Changeset 740 for vendor/current/source4/kdc

Timestamp:

Nov 14, 2012, 12:59:34 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to 3.6.0

Location:

vendor/current/source4/kdc

Files:

• config.m4 (deleted)
• config.mk (deleted)
• db-glue.c (added)
• db-glue.h (added)
• hdb-samba4.c (modified) (11 diffs)
• hdb-samba4.h (deleted)
• kdc-glue.h (added)
• kdc-policy.h (added)
• kdc.c (modified) (25 diffs)
• kdc.h (deleted)
• kpasswdd.c (modified) (36 diffs)
• mit_samba.c (added)
• mit_samba_interface.h (added)
• pac-glue.c (modified) (6 diffs)
• pac-glue.h (modified) (2 diffs)
• policy.c (added)
• proxy.c (added)
• samba_kdc.h (added)
• wdc-samba4.c (added)
• wscript_build (added)

vendor/current/source4/kdc/hdb-samba4.c

@@ -34 +34 @@
 
 #include "includes.h"
-#include "system/time.h"
-#include "../libds/common/flags.h"
-#include "lib/ldb/include/ldb.h"
-#include "lib/ldb/include/ldb_errors.h"
-#include "librpc/gen_ndr/netlogon.h"
-#include "libcli/security/security.h"
-#include "auth/auth.h"
-#include "auth/credentials/credentials.h"
-#include "auth/auth_sam.h"
-#include "../lib/util/util_ldb.h"
-#include "dsdb/samdb/samdb.h"
-#include "librpc/ndr/libndr.h"
-#include "librpc/gen_ndr/ndr_drsblobs.h"
-#include "librpc/gen_ndr/lsa.h"
-#include "libcli/auth/libcli_auth.h"
-#include "param/param.h"
-#include "events/events.h"
-#include "kdc/kdc.h"
-#include "../lib/crypto/md4.h"
-
-enum hdb_samba4_ent_type 
-{ HDB_SAMBA4_ENT_TYPE_CLIENT, HDB_SAMBA4_ENT_TYPE_SERVER, 
-  HDB_SAMBA4_ENT_TYPE_KRBTGT, HDB_SAMBA4_ENT_TYPE_TRUST, HDB_SAMBA4_ENT_TYPE_ANY };
-
-enum trust_direction {
-        UNKNOWN = 0,
-        INBOUND = LSA_TRUST_DIRECTION_INBOUND, 
-        OUTBOUND = LSA_TRUST_DIRECTION_OUTBOUND
-};
-
-static const char *trust_attrs[] = {
-        "trustPartner",
-        "trustAuthIncoming",
-        "trustAuthOutgoing",
-        "whenCreated",
-        "msDS-SupportedEncryptionTypes",
-        "trustAttributes",
-        "trustDirection",
-        "trustType",
-        NULL
-};
-
-static KerberosTime ldb_msg_find_krb5time_ldap_time(struct ldb_message *msg, const char *attr, KerberosTime default_val)
-{
-    const char *tmp;
-    const char *gentime;
-    struct tm tm;
-
-    gentime = ldb_msg_find_attr_as_string(msg, attr, NULL);
-    if (!gentime)
-        return default_val;
-
-    tmp = strptime(gentime, "%Y%m%d%H%M%SZ", &tm);
-    if (tmp == NULL) {
-            return default_val;
-    }
-
-    return timegm(&tm);
-}
-
-static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum hdb_samba4_ent_type ent_type) 
-{
-        HDBFlags flags = int2HDBFlags(0);
-
-        /* we don't allow kadmin deletes */
-        flags.immutable = 1;
-
-        /* mark the principal as invalid to start with */
-        flags.invalid = 1;
-
-        flags.renewable = 1;
-
-        /* All accounts are servers, but this may be disabled again in the caller */
-        flags.server = 1;
-
-        /* Account types - clear the invalid bit if it turns out to be valid */
-        if (userAccountControl & UF_NORMAL_ACCOUNT) {
-                if (ent_type == HDB_SAMBA4_ENT_TYPE_CLIENT || ent_type == HDB_SAMBA4_ENT_TYPE_ANY) {
-                        flags.client = 1;
-                }
-                flags.invalid = 0;
-        }
-        
-        if (userAccountControl & UF_INTERDOMAIN_TRUST_ACCOUNT) {
-                if (ent_type == HDB_SAMBA4_ENT_TYPE_CLIENT || ent_type == HDB_SAMBA4_ENT_TYPE_ANY) {
-                        flags.client = 1;
-                }
-                flags.invalid = 0;
-        }
-        if (userAccountControl & UF_WORKSTATION_TRUST_ACCOUNT) {
-                if (ent_type == HDB_SAMBA4_ENT_TYPE_CLIENT || ent_type == HDB_SAMBA4_ENT_TYPE_ANY) {
-                        flags.client = 1;
-                }
-                flags.invalid = 0;
-        }
-        if (userAccountControl & UF_SERVER_TRUST_ACCOUNT) {
