)) {
+        if (wbc_status == WBC_ERR_AUTH_ERROR) {
                 DEBUG(1, ("error was %s (0x%08x)\nerror message was '%s'\n",
                       err->nt_string, err->nt_status, err->display_string));
 …
                 wbcFreeMemory(err);
                 NT_STATUS_NOT_OK_RETURN(nt_status);
+        }
+        nt_status = get_info3_from_wbcAuthUserInfo(mem_ctx,
+                                lp_iconv_convenience(ctx->auth_ctx->lp_ctx),
+                                info, &info3);
+        } else if (!WBC_ERROR_IS_OK(wbc_status)) {
+                DEBUG(1, ("wbcAuthenticateUserEx: failed with %u - %s\n",
+                        wbc_status, wbcErrorString(wbc_status)));
+                return NT_STATUS_LOGON_FAILURE;
+        }
+        nt_status = get_info3_from_wbcAuthUserInfo(mem_ctx, info, &info3);
         wbcFreeMemory(info);
         NT_STATUS_NOT_OK_RETURN(nt_status);
         validation.sam3 = &info3;
         nt_status = make_server_info_netlogon_validation(mem_ctx,
+        nt_status = make_user_info_dc_netlogon_validation(mem_ctx,
                                         user_info->client.account_name,
 , &validation, server_info);
+, &validation, user_info_dc);
         return nt_status;
+}
-static const struct auth_operations winbind_samba3_ops = {
-        .name           = "winbind_samba3",
-        .get_challenge  = auth_get_challenge_not_implemented,
-        .want_check     = winbind_want_check,
-        .check_password = winbind_check_password_samba3
-};
 static const struct auth_operations winbind_ops = {
 …
         NTSTATUS ret;
-        ret = auth_register(&winbind_samba3_ops);
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(0,("Failed to register 'winbind_samba3' auth backend!\n"));
-                return ret;
+        }
         ret = auth_register(&winbind_ops);
         if (!NT_STATUS_IS_OK(ret)) {

vendor/current/source4/auth/ntlmssp/ntlmssp.c

-              r414
+              r740
 #include "includes.h"
 #include "auth/ntlmssp/ntlmssp.h"
-#include "../librpc/gen_ndr/ntlmssp.h"
 #include "../libcli/auth/libcli_auth.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
-#include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
 #include "auth/gensec/gensec_proto.h"
-#include "param/param.h"
 /**
 …
                 .role           = NTLMSSP_SERVER,
                 .command        = NTLMSSP_NEGOTIATE,
                 .sync_fn        = ntlmssp_server_negotiate,
+                .sync_fn        = gensec_ntlmssp_server_negotiate,
         },{
                 .role           = NTLMSSP_CLIENT,
 …
                 .role           = NTLMSSP_SERVER,
                 .command        = NTLMSSP_AUTH,
                 .sync_fn        = ntlmssp_server_auth,
+                .sync_fn        = gensec_ntlmssp_server_auth,
+        }
 };
-/**
- * Print out the NTLMSSP flags for debugging
- * @param neg_flags The flags from the packet
- */
-void debug_ntlmssp_flags(uint32_t neg_flags)
+{
-        DEBUG(3,("Got NTLMSSP neg_flags=0x%08x\n", neg_flags));
-        if (neg_flags & NTLMSSP_NEGOTIATE_UNICODE)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_UNICODE\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_OEM)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_OEM\n"));
-        if (neg_flags & NTLMSSP_REQUEST_TARGET)
-                DEBUGADD(4, ("  NTLMSSP_REQUEST_TARGET\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_SIGN)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_SIGN\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_SEAL)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_SEAL\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_DATAGRAM)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_DATAGRAM\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_LM_KEY\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_NETWARE)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_NETWARE\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_NTLM)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_NTLM\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_ALWAYS_SIGN\n"));
-        if (neg_flags & NTLMSSP_REQUEST_NON_NT_SESSION_KEY)
-                DEBUGADD(4, ("  NTLMSSP_REQUEST_NON_NT_SESSION_KEY\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_NTLM2)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_NTLM2\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_TARGET_INFO)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_TARGET_INFO\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_128)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_128\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_KEY_EXCH\n"));
-        if (neg_flags & NTLMSSP_NEGOTIATE_56)
-                DEBUGADD(4, ("  NTLMSSP_NEGOTIATE_56\n"));
+}
 static NTSTATUS gensec_ntlmssp_magic(struct gensec_security *gensec_security,
 …
+}
 static NTSTATUS gensec_ntlmssp_update_find(struct gensec_ntlmssp_state *gensec_ntlmssp_state,
+static NTSTATUS gensec_ntlmssp_update_find(struct ntlmssp_state *ntlmssp_state,
                                            const DATA_BLOB input, uint32_t *idx)
+{
+        struct gensec_security *gensec_security = gensec_ntlmssp_state->gensec_security;
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(ntlmssp_state->callback_private,
+                                      struct gensec_ntlmssp_context);
+        struct gensec_security *gensec_security = gensec_ntlmssp->gensec_security;
         uint32_t ntlmssp_command;
         uint32_t i;
         if (gensec_ntlmssp_state->expected_state == NTLMSSP_DONE) {
+        if (ntlmssp_state->expected_state == NTLMSSP_DONE) {
                 /* We are strict here because other modules, which we
                  * don't fully control (such as GSSAPI) are also
 …
         if (!input.length) {
                 switch (gensec_ntlmssp_state->role) {
+                switch (ntlmssp_state->role) {
                 case NTLMSSP_CLIENT:
                         ntlmssp_command = NTLMSSP_INITIAL;
 …
+                }
         } else {
                 if (!msrpc_parse(gensec_ntlmssp_state,
+                if (!msrpc_parse(ntlmssp_state,
                                  &input, "Cd",
                                  "NTLMSSP",
 …
+        }
         if (ntlmssp_command != gensec_ntlmssp_state->expected_state) {
                 DEBUG(2, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command, gensec_ntlmssp_state->expected_state));
+        if (ntlmssp_command != ntlmssp_state->expected_state) {
+                DEBUG(2, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command, ntlmssp_state->expected_state));
                 return NT_STATUS_INVALID_PARAMETER;
+        }
         for (i=0; i < ARRAY_SIZE(ntlmssp_callbacks); i++) {
                 if (ntlmssp_callbacks[i].role == gensec_ntlmssp_state->role &&
+                if (ntlmssp_callbacks[i].role == ntlmssp_state->role &&
                     ntlmssp_callbacks[i].command == ntlmssp_command) {
                         *idx = i;
 …
         DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
                   gensec_ntlmssp_state->role, ntlmssp_command));
+                  ntlmssp_state->role, ntlmssp_command));
         return NT_STATUS_INVALID_PARAMETER;
 …
                                       const DATA_BLOB input, DATA_BLOB *out)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
         NTSTATUS status;
         uint32_t i;
 …
                 /* if the caller doesn't want to manage/own the memory,
                    we can put it on our context */
                 out_mem_ctx = gensec_ntlmssp_state;
+        }
         status = gensec_ntlmssp_update_find(gensec_ntlmssp_state, input, &i);
+                out_mem_ctx = ntlmssp_state;
+        }
+        status = gensec_ntlmssp_update_find(ntlmssp_state, input, &i);
         NT_STATUS_NOT_OK_RETURN(status);
 …
  * Return the NTLMSSP master session key
+ *
  * @param gensec_ntlmssp_state NTLMSSP State
+ * @param ntlmssp_state NTLMSSP State
  */
 …
                                     DATA_BLOB *session_key)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        if (gensec_ntlmssp_state->expected_state != NTLMSSP_DONE) {
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
+        if (ntlmssp_state->expected_state != NTLMSSP_DONE) {
                 return NT_STATUS_NO_USER_SESSION_KEY;
+        }
         if (!gensec_ntlmssp_state->session_key.data) {
+        if (!ntlmssp_state->session_key.data) {
                 return NT_STATUS_NO_USER_SESSION_KEY;
+        }
         *session_key = gensec_ntlmssp_state->session_key;
+        *session_key = ntlmssp_state->session_key;
         return NT_STATUS_OK;
+}
-void ntlmssp_handle_neg_flags(struct gensec_ntlmssp_state *gensec_ntlmssp_state,
-                              uint32_t neg_flags, bool allow_lm)
+{
-        if (neg_flags & NTLMSSP_NEGOTIATE_UNICODE) {
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_OEM;
-                gensec_ntlmssp_state->unicode = true;
-        } else {
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_UNICODE;
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
-                gensec_ntlmssp_state->unicode = false;
+        }
-        if ((neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) && allow_lm && !gensec_ntlmssp_state->use_ntlmv2) {
-                /* other end forcing us to use LM */
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_LM_KEY;
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
-        } else {
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
+        }
-        if (!(neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+        }
-        if (!(neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SIGN;
+        }
-        if (!(neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SEAL;
+        }
-        if (!(neg_flags & NTLMSSP_NEGOTIATE_NTLM2)) {
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
+        }
-        if (!(neg_flags & NTLMSSP_NEGOTIATE_128)) {
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_128;
+        }
-        if (!(neg_flags & NTLMSSP_NEGOTIATE_56)) {
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_56;
+        }
-        if (!(neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_KEY_EXCH;
+        }
-        /* Woop Woop - unknown flag for Windows compatibility...
-           What does this really do ? JRA. */
-        if (!(neg_flags & NTLMSSP_NEGOTIATE_VERSION)) {
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_VERSION;
+        }
-        if ((neg_flags & NTLMSSP_REQUEST_TARGET)) {
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_REQUEST_TARGET;
+        }
+}
-/**
-   Weaken NTLMSSP keys to cope with down-level clients and servers.
-   We probably should have some parameters to control this, but as
-   it only occours for LM_KEY connections, and this is controlled
-   by the client lanman auth/lanman auth parameters, it isn't too bad.
-*/
-DATA_BLOB ntlmssp_weakend_key(struct gensec_ntlmssp_state *gensec_ntlmssp_state,
-                              TALLOC_CTX *mem_ctx)
+{
-        DATA_BLOB weakened_key = data_blob_talloc(mem_ctx,
-                                                  gensec_ntlmssp_state->session_key.data,
-                                                  gensec_ntlmssp_state->session_key.length);
-        /* Nothing to weaken.  We certainly don't want to 'extend' the length... */
-        if (weakened_key.length < 16) {
-                /* perhaps there was no key? */
-                return weakened_key;
+        }
-        /* Key weakening not performed on the master key for NTLM2
-           and does not occour for NTLM1.  Therefore we only need
-           to do this for the LM_KEY.
-        */
-        if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
-                /* LM key doesn't support 128 bit crypto, so this is
-                 * the best we can do.  If you negotiate 128 bit, but
-                 * not 56, you end up with 40 bit... */
-                if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
-                        weakened_key.data[7] = 0xa0;
-                        weakened_key.length = 8;
-                } else { /* forty bits */
-                        weakened_key.data[5] = 0xe5;
-                        weakened_key.data[6] = 0x38;
-                        weakened_key.data[7] = 0xb0;
-                        weakened_key.length = 8;
+                }
+        }
-        return weakened_key;
+}
 …
                                         uint32_t feature)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
         if (feature & GENSEC_FEATURE_SIGN) {
                 if (!gensec_ntlmssp_state->session_key.length) {
+                if (!ntlmssp_state->session_key.length) {
                         return false;
+                }
                 if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
+                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
                         return true;
+                }
+        }
         if (feature & GENSEC_FEATURE_SEAL) {
                 if (!gensec_ntlmssp_state->session_key.length) {
+                if (!ntlmssp_state->session_key.length) {
                         return false;
+                }
                 if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
+                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
                         return true;
+                }
+        }
         if (feature & GENSEC_FEATURE_SESSION_KEY) {
                 if (gensec_ntlmssp_state->session_key.length) {
+                if (ntlmssp_state->session_key.length) {
                         return true;
+                }
 …
+        }
         if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
                 if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
                         return true;
+                }
 …
 NTSTATUS gensec_ntlmssp_start(struct gensec_security *gensec_security)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state;
+        gensec_ntlmssp_state = talloc_zero(gensec_security, struct gensec_ntlmssp_state);
+        if (!gensec_ntlmssp_state) {
+        struct gensec_ntlmssp_context *gensec_ntlmssp;
+        struct ntlmssp_state *ntlmssp_state;
+        gensec_ntlmssp = talloc_zero(gensec_security,
+                                     struct gensec_ntlmssp_context);
+        if (!gensec_ntlmssp) {
                 return NT_STATUS_NO_MEMORY;
+        }
+        gensec_ntlmssp_state->gensec_security = gensec_security;
+        gensec_ntlmssp_state->auth_context = NULL;
+        gensec_ntlmssp_state->server_info = NULL;
+        gensec_security->private_data = gensec_ntlmssp_state;
+        gensec_ntlmssp->gensec_security = gensec_security;
+        ntlmssp_state = talloc_zero(gensec_ntlmssp,
+                                    struct ntlmssp_state);
+        if (!ntlmssp_state) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        ntlmssp_state->callback_private = gensec_ntlmssp;
+        gensec_ntlmssp->ntlmssp_state = ntlmssp_state;
+        gensec_security->private_data = gensec_ntlmssp;
         return NT_STATUS_OK;
+}
 …
 static const struct gensec_security_ops gensec_ntlmssp_security_ops = {
         .name           = "ntlmssp",
         .sasl_name      = "NTLM",
+        .sasl_name      = GENSEC_SASL_NAME_NTLMSSP, /* "NTLM" */
         .auth_type      = DCERPC_AUTH_TYPE_NTLMSSP,
         .oid            = gensec_ntlmssp_oids,

vendor/current/source4/auth/ntlmssp/ntlmssp.h

-              r414
+              r740
 /*
+/*
    Unix SMB/CIFS implementation.
    SMB parameters and setup
 …
    Copyright (C) Luke Kenneth Casson Leighton 1996-1997
    Copyright (C) Paul Ashton 1997
+   Copyright (C) Andrew Bartlett 2010
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
-#include "librpc/gen_ndr/samr.h"
 #include "../librpc/gen_ndr/ntlmssp.h"
+#include "../libcli/auth/ntlmssp.h"
+/* NTLMSSP mode */
+enum ntlmssp_role
+{
+        NTLMSSP_SERVER,
+        NTLMSSP_CLIENT
+};
+/* NTLMSSP message types */
+enum ntlmssp_message_type
+{
+        NTLMSSP_INITIAL = 0 /* samba internal state */,
+        NTLMSSP_NEGOTIATE = 1,
+        NTLMSSP_CHALLENGE = 2,
+        NTLMSSP_AUTH      = 3,
+        NTLMSSP_UNKNOWN   = 4,
+        NTLMSSP_DONE   = 5 /* samba final state */
+};
+struct gensec_ntlmssp_state
+{
+struct gensec_ntlmssp_context {
         struct gensec_security *gensec_security;
+        enum ntlmssp_role role;
+        enum samr_Role server_role;
+        uint32_t expected_state;
+        bool unicode;
+        bool use_ntlmv2;
+        bool use_nt_response;  /* Set to 'False' to debug what happens when the NT response is omited */
+        bool allow_lm_key;     /* The LM_KEY code is not functional at this point, and it's not
+                                  very secure anyway */
+        bool server_multiple_authentications;  /* Set to 'True' to allow squid 2.5
+                                                  style 'challenge caching' */
+        char *user;
+        const char *domain;
+        const char *workstation;
+        char *server_domain;
+        DATA_BLOB internal_chal; /* Random challenge as supplied to the client for NTLM authentication */
+        DATA_BLOB chal; /* Random challenge as input into the actual NTLM (or NTLM2) authentication */
+        DATA_BLOB lm_resp;
+        DATA_BLOB nt_resp;
+        DATA_BLOB session_key;
+        uint32_t neg_flags; /* the current state of negotiation with the NTLMSSP partner */
+        /* internal variables used by KEY_EXCH (client-supplied user session key */
+        DATA_BLOB encrypted_session_key;
+        /**
+         * Callback to get the 'challenge' used for NTLM authentication.
+         *
+         * @param ntlmssp_state This structure
+         * @return 8 bytes of challenge data, determined by the server to be the challenge for NTLM authentication
+         *
+         */
+        const uint8_t *(*get_challenge)(const struct gensec_ntlmssp_state *);
+        /**
+         * Callback to find if the challenge used by NTLM authentication may be modified
+         *
+         * The NTLM2 authentication scheme modifies the effective challenge, but this is not compatiable with the
+         * current 'security=server' implementation..
+         *
+         * @param ntlmssp_state This structure
+         * @return Can the challenge be set to arbitary values?
+         *
+         */
+        bool (*may_set_challenge)(const struct gensec_ntlmssp_state *);
+        /**
+         * Callback to set the 'challenge' used for NTLM authentication.
+         *
+         * The callback may use the void *auth_context to store state information, but the same value is always available
+         * from the DATA_BLOB chal on this structure.
+         *
+         * @param ntlmssp_state This structure
+         * @param challenge 8 bytes of data, agreed by the client and server to be the effective challenge for NTLM2 authentication
+         *
+         */
+        NTSTATUS (*set_challenge)(struct gensec_ntlmssp_state *, DATA_BLOB *challenge);
+        /**
+         * Callback to check the user's password.
+         *
+         * The callback must reads the feilds of this structure for the information it needs on the user
+         * @param ntlmssp_state This structure
+         * @param nt_session_key If an NT session key is returned by the authentication process, return it here
+         * @param lm_session_key If an LM session key is returned by the authentication process, return it here
+         *
+         */
+        NTSTATUS (*check_password)(struct gensec_ntlmssp_state *,
+                                   TALLOC_CTX *mem_ctx,
+                                   DATA_BLOB *nt_session_key, DATA_BLOB *lm_session_key);
+        const char *server_name;
+        bool doing_ntlm2;
+        union {
+                /* NTLM */
+                struct {
+                        uint32_t seq_num;
+                        struct arcfour_state *arcfour_state;
+                } ntlm;
+                /* NTLM2 */
+                struct {
+                        uint32_t send_seq_num;
+                        uint32_t recv_seq_num;
+                        DATA_BLOB send_sign_key;
+                        DATA_BLOB recv_sign_key;
+                        struct arcfour_state *send_seal_arcfour_state;
+                        struct arcfour_state *recv_seal_arcfour_state;
+                        /* internal variables used by NTLM2 */
+                        uint8_t session_nonce[16];
+                } ntlm2;
+        } crypt;
+        struct ntlmssp_state *ntlmssp_state;
         struct auth_context *auth_context;
         struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
 };
 …
 struct auth_session_info;
+NTSTATUS gensec_ntlmssp_init(void);
 #include "auth/ntlmssp/proto.h"

vendor/current/source4/auth/ntlmssp/ntlmssp_client.c

-              r414
+              r740
 #include "includes.h"
 #include "auth/ntlmssp/ntlmssp.h"
-#include "../librpc/gen_ndr/ntlmssp.h"
 #include "../lib/crypto/crypto.h"
 #include "../libcli/auth/libcli_auth.h"
 …
 #include "auth/gensec/gensec.h"
 #include "param/param.h"
+#include "libcli/auth/ntlmssp_private.h"
 /*********************************************************************
 …
                                 DATA_BLOB in, DATA_BLOB *out)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        const char *domain = gensec_ntlmssp_state->domain;
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
+        const char *domain = ntlmssp_state->domain;
         const char *workstation = cli_credentials_get_workstation(gensec_security->credentials);
+        NTSTATUS status;
         /* These don't really matter in the initial packet, so don't panic if they are not set */
 …
+        }
         if (gensec_ntlmssp_state->unicode) {
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
+        if (ntlmssp_state->unicode) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
         } else {
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
+        }
         if (gensec_ntlmssp_state->use_ntlmv2) {
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
+        if (ntlmssp_state->use_ntlmv2) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
+        }
         /* generate the ntlmssp negotiate packet */
         msrpc_gen(out_mem_ctx,
+        status = msrpc_gen(out_mem_ctx,
                   out, "CddAA",
                   "NTLMSSP",
                   NTLMSSP_NEGOTIATE,
                   gensec_ntlmssp_state->neg_flags,
+                  ntlmssp_state->neg_flags,
                   domain,
                   workstation);
+        gensec_ntlmssp_state->expected_state = NTLMSSP_CHALLENGE;
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+        ntlmssp_state->expected_state = NTLMSSP_CHALLENGE;
         return NT_STATUS_MORE_PROCESSING_REQUIRED;
 …
                                   const DATA_BLOB in, DATA_BLOB *out)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
         uint32_t chal_flags, ntlmssp_command, unkn1, unkn2;
         DATA_BLOB server_domain_blob;
 …
         debug_ntlmssp_flags(chal_flags);
         ntlmssp_handle_neg_flags(gensec_ntlmssp_state, chal_flags, gensec_ntlmssp_state->allow_lm_key);
         if (gensec_ntlmssp_state->unicode) {
+        ntlmssp_handle_neg_flags(ntlmssp_state, chal_flags, ntlmssp_state->allow_lm_key);
+        if (ntlmssp_state->unicode) {
                 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
                         chal_parse_string = "CdUdbddB";
 …
+        }
+        gensec_ntlmssp_state->server_domain = server_domain;
+        if (chal_flags & NTLMSSP_TARGET_TYPE_SERVER) {
+                ntlmssp_state->server.is_standalone = true;
+        } else {
+                ntlmssp_state->server.is_standalone = false;
+        }
+        /* TODO: parse struct_blob and fill in the rest */
+        ntlmssp_state->server.netbios_name = "";
+        ntlmssp_state->server.netbios_domain = server_domain;
+        ntlmssp_state->server.dns_name = "";
+        ntlmssp_state->server.dns_domain = "";
         if (challenge_blob.length != 8) {
 …
                                                  &user, &domain);
         if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
                 flags |= CLI_CRED_NTLM2;
+        }
         if (gensec_ntlmssp_state->use_ntlmv2) {
+        if (ntlmssp_state->use_ntlmv2) {
                 flags |= CLI_CRED_NTLMv2_AUTH;
+        }
         if (gensec_ntlmssp_state->use_nt_response) {
+        if (ntlmssp_state->use_nt_response) {
                 flags |= CLI_CRED_NTLM_AUTH;
+        }
         if (lp_client_lanman_auth(gensec_security->settings->lp_ctx)) {
+        if (lpcfg_client_lanman_auth(gensec_security->settings->lp_ctx)) {
                 flags |= CLI_CRED_LANMAN_AUTH;
+        }
 …
                 /* LM Key is still possible, just silly.  Fortunetly
                  * we require command line options to end up here */
                 /* gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY; */
+                /* ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY; */
+        }
         if (!(flags & CLI_CRED_NTLM2)) {
                 /* NTLM2 is incompatible... */
                 gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
+        }
         if ((gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
             && lp_client_lanman_auth(gensec_security->settings->lp_ctx) && lm_session_key.length == 16) {
+        if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
+            && lpcfg_client_lanman_auth(gensec_security->settings->lp_ctx) && lm_session_key.length == 16) {
                 DATA_BLOB new_session_key = data_blob_talloc(mem_ctx, NULL, 16);
                 if (lm_response.length == 24) {
 …
         /* Key exchange encryptes a new client-generated session key with
            the password-derived key */
         if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
+        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
                 /* Make up a new session key */
                 uint8_t client_session_key[16];
 …
                 /* Encrypt the new session key with the old one */
                 encrypted_session_key = data_blob_talloc(gensec_ntlmssp_state,
+                encrypted_session_key = data_blob_talloc(ntlmssp_state,
                                                          client_session_key, sizeof(client_session_key));
                 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length);
 …
         DEBUG(3, ("NTLMSSP: Set final flags:\n"));
         debug_ntlmssp_flags(gensec_ntlmssp_state->neg_flags);
+        debug_ntlmssp_flags(ntlmssp_state->neg_flags);
         /* this generates the actual auth packet */
         if (!msrpc_gen(mem_ctx,
+        nt_status = msrpc_gen(mem_ctx,
                        out, auth_gen_string,
                        "NTLMSSP",
 …
                        cli_credentials_get_workstation(gensec_security->credentials),
                        encrypted_session_key.data, encrypted_session_key.length,
+                       gensec_ntlmssp_state->neg_flags)) {
+                       ntlmssp_state->neg_flags);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(mem_ctx);
                 return NT_STATUS_NO_MEMORY;
+        }
         gensec_ntlmssp_state->session_key = session_key;
         talloc_steal(gensec_ntlmssp_state, session_key.data);
+                return nt_status;
+        }
+        ntlmssp_state->session_key = session_key;
+        talloc_steal(ntlmssp_state, session_key.data);
         talloc_steal(out_mem_ctx, out->data);
         gensec_ntlmssp_state->chal = challenge_blob;
         gensec_ntlmssp_state->lm_resp = lm_response;
         talloc_steal(gensec_ntlmssp_state->lm_resp.data, lm_response.data);
         gensec_ntlmssp_state->nt_resp = nt_response;
         talloc_steal(gensec_ntlmssp_state->nt_resp.data, nt_response.data);
         gensec_ntlmssp_state->expected_state = NTLMSSP_DONE;
+        ntlmssp_state->chal = challenge_blob;
+        ntlmssp_state->lm_resp = lm_response;
+        talloc_steal(ntlmssp_state->lm_resp.data, lm_response.data);
+        ntlmssp_state->nt_resp = nt_response;
+        talloc_steal(ntlmssp_state->nt_resp.data, nt_response.data);
+        ntlmssp_state->expected_state = NTLMSSP_DONE;
         if (gensec_security->want_features & (GENSEC_FEATURE_SIGN|GENSEC_FEATURE_SEAL)) {
                 nt_status = ntlmssp_sign_init(gensec_ntlmssp_state);
+                nt_status = ntlmssp_sign_init(ntlmssp_state);
                 if (!NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n",
 …
 NTSTATUS gensec_ntlmssp_client_start(struct gensec_security *gensec_security)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state;
+        struct gensec_ntlmssp_context *gensec_ntlmssp;
+        struct ntlmssp_state *ntlmssp_state;
         NTSTATUS nt_status;
 …
         NT_STATUS_NOT_OK_RETURN(nt_status);
+        gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        gensec_ntlmssp_state->role = NTLMSSP_CLIENT;
+        gensec_ntlmssp_state->domain = lp_workgroup(gensec_security->settings->lp_ctx);
+        gensec_ntlmssp_state->unicode = gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "unicode", true);
+        gensec_ntlmssp_state->use_nt_response = gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "send_nt_reponse", true);
+        gensec_ntlmssp_state->allow_lm_key = (lp_client_lanman_auth(gensec_security->settings->lp_ctx)
+        gensec_ntlmssp = talloc_get_type_abort(gensec_security->private_data,
+                                               struct gensec_ntlmssp_context);
+        ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
+        ntlmssp_state->role = NTLMSSP_CLIENT;
+        ntlmssp_state->domain = lpcfg_workgroup(gensec_security->settings->lp_ctx);
+        ntlmssp_state->unicode = gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "unicode", true);
+        ntlmssp_state->use_nt_response = gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "send_nt_reponse", true);
+        ntlmssp_state->allow_lm_key = (lpcfg_client_lanman_auth(gensec_security->settings->lp_ctx)
                                               && (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "allow_lm_key", false)
                                                   || gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "lm_key", false)));
         gensec_ntlmssp_state->use_ntlmv2 = lp_client_ntlmv2_auth(gensec_security->settings->lp_ctx);
         gensec_ntlmssp_state->expected_state = NTLMSSP_INITIAL;
         gensec_ntlmssp_state->neg_flags =
+        ntlmssp_state->use_ntlmv2 = lpcfg_client_ntlmv2_auth(gensec_security->settings->lp_ctx);
+        ntlmssp_state->expected_state = NTLMSSP_INITIAL;
+        ntlmssp_state->neg_flags =
                 NTLMSSP_NEGOTIATE_NTLM |
                 NTLMSSP_REQUEST_TARGET;
         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "128bit", true)) {
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_128;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_128;
+        }
         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "56bit", false)) {
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_56;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_56;
+        }
         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "lm_key", false)) {
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_LM_KEY;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_LM_KEY;
+        }
         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "keyexchange", true)) {
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_KEY_EXCH;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_KEY_EXCH;
+        }
         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "alwayssign", true)) {
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+        }
         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "ntlm2", true)) {
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
         } else {
                 /* apparently we can't do ntlmv2 if we don't do ntlm2 */
                 gensec_ntlmssp_state->use_ntlmv2 = false;
+                ntlmssp_state->use_ntlmv2 = false;
+        }
 …
                  * sealing.  (It is actually pulled out and used directly)
                  */
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+        }
         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+        }
         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
+                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
+        }
+        gensec_security->private_data = gensec_ntlmssp_state;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
+        }
         return NT_STATUS_OK;