-                if (ent_type == HDB_SAMBA4_ENT_TYPE_CLIENT || ent_type == HDB_SAMBA4_ENT_TYPE_ANY) {
-                        flags.client = 1;
-                }
-                flags.invalid = 0;
-        }
-
-        /* Not permitted to act as a client if disabled */
-        if (userAccountControl & UF_ACCOUNTDISABLE) {
-                flags.client = 0;
-        }
-        if (userAccountControl & UF_LOCKOUT) {
-                flags.invalid = 1;
-        }
-/*
-        if (userAccountControl & UF_PASSWORD_NOTREQD) {
-                flags.invalid = 1;
-        }
-*/
-/*
-        UF_PASSWORD_CANT_CHANGE and UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED are irrelevent
-*/
-        if (userAccountControl & UF_TEMP_DUPLICATE_ACCOUNT) {
-                flags.invalid = 1;
-        }
-
-/* UF_DONT_EXPIRE_PASSWD and UF_USE_DES_KEY_ONLY handled in hdb_samba4_message2entry() */
-
-/*
-        if (userAccountControl & UF_MNS_LOGON_ACCOUNT) {
-                flags.invalid = 1;
-        }
-*/
-        if (userAccountControl & UF_SMARTCARD_REQUIRED) {
-                flags.require_hwauth = 1;
-        }
-        if (userAccountControl & UF_TRUSTED_FOR_DELEGATION) {
-                flags.ok_as_delegate = 1;
-        }       
-        if (!(userAccountControl & UF_NOT_DELEGATED)) {
-                flags.forwardable = 1;
-                flags.proxiable = 1;
-        }
-
-        if (userAccountControl & UF_DONT_REQUIRE_PREAUTH) {
-                flags.require_preauth = 0;
-        } else {
-                flags.require_preauth = 1;
-
-        }
-        return flags;
-}
-
-static int hdb_samba4_destructor(struct hdb_samba4_private *p)
-{
-    hdb_entry_ex *entry_ex = p->entry_ex;
-    free_hdb_entry(&entry_ex->entry);
-    return 0;
-}
-
-static void hdb_samba4_free_entry(krb5_context context, hdb_entry_ex *entry_ex)
-{
-        talloc_free(entry_ex->ctx);
-}
-
-static krb5_error_code hdb_samba4_message2entry_keys(krb5_context context,
-                                              struct smb_iconv_convenience *iconv_convenience,
-                                              TALLOC_CTX *mem_ctx,
-                                              struct ldb_message *msg,
-                                              unsigned int userAccountControl,
-                                              hdb_entry_ex *entry_ex)
-{
-        krb5_error_code ret = 0;
-        enum ndr_err_code ndr_err;
-        struct samr_Password *hash;
-        const struct ldb_val *sc_val;
-        struct supplementalCredentialsBlob scb;
-        struct supplementalCredentialsPackage *scpk = NULL;
-        bool newer_keys = false;
-        struct package_PrimaryKerberosBlob _pkb;
-        struct package_PrimaryKerberosCtr3 *pkb3 = NULL;
-        struct package_PrimaryKerberosCtr4 *pkb4 = NULL;
-        uint32_t i;
-        uint32_t allocated_keys = 0;
-
-        entry_ex->entry.keys.val = NULL;
-        entry_ex->entry.keys.len = 0;
-
-        entry_ex->entry.kvno = ldb_msg_find_attr_as_int(msg, "msDS-KeyVersionNumber", 0);
-
-        /* Get keys from the db */
-
-        hash = samdb_result_hash(mem_ctx, msg, "unicodePwd");
-        sc_val = ldb_msg_find_ldb_val(msg, "supplementalCredentials");
-
-        /* unicodePwd for enctype 0x17 (23) if present */
-        if (hash) {
-                allocated_keys++;
-        }
-
-        /* supplementalCredentials if present */
-        if (sc_val) {
-                ndr_err = ndr_pull_struct_blob_all(sc_val, mem_ctx, iconv_convenience, &scb,
-                                                   (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        dump_data(0, sc_val->data, sc_val->length);
-                        ret = EINVAL;
-                        goto out;
-                }
-
-                if (scb.sub.signature != SUPPLEMENTAL_CREDENTIALS_SIGNATURE) {
-                        NDR_PRINT_DEBUG(supplementalCredentialsBlob, &scb);
-                        ret = EINVAL;