vendor/current/source4/auth/ntlmssp/ntlmssp_server.c

-              r414
+              r740
 #include "includes.h"
 #include "system/network.h"
+#include "lib/tsocket/tsocket.h"
 #include "auth/ntlmssp/ntlmssp.h"
+#include "../librpc/gen_ndr/ntlmssp.h"
+#include "../librpc/gen_ndr/ndr_ntlmssp.h"
+#include "../libcli/auth/ntlmssp_ndr.h"
+#include "../libcli/auth/ntlmssp_private.h"
 #include "../libcli/auth/libcli_auth.h"
 #include "../lib/crypto/crypto.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
 #include "auth/auth.h"
-#include "auth/ntlm/auth_proto.h"
 #include "param/param.h"
+#include "auth/session_proto.h"
+/**
+ * Set a username on an NTLMSSP context - ensures it is talloc()ed
+ *
+ */
+static NTSTATUS ntlmssp_set_username(struct gensec_ntlmssp_state *gensec_ntlmssp_state, const char *user)
+{
+        if (!user) {
+                /* it should be at least "" */
+                DEBUG(1, ("NTLMSSP failed to set username - cannot accept NULL username\n"));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        gensec_ntlmssp_state->user = talloc_strdup(gensec_ntlmssp_state, user);
+        if (!gensec_ntlmssp_state->user) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        return NT_STATUS_OK;
+}
+/**
+ * Set a domain on an NTLMSSP context - ensures it is talloc()ed
+ *
+ */
+static NTSTATUS ntlmssp_set_domain(struct gensec_ntlmssp_state *gensec_ntlmssp_state, const char *domain)
+{
+        gensec_ntlmssp_state->domain = talloc_strdup(gensec_ntlmssp_state, domain);
+        if (!gensec_ntlmssp_state->domain) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        return NT_STATUS_OK;
+}
+/**
+ * Set a workstation on an NTLMSSP context - ensures it is talloc()ed
+ *
+ */
+static NTSTATUS ntlmssp_set_workstation(struct gensec_ntlmssp_state *gensec_ntlmssp_state, const char *workstation)
+{
+        gensec_ntlmssp_state->workstation = talloc_strdup(gensec_ntlmssp_state, workstation);
+        if (!gensec_ntlmssp_state->workstation) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        return NT_STATUS_OK;
+}
+/**
+ * Determine correct target name flags for reply, given server role
+ * and negotiated flags
+ *
+ * @param gensec_ntlmssp_state NTLMSSP State
+ * @param neg_flags The flags from the packet
+ * @param chal_flags The flags to be set in the reply packet
+ * @return The 'target name' string.
+ */
+static const char *ntlmssp_target_name(struct gensec_ntlmssp_state *gensec_ntlmssp_state,
+                                       uint32_t neg_flags, uint32_t *chal_flags)
+{
+        if (neg_flags & NTLMSSP_REQUEST_TARGET) {
+                *chal_flags |= NTLMSSP_NEGOTIATE_TARGET_INFO;
+                *chal_flags |= NTLMSSP_REQUEST_TARGET;
+                if (gensec_ntlmssp_state->server_role == ROLE_STANDALONE) {
+                        *chal_flags |= NTLMSSP_TARGET_TYPE_SERVER;
+                        return gensec_ntlmssp_state->server_name;
+                } else {
+                        *chal_flags |= NTLMSSP_TARGET_TYPE_DOMAIN;
+                        return gensec_ntlmssp_state->domain;
+                };
+        } else {
+                return "";
+        }
+}
+/**
+ * Next state function for the Negotiate packet
+ *
+/**
+ * Next state function for the Negotiate packet (GENSEC wrapper)
+ *
  * @param gensec_security GENSEC state
  * @param out_mem_ctx Memory context for *out
  * @param in The request, as a DATA_BLOB.  reply.data must be NULL
  * @param out The reply, as an allocated DATA_BLOB, caller to free.
+ * @return Errors or MORE_PROCESSING_REQUIRED if (normal) a reply is required.
+ */
+NTSTATUS ntlmssp_server_negotiate(struct gensec_security *gensec_security,
+                                  TALLOC_CTX *out_mem_ctx,
+                                  const DATA_BLOB in, DATA_BLOB *out)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        DATA_BLOB struct_blob;
+        uint32_t neg_flags = 0;
+        uint32_t ntlmssp_command, chal_flags;
+        const uint8_t *cryptkey;
+        const char *target_name;
+        /* parse the NTLMSSP packet */
+#if 0
+        file_save("ntlmssp_negotiate.dat", request.data, request.length);
+#endif
+        if (in.length) {
+                if ((in.length < 16) || !msrpc_parse(out_mem_ctx,
+                                                         &in, "Cdd",
+                                                         "NTLMSSP",
+                                                         &ntlmssp_command,
+                                                         &neg_flags)) {
+                        DEBUG(1, ("ntlmssp_server_negotiate: failed to parse "
+                                "NTLMSSP Negotiate of length %u:\n",
+                                (unsigned int)in.length ));
+                        dump_data(2, in.data, in.length);
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+                debug_ntlmssp_flags(neg_flags);
+        }
+        ntlmssp_handle_neg_flags(gensec_ntlmssp_state, neg_flags, gensec_ntlmssp_state->allow_lm_key);
+        /* Ask our caller what challenge they would like in the packet */
+        cryptkey = gensec_ntlmssp_state->get_challenge(gensec_ntlmssp_state);
+        if (!cryptkey) {
+                DEBUG(1, ("ntlmssp_server_negotiate: backend doesn't give a challenge\n"));
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        /* Check if we may set the challenge */
+        if (!gensec_ntlmssp_state->may_set_challenge(gensec_ntlmssp_state)) {
+                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
+        }
+        /* The flags we send back are not just the negotiated flags,
+         * they are also 'what is in this packet'.  Therfore, we
+         * operate on 'chal_flags' from here on
+         */
+        chal_flags = gensec_ntlmssp_state->neg_flags;
+        /* get the right name to fill in as 'target' */
+        target_name = ntlmssp_target_name(gensec_ntlmssp_state,
+                                          neg_flags, &chal_flags);
+        if (target_name == NULL)
+ * @return Errors or MORE_PROCESSING_REQUIRED if (normal) a reply is required.
+ */
+NTSTATUS gensec_ntlmssp_server_negotiate(struct gensec_security *gensec_security,
+                                         TALLOC_CTX *out_mem_ctx,
+                                         const DATA_BLOB request, DATA_BLOB *reply)
+{
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
+        return ntlmssp_server_negotiate(ntlmssp_state, out_mem_ctx, request, reply);
+}
+/**
+ * Next state function for the Authenticate packet (GENSEC wrapper)
+ *
+ * @param gensec_security GENSEC state
+ * @param out_mem_ctx Memory context for *out
+ * @param in The request, as a DATA_BLOB.  reply.data must be NULL
+ * @param out The reply, as an allocated DATA_BLOB, caller to free.
+ * @return Errors or NT_STATUS_OK if authentication sucessful
+ */
+NTSTATUS gensec_ntlmssp_server_auth(struct gensec_security *gensec_security,
+                                    TALLOC_CTX *out_mem_ctx,
+                                    const DATA_BLOB in, DATA_BLOB *out)
+{
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
+        return ntlmssp_server_auth(ntlmssp_state, out_mem_ctx, in, out);
+}
+/**
+ * Return the challenge as determined by the authentication subsystem
+ * @return an 8 byte random challenge
+ */
+static NTSTATUS auth_ntlmssp_get_challenge(const struct ntlmssp_state *ntlmssp_state,
+                                           uint8_t chal[8])
+{
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(ntlmssp_state->callback_private,
+                                      struct gensec_ntlmssp_context);
+        struct auth_context *auth_context = gensec_ntlmssp->auth_context;
+        NTSTATUS status;
+        status = auth_context->get_challenge(auth_context, chal);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("auth_ntlmssp_get_challenge: failed to get challenge: %s\n",
+                        nt_errstr(status)));
+                return status;
+        }
+        return NT_STATUS_OK;
+}
+/**
+ * Some authentication methods 'fix' the challenge, so we may not be able to set it
+ *
+ * @return If the effective challenge used by the auth subsystem may be modified
+ */
+static bool auth_ntlmssp_may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
+{
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(ntlmssp_state->callback_private,
+                                      struct gensec_ntlmssp_context);
+        struct auth_context *auth_context = gensec_ntlmssp->auth_context;
+        return auth_context->challenge_may_be_modified(auth_context);
+}
+/**
+ * NTLM2 authentication modifies the effective challenge,
+ * @param challenge The new challenge value
+ */
+static NTSTATUS auth_ntlmssp_set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
+{
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(ntlmssp_state->callback_private,
+                                      struct gensec_ntlmssp_context);
+        struct auth_context *auth_context = gensec_ntlmssp->auth_context;
+        NTSTATUS nt_status;
+        const uint8_t *chal;
+        if (challenge->length != 8) {
                 return NT_STATUS_INVALID_PARAMETER;
+        gensec_ntlmssp_state->chal = data_blob_talloc(gensec_ntlmssp_state, cryptkey, 8);
+        gensec_ntlmssp_state->internal_chal = data_blob_talloc(gensec_ntlmssp_state, cryptkey, 8);
+        /* This creates the 'blob' of names that appears at the end of the packet */
+        if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
+        }
+        chal = challenge->data;
+        nt_status = auth_context->set_challenge(auth_context,
+                                                chal,
+                                                "NTLMSSP callback (NTLM2)");
+        return nt_status;
+}
+/**
+ * Check the password on an NTLMSSP login.
+ *
+ * Return the session keys used on the connection.
+ */
+static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state,
+                                            TALLOC_CTX *mem_ctx,
+                                            DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
+{
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(ntlmssp_state->callback_private,
+                                      struct gensec_ntlmssp_context);
+        struct auth_context *auth_context = gensec_ntlmssp->auth_context;
+        NTSTATUS nt_status;
+        struct auth_usersupplied_info *user_info;
+        user_info = talloc_zero(ntlmssp_state, struct auth_usersupplied_info);
+        if (!user_info) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        user_info->logon_parameters = MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
+        user_info->flags = 0;
+        user_info->mapped_state = false;
+        user_info->client.account_name = ntlmssp_state->user;
+        user_info->client.domain_name = ntlmssp_state->domain;
+        user_info->workstation_name = ntlmssp_state->client.netbios_name;
+        user_info->remote_host = gensec_get_remote_address(gensec_ntlmssp->gensec_security);
+        user_info->password_state = AUTH_PASSWORD_RESPONSE;
+        user_info->password.response.lanman = ntlmssp_state->lm_resp;
+        user_info->password.response.lanman.data = talloc_steal(user_info, ntlmssp_state->lm_resp.data);
+        user_info->password.response.nt = ntlmssp_state->nt_resp;
+        user_info->password.response.nt.data = talloc_steal(user_info, ntlmssp_state->nt_resp.data);
+        nt_status = auth_context->check_password(auth_context,
+                                                 gensec_ntlmssp,
+                                                 user_info,
+                                                 &gensec_ntlmssp->user_info_dc);
+        talloc_free(user_info);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+        if (gensec_ntlmssp->user_info_dc->user_session_key.length) {
+                DEBUG(10, ("Got NT session key of length %u\n",
+                           (unsigned)gensec_ntlmssp->user_info_dc->user_session_key.length));
+                *user_session_key = gensec_ntlmssp->user_info_dc->user_session_key;
+                talloc_steal(mem_ctx, user_session_key->data);
+                gensec_ntlmssp->user_info_dc->user_session_key = data_blob_null;
+        }
+        if (gensec_ntlmssp->user_info_dc->lm_session_key.length) {
+                DEBUG(10, ("Got LM session key of length %u\n",
+                           (unsigned)gensec_ntlmssp->user_info_dc->lm_session_key.length));
+                *lm_session_key = gensec_ntlmssp->user_info_dc->lm_session_key;
+                talloc_steal(mem_ctx, lm_session_key->data);
+                gensec_ntlmssp->user_info_dc->lm_session_key = data_blob_null;
+        }
+        return nt_status;
+}
+/**
+ * Return the credentials of a logged on user, including session keys
+ * etc.
+ *
+ * Only valid after a successful authentication
+ *
+ * May only be called once per authentication.
+ *
+ */
+NTSTATUS gensec_ntlmssp_session_info(struct gensec_security *gensec_security,
+                                     struct auth_session_info **session_info)
+{
+        NTSTATUS nt_status;
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
+        nt_status = gensec_generate_session_info(ntlmssp_state,
+                                                 gensec_security,
+                                                 gensec_ntlmssp->user_info_dc,
+                                                 session_info);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+        (*session_info)->session_key = data_blob_talloc(*session_info,
+                                                        ntlmssp_state->session_key.data,
+                                                        ntlmssp_state->session_key.length);
+        return NT_STATUS_OK;
+}
+/**
+ * Start NTLMSSP on the server side
+ *
+ */
+NTSTATUS gensec_ntlmssp_server_start(struct gensec_security *gensec_security)
+{
+        NTSTATUS nt_status;
+        struct ntlmssp_state *ntlmssp_state;
+        struct gensec_ntlmssp_context *gensec_ntlmssp;
+        nt_status = gensec_ntlmssp_start(gensec_security);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+        gensec_ntlmssp = talloc_get_type_abort(gensec_security->private_data,
+                                               struct gensec_ntlmssp_context);
+        ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
+        ntlmssp_state->role = NTLMSSP_SERVER;
+        ntlmssp_state->expected_state = NTLMSSP_NEGOTIATE;
+        ntlmssp_state->allow_lm_key = (lpcfg_lanman_auth(gensec_security->settings->lp_ctx)
+                                          && gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "allow_lm_key", false));
+        ntlmssp_state->neg_flags =
+                NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_VERSION;
+        ntlmssp_state->lm_resp = data_blob(NULL, 0);
+        ntlmssp_state->nt_resp = data_blob(NULL, 0);
+        if (gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "128bit", true)) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_128;
+        }
+        if (gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "56bit", true)) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_56;
+        }
+        if (gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "keyexchange", true)) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_KEY_EXCH;
+        }
+        if (gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "alwayssign", true)) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+        }
+        if (gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "ntlm2", true)) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
+        }
+        if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+        }
+        if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
+        }
+        gensec_ntlmssp->auth_context = gensec_security->auth_context;
+        ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
+        ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
+        ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
+        ntlmssp_state->check_password = auth_ntlmssp_check_password;
+        if (lpcfg_server_role(gensec_security->settings->lp_ctx) == ROLE_STANDALONE) {
+                ntlmssp_state->server.is_standalone = true;
+        } else {
+                ntlmssp_state->server.is_standalone = false;
+        }
+        ntlmssp_state->server.netbios_name = lpcfg_netbios_name(gensec_security->settings->lp_ctx);
+        ntlmssp_state->server.netbios_domain = lpcfg_workgroup(gensec_security->settings->lp_ctx);
+        {
                 char dnsdomname[MAXHOSTNAMELEN], dnsname[MAXHOSTNAMELEN];
-                const char *target_name_dns = "";
                 /* Find out the DNS domain name */
                 dnsdomname[0] = '\0';
+                safe_strcpy(dnsdomname, lp_realm(gensec_security->settings->lp_ctx), sizeof(dnsdomname) - 1);
+                strlower_m(dnsdomname);
+                safe_strcpy(dnsdomname, lpcfg_dnsdomain(gensec_security->settings->lp_ctx), sizeof(dnsdomname) - 1);
                 /* Find out the DNS host name */
                 safe_strcpy(dnsname, gensec_ntlmssp_state->server_name, sizeof(dnsname) - 1);
+                safe_strcpy(dnsname, ntlmssp_state->server.netbios_name, sizeof(dnsname) - 1);
                 if (dnsdomname[0] != '\0') {
                         safe_strcat(dnsname, ".", sizeof(dnsname) - 1);
 …
                 strlower_m(dnsname);
+                if (chal_flags |= NTLMSSP_TARGET_TYPE_DOMAIN) {
+                        target_name_dns = dnsdomname;
+                } else if (chal_flags |= NTLMSSP_TARGET_TYPE_SERVER) {
+                        target_name_dns = dnsname;
+                }
+                msrpc_gen(out_mem_ctx,
+                          &struct_blob, "aaaaa",
+                          MsvAvNbDomainName, target_name,
+                          MsvAvNbComputerName, gensec_ntlmssp_state->server_name,
+                          MsvAvDnsDomainName, dnsdomname,
+                          MsvAvDnsComputerName, dnsname,
+                          MsvAvEOL, "");
+        } else {
+                struct_blob = data_blob(NULL, 0);
+        }
+        {
+                /* Marshal the packet in the right format, be it unicode or ASCII */
+                const char *gen_string;
+                if (gensec_ntlmssp_state->unicode) {
+                        gen_string = "CdUdbddB";
+                } else {
+                        gen_string = "CdAdbddB";
+                }
+                msrpc_gen(out_mem_ctx,
+                          out, gen_string,
+                          "NTLMSSP",
+                          NTLMSSP_CHALLENGE,
+                          target_name,
+                          chal_flags,
+                          cryptkey, 8,
+, 0,
+                          struct_blob.data, struct_blob.length);
+        }
+        gensec_ntlmssp_state->expected_state = NTLMSSP_AUTH;
+        return NT_STATUS_MORE_PROCESSING_REQUIRED;
+}
+/**
+ * Next state function for the Authenticate packet
+ *
+ * @param gensec_ntlmssp_state NTLMSSP State
+ * @param request The request, as a DATA_BLOB
+ * @return Errors or NT_STATUS_OK.
+ */
+static NTSTATUS ntlmssp_server_preauth(struct gensec_ntlmssp_state *gensec_ntlmssp_state,
+                                       const DATA_BLOB request)
+{
+        uint32_t ntlmssp_command, auth_flags;
+        NTSTATUS nt_status;
+        uint8_t session_nonce_hash[16];
+        const char *parse_string;
+        char *domain = NULL;
+        char *user = NULL;
+        char *workstation = NULL;
+#if 0
+        file_save("ntlmssp_auth.dat", request.data, request.length);
+#endif
+        if (gensec_ntlmssp_state->unicode) {
+                parse_string = "CdBBUUUBd";
+        } else {
+                parse_string = "CdBBAAABd";
+        }
+        /* zero these out */
+        data_blob_free(&gensec_ntlmssp_state->lm_resp);
+        data_blob_free(&gensec_ntlmssp_state->nt_resp);
+        data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
+        gensec_ntlmssp_state->user = NULL;
+        gensec_ntlmssp_state->domain = NULL;
+        gensec_ntlmssp_state->workstation = NULL;
+        /* now the NTLMSSP encoded auth hashes */
+        if (!msrpc_parse(gensec_ntlmssp_state,
+                         &request, parse_string,
+                         "NTLMSSP",
+                         &ntlmssp_command,
+                         &gensec_ntlmssp_state->lm_resp,
+                         &gensec_ntlmssp_state->nt_resp,
+                         &domain,
+                         &user,
+                         &workstation,
+                         &gensec_ntlmssp_state->encrypted_session_key,
+                         &auth_flags)) {
+                DEBUG(10, ("ntlmssp_server_auth: failed to parse NTLMSSP (nonfatal):\n"));
+                dump_data(10, request.data, request.length);
+                /* zero this out */
+                data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
+                auth_flags = 0;
+                /* Try again with a shorter string (Win9X truncates this packet) */
+                if (gensec_ntlmssp_state->unicode) {
+                        parse_string = "CdBBUUU";
+                } else {
+                        parse_string = "CdBBAAA";
+                }
+                /* now the NTLMSSP encoded auth hashes */
+                if (!msrpc_parse(gensec_ntlmssp_state,
+                                 &request, parse_string,
+                                 "NTLMSSP",
+                                 &ntlmssp_command,
+                                 &gensec_ntlmssp_state->lm_resp,
+                                 &gensec_ntlmssp_state->nt_resp,
+                                 &domain,
+                                 &user,
+                                 &workstation)) {
+                        DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP:\n"));
+                        dump_data(2, request.data, request.length);
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+        }
+        if (auth_flags)
+                ntlmssp_handle_neg_flags(gensec_ntlmssp_state, auth_flags, gensec_ntlmssp_state->allow_lm_key);
+        if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(gensec_ntlmssp_state, domain))) {
+                /* zero this out */
+                data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
+                return nt_status;
+        }
+        if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(gensec_ntlmssp_state, user))) {
+                /* zero this out */
+                data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
+                return nt_status;
+        }
+        if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_workstation(gensec_ntlmssp_state, workstation))) {
+                /* zero this out */
+                data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
+                return nt_status;
+        }
+        DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
+                 gensec_ntlmssp_state->user, gensec_ntlmssp_state->domain, gensec_ntlmssp_state->workstation, (unsigned long)gensec_ntlmssp_state->lm_resp.length, (unsigned long)gensec_ntlmssp_state->nt_resp.length));
+#if 0
+        file_save("nthash1.dat",  &gensec_ntlmssp_state->nt_resp.data,  &gensec_ntlmssp_state->nt_resp.length);
+        file_save("lmhash1.dat",  &gensec_ntlmssp_state->lm_resp.data,  &gensec_ntlmssp_state->lm_resp.length);
+#endif
+        /* NTLM2 uses a 'challenge' that is made of up both the server challenge, and a
+           client challenge
+           However, the NTLM2 flag may still be set for the real NTLMv2 logins, be careful.
+        */
+        if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+                if (gensec_ntlmssp_state->nt_resp.length == 24 && gensec_ntlmssp_state->lm_resp.length == 24) {
+                        struct MD5Context md5_session_nonce_ctx;
+                        SMB_ASSERT(gensec_ntlmssp_state->internal_chal.data
+                                   && gensec_ntlmssp_state->internal_chal.length == 8);
+                        gensec_ntlmssp_state->doing_ntlm2 = true;
+                        memcpy(gensec_ntlmssp_state->crypt.ntlm2.session_nonce, gensec_ntlmssp_state->internal_chal.data, 8);
+                        memcpy(&gensec_ntlmssp_state->crypt.ntlm2.session_nonce[8], gensec_ntlmssp_state->lm_resp.data, 8);
+                        MD5Init(&md5_session_nonce_ctx);
+                        MD5Update(&md5_session_nonce_ctx, gensec_ntlmssp_state->crypt.ntlm2.session_nonce, 16);
+                        MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
+                        gensec_ntlmssp_state->chal = data_blob_talloc(gensec_ntlmssp_state,
+                                                               session_nonce_hash, 8);
+                        /* LM response is no longer useful, zero it out */
+                        data_blob_free(&gensec_ntlmssp_state->lm_resp);
+                        /* We changed the effective challenge - set it */
+                        if (!NT_STATUS_IS_OK(nt_status =
+                                             gensec_ntlmssp_state->set_challenge(gensec_ntlmssp_state,
+                                                                                 &gensec_ntlmssp_state->chal))) {
+                                /* zero this out */
+                                data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
+                                return nt_status;
+                        }
+                        /* LM Key is incompatible... */
+                        gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
+                }
+        }
+                ntlmssp_state->server.dns_name = talloc_strdup(ntlmssp_state,
+                                                                      dnsname);
+                NT_STATUS_HAVE_NO_MEMORY(ntlmssp_state->server.dns_name);
+                ntlmssp_state->server.dns_domain = talloc_strdup(ntlmssp_state,
+                                                                        dnsdomname);
+                NT_STATUS_HAVE_NO_MEMORY(ntlmssp_state->server.dns_domain);
+        }
         return NT_STATUS_OK;
+}
-/**
- * Next state function for the Authenticate packet
- * (after authentication - figures out the session keys etc)
+ *
- * @param gensec_ntlmssp_state NTLMSSP State
- * @return Errors or NT_STATUS_OK.
- */
-static NTSTATUS ntlmssp_server_postauth(struct gensec_security *gensec_security,
-                                        DATA_BLOB *user_session_key,
-                                        DATA_BLOB *lm_session_key)
+{
-        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
-        NTSTATUS nt_status;
-        DATA_BLOB session_key = data_blob(NULL, 0);
-        if (user_session_key)
-                dump_data_pw("USER session key:\n", user_session_key->data, user_session_key->length);
-        if (lm_session_key)
-                dump_data_pw("LM first-8:\n", lm_session_key->data, lm_session_key->length);
-        /* Handle the different session key derivation for NTLM2 */
-        if (gensec_ntlmssp_state->doing_ntlm2) {
-                if (user_session_key && user_session_key->data && user_session_key->length == 16) {
-                        session_key = data_blob_talloc(gensec_ntlmssp_state, NULL, 16);
-                        hmac_md5(user_session_key->data, gensec_ntlmssp_state->crypt.ntlm2.session_nonce,
-                                 sizeof(gensec_ntlmssp_state->crypt.ntlm2.session_nonce), session_key.data);
-                        DEBUG(10,("ntlmssp_server_auth: Created NTLM2 session key.\n"));
-                        dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
-                } else {
-                        DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM2 session key.\n"));
-                        session_key = data_blob(NULL, 0);
+                }
-        } else if ((gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
-                /* Ensure we can never get here on NTLMv2 */
-                && (gensec_ntlmssp_state->nt_resp.length == 0 || gensec_ntlmssp_state->nt_resp.length == 24)) {
-                if (lm_session_key && lm_session_key->data && lm_session_key->length >= 8) {
-                        if (gensec_ntlmssp_state->lm_resp.data && gensec_ntlmssp_state->lm_resp.length == 24) {
-                                session_key = data_blob_talloc(gensec_ntlmssp_state, NULL, 16);
-                                SMBsesskeygen_lm_sess_key(lm_session_key->data, gensec_ntlmssp_state->lm_resp.data,
-                                                          session_key.data);
-                                DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
-                                dump_data_pw("LM session key:\n", session_key.data, session_key.length);
-                        } else {
-                                /* When there is no LM response, just use zeros */
-                                static const uint8_t zeros[24];
-                                session_key = data_blob_talloc(gensec_ntlmssp_state, NULL, 16);
-                                SMBsesskeygen_lm_sess_key(zeros, zeros,
-                                                          session_key.data);
-                                DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
-                                dump_data_pw("LM session key:\n", session_key.data, session_key.length);
+                        }
-                } else {
-                        /* LM Key not selected */
-                        gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
-                        DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM session key.\n"));
-                        session_key = data_blob(NULL, 0);
+                }
-        } else if (user_session_key && user_session_key->data) {
-                session_key = data_blob_talloc(gensec_ntlmssp_state, user_session_key->data, user_session_key->length);
-                DEBUG(10,("ntlmssp_server_auth: Using unmodified nt session key.\n"));
-                dump_data_pw("unmodified session key:\n", session_key.data, session_key.length);
-                /* LM Key not selected */
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
-        } else if (lm_session_key && lm_session_key->data) {
-                /* Very weird to have LM key, but no user session key, but anyway.. */
-                session_key = data_blob_talloc(gensec_ntlmssp_state, lm_session_key->data, lm_session_key->length);
-                DEBUG(10,("ntlmssp_server_auth: Using unmodified lm session key.\n"));
-                dump_data_pw("unmodified session key:\n", session_key.data, session_key.length);
-                /* LM Key not selected */
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
-        } else {
-                DEBUG(10,("ntlmssp_server_auth: Failed to create unmodified session key.\n"));
-                session_key = data_blob(NULL, 0);
-                /* LM Key not selected */
-                gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
+        }
-        /* With KEY_EXCH, the client supplies the proposed session key,
-           but encrypts it with the long-term key */
-        if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
-                if (!gensec_ntlmssp_state->encrypted_session_key.data
-                    || gensec_ntlmssp_state->encrypted_session_key.length != 16) {
-                        data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
-                        DEBUG(1, ("Client-supplied KEY_EXCH session key was of invalid length (%u)!\n",
-                                  (unsigned)gensec_ntlmssp_state->encrypted_session_key.length));
-                        return NT_STATUS_INVALID_PARAMETER;
-                } else if (!session_key.data || session_key.length != 16) {
-                        DEBUG(5, ("server session key is invalid (len == %u), cannot do KEY_EXCH!\n",
-                                  (unsigned)session_key.length));
-                        gensec_ntlmssp_state->session_key = session_key;
-                } else {
-                        dump_data_pw("KEY_EXCH session key (enc):\n",
-                                     gensec_ntlmssp_state->encrypted_session_key.data,
-                                     gensec_ntlmssp_state->encrypted_session_key.length);
-                        arcfour_crypt(gensec_ntlmssp_state->encrypted_session_key.data,
-                                      session_key.data,
-                                      gensec_ntlmssp_state->encrypted_session_key.length);
-                        gensec_ntlmssp_state->session_key = data_blob_talloc(gensec_ntlmssp_state,
-                                                                      gensec_ntlmssp_state->encrypted_session_key.data,
-                                                                      gensec_ntlmssp_state->encrypted_session_key.length);
-                        dump_data_pw("KEY_EXCH session key:\n", gensec_ntlmssp_state->encrypted_session_key.data,
-                                     gensec_ntlmssp_state->encrypted_session_key.length);
-                        talloc_free(session_key.data);
+                }
-        } else {
-                gensec_ntlmssp_state->session_key = session_key;
+        }
-        if ((gensec_security->want_features & GENSEC_FEATURE_SIGN)
-            || (gensec_security->want_features & GENSEC_FEATURE_SEAL)) {
-                nt_status = ntlmssp_sign_init(gensec_ntlmssp_state);
-        } else {
-                nt_status = NT_STATUS_OK;
+        }
-        data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
-        /* allow arbitarily many authentications, but watch that this will cause a
-           memory leak, until the gensec_ntlmssp_state is shutdown
-        */
-        if (gensec_ntlmssp_state->server_multiple_authentications) {
-                gensec_ntlmssp_state->expected_state = NTLMSSP_AUTH;
-        } else {
-                gensec_ntlmssp_state->expected_state = NTLMSSP_DONE;
+        }
-        return nt_status;
+}
-/**
- * Next state function for the Authenticate packet
+ *
- * @param gensec_security GENSEC state
- * @param out_mem_ctx Memory context for *out
- * @param in The request, as a DATA_BLOB.  reply.data must be NULL
- * @param out The reply, as an allocated DATA_BLOB, caller to free.
- * @return Errors or NT_STATUS_OK if authentication sucessful
- */
-NTSTATUS ntlmssp_server_auth(struct gensec_security *gensec_security,
-                             TALLOC_CTX *out_mem_ctx,
-                             const DATA_BLOB in, DATA_BLOB *out)
+{
-        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
-        DATA_BLOB user_session_key = data_blob(NULL, 0);
-        DATA_BLOB lm_session_key = data_blob(NULL, 0);
-        NTSTATUS nt_status;
-        TALLOC_CTX *mem_ctx = talloc_new(out_mem_ctx);
-        if (!mem_ctx) {
-                return NT_STATUS_NO_MEMORY;
+        }
-        /* zero the outbound NTLMSSP packet */
-        *out = data_blob_talloc(out_mem_ctx, NULL, 0);
-        if (!NT_STATUS_IS_OK(nt_status = ntlmssp_server_preauth(gensec_ntlmssp_state, in))) {
-                talloc_free(mem_ctx);
-                return nt_status;
+        }
-        /*
-         * Note we don't check here for NTLMv2 auth settings. If NTLMv2 auth
-         * is required (by "ntlm auth = no" and "lm auth = no" being set in the
-         * smb.conf file) and no NTLMv2 response was sent then the password check
-         * will fail here. JRA.
-         */
-        /* Finally, actually ask if the password is OK */
-        if (!NT_STATUS_IS_OK(nt_status = gensec_ntlmssp_state->check_password(gensec_ntlmssp_state, mem_ctx,
-                                                                              &user_session_key, &lm_session_key))) {
-                talloc_free(mem_ctx);
-                return nt_status;
+        }
-        if (gensec_security->want_features
-            & (GENSEC_FEATURE_SIGN|GENSEC_FEATURE_SEAL|GENSEC_FEATURE_SESSION_KEY)) {
-                nt_status = ntlmssp_server_postauth(gensec_security, &user_session_key, &lm_session_key);
-                talloc_free(mem_ctx);
-                return nt_status;
-        } else {
-                gensec_ntlmssp_state->session_key = data_blob(NULL, 0);
-                talloc_free(mem_ctx);
-                return NT_STATUS_OK;
+        }
+}
-/**
- * Return the challenge as determined by the authentication subsystem
- * @return an 8 byte random challenge
- */
-static const uint8_t *auth_ntlmssp_get_challenge(const struct gensec_ntlmssp_state *gensec_ntlmssp_state)
+{
-        NTSTATUS status;
-        const uint8_t *chal;
-        status = gensec_ntlmssp_state->auth_context->get_challenge(gensec_ntlmssp_state->auth_context, &chal);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("auth_ntlmssp_get_challenge: failed to get challenge: %s\n",
-                        nt_errstr(status)));
-                return NULL;
+        }
-        return chal;
+}
-/**
- * Some authentication methods 'fix' the challenge, so we may not be able to set it
+ *
- * @return If the effective challenge used by the auth subsystem may be modified
- */
-static bool auth_ntlmssp_may_set_challenge(const struct gensec_ntlmssp_state *gensec_ntlmssp_state)
+{
-        return gensec_ntlmssp_state->auth_context->challenge_may_be_modified(gensec_ntlmssp_state->auth_context);
+}
-/**
- * NTLM2 authentication modifies the effective challenge,
- * @param challenge The new challenge value
- */
-static NTSTATUS auth_ntlmssp_set_challenge(struct gensec_ntlmssp_state *gensec_ntlmssp_state, DATA_BLOB *challenge)
+{
-        NTSTATUS nt_status;
-        struct auth_context *auth_context = gensec_ntlmssp_state->auth_context;
-        const uint8_t *chal;
-        if (challenge->length != 8) {
-                return NT_STATUS_INVALID_PARAMETER;
+        }
-        chal = challenge->data;
-        nt_status = gensec_ntlmssp_state->auth_context->set_challenge(auth_context,
-                                                                      chal,
-                                                                      "NTLMSSP callback (NTLM2)");
-        return nt_status;
+}
-/**
- * Check the password on an NTLMSSP login.
+ *
- * Return the session keys used on the connection.
- */
-static NTSTATUS auth_ntlmssp_check_password(struct gensec_ntlmssp_state *gensec_ntlmssp_state,
-                                            TALLOC_CTX *mem_ctx,
-                                            DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
+{
-        NTSTATUS nt_status;
-        struct auth_usersupplied_info *user_info = talloc(mem_ctx, struct auth_usersupplied_info);
-        if (!user_info) {
-                return NT_STATUS_NO_MEMORY;
+        }
-        user_info->logon_parameters = MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
-        user_info->flags = 0;
-        user_info->mapped_state = false;
-        user_info->client.account_name = gensec_ntlmssp_state->user;
-        user_info->client.domain_name = gensec_ntlmssp_state->domain;
-        user_info->workstation_name = gensec_ntlmssp_state->workstation;
-        user_info->remote_host = gensec_get_peer_addr(gensec_ntlmssp_state->gensec_security);
-        user_info->password_state = AUTH_PASSWORD_RESPONSE;
-        user_info->password.response.lanman = gensec_ntlmssp_state->lm_resp;
-        user_info->password.response.lanman.data = talloc_steal(user_info, gensec_ntlmssp_state->lm_resp.data);
-        user_info->password.response.nt = gensec_ntlmssp_state->nt_resp;
-        user_info->password.response.nt.data = talloc_steal(user_info, gensec_ntlmssp_state->nt_resp.data);
-        nt_status = gensec_ntlmssp_state->auth_context->check_password(gensec_ntlmssp_state->auth_context,
-                                                                       mem_ctx,
-                                                                       user_info,
-                                                                       &gensec_ntlmssp_state->server_info);
-        talloc_free(user_info);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
-        talloc_steal(gensec_ntlmssp_state, gensec_ntlmssp_state->server_info);
-        if (gensec_ntlmssp_state->server_info->user_session_key.length) {
-                DEBUG(10, ("Got NT session key of length %u\n",
-                           (unsigned)gensec_ntlmssp_state->server_info->user_session_key.length));
-                if (!talloc_reference(mem_ctx, gensec_ntlmssp_state->server_info->user_session_key.data)) {
-                        return NT_STATUS_NO_MEMORY;
+                }
-                *user_session_key = gensec_ntlmssp_state->server_info->user_session_key;
+        }
-        if (gensec_ntlmssp_state->server_info->lm_session_key.length) {
-                DEBUG(10, ("Got LM session key of length %u\n",
-                           (unsigned)gensec_ntlmssp_state->server_info->lm_session_key.length));
-                if (!talloc_reference(mem_ctx, gensec_ntlmssp_state->server_info->lm_session_key.data)) {
-                        return NT_STATUS_NO_MEMORY;
+                }
-                *lm_session_key = gensec_ntlmssp_state->server_info->lm_session_key;
+        }
-        return nt_status;
+}
-/**
- * Return the credentials of a logged on user, including session keys
- * etc.
+ *
- * Only valid after a successful authentication
+ *
- * May only be called once per authentication.
+ *
- */
-NTSTATUS gensec_ntlmssp_session_info(struct gensec_security *gensec_security,
-                                     struct auth_session_info **session_info)
+{
-        NTSTATUS nt_status;
-        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
-        nt_status = auth_generate_session_info(gensec_ntlmssp_state, gensec_security->event_ctx, gensec_security->settings->lp_ctx, gensec_ntlmssp_state->server_info, session_info);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
-        (*session_info)->session_key = data_blob_talloc(*session_info,
-                                                        gensec_ntlmssp_state->session_key.data,
-                                                        gensec_ntlmssp_state->session_key.length);
-        return NT_STATUS_OK;
+}
-/**
- * Start NTLMSSP on the server side
+ *
- */
-NTSTATUS gensec_ntlmssp_server_start(struct gensec_security *gensec_security)
+{
-        NTSTATUS nt_status;
-        struct gensec_ntlmssp_state *gensec_ntlmssp_state;
-        nt_status = gensec_ntlmssp_start(gensec_security);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
-        gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
-        gensec_ntlmssp_state->role = NTLMSSP_SERVER;
-        gensec_ntlmssp_state->workstation = NULL;
-        gensec_ntlmssp_state->server_name = lp_netbios_name(gensec_security->settings->lp_ctx);
-        gensec_ntlmssp_state->domain = lp_workgroup(gensec_security->settings->lp_ctx);
-        gensec_ntlmssp_state->expected_state = NTLMSSP_NEGOTIATE;
-        gensec_ntlmssp_state->allow_lm_key = (lp_lanman_auth(gensec_security->settings->lp_ctx)
-                                          && gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "allow_lm_key", false));
-        gensec_ntlmssp_state->server_multiple_authentications = false;
-        gensec_ntlmssp_state->neg_flags =
-                NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_VERSION;
-        gensec_ntlmssp_state->lm_resp = data_blob(NULL, 0);
-        gensec_ntlmssp_state->nt_resp = data_blob(NULL, 0);
-        gensec_ntlmssp_state->encrypted_session_key = data_blob(NULL, 0);
-        if (gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "128bit", true)) {
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_128;
+        }
-        if (gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "56bit", true)) {
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_56;
+        }
-        if (gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "keyexchange", true)) {
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_KEY_EXCH;
+        }
-        if (gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "alwayssign", true)) {
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+        }
-        if (gensec_setting_bool(gensec_security->settings, "ntlmssp_server", "ntlm2", true)) {
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
+        }
-        if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+        }
-        if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
-                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
+        }
-        gensec_ntlmssp_state->auth_context = gensec_security->auth_context;
-        gensec_ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
-        gensec_ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
-        gensec_ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
-        gensec_ntlmssp_state->check_password = auth_ntlmssp_check_password;
-        gensec_ntlmssp_state->server_role = lp_server_role(gensec_security->settings->lp_ctx);
-        return NT_STATUS_OK;
+}

vendor/current/source4/auth/ntlmssp/ntlmssp_sign.c

-              r414
+              r740
 /*
+/*
  *  Unix SMB/CIFS implementation.
  *  Version 3.0
 …
  *  Copyright (C) Luke Kenneth Casson Leighton 1996-2001
  *  Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2005
+ *
+ *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
  *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
+ *
+ *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
+ *
+ *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
 …
 #include "includes.h"
 #include "auth/ntlmssp/ntlmssp.h"
-#include "../librpc/gen_ndr/ntlmssp.h"
-#include "../libcli/auth/libcli_auth.h"
-#include "../lib/crypto/crypto.h"
 #include "auth/gensec/gensec.h"
+#include "../libcli/auth/ntlmssp_private.h"
+#define CLI_SIGN "session key to client-to-server signing key magic constant"
+#define CLI_SEAL "session key to client-to-server sealing key magic constant"
+#define SRV_SIGN "session key to server-to-client signing key magic constant"
+#define SRV_SEAL "session key to server-to-client sealing key magic constant"
+/**
+ * Some notes on the NTLM2 code:
+ *
+ * NTLM2 is a AEAD system.  This means that the data encrypted is not
+ * all the data that is signed.  In DCE-RPC case, the headers of the
+ * DCE-RPC packets are also signed.  This prevents some of the
+ * fun-and-games one might have by changing them.
+ *
+ */
+static void calc_ntlmv2_key(TALLOC_CTX *mem_ctx,
+                            DATA_BLOB *subkey,
+                            DATA_BLOB session_key,
+                            const char *constant)
+{
+        struct MD5Context ctx3;
+        *subkey = data_blob_talloc(mem_ctx, NULL, 16);
+        MD5Init(&ctx3);
+        MD5Update(&ctx3, session_key.data, session_key.length);
+        MD5Update(&ctx3, (const uint8_t *)constant, strlen(constant)+1);
+        MD5Final(subkey->data, &ctx3);
+}
+enum ntlmssp_direction {
+        NTLMSSP_SEND,
+        NTLMSSP_RECEIVE
+};
+static NTSTATUS ntlmssp_make_packet_signature(struct gensec_ntlmssp_state *gensec_ntlmssp_state,
+                                              TALLOC_CTX *sig_mem_ctx,
+                                              const uint8_t *data, size_t length,
+                                              const uint8_t *whole_pdu, size_t pdu_length,
+                                              enum ntlmssp_direction direction,
+                                              DATA_BLOB *sig, bool encrypt_sig)
+{
+        if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+                HMACMD5Context ctx;
+                uint8_t digest[16];
+                uint8_t seq_num[4];
+                *sig = data_blob_talloc(sig_mem_ctx, NULL, NTLMSSP_SIG_SIZE);
+                if (!sig->data) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                switch (direction) {
+                case NTLMSSP_SEND:
+                        SIVAL(seq_num, 0, gensec_ntlmssp_state->crypt.ntlm2.send_seq_num);
+                        gensec_ntlmssp_state->crypt.ntlm2.send_seq_num++;
+                        hmac_md5_init_limK_to_64(gensec_ntlmssp_state->crypt.ntlm2.send_sign_key.data,
+                                                 gensec_ntlmssp_state->crypt.ntlm2.send_sign_key.length, &ctx);
+                        break;
+                case NTLMSSP_RECEIVE:
+                        SIVAL(seq_num, 0, gensec_ntlmssp_state->crypt.ntlm2.recv_seq_num);
+                        gensec_ntlmssp_state->crypt.ntlm2.recv_seq_num++;
+                        hmac_md5_init_limK_to_64(gensec_ntlmssp_state->crypt.ntlm2.recv_sign_key.data,
+                                                 gensec_ntlmssp_state->crypt.ntlm2.recv_sign_key.length, &ctx);
+                        break;
+                }
+                hmac_md5_update(seq_num, sizeof(seq_num), &ctx);
+                hmac_md5_update(whole_pdu, pdu_length, &ctx);
+                hmac_md5_final(digest, &ctx);
+                if (encrypt_sig && gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
+                        switch (direction) {
+                        case NTLMSSP_SEND:
+                                arcfour_crypt_sbox(gensec_ntlmssp_state->crypt.ntlm2.send_seal_arcfour_state, digest, 8);
+                                break;
+                        case NTLMSSP_RECEIVE:
+                                arcfour_crypt_sbox(gensec_ntlmssp_state->crypt.ntlm2.recv_seal_arcfour_state, digest, 8);
+                                break;
+                        }
+                }
+                SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION);
+                memcpy(sig->data + 4, digest, 8);
+                memcpy(sig->data + 12, seq_num, 4);
+                DEBUG(10, ("NTLM2: created signature over %llu bytes of input:\n", (unsigned long long)pdu_length));
+                dump_data(11, sig->data, sig->length);
+        } else {
+                uint32_t crc;
+                crc = crc32_calc_buffer(data, length);
+                if (!msrpc_gen(sig_mem_ctx,
+                               sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, gensec_ntlmssp_state->crypt.ntlm.seq_num)) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                gensec_ntlmssp_state->crypt.ntlm.seq_num++;
+                arcfour_crypt_sbox(gensec_ntlmssp_state->crypt.ntlm.arcfour_state, sig->data+4, sig->length-4);
+                DEBUG(10, ("NTLM1: created signature over %llu bytes of input:\n", (unsigned long long)length));
+                dump_data(11, sig->data, sig->length);
+        }
+        return NT_STATUS_OK;
+}
+/* TODO: make this non-public */
+NTSTATUS gensec_ntlmssp_sign_packet(struct gensec_security *gensec_security,
+                                    TALLOC_CTX *sig_mem_ctx,
+                                    const uint8_t *data, size_t length,
+                                    const uint8_t *whole_pdu, size_t pdu_length,
+NTSTATUS gensec_ntlmssp_sign_packet(struct gensec_security *gensec_security,
+                                    TALLOC_CTX *sig_mem_ctx,
+                                    const uint8_t *data, size_t length,
+                                    const uint8_t *whole_pdu, size_t pdu_length,
                                     DATA_BLOB *sig)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        return ntlmssp_make_packet_signature(gensec_ntlmssp_state, sig_mem_ctx,
+                                             data, length,
+                                             whole_pdu, pdu_length,
+                                             NTLMSSP_SEND, sig, true);
+}
+/**
+ * Check the signature of an incoming packet
+ *
+ */
+NTSTATUS gensec_ntlmssp_check_packet(struct gensec_security *gensec_security,
+                                     TALLOC_CTX *sig_mem_ctx,
+                                     const uint8_t *data, size_t length,
+                                     const uint8_t *whole_pdu, size_t pdu_length,
+                                     const DATA_BLOB *sig)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        DATA_BLOB local_sig;
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
         NTSTATUS nt_status;
+        if (!gensec_ntlmssp_state->session_key.length) {
+                DEBUG(3, ("NO session key, cannot check packet signature\n"));
+                return NT_STATUS_NO_USER_SESSION_KEY;
+        }
+        nt_status = ntlmssp_make_packet_signature(gensec_ntlmssp_state, sig_mem_ctx,
+                                                  data, length,
+                                                  whole_pdu, pdu_length,
+                                                  NTLMSSP_RECEIVE, &local_sig, true);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                DEBUG(0, ("NTLMSSP packet check failed with %s\n", nt_errstr(nt_status)));
+                return nt_status;
+        }
+        if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+                if (local_sig.length != sig->length ||
+                    memcmp(local_sig.data,
+                           sig->data, sig->length) != 0) {
+                        DEBUG(5, ("BAD SIG NTLM2: wanted signature over %llu bytes of input:\n", (unsigned long long)pdu_length));
+                        dump_data(5, local_sig.data, local_sig.length);
+                        DEBUG(5, ("BAD SIG: got signature over %llu bytes of input:\n", (unsigned long long)pdu_length));
+                        dump_data(5, sig->data, sig->length);
+                        DEBUG(1, ("NTLMSSP NTLM2 packet check failed due to invalid signature on %llu bytes of input!\n", (unsigned long long)pdu_length));
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+        } else {
+                if (local_sig.length != sig->length ||
+                    memcmp(local_sig.data + 8,
+                           sig->data + 8, sig->length - 8) != 0) {
+                        DEBUG(5, ("BAD SIG NTLM1: wanted signature of %llu bytes of input:\n", (unsigned long long)length));
+                        dump_data(5, local_sig.data, local_sig.length);
+                        DEBUG(5, ("BAD SIG: got signature of %llu bytes of input:\n", (unsigned long long)length));
+                        dump_data(5, sig->data, sig->length);
+                        DEBUG(1, ("NTLMSSP NTLM1 packet check failed due to invalid signature on %llu bytes of input:\n", (unsigned long long)length));
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+        }
+        dump_data_pw("checked ntlmssp signature\n", sig->data, sig->length);
+        return NT_STATUS_OK;
+}
+/**
+ * Seal data with the NTLMSSP algorithm
+ *
+ */
+NTSTATUS gensec_ntlmssp_seal_packet(struct gensec_security *gensec_security,
+                                    TALLOC_CTX *sig_mem_ctx,
+                                    uint8_t *data, size_t length,
+                                    const uint8_t *whole_pdu, size_t pdu_length,
+                                    DATA_BLOB *sig)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        NTSTATUS nt_status;
+        if (!gensec_ntlmssp_state->session_key.length) {
+                DEBUG(3, ("NO session key, cannot seal packet\n"));
+                return NT_STATUS_NO_USER_SESSION_KEY;
+        }
+        DEBUG(10,("ntlmssp_seal_data: seal\n"));
+        dump_data_pw("ntlmssp clear data\n", data, length);
+        if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+                /* The order of these two operations matters - we must first seal the packet,
+                   then seal the sequence number - this is becouse the send_seal_hash is not
+                   constant, but is is rather updated with each iteration */
+                nt_status = ntlmssp_make_packet_signature(gensec_ntlmssp_state, sig_mem_ctx,
+                                                          data, length,
+                                                          whole_pdu, pdu_length,
+                                                          NTLMSSP_SEND, sig, false);
+                arcfour_crypt_sbox(gensec_ntlmssp_state->crypt.ntlm2.send_seal_arcfour_state, data, length);
+                if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
+                        arcfour_crypt_sbox(gensec_ntlmssp_state->crypt.ntlm2.send_seal_arcfour_state, sig->data+4, 8);
+                }
+        } else {
+                uint32_t crc;
+                crc = crc32_calc_buffer(data, length);
+                if (!msrpc_gen(sig_mem_ctx,
+                               sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, gensec_ntlmssp_state->crypt.ntlm.seq_num)) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                /* The order of these two operations matters - we must
+                   first seal the packet, then seal the sequence
+                   number - this is becouse the ntlmssp_hash is not
+                   constant, but is is rather updated with each
+                   iteration */
+                arcfour_crypt_sbox(gensec_ntlmssp_state->crypt.ntlm.arcfour_state, data, length);
+                arcfour_crypt_sbox(gensec_ntlmssp_state->crypt.ntlm.arcfour_state, sig->data+4, sig->length-4);
+                /* increment counter on send */
+                gensec_ntlmssp_state->crypt.ntlm.seq_num++;
+                nt_status = NT_STATUS_OK;
+        }
+        dump_data_pw("ntlmssp signature\n", sig->data, sig->length);
+        dump_data_pw("ntlmssp sealed data\n", data, length);
+        nt_status = ntlmssp_sign_packet(gensec_ntlmssp->ntlmssp_state,
+                                        sig_mem_ctx,
+                                        data, length,
+                                        whole_pdu, pdu_length,
+                                        sig);
         return nt_status;
+}
+/**
+ * Unseal data with the NTLMSSP algorithm
+ *
+ */
+NTSTATUS gensec_ntlmssp_check_packet(struct gensec_security *gensec_security,
+                                     TALLOC_CTX *sig_mem_ctx,
+                                     const uint8_t *data, size_t length,
+                                     const uint8_t *whole_pdu, size_t pdu_length,
+                                     const DATA_BLOB *sig)
+{
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        NTSTATUS nt_status;
+        nt_status = ntlmssp_check_packet(gensec_ntlmssp->ntlmssp_state,
+                                         data, length,
+                                         whole_pdu, pdu_length,
+                                         sig);
+        return nt_status;
+}
+NTSTATUS gensec_ntlmssp_seal_packet(struct gensec_security *gensec_security,
+                                    TALLOC_CTX *sig_mem_ctx,
+                                    uint8_t *data, size_t length,
+                                    const uint8_t *whole_pdu, size_t pdu_length,
+                                    DATA_BLOB *sig)
+{
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        NTSTATUS nt_status;
+        nt_status = ntlmssp_seal_packet(gensec_ntlmssp->ntlmssp_state,
+                                        sig_mem_ctx,
+                                        data, length,
+                                        whole_pdu, pdu_length,
+                                        sig);
+        return nt_status;
+}
 /*
   wrappers for the ntlmssp_*() functions
 */
 NTSTATUS gensec_ntlmssp_unseal_packet(struct gensec_security *gensec_security,
                                       TALLOC_CTX *sig_mem_ctx,
                                       uint8_t *data, size_t length,
                                       const uint8_t *whole_pdu, size_t pdu_length,
+NTSTATUS gensec_ntlmssp_unseal_packet(struct gensec_security *gensec_security,
+                                      TALLOC_CTX *sig_mem_ctx,
+                                      uint8_t *data, size_t length,
+                                      const uint8_t *whole_pdu, size_t pdu_length,
                                       const DATA_BLOB *sig)
+{
+        struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
+        if (!gensec_ntlmssp_state->session_key.length) {
+                DEBUG(3, ("NO session key, cannot unseal packet\n"));
+                return NT_STATUS_NO_USER_SESSION_KEY;
+        }
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        NTSTATUS nt_status;
+        dump_data_pw("ntlmssp sealed data\n", data, length);
+        if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+                arcfour_crypt_sbox(gensec_ntlmssp_state->crypt.ntlm2.recv_seal_arcfour_state, data, length);
+        } else {
+                arcfour_crypt_sbox(gensec_ntlmssp_state->crypt.ntlm.arcfour_state, data, length);
+        }
+        dump_data_pw("ntlmssp clear data\n", data, length);
+        return gensec_ntlmssp_check_packet(gensec_security, sig_mem_ctx, data, length, whole_pdu, pdu_length, sig);
+}
+        nt_status = ntlmssp_unseal_packet(gensec_ntlmssp->ntlmssp_state,
+                                          data, length,
+                                          whole_pdu, pdu_length,
+                                          sig);
+/**
+   Initialise the state for NTLMSSP signing.
+*/
+/* TODO: make this non-public */
+NTSTATUS ntlmssp_sign_init(struct gensec_ntlmssp_state *gensec_ntlmssp_state)
+{
+        TALLOC_CTX *mem_ctx = talloc_new(gensec_ntlmssp_state);
+        if (!mem_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        DEBUG(3, ("NTLMSSP Sign/Seal - Initialising with flags:\n"));
+        debug_ntlmssp_flags(gensec_ntlmssp_state->neg_flags);
+        if (gensec_ntlmssp_state->session_key.length < 8) {
+                talloc_free(mem_ctx);
+                DEBUG(3, ("NO session key, cannot intialise signing\n"));
+                return NT_STATUS_NO_USER_SESSION_KEY;
+        }
+        if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2)
+        {
+                DATA_BLOB weak_session_key = gensec_ntlmssp_state->session_key;
+                const char *send_sign_const;
+                const char *send_seal_const;
+                const char *recv_sign_const;
+                const char *recv_seal_const;
+                DATA_BLOB send_seal_key;
+                DATA_BLOB recv_seal_key;
+                switch (gensec_ntlmssp_state->role) {
+                case NTLMSSP_CLIENT:
+                        send_sign_const = CLI_SIGN;
+                        send_seal_const = CLI_SEAL;
+                        recv_sign_const = SRV_SIGN;
+                        recv_seal_const = SRV_SEAL;
+                        break;
+                case NTLMSSP_SERVER:
+                        send_sign_const = SRV_SIGN;
+                        send_seal_const = SRV_SEAL;
+                        recv_sign_const = CLI_SIGN;
+                        recv_seal_const = CLI_SEAL;
+                        break;
+                default:
+                        talloc_free(mem_ctx);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+                gensec_ntlmssp_state->crypt.ntlm2.send_seal_arcfour_state = talloc(gensec_ntlmssp_state, struct arcfour_state);
+                NT_STATUS_HAVE_NO_MEMORY(gensec_ntlmssp_state->crypt.ntlm2.send_seal_arcfour_state);
+                gensec_ntlmssp_state->crypt.ntlm2.recv_seal_arcfour_state = talloc(gensec_ntlmssp_state, struct arcfour_state);
+                NT_STATUS_HAVE_NO_MEMORY(gensec_ntlmssp_state->crypt.ntlm2.send_seal_arcfour_state);
+                /**
+                   Weaken NTLMSSP keys to cope with down-level
+                   clients, servers and export restrictions.
+                   We probably should have some parameters to control
+                   this, once we get NTLM2 working.
+                */
+                /* Key weakening was not performed on the master key
+                 * for NTLM2 (in ntlmssp_weaken_keys()), but must be
+                 * done on the encryption subkeys only.  That is why
+                 * we don't have this code for the ntlmv1 case.
+                 */
+                if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
+                } else if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
+                        weak_session_key.length = 7;
+                } else { /* forty bits */
+                        weak_session_key.length = 5;
+                }
+                dump_data_pw("NTLMSSP weakend master key:\n",
+                             weak_session_key.data,
+                             weak_session_key.length);
+                /* SEND: sign key */
+                calc_ntlmv2_key(gensec_ntlmssp_state,
+                                &gensec_ntlmssp_state->crypt.ntlm2.send_sign_key,
+                                gensec_ntlmssp_state->session_key, send_sign_const);
+                dump_data_pw("NTLMSSP send sign key:\n",
+                             gensec_ntlmssp_state->crypt.ntlm2.send_sign_key.data,
+                             gensec_ntlmssp_state->crypt.ntlm2.send_sign_key.length);
+                /* SEND: seal ARCFOUR pad */
+                calc_ntlmv2_key(mem_ctx,
+                                &send_seal_key,
+                                weak_session_key, send_seal_const);
+                dump_data_pw("NTLMSSP send seal key:\n",
+                             send_seal_key.data,
+                             send_seal_key.length);
+                arcfour_init(gensec_ntlmssp_state->crypt.ntlm2.send_seal_arcfour_state,
+                             &send_seal_key);
+                dump_data_pw("NTLMSSP send sesl hash:\n",
+                             gensec_ntlmssp_state->crypt.ntlm2.send_seal_arcfour_state->sbox,
+                             sizeof(gensec_ntlmssp_state->crypt.ntlm2.send_seal_arcfour_state->sbox));
+                /* RECV: sign key */
+                calc_ntlmv2_key(gensec_ntlmssp_state,
+                                &gensec_ntlmssp_state->crypt.ntlm2.recv_sign_key,
+                                gensec_ntlmssp_state->session_key, recv_sign_const);
+                dump_data_pw("NTLMSSP recv sign key:\n",
+                             gensec_ntlmssp_state->crypt.ntlm2.recv_sign_key.data,
+                             gensec_ntlmssp_state->crypt.ntlm2.recv_sign_key.length);
+                /* RECV: seal ARCFOUR pad */
+                calc_ntlmv2_key(mem_ctx,
+                                &recv_seal_key,
+                                weak_session_key, recv_seal_const);
+                dump_data_pw("NTLMSSP recv seal key:\n",
+                             recv_seal_key.data,
+                             recv_seal_key.length);
+                arcfour_init(gensec_ntlmssp_state->crypt.ntlm2.recv_seal_arcfour_state,
+                             &recv_seal_key);
+                dump_data_pw("NTLMSSP receive seal hash:\n",
+                             gensec_ntlmssp_state->crypt.ntlm2.recv_seal_arcfour_state->sbox,
+                             sizeof(gensec_ntlmssp_state->crypt.ntlm2.recv_seal_arcfour_state->sbox));
+                gensec_ntlmssp_state->crypt.ntlm2.send_seq_num = 0;
+                gensec_ntlmssp_state->crypt.ntlm2.recv_seq_num = 0;
+        } else {
+                DATA_BLOB weak_session_key = ntlmssp_weakend_key(gensec_ntlmssp_state, mem_ctx);
+                DEBUG(5, ("NTLMSSP Sign/Seal - using NTLM1\n"));
+                gensec_ntlmssp_state->crypt.ntlm.arcfour_state = talloc(gensec_ntlmssp_state, struct arcfour_state);
+                NT_STATUS_HAVE_NO_MEMORY(gensec_ntlmssp_state->crypt.ntlm.arcfour_state);
+                arcfour_init(gensec_ntlmssp_state->crypt.ntlm.arcfour_state,
+                             &weak_session_key);
+                dump_data_pw("NTLMSSP hash:\n", gensec_ntlmssp_state->crypt.ntlm.arcfour_state->sbox,
+                             sizeof(gensec_ntlmssp_state->crypt.ntlm.arcfour_state->sbox));
+                gensec_ntlmssp_state->crypt.ntlm.seq_num = 0;
+        }
+        talloc_free(mem_ctx);
+        return NT_STATUS_OK;
+        return nt_status;
+}
 …
 NTSTATUS gensec_ntlmssp_wrap(struct gensec_security *gensec_security,
                              TALLOC_CTX *sig_mem_ctx,
+                             TALLOC_CTX *out_mem_ctx,
                              const DATA_BLOB *in,
                              DATA_BLOB *out)
+{
+        DATA_BLOB sig;
+        NTSTATUS nt_status;
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
+                *out = data_blob_talloc(sig_mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
+                if (!out->data) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
+                nt_status = gensec_ntlmssp_seal_packet(gensec_security, sig_mem_ctx,
+                                                       out->data + NTLMSSP_SIG_SIZE,
+                                                       out->length - NTLMSSP_SIG_SIZE,
+                                                       out->data + NTLMSSP_SIG_SIZE,
+                                                       out->length - NTLMSSP_SIG_SIZE,
+                                                       &sig);
+                if (NT_STATUS_IS_OK(nt_status)) {
+                        memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
+                }
+                return nt_status;
+        } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
+                *out = data_blob_talloc(sig_mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
+                if (!out->data) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
+                nt_status = gensec_ntlmssp_sign_packet(gensec_security, sig_mem_ctx,
+                                                       out->data + NTLMSSP_SIG_SIZE,
+                                                       out->length - NTLMSSP_SIG_SIZE,
+                                                       out->data + NTLMSSP_SIG_SIZE,
+                                                       out->length - NTLMSSP_SIG_SIZE,
+                                                       &sig);
+                if (NT_STATUS_IS_OK(nt_status)) {
+                        memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
+                }
+                return nt_status;
+        } else {
+                *out = *in;
+                return NT_STATUS_OK;
+        }
+        return ntlmssp_wrap(gensec_ntlmssp->ntlmssp_state,
+                            out_mem_ctx,
+                            in, out);
+}
 NTSTATUS gensec_ntlmssp_unwrap(struct gensec_security *gensec_security,
                                TALLOC_CTX *sig_mem_ctx,
+                               TALLOC_CTX *out_mem_ctx,
                                const DATA_BLOB *in,
                                DATA_BLOB *out)
+{
+        DATA_BLOB sig;
+        struct gensec_ntlmssp_context *gensec_ntlmssp =
+                talloc_get_type_abort(gensec_security->private_data,
+                                      struct gensec_ntlmssp_context);
+        if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
+                if (in->length < NTLMSSP_SIG_SIZE) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+                sig.data = in->data;
+                sig.length = NTLMSSP_SIG_SIZE;
+                *out = data_blob_talloc(sig_mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
+                return gensec_ntlmssp_unseal_packet(gensec_security, sig_mem_ctx,
+                                                    out->data, out->length,
+                                                    out->data, out->length,
+                                                    &sig);
+        } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
+                struct gensec_ntlmssp_state *gensec_ntlmssp_state =
+                (struct gensec_ntlmssp_state *)gensec_security->private_data;
+                NTSTATUS status;
+                uint32_t ntlm_seqnum;
+                struct arcfour_state ntlm_state;
+                uint32_t ntlm2_seqnum_r;
+                uint8_t ntlm2_key_r[16];
+                struct arcfour_state ntlm2_state_r;
+                if (in->length < NTLMSSP_SIG_SIZE) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+                sig.data = in->data;
+                sig.length = NTLMSSP_SIG_SIZE;
+                *out = data_blob_talloc(sig_mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
+                if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+                        ntlm2_seqnum_r = gensec_ntlmssp_state->crypt.ntlm2.recv_seq_num;
+                        ntlm2_state_r = *gensec_ntlmssp_state->crypt.ntlm2.recv_seal_arcfour_state;
+                        memcpy(ntlm2_key_r,
+                               gensec_ntlmssp_state->crypt.ntlm2.recv_sign_key.data,
+);
+                } else {
+                        ntlm_seqnum = gensec_ntlmssp_state->crypt.ntlm.seq_num;
+                        ntlm_state = *gensec_ntlmssp_state->crypt.ntlm.arcfour_state;
+                }
+                status = gensec_ntlmssp_check_packet(gensec_security, sig_mem_ctx,
+                                                     out->data, out->length,
+                                                     out->data, out->length,
+                                                     &sig);
+                if (!NT_STATUS_IS_OK(status)) {
+                        NTSTATUS check_status = status;
+                        /*
+                         * The Windows LDAP libraries seems to have a bug
+                         * and always use sealing even if only signing was
+                         * negotiated. So we need to fallback.
+                         */
+                        if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+                                gensec_ntlmssp_state->crypt.ntlm2.recv_seq_num = ntlm2_seqnum_r;
+                                *gensec_ntlmssp_state->crypt.ntlm2.recv_seal_arcfour_state = ntlm2_state_r;
+                                memcpy(gensec_ntlmssp_state->crypt.ntlm2.recv_sign_key.data,
+                                       ntlm2_key_r, 16);
+                        } else {
+                                gensec_ntlmssp_state->crypt.ntlm.seq_num = ntlm_seqnum;
+                                *gensec_ntlmssp_state->crypt.ntlm.arcfour_state = ntlm_state;
+                        }
+                        status = gensec_ntlmssp_unseal_packet(gensec_security,
+                                                              sig_mem_ctx,
+                                                              out->data,
+                                                              out->length,
+                                                              out->data,
+                                                              out->length,
+                                                              &sig);
+                        if (NT_STATUS_IS_OK(status)) {
+                                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
+                        } else {
+                                status = check_status;
+                        }
+                }
+                return status;
+        } else {
+                *out = *in;
+                return NT_STATUS_OK;
+        }
+        return ntlmssp_unwrap(gensec_ntlmssp->ntlmssp_state,
+                              out_mem_ctx,
+                              in, out);
+}