-                        goto out;
-                }
-
-                for (i=0; i < scb.sub.num_packages; i++) {
-                        if (strcmp("Primary:Kerberos-Newer-Keys", scb.sub.packages[i].name) == 0) {
-                                scpk = &scb.sub.packages[i];
-                                if (!scpk->data || !scpk->data[0]) {
-                                        scpk = NULL;
-                                        continue;
-                                }
-                                newer_keys = true;
-                                break;
-                        } else if (strcmp("Primary:Kerberos", scb.sub.packages[i].name) == 0) {
-                                scpk = &scb.sub.packages[i];
-                                if (!scpk->data || !scpk->data[0]) {
-                                        scpk = NULL;
-                                }
-                                /*
-                                 * we don't break here in hope to find
-                                 * a Kerberos-Newer-Keys package
-                                 */
-                        }
-                }
-        }
-        /*
-         * Primary:Kerberos-Newer-Keys or Primary:Kerberos element
-         * of supplementalCredentials
-         */
-        if (scpk) {
-                DATA_BLOB blob;
-
-                blob = strhex_to_data_blob(mem_ctx, scpk->data);
-                if (!blob.data) {
-                        ret = ENOMEM;
-                        goto out;
-                }
-
-                /* we cannot use ndr_pull_struct_blob_all() here, as w2k and w2k3 add padding bytes */
-                ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, iconv_convenience, &_pkb,
-                                               (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        ret = EINVAL;
-                        krb5_set_error_message(context, ret, "hdb_samba4_message2entry_keys: could not parse package_PrimaryKerberosBlob");
-                        krb5_warnx(context, "hdb_samba4_message2entry_keys: could not parse package_PrimaryKerberosBlob");
-                        goto out;
-                }
-
-                if (newer_keys && _pkb.version != 4) {
-                        ret = EINVAL;
-                        krb5_set_error_message(context, ret, "hdb_samba4_message2entry_keys: Primary:Kerberos-Newer-Keys not version 4");
-                        krb5_warnx(context, "hdb_samba4_message2entry_keys: Primary:Kerberos-Newer-Keys not version 4");
-                        goto out;
-                }
-
-                if (!newer_keys && _pkb.version != 3) {
-                        ret = EINVAL;
-                        krb5_set_error_message(context, ret, "hdb_samba4_message2entry_keys: could not parse Primary:Kerberos not version 3");
-                        krb5_warnx(context, "hdb_samba4_message2entry_keys: could not parse Primary:Kerberos not version 3");
-                        goto out;
-                }
-
-                if (_pkb.version == 4) {
-                        pkb4 = &_pkb.ctr.ctr4;
-                        allocated_keys += pkb4->num_keys;
-                } else if (_pkb.version == 3) {
-                        pkb3 = &_pkb.ctr.ctr3;
-                        allocated_keys += pkb3->num_keys;
-                }
-        }
-
-        if (allocated_keys == 0) {
-                /* oh, no password.  Apparently (comment in
-                 * hdb-ldap.c) this violates the ASN.1, but this
-                 * allows an entry with no keys (yet). */
-                return 0;
-        }
-
-        /* allocate space to decode into */
-        entry_ex->entry.keys.len = 0;
-        entry_ex->entry.keys.val = calloc(allocated_keys, sizeof(Key));
-        if (entry_ex->entry.keys.val == NULL) {
-                ret = ENOMEM;
-                goto out;
-        }
-