vendor/current/source4/auth/pyauth.c

-              r414
+              r740
    Unix SMB/CIFS implementation.
    Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2011
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
 …
 */
+#include <Python.h>
 #include "includes.h"
+#include "libcli/util/pyerrors.h"
 #include "param/param.h"
 #include "pyauth.h"
+#include "pyldb.h"
 #include "auth/system_session_proto.h"
+#include "auth/auth.h"
 #include "param/pyparam.h"
 #include "libcli/security/security.h"
+PyTypeObject PyAuthSession = {
+#include "auth/credentials/pycredentials.h"
+#include <tevent.h>
+#include "librpc/rpc/pyrpc_util.h"
+staticforward PyTypeObject PyAuthContext;
+/* There's no Py_ssize_t in 2.4, apparently */
+#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5
+typedef int Py_ssize_t;
+typedef inquiry lenfunc;
+typedef intargfunc ssizeargfunc;
+#endif
+#ifndef Py_RETURN_NONE
+#define Py_RETURN_NONE return Py_INCREF(Py_None), Py_None
+#endif
+static PyObject *py_auth_session_get_security_token(PyObject *self, void *closure)
+{
+        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
+        PyObject *py_security_token;
+        py_security_token = py_return_ndr_struct("samba.dcerpc.security", "token",
+                                                 session->security_token, session->security_token);
+        return py_security_token;
+}
+static int py_auth_session_set_security_token(PyObject *self, PyObject *value, void *closure)
+{
+        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
+        session->security_token = talloc_reference(session, py_talloc_get_ptr(value));
+        return 0;
+}
+static PyObject *py_auth_session_get_session_key(PyObject *self, void *closure)
+{
+        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
+        return PyString_FromStringAndSize((char *)session->session_key.data, session->session_key.length);
+}
+static int py_auth_session_set_session_key(PyObject *self, PyObject *value, void *closure)
+{
+        DATA_BLOB val;
+        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
+        val.data = (uint8_t *)PyString_AsString(value);
+        val.length = PyString_Size(value);
+        session->session_key = data_blob_talloc(session, val.data, val.length);
+        return 0;
+}
+static PyObject *py_auth_session_get_credentials(PyObject *self, void *closure)
+{
+        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
+        PyObject *py_credentials;
+        /* This is evil, as the credentials are not IDL structures */
+        py_credentials = py_return_ndr_struct("samba.credentials", "Credentials", session->credentials, session->credentials);
+        return py_credentials;
+}
+static int py_auth_session_set_credentials(PyObject *self, PyObject *value, void *closure)
+{
+        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
+        session->credentials = talloc_reference(session, PyCredentials_AsCliCredentials(value));
+        return 0;
+}
+static PyGetSetDef py_auth_session_getset[] = {
+        { discard_const_p(char, "security_token"), (getter)py_auth_session_get_security_token, (setter)py_auth_session_set_security_token, NULL },
+        { discard_const_p(char, "session_key"), (getter)py_auth_session_get_session_key, (setter)py_auth_session_set_session_key, NULL },
+        { discard_const_p(char, "credentials"), (getter)py_auth_session_get_credentials, (setter)py_auth_session_set_credentials, NULL },
+        { NULL }
+};
+static PyTypeObject PyAuthSession = {
         .tp_name = "AuthSession",
         .tp_basicsize = sizeof(py_talloc_Object),
-        .tp_dealloc = py_talloc_dealloc,
         .tp_flags = Py_TPFLAGS_DEFAULT,
         .tp_repr = py_talloc_default_repr,
+        .tp_getset = py_auth_session_getset,
 };
 …
         struct loadparm_context *lp_ctx = NULL;
         struct auth_session_info *session;
+        TALLOC_CTX *mem_ctx;
         if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
                 return NULL;
+        lp_ctx = lp_from_py_object(py_lp_ctx);
+        if (lp_ctx == NULL)
+                return NULL;
+        session = system_session(NULL, lp_ctx);
+        mem_ctx = talloc_new(NULL);
+        if (mem_ctx == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
+        if (lp_ctx == NULL) {
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+        session = system_session(lp_ctx);
+        talloc_free(mem_ctx);
         return PyAuthSession_FromSession(session);
+}
-static PyObject *py_system_session_anon(PyObject *module, PyObject *args)
+{
-        PyObject *py_lp_ctx = Py_None;
-        struct loadparm_context *lp_ctx;
-        struct auth_session_info *session;
-        if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
-                return NULL;
-        lp_ctx = lp_from_py_object(py_lp_ctx);
-        if (lp_ctx == NULL)
-                return NULL;
-        session = system_session_anon(NULL, lp_ctx);
-        return PyAuthSession_FromSession(session);
+}
 static PyObject *py_admin_session(PyObject *module, PyObject *args)
 …
         struct auth_session_info *session;
         struct dom_sid *domain_sid = NULL;
+        TALLOC_CTX *mem_ctx;
         if (!PyArg_ParseTuple(args, "OO", &py_lp_ctx, &py_sid))
                 return NULL;
+        lp_ctx = lp_from_py_object(py_lp_ctx);
+        if (lp_ctx == NULL)
+                return NULL;
+        domain_sid = dom_sid_parse_talloc(NULL, PyString_AsString(py_sid));
+        mem_ctx = talloc_new(NULL);
+        if (mem_ctx == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
+        if (lp_ctx == NULL) {
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+        domain_sid = dom_sid_parse_talloc(mem_ctx, PyString_AsString(py_sid));
+        if (domain_sid == NULL) {
+                PyErr_Format(PyExc_RuntimeError, "Unable to parse sid %s",
+                                         PyString_AsString(py_sid));
+                talloc_free(mem_ctx);
+                return NULL;
+        }
         session = admin_session(NULL, lp_ctx, domain_sid);
+        talloc_free(mem_ctx);
         return PyAuthSession_FromSession(session);
+}
+static PyObject *py_user_session(PyObject *module, PyObject *args, PyObject *kwargs)
+{
+        NTSTATUS nt_status;
+        struct auth_session_info *session;
+        TALLOC_CTX *mem_ctx;
+        const char * const kwnames[] = { "ldb", "lp_ctx", "principal", "dn", "session_info_flags", NULL };
+        struct ldb_context *ldb_ctx;
+        PyObject *py_ldb = Py_None;
+        PyObject *py_dn = Py_None;
+        PyObject *py_lp_ctx = Py_None;
+        struct loadparm_context *lp_ctx = NULL;
+        struct ldb_dn *user_dn;
+        char *principal = NULL;
+        int session_info_flags = 0; /* This is an int, because that's
+                                 * what we need for the python
+                                 * PyArg_ParseTupleAndKeywords */
+        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|OzOi",
+                                         discard_const_p(char *, kwnames),
+                                         &py_ldb, &py_lp_ctx, &principal, &py_dn, &session_info_flags)) {
+                return NULL;
+        }
+        mem_ctx = talloc_new(NULL);
+        if (mem_ctx == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        ldb_ctx = PyLdb_AsLdbContext(py_ldb);
+        if (py_dn == Py_None) {
+                user_dn = NULL;
+        } else {
+                if (!PyObject_AsDn(ldb_ctx, py_dn, ldb_ctx, &user_dn)) {
+                        talloc_free(mem_ctx);
+                        return NULL;
+                }
+        }
+        lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
+        if (lp_ctx == NULL) {
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+        nt_status = authsam_get_session_info_principal(mem_ctx, lp_ctx, ldb_ctx, principal, user_dn,
+                                                       session_info_flags, &session);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                talloc_free(mem_ctx);
+                PyErr_NTSTATUS_IS_ERR_RAISE(nt_status);
+        }
+        talloc_steal(NULL, session);
+        talloc_free(mem_ctx);
+        return PyAuthSession_FromSession(session);
+}
+static const char **PyList_AsStringList(TALLOC_CTX *mem_ctx, PyObject *list,
+                                        const char *paramname)
+{
+        const char **ret;
+        Py_ssize_t i;
+        if (!PyList_Check(list)) {
+                PyErr_Format(PyExc_TypeError, "%s is not a list", paramname);
+                return NULL;
+        }
+        ret = talloc_array(NULL, const char *, PyList_Size(list)+1);
+        if (ret == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        for (i = 0; i < PyList_Size(list); i++) {
+                PyObject *item = PyList_GetItem(list, i);
+                if (!PyString_Check(item)) {
+                        PyErr_Format(PyExc_TypeError, "%s should be strings", paramname);
+                        return NULL;
+                }
+                ret[i] = talloc_strndup(ret, PyString_AsString(item),
+                                        PyString_Size(item));
+        }
+        ret[i] = NULL;
+        return ret;
+}
+static PyObject *PyAuthContext_FromContext(struct auth_context *auth_context)
+{
+        return py_talloc_reference(&PyAuthContext, auth_context);
+}
+static PyObject *py_auth_context_new(PyTypeObject *type, PyObject *args, PyObject *kwargs)
+{
+        PyObject *py_lp_ctx = Py_None;
+        PyObject *py_ldb = Py_None;
+        PyObject *py_messaging_ctx = Py_None;
+        PyObject *py_auth_context = Py_None;
+        PyObject *py_methods = Py_None;
+        TALLOC_CTX *mem_ctx;
+        struct auth_context *auth_context;
+        struct messaging_context *messaging_context = NULL;
+        struct loadparm_context *lp_ctx;
+        struct tevent_context *ev;
+        struct ldb_context *ldb;
+        NTSTATUS nt_status;
+        const char **methods;
+        const char * const kwnames[] = { "lp_ctx", "messaging_ctx", "ldb", "methods", NULL };
+        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OOOO",
+                                         discard_const_p(char *, kwnames),
+                                         &py_lp_ctx, &py_messaging_ctx, &py_ldb, &py_methods))
+                return NULL;
+        mem_ctx = talloc_new(NULL);
+        if (mem_ctx == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        if (py_ldb != Py_None) {
+                ldb = PyLdb_AsLdbContext(py_ldb);
+        }
+        lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
+        ev = tevent_context_init(mem_ctx);
+        if (ev == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+        if (py_messaging_ctx != Py_None) {
+                messaging_context = py_talloc_get_type(py_messaging_ctx, struct messaging_context);
+        }
+        if (py_methods == Py_None && py_ldb == Py_None) {
+                nt_status = auth_context_create(mem_ctx, ev, messaging_context, lp_ctx, &auth_context);
+        } else {
+                if (py_methods != Py_None) {
+                        methods = PyList_AsStringList(mem_ctx, py_methods, "methods");
+                        if (methods == NULL) {
+                                talloc_free(mem_ctx);
+                                return NULL;
+                        }
+                } else {
+                        methods = auth_methods_from_lp(mem_ctx, lp_ctx);
+                }
+                nt_status = auth_context_create_methods(mem_ctx, methods, ev,
+                                                        messaging_context, lp_ctx,
+                                                        ldb, &auth_context);
+        }
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                talloc_free(mem_ctx);
+                PyErr_NTSTATUS_IS_ERR_RAISE(nt_status);
+        }
+        if (!talloc_reference(auth_context, lp_ctx)) {
+                talloc_free(mem_ctx);
+                PyErr_NoMemory();
+                return NULL;
+        }
+        if (!talloc_reference(auth_context, ev)) {
+                talloc_free(mem_ctx);
+                PyErr_NoMemory();
+                return NULL;
+        }
+        py_auth_context = PyAuthContext_FromContext(auth_context);
+        talloc_free(mem_ctx);
+        return py_auth_context;
+}
+static PyTypeObject PyAuthContext = {
+        .tp_name = "AuthContext",
+        .tp_basicsize = sizeof(py_talloc_Object),
+        .tp_flags = Py_TPFLAGS_DEFAULT,
+        .tp_new = py_auth_context_new,
+        .tp_basicsize = sizeof(py_talloc_Object),
+};
 static PyMethodDef py_auth_methods[] = {
         { "system_session", (PyCFunction)py_system_session, METH_VARARGS, NULL },
-        { "system_session_anonymous", (PyCFunction)py_system_session_anon, METH_VARARGS, NULL },
         { "admin_session", (PyCFunction)py_admin_session, METH_VARARGS, NULL },
+        { "user_session", (PyCFunction)py_user_session, METH_VARARGS|METH_KEYWORDS, NULL },
         { NULL },
 };
 …
         PyObject *m;
+        PyAuthSession.tp_base = PyTalloc_GetObjectType();
+        if (PyAuthSession.tp_base == NULL)
+                return;
         if (PyType_Ready(&PyAuthSession) < 0)
                 return;
+        m = Py_InitModule3("auth", py_auth_methods, "Authentication and authorization support.");
+        PyAuthContext.tp_base = PyTalloc_GetObjectType();
+        if (PyAuthContext.tp_base == NULL)
+                return;
+        if (PyType_Ready(&PyAuthContext) < 0)
+                return;
+        m = Py_InitModule3("auth", py_auth_methods,
+                                           "Authentication and authorization support.");
         if (m == NULL)
                 return;
 …
         Py_INCREF(&PyAuthSession);
         PyModule_AddObject(m, "AuthSession", (PyObject *)&PyAuthSession);
+}
+        Py_INCREF(&PyAuthContext);
+        PyModule_AddObject(m, "AuthContext", (PyObject *)&PyAuthContext);
+#define ADD_FLAG(val)  PyModule_AddObject(m, #val, PyInt_FromLong(val))
+        ADD_FLAG(AUTH_SESSION_INFO_DEFAULT_GROUPS);
+        ADD_FLAG(AUTH_SESSION_INFO_AUTHENTICATED);
+        ADD_FLAG(AUTH_SESSION_INFO_SIMPLE_PRIVILEGES);
+}

vendor/current/source4/auth/pyauth.h

-              r414
+              r740
 #define _PYAUTH_H_
 #include "pytalloc.h"
+#include <pytalloc.h>
 #include "auth/session.h"
-PyAPI_DATA(PyTypeObject) PyAuthSession;
 #define PyAuthSession_AsSession(obj) py_talloc_get_type(obj, struct auth_session_info)
 #define PyAuthSession_Check(obj) PyObject_TypeCheck(obj, &PyAuthSession)

vendor/current/source4/auth/sam.c

-              r414
+              r740
    Unix SMB/CIFS implementation.
    Password and authentication handling
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2004
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2010
    Copyright (C) Gerald Carter                             2003
    Copyright (C) Stefan Metzmacher                         2005
 …
 #include "auth/auth.h"
 #include <ldb.h>
-#include "../lib/util/util_ldb.h"
 #include "dsdb/samdb/samdb.h"
 #include "libcli/security/security.h"
+#include "libcli/ldap/ldap.h"
+#include "../libcli/ldap/ldap_ndr.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
+#include "librpc/gen_ndr/ndr_security.h"
+#include "auth/auth_sam.h"
+#include "dsdb/common/util.h"
+#include "libcli/ldap/ldap_ndr.h"
 #include "param/param.h"
-#include "auth/auth_sam.h"
 #define KRBTGT_ATTRS \
 …
         "servicePrincipalName",                 \
         "msDS-KeyVersionNumber",                \
+        "msDS-SecondaryKrbTgtNumber",           \
+        "msDS-SupportedEncryptionTypes",        \
         "supplementalCredentials",              \
+                                                \
 …
+                                                \
         "pwdLastSet",                           \
         "accountExpires"
+        "accountExpires"
 const char *krbtgt_attrs[] = {
         KRBTGT_ATTRS
+        KRBTGT_ATTRS, NULL
 };
 const char *server_attrs[] = {
         KRBTGT_ATTRS
+        KRBTGT_ATTRS, NULL
 };
 …
         "userWorkstations",
         /* required for server_info, not access control: */
+        /* required for user_info_dc, not access control: */
         "displayName",
         "scriptPath",
 …
 /****************************************************************************
  Do a specific test for a SAM_ACCOUNT being vaild for this connection
+ Do a specific test for a SAM_ACCOUNT being valid for this connection
  (ie not disabled, expired and the like).
 ****************************************************************************/
 …
                                                               domain_dn, msg);
         workstation_list = samdb_result_string(msg, "userWorkstations", NULL);
+        workstation_list = ldb_msg_find_attr_as_string(msg, "userWorkstations", NULL);
         /* Quit if the account was disabled. */
         if (acct_flags & ACB_DISABLED) {
                 DEBUG(1,("authsam_account_ok: Account for user '%s' was disabled.\n", name_for_logs));
+                DEBUG(2,("authsam_account_ok: Account for user '%s' was disabled.\n", name_for_logs));
                 return NT_STATUS_ACCOUNT_DISABLED;
+        }
 …
         /* Quit if the account was locked out. */
         if (acct_flags & ACB_AUTOLOCK) {
                 DEBUG(1,("authsam_account_ok: Account for user %s was locked out.\n", name_for_logs));
+                DEBUG(2,("authsam_account_ok: Account for user %s was locked out.\n", name_for_logs));
                 return NT_STATUS_ACCOUNT_LOCKED_OUT;
+        }
 …
         unix_to_nt_time(&now, time(NULL));
         if (now > acct_expiry) {
                 DEBUG(1,("authsam_account_ok: Account for user '%s' has expired.\n", name_for_logs));
+                DEBUG(2,("authsam_account_ok: Account for user '%s' has expired.\n", name_for_logs));
                 DEBUG(3,("authsam_account_ok: Account expired at '%s'.\n",
                          nt_time_string(mem_ctx, acct_expiry)));
 …
         /* check for immediate expiry "must change at next logon" (but not if this is a password change request) */
         if ((must_change_time == 0) && !password_change) {
                 DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n",
+                DEBUG(2,("sam_account_ok: Account for user '%s' password must change!.\n",
                          name_for_logs));
                 return NT_STATUS_PASSWORD_MUST_CHANGE;
 …
         /* check for expired password (but not if this is a password change request) */
         if ((must_change_time < now) && !password_change) {
                 DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n",
+                DEBUG(2,("sam_account_ok: Account for user '%s' password expired!.\n",
                          name_for_logs));
                 DEBUG(1,("sam_account_ok: Password expired at '%s' unix time.\n",
+                DEBUG(2,("sam_account_ok: Password expired at '%s' unix time.\n",
                          nt_time_string(mem_ctx, must_change_time)));
                 return NT_STATUS_PASSWORD_EXPIRED;
 …
+}
+/* This function tests if a SID structure "sids" contains the SID "sid" */
+static bool sids_contains_sid(const struct dom_sid **sids, const int num_sids,
+        const struct dom_sid *sid)
+{
+        int i;
+        for (i = 0; i < num_sids; i++) {
+                if (dom_sid_equal(sids[i], sid))
+                        return true;
+        }
+        return false;
+}
+/*
+ * This function generates the transitive closure of a given SID "sid" (it
+ * basically expands nested groups of a SID).
+ * If the SID isn't located in the "res_sids" structure yet and the
+ * "only_childs" flag is negative, we add it to "res_sids".
+ * Then we've always to consider the "memberOf" attributes. We invoke the
+ * function recursively on each item of it with the "only_childs" flag set to
+ * "false".
+ * The "only_childs" flag is particularly useful if you have a user SID and
+ * want to include all his groups (referenced with "memberOf") without his SID
+ * itself.
+ *
+ * At the beginning "res_sids" should reference to a NULL pointer.
+ */
+static NTSTATUS authsam_expand_nested_groups(struct ldb_context *sam_ctx,
+        const struct dom_sid *sid, const bool only_childs,
+        TALLOC_CTX *res_sids_ctx, struct dom_sid ***res_sids,
+        int *num_res_sids)
+{
+        const char * const attrs[] = { "memberOf", NULL };
+        int i, ret;
+        bool already_there;
+        struct ldb_dn *tmp_dn;
+        struct dom_sid *tmp_sid;
+        TALLOC_CTX *tmp_ctx;
+        struct ldb_message **res;
+        NTSTATUS status;
+        if (*res_sids == NULL) {
+                *num_res_sids = 0;
+        }
+        if (sid == NULL) {
+                return NT_STATUS_OK;
+        }
+        already_there = sids_contains_sid((const struct dom_sid**) *res_sids,
+                *num_res_sids, sid);
+        if (already_there) {
+                return NT_STATUS_OK;
+        }
+        if (!only_childs) {
+                tmp_sid = dom_sid_dup(res_sids_ctx, sid);
+                NT_STATUS_HAVE_NO_MEMORY(tmp_sid);
+                *res_sids = talloc_realloc(res_sids_ctx, *res_sids,
+                        struct dom_sid *, *num_res_sids + 1);
+                NT_STATUS_HAVE_NO_MEMORY(*res_sids);
+                (*res_sids)[*num_res_sids] = tmp_sid;
+                ++(*num_res_sids);
+        }
+        tmp_ctx = talloc_new(sam_ctx);
+        ret = gendb_search(sam_ctx, tmp_ctx, NULL, &res, attrs,
+                "objectSid=%s", ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+        if (ret != 1) {
+                talloc_free(tmp_ctx);
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+        if (res[0]->num_elements == 0) {
+                talloc_free(res);
+                talloc_free(tmp_ctx);
+                return NT_STATUS_OK;
+        }
+        for (i = 0; i < res[0]->elements[0].num_values; i++) {
+                tmp_dn = ldb_dn_from_ldb_val(tmp_ctx, sam_ctx,
+                        &res[0]->elements[0].values[i]);
+                tmp_sid = samdb_search_dom_sid(sam_ctx, tmp_ctx, tmp_dn,
+                        "objectSid", NULL);
+                status = authsam_expand_nested_groups(sam_ctx, tmp_sid,
+                        false, res_sids_ctx, res_sids, num_res_sids);
+                if (!NT_STATUS_IS_OK(status)) {
+                        talloc_free(res);
+                        talloc_free(tmp_ctx);
+                        return status;
+                }
+        }
+        talloc_free(res);
+        talloc_free(tmp_ctx);
+        return NT_STATUS_OK;
+}
+_PUBLIC_ NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx,
+_PUBLIC_ NTSTATUS authsam_make_user_info_dc(TALLOC_CTX *mem_ctx,
                                            struct ldb_context *sam_ctx,
                                            const char *netbios_name,
 …
                                            DATA_BLOB user_sess_key,
                                            DATA_BLOB lm_sess_key,
+                                           struct auth_serversupplied_info
+                                                   **_server_info)
+                                           struct auth_user_info_dc **_user_info_dc)
+{
         NTSTATUS status;
         struct auth_serversupplied_info *server_info;
         const char *str;
         struct dom_sid *tmp_sid;
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
+        const char *str, *filter;
         /* SIDs for the account and his primary group */
         struct dom_sid *account_sid;
+        struct dom_sid *primary_group_sid;
+        const char *primary_group_string;
+        const char *primary_group_dn;
+        DATA_BLOB primary_group_blob;
         /* SID structures for the expanded group memberships */
+        struct dom_sid **groupSIDs = NULL, **groupSIDs_2 = NULL;
+        int num_groupSIDs = 0, num_groupSIDs_2 = 0, i;
+        uint32_t userAccountControl;
+        server_info = talloc(mem_ctx, struct auth_serversupplied_info);
+        NT_STATUS_HAVE_NO_MEMORY(server_info);
+        account_sid = samdb_result_dom_sid(server_info, msg, "objectSid");
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(account_sid, server_info);
+        primary_group_sid = dom_sid_add_rid(server_info,
+                samdb_domain_sid(sam_ctx),
+                samdb_result_uint(msg, "primaryGroupID", ~0));
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(primary_group_sid, server_info);
+        /* Expands the primary group */
+        status = authsam_expand_nested_groups(sam_ctx, primary_group_sid, false,
+                                              server_info, &groupSIDs, &num_groupSIDs);
+        struct dom_sid *sids = NULL;
+        unsigned int num_sids = 0, i;
+        struct dom_sid *domain_sid;
+        TALLOC_CTX *tmp_ctx;
+        struct ldb_message_element *el;
+        user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+        tmp_ctx = talloc_new(user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc, user_info_dc);
+        sids = talloc_array(user_info_dc, struct dom_sid, 2);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sids, user_info_dc);
+        num_sids = 2;
+        account_sid = samdb_result_dom_sid(user_info_dc, msg, "objectSid");
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(account_sid, user_info_dc);
+        status = dom_sid_split_rid(tmp_ctx, account_sid, &domain_sid, NULL);
         if (!NT_STATUS_IS_OK(status)) {
                 talloc_free(server_info);
+                talloc_free(user_info_dc);
                 return status;
+        }
+        sids[PRIMARY_USER_SID_INDEX] = *account_sid;
+        sids[PRIMARY_GROUP_SID_INDEX] = *domain_sid;
+        sid_append_rid(&sids[PRIMARY_GROUP_SID_INDEX], ldb_msg_find_attr_as_uint(msg, "primaryGroupID", ~0));
+        /* Filter out builtin groups from this token.  We will search
+         * for builtin groups later, and not include them in the PAC
+         * on SamLogon validation info */
+        filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(!(groupType:1.2.840.113556.1.4.803:=%u))(groupType:1.2.840.113556.1.4.803:=%u))", GROUP_TYPE_BUILTIN_LOCAL_GROUP, GROUP_TYPE_SECURITY_ENABLED);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(filter, user_info_dc);
+        primary_group_string = dom_sid_string(tmp_ctx, &sids[PRIMARY_GROUP_SID_INDEX]);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(primary_group_string, user_info_dc);
+        primary_group_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", primary_group_string);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(primary_group_dn, user_info_dc);
+        primary_group_blob = data_blob_string_const(primary_group_dn);
+        /* Expands the primary group - this function takes in
+         * memberOf-like values, so we fake one up with the
+         * <SID=S-...> format of DN and then let it expand
+         * them, as long as they meet the filter - so only
+         * domain groups, not builtin groups
+         *
+         * The primary group is still treated specially, so we set the
+         * 'only childs' flag to true
+         */
+        status = dsdb_expand_nested_groups(sam_ctx, &primary_group_blob, true, filter,
+                                           user_info_dc, &sids, &num_sids);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(user_info_dc);
+                return status;
+        }
         /* Expands the additional groups */
+        status = authsam_expand_nested_groups(sam_ctx, account_sid, true,
+                server_info, &groupSIDs_2, &num_groupSIDs_2);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(server_info);
+                return status;
+        }
+        /* Merge the two expanded structures (groupSIDs, groupSIDs_2) */
+        for (i = 0; i < num_groupSIDs_2; i++)
+                if (!sids_contains_sid((const struct dom_sid **) groupSIDs,
+                                num_groupSIDs, groupSIDs_2[i])) {
+                        tmp_sid = dom_sid_dup(server_info, groupSIDs_2[i]);
+                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(tmp_sid, server_info);
+                        groupSIDs = talloc_realloc(server_info, groupSIDs,
+                                struct dom_sid *, num_groupSIDs + 1);
+                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(groupSIDs,
+                                server_info);
+                        groupSIDs[num_groupSIDs] = tmp_sid;
+                        ++num_groupSIDs;
+                }
+        talloc_free(groupSIDs_2);
+        server_info->account_sid = account_sid;
+        server_info->primary_group_sid = primary_group_sid;
+        /* DCs also get SID_NT_ENTERPRISE_DCS */
+        userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
+        if (userAccountControl & UF_SERVER_TRUST_ACCOUNT) {
+                groupSIDs = talloc_realloc(server_info, groupSIDs, struct dom_sid *,
+                                           num_groupSIDs+1);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(groupSIDs, server_info);
+                groupSIDs[num_groupSIDs] = dom_sid_parse_talloc(groupSIDs, SID_NT_ENTERPRISE_DCS);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(groupSIDs[num_groupSIDs], server_info);
+                num_groupSIDs++;
+        }
+        server_info->domain_groups = groupSIDs;
+        server_info->n_domain_groups = num_groupSIDs;
+        server_info->account_name = talloc_steal(server_info,
+                samdb_result_string(msg, "sAMAccountName", NULL));
+        server_info->domain_name = talloc_strdup(server_info, domain_name);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->domain_name,
+                server_info);
+        str = samdb_result_string(msg, "displayName", "");
+        server_info->full_name = talloc_strdup(server_info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->full_name, server_info);
+        str = samdb_result_string(msg, "scriptPath", "");
+        server_info->logon_script = talloc_strdup(server_info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->logon_script,
+                server_info);
+        str = samdb_result_string(msg, "profilePath", "");
+        server_info->profile_path = talloc_strdup(server_info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->profile_path,
+                server_info);
+        str = samdb_result_string(msg, "homeDirectory", "");
+        server_info->home_directory = talloc_strdup(server_info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->home_directory,
+                server_info);
+        str = samdb_result_string(msg, "homeDrive", "");
+        server_info->home_drive = talloc_strdup(server_info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->home_drive, server_info);
+        server_info->logon_server = talloc_strdup(server_info, netbios_name);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->logon_server,
+                server_info);
+        server_info->last_logon = samdb_result_nttime(msg, "lastLogon", 0);
+        server_info->last_logoff = samdb_result_last_logoff(msg);
+        server_info->acct_expiry = samdb_result_account_expires(msg);
+        server_info->last_password_change = samdb_result_nttime(msg,
+        el = ldb_msg_find_element(msg, "memberOf");
+        for (i = 0; el && i < el->num_values; i++) {
+                /* This function takes in memberOf values and expands
+                 * them, as long as they meet the filter - so only
+                 * domain groups, not builtin groups */
+                status = dsdb_expand_nested_groups(sam_ctx, &el->values[i], false, filter,
+                                                   user_info_dc, &sids, &num_sids);
+                if (!NT_STATUS_IS_OK(status)) {
+                        talloc_free(user_info_dc);
+                        return status;
+                }
+        }
+        user_info_dc->sids = sids;
+        user_info_dc->num_sids = num_sids;
+        user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+        info->account_name = talloc_steal(info,
+                ldb_msg_find_attr_as_string(msg, "sAMAccountName", NULL));
+        info->domain_name = talloc_strdup(info, domain_name);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->domain_name,
+                user_info_dc);
+        str = ldb_msg_find_attr_as_string(msg, "displayName", "");
+        info->full_name = talloc_strdup(info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->full_name, user_info_dc);
+        str = ldb_msg_find_attr_as_string(msg, "scriptPath", "");
+        info->logon_script = talloc_strdup(info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->logon_script,
+                user_info_dc);
+        str = ldb_msg_find_attr_as_string(msg, "profilePath", "");
+        info->profile_path = talloc_strdup(info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->profile_path,
+                user_info_dc);
+        str = ldb_msg_find_attr_as_string(msg, "homeDirectory", "");
+        info->home_directory = talloc_strdup(info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->home_directory,
+                user_info_dc);
+        str = ldb_msg_find_attr_as_string(msg, "homeDrive", "");
+        info->home_drive = talloc_strdup(info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->home_drive, user_info_dc);
+        info->logon_server = talloc_strdup(info, netbios_name);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->logon_server,
+                user_info_dc);
+        info->last_logon = samdb_result_nttime(msg, "lastLogon", 0);
+        info->last_logoff = samdb_result_last_logoff(msg);
+        info->acct_expiry = samdb_result_account_expires(msg);
+        info->last_password_change = samdb_result_nttime(msg,
                 "pwdLastSet", 0);
         server_info->allow_password_change
+        info->allow_password_change
                 = samdb_result_allow_password_change(sam_ctx, mem_ctx,
                         domain_dn, msg, "pwdLastSet");
         server_info->force_password_change
+        info->force_password_change
                 = samdb_result_force_password_change(sam_ctx, mem_ctx,
                         domain_dn, msg);
         server_info->logon_count = samdb_result_uint(msg, "logonCount", 0);
         server_info->bad_password_count = samdb_result_uint(msg, "badPwdCount",
+        info->logon_count = ldb_msg_find_attr_as_uint(msg, "logonCount", 0);
+        info->bad_password_count = ldb_msg_find_attr_as_uint(msg, "badPwdCount",
 );
         server_info->acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx,
+        info->acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx,
                                                           msg, domain_dn);
+        server_info->user_session_key = data_blob_talloc_reference(server_info,
+                &user_sess_key);
+        server_info->lm_session_key = data_blob_talloc_reference(server_info,
+                &lm_sess_key);
+        server_info->authenticated = true;
+        *_server_info = server_info;
+        user_info_dc->user_session_key = data_blob_talloc(user_info_dc,
+                                                         user_sess_key.data,
+                                                         user_sess_key.length);
+        if (user_sess_key.data) {
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->user_session_key.data,
+                                                  user_info_dc);
+        }
+        user_info_dc->lm_session_key = data_blob_talloc(user_info_dc,
+                                                       lm_sess_key.data,
+                                                       lm_sess_key.length);
+        if (lm_sess_key.data) {
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->lm_session_key.data,
+                                                  user_info_dc);
+        }
+        if (info->acct_flags & ACB_SVRTRUST) {
+                /* the SID_NT_ENTERPRISE_DCS SID gets added into the
+                   PAC */
+                user_info_dc->sids = talloc_realloc(user_info_dc,
+                                                   user_info_dc->sids,
+                                                   struct dom_sid,
+                                                   user_info_dc->num_sids+1);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->sids, user_info_dc);
+                user_info_dc->sids[user_info_dc->num_sids] = global_sid_Enterprise_DCs;
+                user_info_dc->num_sids++;
+        }
+        if ((info->acct_flags & (ACB_PARTIAL_SECRETS_ACCOUNT | ACB_WSTRUST)) ==
+            (ACB_PARTIAL_SECRETS_ACCOUNT | ACB_WSTRUST)) {
+                /* the DOMAIN_RID_ENTERPRISE_READONLY_DCS PAC */
+                user_info_dc->sids = talloc_realloc(user_info_dc,
+                                                   user_info_dc->sids,
+                                                   struct dom_sid,
+                                                   user_info_dc->num_sids+1);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->sids, user_info_dc);
+                user_info_dc->sids[user_info_dc->num_sids] = *domain_sid;
+                sid_append_rid(&user_info_dc->sids[user_info_dc->num_sids],
+                            DOMAIN_RID_ENTERPRISE_READONLY_DCS);
+                user_info_dc->num_sids++;
+        }
+        info->authenticated = true;
+        talloc_free(tmp_ctx);
+        *_user_info_dc = user_info_dc;
         return NT_STATUS_OK;
 …
         /* pull the user attributes */
         ret = gendb_search_single_extended_dn(sam_ctx, tmp_ctx, user_dn,
                 LDB_SCOPE_BASE, msg, attrs, "(objectClass=*)");
+        ret = dsdb_search_one(sam_ctx, tmp_ctx, msg, user_dn,
+                              LDB_SCOPE_BASE, attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
         if (ret != LDB_SUCCESS) {
                 talloc_free(tmp_ctx);
 …
         return NT_STATUS_OK;
+}
+/* Used in the gensec_gssapi and gensec_krb5 server-side code, where the PAC isn't available, and for tokenGroups in the DSDB stack.
+ Supply either a principal or a DN
+*/
+NTSTATUS authsam_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
+                                           struct loadparm_context *lp_ctx,
+                                           struct ldb_context *sam_ctx,
+                                           const char *principal,
+                                           struct ldb_dn *user_dn,
+                                           struct auth_user_info_dc **user_info_dc)
+{
+        NTSTATUS nt_status;
+        DATA_BLOB user_sess_key = data_blob(NULL, 0);
+        DATA_BLOB lm_sess_key = data_blob(NULL, 0);
+        struct ldb_message *msg;
+        struct ldb_dn *domain_dn;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        if (principal) {
+                nt_status = sam_get_results_principal(sam_ctx, tmp_ctx, principal,
+                                                      user_attrs, &domain_dn, &msg);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        talloc_free(tmp_ctx);
+                        return nt_status;
+                }
+        } else if (user_dn) {
+                struct dom_sid *user_sid, *domain_sid;
+                int ret;
+                /* pull the user attributes */
+                ret = dsdb_search_one(sam_ctx, tmp_ctx, &msg, user_dn,
+                                      LDB_SCOPE_BASE, user_attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
+                if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                } else if (ret != LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+                user_sid = samdb_result_dom_sid(msg, msg, "objectSid");
+                nt_status = dom_sid_split_rid(tmp_ctx, user_sid, &domain_sid, NULL);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+                domain_dn = samdb_search_dn(sam_ctx, mem_ctx, NULL,
+                                          "(&(objectSid=%s)(objectClass=domain))",
+                                            ldap_encode_ndr_dom_sid(tmp_ctx, domain_sid));
+                if (!domain_dn) {
+                        DEBUG(3, ("authsam_get_user_info_dc_principal: Failed to find domain with: SID %s\n",
+                                  dom_sid_string(tmp_ctx, domain_sid)));
+                        return NT_STATUS_NO_SUCH_USER;
+                }
+        } else {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        nt_status = authsam_make_user_info_dc(tmp_ctx, sam_ctx,
+                                             lpcfg_netbios_name(lp_ctx),
+                                             lpcfg_workgroup(lp_ctx),
+                                             domain_dn,
+                                             msg,
+                                             user_sess_key, lm_sess_key,
+                                             user_info_dc);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                talloc_free(tmp_ctx);
+                return nt_status;
+        }
+        talloc_steal(mem_ctx, *user_info_dc);
+        talloc_free(tmp_ctx);
+        return NT_STATUS_OK;
+}