-        if (hash && !(userAccountControl & UF_USE_DES_KEY_ONLY)) {
-                Key key;
-
-                key.mkvno = 0;
-                key.salt = NULL; /* No salt for this enc type */
-
-                ret = krb5_keyblock_init(context,
-                                         ENCTYPE_ARCFOUR_HMAC,
-                                         hash->hash, sizeof(hash->hash), 
-                                         &key.key);
-                if (ret) {
-                        goto out;
-                }
-
-                entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
-                entry_ex->entry.keys.len++;
-        }
-
-        if (pkb4) {
-                for (i=0; i < pkb4->num_keys; i++) {
-                        bool use = true;
-                        Key key;
-
-                        if (!pkb4->keys[i].value) continue;
-
-                        if (userAccountControl & UF_USE_DES_KEY_ONLY) {
-                                switch (pkb4->keys[i].keytype) {
-                                case ENCTYPE_DES_CBC_CRC:
-                                case ENCTYPE_DES_CBC_MD5:
-                                        break;
-                                default:
-                                        use = false;
-                                        break;
-                                }
-                        }
-
-                        if (!use) continue;
-
-                        key.mkvno = 0;
-                        key.salt = NULL;
-
-                        if (pkb4->salt.string) {
-                                DATA_BLOB salt;
-
-                                salt = data_blob_string_const(pkb4->salt.string);
-
-                                key.salt = calloc(1, sizeof(*key.salt));
-                                if (key.salt == NULL) {
-                                        ret = ENOMEM;
-                                        goto out;
-                                }
-
-                                key.salt->type = hdb_pw_salt;
-
-                                ret = krb5_data_copy(&key.salt->salt, salt.data, salt.length);
-                                if (ret) {
-                                        free(key.salt);
-                                        key.salt = NULL;
-                                        goto out;
-                                }
-                        }
-
-                        /* TODO: maybe pass the iteration_count somehow... */
-
-                        ret = krb5_keyblock_init(context,
-                                                 pkb4->keys[i].keytype,
-                                                 pkb4->keys[i].value->data,
-                                                 pkb4->keys[i].value->length,
-                                                 &key.key);
-                        if (ret == KRB5_PROG_ETYPE_NOSUPP) {
-                                DEBUG(2,("Unsupported keytype ignored - type %u\n",
-                                         pkb4->keys[i].keytype));
-                                ret = 0;
-                                continue;
-                        }
-                        if (ret) {
-                                if (key.salt) {
-                                        free_Salt(key.salt);
-                                        free(key.salt);
-                                        key.salt = NULL;
-                                }
-                                goto out;
-                        }
-
-                        entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
-                        entry_ex->entry.keys.len++;
-                }
-        } else if (pkb3) {
-                for (i=0; i < pkb3->num_keys; i++) {
-                        bool use = true;
-                        Key key;
-
-                        if (!pkb3->keys[i].value) continue;
-
-                        