vendor/current/source4/auth/samba_server_gensec.c

-              r414
+              r740
         struct gensec_security *gensec_ctx;
         struct auth_context *auth_context;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
         nt_status = auth_context_create(mem_ctx,
+        nt_status = auth_context_create(tmp_ctx,
                                         event_ctx,
                                         msg_ctx,
 …
         if (!NT_STATUS_IS_OK(nt_status)) {
                 DEBUG(1, ("Failed to start auth server code: %s\n", nt_errstr(nt_status)));
+                talloc_free(tmp_ctx);
                 return nt_status;
+        }
         nt_status = gensec_server_start(mem_ctx,
+        nt_status = gensec_server_start(tmp_ctx,
                                         event_ctx,
                                         lp_gensec_settings(mem_ctx, lp_ctx),
+                                        lpcfg_gensec_settings(mem_ctx, lp_ctx),
                                         auth_context,
                                         &gensec_ctx);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(auth_context);
+                talloc_free(tmp_ctx);
                 DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(nt_status)));
                 return nt_status;
 …
                 gensec_set_target_service(gensec_ctx, target_service);
+        }
+        *gensec_context = gensec_ctx;
+        *gensec_context = talloc_steal(mem_ctx, gensec_ctx);
+        talloc_free(tmp_ctx);
         return nt_status;
+}

vendor/current/source4/auth/session.c

-              r414
+              r740
    Authentication utility functions
    Copyright (C) Andrew Tridgell 1992-1998
    Copyright (C) Andrew Bartlett 2001
+   Copyright (C) Andrew Bartlett 2001-2010
    Copyright (C) Jeremy Allison 2000-2001
    Copyright (C) Rafal Szczesniak 2002
 …
 #include "includes.h"
 #include "auth/auth.h"
+#include "auth/auth_sam.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 #include "libcli/security/security.h"
 #include "libcli/auth/libcli_auth.h"
 #include "dsdb/samdb/samdb.h"
-#include "auth/credentials/credentials.h"
-#include "param/param.h"
 #include "auth/session_proto.h"
+#include "system/kerberos.h"
+#include <gssapi/gssapi.h>
 _PUBLIC_ struct auth_session_info *anonymous_session(TALLOC_CTX *mem_ctx,
+                                            struct tevent_context *event_ctx,
+                                            struct loadparm_context *lp_ctx)
+                                            struct loadparm_context *lp_ctx)
+{
         NTSTATUS nt_status;
         struct auth_session_info *session_info = NULL;
         nt_status = auth_anonymous_session_info(mem_ctx, event_ctx, lp_ctx, &session_info);
+        nt_status = auth_anonymous_session_info(mem_ctx, lp_ctx, &session_info);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 return NULL;
 …
+}
+_PUBLIC_ NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx,
+                                     struct tevent_context *event_ctx,
+                                     struct loadparm_context *lp_ctx,
+                                     struct auth_session_info **_session_info)
+{
+        NTSTATUS nt_status;
+        struct auth_serversupplied_info *server_info = NULL;
+        struct auth_session_info *session_info = NULL;
+        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
+        nt_status = auth_anonymous_server_info(mem_ctx,
+                                               lp_netbios_name(lp_ctx),
+                                               &server_info);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                talloc_free(mem_ctx);
+                return nt_status;
+        }
+        /* references the server_info into the session_info */
+        nt_status = auth_generate_session_info(parent_ctx, event_ctx, lp_ctx, server_info, &session_info);
+        talloc_free(mem_ctx);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+        session_info->credentials = cli_credentials_init(session_info);
+        if (!session_info->credentials) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        cli_credentials_set_conf(session_info->credentials, lp_ctx);
+        cli_credentials_set_anonymous(session_info->credentials);
+        *_session_info = session_info;
+        return NT_STATUS_OK;
+}
+_PUBLIC_ NTSTATUS auth_anonymous_server_info(TALLOC_CTX *mem_ctx,
+                                    const char *netbios_name,
+                                    struct auth_serversupplied_info **_server_info)
+{
+        struct auth_serversupplied_info *server_info;
+        server_info = talloc(mem_ctx, struct auth_serversupplied_info);
+        NT_STATUS_HAVE_NO_MEMORY(server_info);
+        server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_ANONYMOUS);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
+        /* is this correct? */
+        server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_GUESTS);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
+        server_info->n_domain_groups = 0;
+        server_info->domain_groups = NULL;
+        /* annoying, but the Anonymous really does have a session key... */
+        server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
+        server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
+        /*  and it is all zeros! */
+        data_blob_clear(&server_info->user_session_key);
+        data_blob_clear(&server_info->lm_session_key);
+        server_info->account_name = talloc_strdup(server_info, "ANONYMOUS LOGON");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+        server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+        server_info->full_name = talloc_strdup(server_info, "Anonymous Logon");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
+        server_info->logon_script = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
+        server_info->profile_path = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
+        server_info->home_directory = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
+        server_info->home_drive = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
+        server_info->logon_server = talloc_strdup(server_info, netbios_name);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
+        server_info->last_logon = 0;
+        server_info->last_logoff = 0;
+        server_info->acct_expiry = 0;
+        server_info->last_password_change = 0;
+        server_info->allow_password_change = 0;
+        server_info->force_password_change = 0;
+        server_info->logon_count = 0;
+        server_info->bad_password_count = 0;
+        server_info->acct_flags = ACB_NORMAL;
+        server_info->authenticated = false;
+        *_server_info = server_info;
+        return NT_STATUS_OK;
+}
+_PUBLIC_ NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx,
+                                    struct tevent_context *event_ctx,
+                                    struct loadparm_context *lp_ctx,
+                                    struct auth_serversupplied_info *server_info,
+                                    struct auth_session_info **_session_info)
+_PUBLIC_ NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx,
+                                             struct loadparm_context *lp_ctx, /* Optional, if you don't want privilages */
+                                             struct ldb_context *sam_ctx, /* Optional, if you don't want local groups */
+                                             struct auth_user_info_dc *user_info_dc,
+                                             uint32_t session_info_flags,
+                                             struct auth_session_info **_session_info)
+{
         struct auth_session_info *session_info;
         NTSTATUS nt_status;
+        session_info = talloc(mem_ctx, struct auth_session_info);
+        NT_STATUS_HAVE_NO_MEMORY(session_info);
+        session_info->server_info = talloc_reference(session_info, server_info);
+        unsigned int i, num_sids = 0;
+        const char *filter;
+        struct dom_sid *sids = NULL;
+        const struct dom_sid *anonymous_sid, *system_sid;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
+        session_info = talloc(tmp_ctx, struct auth_session_info);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(session_info, tmp_ctx);
+        session_info->info = talloc_reference(session_info, user_info_dc->info);
+        session_info->torture = talloc_zero(session_info, struct auth_user_info_torture);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(session_info->torture, tmp_ctx);
+        session_info->torture->num_dc_sids = user_info_dc->num_sids;
+        session_info->torture->dc_sids = talloc_reference(session_info, user_info_dc->sids);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(session_info->torture->dc_sids, tmp_ctx);
         /* unless set otherwise, the session key is the user session
          * key from the auth subsystem */
+        session_info->session_key = server_info->user_session_key;
+        session_info->session_key = data_blob_talloc(session_info, user_info_dc->user_session_key.data, user_info_dc->user_session_key.length);
+        if (!session_info->session_key.data && session_info->session_key.length) {
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(session_info->session_key.data, tmp_ctx);
+        }
+        anonymous_sid = dom_sid_parse_talloc(tmp_ctx, SID_NT_ANONYMOUS);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(anonymous_sid, tmp_ctx);
+        system_sid = dom_sid_parse_talloc(tmp_ctx, SID_NT_SYSTEM);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(system_sid, tmp_ctx);
+        sids = talloc_array(tmp_ctx, struct dom_sid, user_info_dc->num_sids);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sids, tmp_ctx);
+        if (!sids) {
+                talloc_free(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+        num_sids = user_info_dc->num_sids;
+        for (i=0; i < user_info_dc->num_sids; i++) {
+                sids[i] = user_info_dc->sids[i];
+        }
+        if (user_info_dc->num_sids > PRIMARY_USER_SID_INDEX && dom_sid_equal(anonymous_sid, &user_info_dc->sids[PRIMARY_USER_SID_INDEX])) {
+                /* Don't expand nested groups of system, anonymous etc*/
+        } else if (user_info_dc->num_sids > PRIMARY_USER_SID_INDEX && dom_sid_equal(system_sid, &user_info_dc->sids[PRIMARY_USER_SID_INDEX])) {
+                /* Don't expand nested groups of system, anonymous etc*/
+        } else if (sam_ctx) {
+                filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(groupType:1.2.840.113556.1.4.803:=%u))",
+                                         GROUP_TYPE_BUILTIN_LOCAL_GROUP);
+                /* Search for each group in the token */
+                for (i = 0; i < user_info_dc->num_sids; i++) {
+                        char *sid_string;
+                        const char *sid_dn;
+                        DATA_BLOB sid_blob;
+                        sid_string = dom_sid_string(tmp_ctx,
+                                                      &user_info_dc->sids[i]);
+                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sid_string, user_info_dc);
+                        sid_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", sid_string);
+                        talloc_free(sid_string);
+                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sid_dn, user_info_dc);
+                        sid_blob = data_blob_string_const(sid_dn);
+                        /* This function takes in memberOf values and expands
+                         * them, as long as they meet the filter - so only
+                         * builtin groups
+                         *
+                         * We already have the SID in the token, so set
+                         * 'only childs' flag to true */
+                        nt_status = dsdb_expand_nested_groups(sam_ctx, &sid_blob, true, filter,
+                                                              tmp_ctx, &sids, &num_sids);
+                        if (!NT_STATUS_IS_OK(nt_status)) {
+                                talloc_free(tmp_ctx);
+                                return nt_status;
+                        }
+                }
+        }
         nt_status = security_token_create(session_info,
-                                          event_ctx,
                                           lp_ctx,
+                                          server_info->account_sid,
+                                          server_info->primary_group_sid,
+                                          server_info->n_domain_groups,
+                                          server_info->domain_groups,
+                                          server_info->authenticated,
+                                          num_sids,
+                                          sids,
+                                          session_info_flags,
                                           &session_info->security_token);
         NT_STATUS_NOT_OK_RETURN(nt_status);
+        NT_STATUS_NOT_OK_RETURN_AND_FREE(nt_status, tmp_ctx);
         session_info->credentials = NULL;
+        talloc_steal(mem_ctx, session_info);
         *_session_info = session_info;
+        talloc_free(tmp_ctx);
         return NT_STATUS_OK;
+}
+/* Create a session_info structure from the
+ * auth_session_info_transport we were forwarded over named pipe
+ * forwarding.
+ *
+ * NOTE: The stucture members of session_info_transport are stolen
+ * with talloc_move() into auth_session_info for long term use
+ */
+struct auth_session_info *auth_session_info_from_transport(TALLOC_CTX *mem_ctx,
+                                                           struct auth_session_info_transport *session_info_transport,
+                                                           struct loadparm_context *lp_ctx,
+                                                           const char **reason)
+{
+        struct auth_session_info *session_info;
+        session_info = talloc_zero(mem_ctx, struct auth_session_info);
+        if (!session_info) {
+                *reason = "failed to allocate session_info";
+                return NULL;
+        }
+        session_info->security_token = talloc_move(session_info, &session_info_transport->security_token);
+        session_info->info = talloc_move(session_info, &session_info_transport->info);
+        session_info->session_key = session_info_transport->session_key;
+        session_info->session_key.data = talloc_move(session_info, &session_info_transport->session_key.data);
+        if (session_info_transport->exported_gssapi_credentials.length) {
+                struct cli_credentials *creds;
+                OM_uint32 minor_status;
+                gss_buffer_desc cred_token;
+                gss_cred_id_t cred_handle;
+                const char *error_string;
+                int ret;
+                DEBUG(10, ("Delegated credentials supplied by client\n"));
+                cred_token.value = session_info_transport->exported_gssapi_credentials.data;
+                cred_token.length = session_info_transport->exported_gssapi_credentials.length;
+                ret = gss_import_cred(&minor_status,
+                                      &cred_token,
+                                      &cred_handle);
+                if (ret != GSS_S_COMPLETE) {
+                        *reason = "Internal error in gss_import_cred()";
+                        return NULL;
+                }
+                creds = cli_credentials_init(session_info);
+                if (!creds) {
+                        *reason = "Out of memory in cli_credentials_init()";
+                        return NULL;
+                }
+                session_info->credentials = creds;
+                cli_credentials_set_conf(creds, lp_ctx);
+                /* Just so we don't segfault trying to get at a username */
+                cli_credentials_set_anonymous(creds);
+                ret = cli_credentials_set_client_gss_creds(creds,
+                                                           lp_ctx,
+                                                           cred_handle,
+                                                           CRED_SPECIFIED,
+                                                           &error_string);
+                if (ret) {
+                        *reason = talloc_asprintf(mem_ctx,
+                                                  "Failed to set pipe forwarded"
+                                                  "creds: %s\n", error_string);
+                        return NULL;
+                }
+                /* This credential handle isn't useful for password
+                 * authentication, so ensure nobody tries to do that */
+                cli_credentials_set_kerberos_state(creds,
+                                                   CRED_MUST_USE_KERBEROS);
+        }
+        return session_info;
+}
+/* Create a auth_session_info_transport from an auth_session_info.
+ *
+ * NOTE: Members of the auth_session_info_transport structure are not talloc_referenced, but simply assigned.  They are only valid for the lifetime of the struct auth_session_info
+ *
+ * This isn't normally an issue, as the auth_session_info has a very long typical life
+ */
+NTSTATUS auth_session_info_transport_from_session(TALLOC_CTX *mem_ctx,
+                                                  struct auth_session_info *session_info,
+                                                  struct tevent_context *event_ctx,
+                                                  struct loadparm_context *lp_ctx,
+                                                  struct auth_session_info_transport **transport_out)
+{
+        struct auth_session_info_transport *session_info_transport = talloc_zero(mem_ctx, struct auth_session_info_transport);
+        session_info_transport->security_token = talloc_reference(session_info, session_info->security_token);
+        NT_STATUS_HAVE_NO_MEMORY(session_info_transport->security_token);
+        session_info_transport->info = talloc_reference(session_info, session_info->info);
+        NT_STATUS_HAVE_NO_MEMORY(session_info_transport->info);
+        session_info_transport->session_key = session_info->session_key;
+        session_info_transport->session_key.data = talloc_reference(session_info, session_info->session_key.data);
+        if (!session_info_transport->session_key.data && session_info->session_key.length) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        if (session_info->credentials) {
+                struct gssapi_creds_container *gcc;
+                OM_uint32 gret;
+                OM_uint32 minor_status;
+                gss_buffer_desc cred_token;
+                const char *error_string;
+                int ret;
+                ret = cli_credentials_get_client_gss_creds(session_info->credentials,
+                                                           event_ctx,
+                                                           lp_ctx,
+                                                           &gcc, &error_string);
+                if (ret != 0) {
+                        *transport_out = session_info_transport;
+                        return NT_STATUS_OK;
+                }
+                gret = gss_export_cred(&minor_status,
+                                       gcc->creds,
+                                       &cred_token);
+                if (gret != GSS_S_COMPLETE) {
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+                if (cred_token.length) {
+                        session_info_transport->exported_gssapi_credentials
+                                = data_blob_talloc(session_info_transport,
+                                                   cred_token.value,
+                                                   cred_token.length);
+                        gss_release_buffer(&minor_status, &cred_token);
+                        NT_STATUS_HAVE_NO_MEMORY(session_info_transport->exported_gssapi_credentials.data);
+                }
+        }
+        *transport_out = session_info_transport;
+        return NT_STATUS_OK;
+}
+/* Produce a session_info for an arbitary DN or principal in the local
+ * DB, assuming the local DB holds all the groups
+ *
+ * Supply either a principal or a DN
+ */
+NTSTATUS authsam_get_session_info_principal(TALLOC_CTX *mem_ctx,
+                                            struct loadparm_context *lp_ctx,
+                                            struct ldb_context *sam_ctx,
+                                            const char *principal,
+                                            struct ldb_dn *user_dn,
+                                            uint32_t session_info_flags,
+                                            struct auth_session_info **session_info)
+{
+        NTSTATUS nt_status;
+        struct auth_user_info_dc *user_info_dc;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        nt_status = authsam_get_user_info_dc_principal(tmp_ctx, lp_ctx, sam_ctx,
+                                                      principal, user_dn,
+                                                      &user_info_dc);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                talloc_free(tmp_ctx);
+                return nt_status;
+        }
+        nt_status = auth_generate_session_info(tmp_ctx, lp_ctx, sam_ctx,
+                                               user_info_dc, session_info_flags,
+                                               session_info);
+        if (NT_STATUS_IS_OK(nt_status)) {
+                talloc_steal(mem_ctx, *session_info);
+        }
+        talloc_free(tmp_ctx);
+        return nt_status;
+}
 …
+        }
         security_token_debug(dbg_lev, session_info->security_token);
+}
+        security_token_debug(0, dbg_lev, session_info->security_token);
+}

vendor/current/source4/auth/session.h

-              r414
+              r740
 #define _SAMBA_AUTH_SESSION_H
+struct auth_session_info {
+        struct security_token *security_token;
+        struct auth_serversupplied_info *server_info;
+        DATA_BLOB session_key;
+        struct cli_credentials *credentials;
+};
+#include "librpc/gen_ndr/security.h"
 #include "librpc/gen_ndr/netlogon.h"
+#include "librpc/gen_ndr/auth.h"
 struct tevent_context;
+struct ldb_context;
+struct ldb_dn;
 /* Create a security token for a session SYSTEM (the most
  * trusted/prvilaged account), including the local machine account as
  * the off-host credentials */
 struct auth_session_info *system_session(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx) ;
+struct auth_session_info *system_session(struct loadparm_context *lp_ctx) ;
+/*
+ * Create a system session, but with anonymous credentials (so we do
+ * not need to open secrets.ldb)
+NTSTATUS auth_anonymous_user_info_dc(TALLOC_CTX *mem_ctx,
+                                             const char *netbios_name,
+                                             struct auth_user_info_dc **interim_info);
+NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx,
+                                    struct loadparm_context *lp_ctx, /* Optional, if you don't want privilages */
+                                    struct ldb_context *sam_ctx, /* Optional, if you don't want local groups */
+                                    struct auth_user_info_dc *interim_info,
+                                    uint32_t session_info_flags,
+                                    struct auth_session_info **session_info);
+NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx,
+                                     struct loadparm_context *lp_ctx,
+                                     struct auth_session_info **session_info);
+struct auth_session_info *auth_session_info_from_transport(TALLOC_CTX *mem_ctx,
+                                                           struct auth_session_info_transport *session_info_transport,
+                                                           struct loadparm_context *lp_ctx,
+                                                           const char **reason);
+NTSTATUS auth_session_info_transport_from_session(TALLOC_CTX *mem_ctx,
+                                                  struct auth_session_info *session_info,
+                                                  struct tevent_context *event_ctx,
+                                                  struct loadparm_context *lp_ctx,
+                                                  struct auth_session_info_transport **transport_out);
+/* Produce a session_info for an arbitary DN or principal in the local
+ * DB, assuming the local DB holds all the groups
+ *
+ * Supply either a principal or a DN
  */
+struct auth_session_info *system_session_anon(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
+NTSTATUS auth_anonymous_server_info(TALLOC_CTX *mem_ctx,
+                                    const char *netbios_name,
+                                    struct auth_serversupplied_info **_server_info) ;
+NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx,
+                                    struct tevent_context *event_ctx,
+                                    struct loadparm_context *lp_ctx,
+                                    struct auth_serversupplied_info *server_info,
+                                    struct auth_session_info **_session_info) ;
+NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx,
+                                     struct tevent_context *ev_ctx,
+                                     struct loadparm_context *lp_ctx,
+                                     struct auth_session_info **_session_info);
+NTSTATUS authsam_get_session_info_principal(TALLOC_CTX *mem_ctx,
+                                            struct loadparm_context *lp_ctx,
+                                            struct ldb_context *sam_ctx,
+                                            const char *principal,
+                                            struct ldb_dn *user_dn,
+                                            uint32_t session_info_flags,
+                                            struct auth_session_info **session_info);
 struct auth_session_info *anonymous_session(TALLOC_CTX *mem_ctx,
-                                            struct tevent_context *event_ctx,
                                             struct loadparm_context *lp_ctx);

vendor/current/source4/auth/system_session.c

-              r414
+              r740
    Authentication utility functions
    Copyright (C) Andrew Tridgell 1992-1998
    Copyright (C) Andrew Bartlett 2001
+   Copyright (C) Andrew Bartlett 2001-2010
    Copyright (C) Jeremy Allison 2000-2001
    Copyright (C) Rafal Szczesniak 2002
 …
 #include "includes.h"
 #include "libcli/security/security.h"
-#include "libcli/auth/libcli_auth.h"
 #include "auth/credentials/credentials.h"
 #include "param/param.h"
 #include "auth/auth.h" /* for auth_serversupplied_info */
+#include "auth/auth.h" /* for auth_user_info_dc */
 #include "auth/session.h"
 #include "auth/system_session_proto.h"
+/**
+ * Create the SID list for this user.
+ *
+ * @note Specialised version for system sessions that doesn't use the SAM.
+/*
+  prevent the static system session being freed
  */
+static NTSTATUS create_token(TALLOC_CTX *mem_ctx,
+                               struct dom_sid *user_sid,
+                               struct dom_sid *group_sid,
+                               int n_groupSIDs,
+                               struct dom_sid **groupSIDs,
+                               bool is_authenticated,
+                               struct security_token **token)
+{
+        struct security_token *ptoken;
+        int i;
+        ptoken = security_token_initialise(mem_ctx);
+        NT_STATUS_HAVE_NO_MEMORY(ptoken);
+        ptoken->sids = talloc_array(ptoken, struct dom_sid *, n_groupSIDs + 5);
+        NT_STATUS_HAVE_NO_MEMORY(ptoken->sids);
+        ptoken->user_sid = talloc_reference(ptoken, user_sid);
+        ptoken->group_sid = talloc_reference(ptoken, group_sid);
+        ptoken->privilege_mask = 0;
+        ptoken->sids[0] = ptoken->user_sid;
+        ptoken->sids[1] = ptoken->group_sid;
+        /*
+         * Finally add the "standard" SIDs.
+         * The only difference between guest and "anonymous"
+         * is the addition of Authenticated_Users.
+         */
+        ptoken->sids[2] = dom_sid_parse_talloc(ptoken->sids, SID_WORLD);
+        NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[2]);
+        ptoken->sids[3] = dom_sid_parse_talloc(ptoken->sids, SID_NT_NETWORK);
+        NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[3]);
+        ptoken->num_sids = 4;
+        if (is_authenticated) {
+                ptoken->sids[4] = dom_sid_parse_talloc(ptoken->sids, SID_NT_AUTHENTICATED_USERS);
+                NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[4]);
+                ptoken->num_sids++;
+        }
+        for (i = 0; i < n_groupSIDs; i++) {
+                size_t check_sid_idx;
+                for (check_sid_idx = 1;
+                     check_sid_idx < ptoken->num_sids;
+                     check_sid_idx++) {
+                        if (dom_sid_equal(ptoken->sids[check_sid_idx], groupSIDs[i])) {
+                                break;
+                        }
+                }
+                if (check_sid_idx == ptoken->num_sids) {
+                        ptoken->sids[ptoken->num_sids++] = talloc_reference(ptoken->sids, groupSIDs[i]);
+                }
+        }
+        *token = ptoken;
+        /* Shortcuts to prevent recursion and avoid lookups */
+        if (ptoken->user_sid == NULL) {
+                ptoken->privilege_mask = 0;
+                return NT_STATUS_OK;
+        }
+        if (security_token_is_system(ptoken)) {
+                ptoken->privilege_mask = ~0;
+                return NT_STATUS_OK;
+        }
+        if (security_token_is_anonymous(ptoken)) {
+                ptoken->privilege_mask = 0;
+                return NT_STATUS_OK;
+        }
+        DEBUG(0, ("Created token was not system or anonymous token!"));
+        *token = NULL;
+        return NT_STATUS_INTERNAL_ERROR;
+}
+static NTSTATUS generate_session_info(TALLOC_CTX *mem_ctx,
+                                    struct auth_serversupplied_info *server_info,
+                                    struct auth_session_info **_session_info)
+{
+        struct auth_session_info *session_info;
+        NTSTATUS nt_status;
+        session_info = talloc(mem_ctx, struct auth_session_info);
+        NT_STATUS_HAVE_NO_MEMORY(session_info);
+        session_info->server_info = talloc_reference(session_info, server_info);
+        /* unless set otherwise, the session key is the user session
+         * key from the auth subsystem */
+        session_info->session_key = server_info->user_session_key;
+        nt_status = create_token(session_info,
+                                          server_info->account_sid,
+                                          server_info->primary_group_sid,
+                                          server_info->n_domain_groups,
+                                          server_info->domain_groups,
+                                          server_info->authenticated,
+                                          &session_info->security_token);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+        session_info->credentials = NULL;
+        *_session_info = session_info;
+        return NT_STATUS_OK;
+}
+static int system_session_destructor(struct auth_session_info *info)
+{
+        return -1;
+}
 /* Create a security token for a session SYSTEM (the most
 …
  * the off-host credentials
  */
+_PUBLIC_ struct auth_session_info *system_session(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
+{
+_PUBLIC_ struct auth_session_info *system_session(struct loadparm_context *lp_ctx)
+{
+        static struct auth_session_info *static_session;
         NTSTATUS nt_status;
+        struct auth_session_info *session_info = NULL;
+        nt_status = auth_system_session_info(mem_ctx,
+        if (static_session) {
+                return static_session;
+        }
+        nt_status = auth_system_session_info(talloc_autofree_context(),
                                              lp_ctx,
                                              &session_info);
+                                             &static_session);
         if (!NT_STATUS_IS_OK(nt_status)) {
+                talloc_free(static_session);
+                static_session = NULL;
                 return NULL;
+        }
         return session_info;
+}
+static NTSTATUS _auth_system_session_info(TALLOC_CTX *parent_ctx,
+                                          struct loadparm_context *lp_ctx,
                                           bool anonymous_credentials,
                                           struct auth_session_info **_session_info)
+        talloc_set_destructor(static_session, system_session_destructor);
+        return static_session;
+}
+NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx,
+                                  struct loadparm_context *lp_ctx,
+                                  struct auth_session_info **_session_info)
+{
         NTSTATUS nt_status;
         struct auth_serversupplied_info *server_info = NULL;
+        struct auth_user_info_dc *user_info_dc = NULL;
         struct auth_session_info *session_info = NULL;
         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
         nt_status = auth_system_server_info(mem_ctx, lp_netbios_name(lp_ctx),
                                             &server_info);
+        nt_status = auth_system_user_info_dc(mem_ctx, lpcfg_netbios_name(lp_ctx),
+                                            &user_info_dc);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(mem_ctx);
 …
+        }
         /* references the server_info into the session_info */
         nt_status = generate_session_info(parent_ctx, server_info, &session_info);
+        /* references the user_info_dc into the session_info */
+        nt_status = auth_generate_session_info(parent_ctx, NULL, NULL, user_info_dc, AUTH_SESSION_INFO_SIMPLE_PRIVILEGES, &session_info);
         talloc_free(mem_ctx);
 …
         cli_credentials_set_conf(session_info->credentials, lp_ctx);
+        if (anonymous_credentials) {
+                cli_credentials_set_anonymous(session_info->credentials);
+        } else {
+                cli_credentials_set_machine_account_pending(session_info->credentials, lp_ctx);
+        }
+        cli_credentials_set_machine_account_pending(session_info->credentials, lp_ctx);
         *_session_info = session_info;
 …
+}
+/*
+  Create a system session, but with anonymous credentials (so we do not need to open secrets.ldb)
+*/
+_PUBLIC_ struct auth_session_info *system_session_anon(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
+{
+        NTSTATUS nt_status;
+        struct auth_session_info *session_info = NULL;
+        nt_status = _auth_system_session_info(mem_ctx, lp_ctx, false, &session_info);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return NULL;
+        }
+        return session_info;
+}
+_PUBLIC_ NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx,
+                                           struct loadparm_context *lp_ctx,
+                                           struct auth_session_info **_session_info)
+{
+        return _auth_system_session_info(parent_ctx,
+                        lp_ctx,
+                        lp_parm_bool(lp_ctx, NULL, "system", "anonymous", false),
+                        _session_info);
+}
+NTSTATUS auth_system_server_info(TALLOC_CTX *mem_ctx, const char *netbios_name,
+                                 struct auth_serversupplied_info **_server_info)
+{
+        struct auth_serversupplied_info *server_info;
+        server_info = talloc(mem_ctx, struct auth_serversupplied_info);
+        NT_STATUS_HAVE_NO_MEMORY(server_info);
+        server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_SYSTEM);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
+        /* is this correct? */
+        server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_ADMINISTRATORS);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
+        server_info->n_domain_groups = 0;
+        server_info->domain_groups = NULL;
+NTSTATUS auth_system_user_info_dc(TALLOC_CTX *mem_ctx, const char *netbios_name,
+                                 struct auth_user_info_dc **_user_info_dc)
+{
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
+        user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+        /* This returns a pointer to a struct dom_sid, which is the
+         * same as a 1 element list of struct dom_sid */
+        user_info_dc->num_sids = 1;
+        user_info_dc->sids = dom_sid_parse_talloc(user_info_dc, SID_NT_SYSTEM);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->sids);
         /* annoying, but the Anonymous really does have a session key,
            and it is all zeros! */
+        server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
+        server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
+        data_blob_clear(&server_info->user_session_key);
+        data_blob_clear(&server_info->lm_session_key);
+        server_info->account_name = talloc_strdup(server_info, "SYSTEM");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+        server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+        server_info->full_name = talloc_strdup(server_info, "System");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
+        server_info->logon_script = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
+        server_info->profile_path = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
+        server_info->home_directory = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
+        server_info->home_drive = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
+        server_info->logon_server = talloc_strdup(server_info, netbios_name);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
+        server_info->last_logon = 0;
+        server_info->last_logoff = 0;
+        server_info->acct_expiry = 0;
+        server_info->last_password_change = 0;
+        server_info->allow_password_change = 0;
+        server_info->force_password_change = 0;
+        server_info->logon_count = 0;
+        server_info->bad_password_count = 0;
+        server_info->acct_flags = ACB_NORMAL;
+        server_info->authenticated = true;
+        *_server_info = server_info;
+        user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->user_session_key.data);
+        user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->lm_session_key.data);
+        data_blob_clear(&user_info_dc->user_session_key);
+        data_blob_clear(&user_info_dc->lm_session_key);
+        user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+        info->account_name = talloc_strdup(info, "SYSTEM");
+        NT_STATUS_HAVE_NO_MEMORY(info->account_name);
+        info->domain_name = talloc_strdup(info, "NT AUTHORITY");
+        NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
+        info->full_name = talloc_strdup(info, "System");
+        NT_STATUS_HAVE_NO_MEMORY(info->full_name);
+        info->logon_script = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
+        info->profile_path = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
+        info->home_directory = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
+        info->home_drive = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
+        info->logon_server = talloc_strdup(info, netbios_name);
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_server);
+        info->last_logon = 0;
+        info->last_logoff = 0;
+        info->acct_expiry = 0;
+        info->last_password_change = 0;
+        info->allow_password_change = 0;
+        info->force_password_change = 0;
+        info->logon_count = 0;
+        info->bad_password_count = 0;
+        info->acct_flags = ACB_NORMAL;
+        info->authenticated = true;
+        *_user_info_dc = user_info_dc;
         return NT_STATUS_OK;
 …
+/* Create server info for the Administrator account. This should only be used
+ * during provisioning when we need to impersonate Administrator but
+ * the account has not been created yet */
+static NTSTATUS create_admin_token(TALLOC_CTX *mem_ctx,
+                                   struct dom_sid *user_sid,
+                                   struct dom_sid *group_sid,
+                                   int n_groupSIDs,
+                                   struct dom_sid **groupSIDs,
+                                   struct security_token **token)
+{
+        struct security_token *ptoken;
+        int i;
+        ptoken = security_token_initialise(mem_ctx);
+        NT_STATUS_HAVE_NO_MEMORY(ptoken);
+        ptoken->sids = talloc_array(ptoken, struct dom_sid *, n_groupSIDs + 3);
+        NT_STATUS_HAVE_NO_MEMORY(ptoken->sids);
+        ptoken->user_sid = talloc_reference(ptoken, user_sid);
+        ptoken->group_sid = talloc_reference(ptoken, group_sid);
+        ptoken->privilege_mask = 0;
+        ptoken->sids[0] = ptoken->user_sid;
+        ptoken->sids[1] = ptoken->group_sid;
+        ptoken->sids[2] = dom_sid_parse_talloc(ptoken->sids, SID_NT_AUTHENTICATED_USERS);
+        NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[2]);
+        ptoken->num_sids = 3;
+        for (i = 0; i < n_groupSIDs; i++) {
+                size_t check_sid_idx;
+                for (check_sid_idx = 1;
+                     check_sid_idx < ptoken->num_sids;
+                     check_sid_idx++) {
+                        if (dom_sid_equal(ptoken->sids[check_sid_idx], groupSIDs[i])) {
+                                break;
+                        }
+                }
+                if (check_sid_idx == ptoken->num_sids) {
+                        ptoken->sids[ptoken->num_sids++] = talloc_reference(ptoken->sids, groupSIDs[i]);
+                }
+        }
+        *token = ptoken;
+        ptoken->privilege_mask = ~0;
+        return NT_STATUS_OK;
+}
+static NTSTATUS auth_domain_admin_server_info(TALLOC_CTX *mem_ctx,
+static NTSTATUS auth_domain_admin_user_info_dc(TALLOC_CTX *mem_ctx,
                                               const char *netbios_name,
                                               const char *domain_name,
                                               struct dom_sid *domain_sid,
+                                              struct auth_serversupplied_info **_server_info)
+{
+        struct auth_serversupplied_info *server_info;
+        server_info = talloc(mem_ctx, struct auth_serversupplied_info);
+        NT_STATUS_HAVE_NO_MEMORY(server_info);
+        server_info->account_sid = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_ADMINISTRATOR);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
+        server_info->primary_group_sid = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_USERS);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
+        server_info->n_domain_groups = 6;
+        server_info->domain_groups = talloc_array(server_info, struct dom_sid *, server_info->n_domain_groups);
+        server_info->domain_groups[0] = dom_sid_parse_talloc(server_info, SID_BUILTIN_ADMINISTRATORS);
+        server_info->domain_groups[1] = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_ADMINS);
+        server_info->domain_groups[2] = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_USERS);
+        server_info->domain_groups[3] = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_ENTERPRISE_ADMINS);
+        server_info->domain_groups[4] = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_POLICY_ADMINS);
+        server_info->domain_groups[5] = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_SCHEMA_ADMINS);
+                                              struct auth_user_info_dc **_user_info_dc)
+{
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
+        user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+        user_info_dc->num_sids = 7;
+        user_info_dc->sids = talloc_array(user_info_dc, struct dom_sid, user_info_dc->num_sids);
+        user_info_dc->sids[PRIMARY_USER_SID_INDEX] = *domain_sid;
+        sid_append_rid(&user_info_dc->sids[PRIMARY_USER_SID_INDEX], DOMAIN_RID_ADMINISTRATOR);
+        user_info_dc->sids[PRIMARY_GROUP_SID_INDEX] = *domain_sid;
+        sid_append_rid(&user_info_dc->sids[PRIMARY_USER_SID_INDEX], DOMAIN_RID_USERS);
+        user_info_dc->sids[2] = global_sid_Builtin_Administrators;
+        user_info_dc->sids[3] = *domain_sid;
+        sid_append_rid(&user_info_dc->sids[3], DOMAIN_RID_ADMINS);
+        user_info_dc->sids[4] = *domain_sid;
+        sid_append_rid(&user_info_dc->sids[4], DOMAIN_RID_ENTERPRISE_ADMINS);
+        user_info_dc->sids[5] = *domain_sid;
+        sid_append_rid(&user_info_dc->sids[5], DOMAIN_RID_POLICY_ADMINS);
+        user_info_dc->sids[6] = *domain_sid;
+        sid_append_rid(&user_info_dc->sids[6], DOMAIN_RID_SCHEMA_ADMINS);
         /* What should the session key be?*/
+        server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
+        server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
+        data_blob_clear(&server_info->user_session_key);
+        data_blob_clear(&server_info->lm_session_key);
+        server_info->account_name = talloc_strdup(server_info, "Administrator");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+        server_info->domain_name = talloc_strdup(server_info, domain_name);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+        server_info->full_name = talloc_strdup(server_info, "Administrator");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
+        server_info->logon_script = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
+        server_info->profile_path = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
+        server_info->home_directory = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
+        server_info->home_drive = talloc_strdup(server_info, "");
+        NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
+        server_info->logon_server = talloc_strdup(server_info, netbios_name);
+        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
+        server_info->last_logon = 0;
+        server_info->last_logoff = 0;
+        server_info->acct_expiry = 0;
+        server_info->last_password_change = 0;
+        server_info->allow_password_change = 0;
+        server_info->force_password_change = 0;
+        server_info->logon_count = 0;
+        server_info->bad_password_count = 0;
+        server_info->acct_flags = ACB_NORMAL;
+        server_info->authenticated = true;
+        *_server_info = server_info;
+        user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->user_session_key.data);
+        user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->lm_session_key.data);
+        data_blob_clear(&user_info_dc->user_session_key);
+        data_blob_clear(&user_info_dc->lm_session_key);
+        user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+        info->account_name = talloc_strdup(info, "Administrator");
+        NT_STATUS_HAVE_NO_MEMORY(info->account_name);
+        info->domain_name = talloc_strdup(info, domain_name);
+        NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
+        info->full_name = talloc_strdup(info, "Administrator");
+        NT_STATUS_HAVE_NO_MEMORY(info->full_name);
+        info->logon_script = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
+        info->profile_path = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
+        info->home_directory = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
+        info->home_drive = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
+        info->logon_server = talloc_strdup(info, netbios_name);
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_server);
+        info->last_logon = 0;
+        info->last_logoff = 0;
+        info->acct_expiry = 0;
+        info->last_password_change = 0;
+        info->allow_password_change = 0;
+        info->force_password_change = 0;
+        info->logon_count = 0;
+        info->bad_password_count = 0;
+        info->acct_flags = ACB_NORMAL;
+        info->authenticated = true;
+        *_user_info_dc = user_info_dc;
         return NT_STATUS_OK;
 …
                                                struct loadparm_context *lp_ctx,
                                                struct dom_sid *domain_sid,
                                                struct auth_session_info **_session_info)
+                                               struct auth_session_info **session_info)
+{
         NTSTATUS nt_status;
+        struct auth_serversupplied_info *server_info = NULL;
+        struct auth_session_info *session_info = NULL;
+        struct auth_user_info_dc *user_info_dc = NULL;
         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
         nt_status = auth_domain_admin_server_info(mem_ctx, lp_netbios_name(lp_ctx),
                                                   lp_workgroup(lp_ctx), domain_sid,
                                                   &server_info);
+        nt_status = auth_domain_admin_user_info_dc(mem_ctx, lpcfg_netbios_name(lp_ctx),
+                                                  lpcfg_workgroup(lp_ctx), domain_sid,
+                                                  &user_info_dc);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(mem_ctx);
 …
+        }
+        session_info = talloc(mem_ctx, struct auth_session_info);
+        NT_STATUS_HAVE_NO_MEMORY(session_info);
+        session_info->server_info = talloc_reference(session_info, server_info);
+        /* unless set otherwise, the session key is the user session
+         * key from the auth subsystem */
+        session_info->session_key = server_info->user_session_key;
+        nt_status = create_admin_token(session_info,
+                                       server_info->account_sid,
+                                       server_info->primary_group_sid,
+                                       server_info->n_domain_groups,
+                                       server_info->domain_groups,
+                                       &session_info->security_token);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+        session_info->credentials = cli_credentials_init(session_info);
+        if (!session_info->credentials) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        cli_credentials_set_conf(session_info->credentials, lp_ctx);
+        *_session_info = session_info;
+        return NT_STATUS_OK;
+        nt_status = auth_generate_session_info(mem_ctx, NULL, NULL, user_info_dc,
+                                               AUTH_SESSION_INFO_SIMPLE_PRIVILEGES|AUTH_SESSION_INFO_AUTHENTICATED|AUTH_SESSION_INFO_DEFAULT_GROUPS,
+                                               session_info);
+        /* There is already a reference between the sesion_info and user_info_dc */
+        if (NT_STATUS_IS_OK(nt_status)) {
+                talloc_steal(parent_ctx, *session_info);
+        }
+        talloc_free(mem_ctx);
+        return nt_status;
+}
 …
         return session_info;
+}
+_PUBLIC_ NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx,
+                                              struct loadparm_context *lp_ctx,
+                                              struct auth_session_info **_session_info)
+{
+        NTSTATUS nt_status;
+        struct auth_user_info_dc *user_info_dc = NULL;
+        struct auth_session_info *session_info = NULL;
+        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
+        nt_status = auth_anonymous_user_info_dc(mem_ctx,
+                                               lpcfg_netbios_name(lp_ctx),
+                                               &user_info_dc);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                talloc_free(mem_ctx);
+                return nt_status;
+        }
+        /* references the user_info_dc into the session_info */
+        nt_status = auth_generate_session_info(parent_ctx, NULL, NULL, user_info_dc, AUTH_SESSION_INFO_SIMPLE_PRIVILEGES, &session_info);
+        talloc_free(mem_ctx);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+        session_info->credentials = cli_credentials_init(session_info);
+        if (!session_info->credentials) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        cli_credentials_set_conf(session_info->credentials, lp_ctx);
+        cli_credentials_set_anonymous(session_info->credentials);
+        *_session_info = session_info;
+        return NT_STATUS_OK;
+}
+_PUBLIC_ NTSTATUS auth_anonymous_user_info_dc(TALLOC_CTX *mem_ctx,
+                                    const char *netbios_name,
+                                    struct auth_user_info_dc **_user_info_dc)
+{
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
+        user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+        /* This returns a pointer to a struct dom_sid, which is the
+         * same as a 1 element list of struct dom_sid */
+        user_info_dc->num_sids = 1;
+        user_info_dc->sids = dom_sid_parse_talloc(user_info_dc, SID_NT_ANONYMOUS);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->sids);
+        /* annoying, but the Anonymous really does have a session key... */
+        user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->user_session_key.data);
+        user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->lm_session_key.data);
+        /*  and it is all zeros! */
+        data_blob_clear(&user_info_dc->user_session_key);
+        data_blob_clear(&user_info_dc->lm_session_key);
+        user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+        info->account_name = talloc_strdup(info, "ANONYMOUS LOGON");
+        NT_STATUS_HAVE_NO_MEMORY(info->account_name);
+        info->domain_name = talloc_strdup(info, "NT AUTHORITY");
+        NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
+        info->full_name = talloc_strdup(info, "Anonymous Logon");
+        NT_STATUS_HAVE_NO_MEMORY(info->full_name);
+        info->logon_script = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
+        info->profile_path = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
+        info->home_directory = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
+        info->home_drive = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
+        info->logon_server = talloc_strdup(info, netbios_name);
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_server);
+        info->last_logon = 0;
+        info->last_logoff = 0;
+        info->acct_expiry = 0;
+        info->last_password_change = 0;
+        info->allow_password_change = 0;
+        info->force_password_change = 0;
+        info->logon_count = 0;
+        info->bad_password_count = 0;
+        info->acct_flags = ACB_NORMAL;
+        info->authenticated = false;
+        *_user_info_dc = user_info_dc;
+        return NT_STATUS_OK;
+}

Context Navigation

Legend:

Download in other formats: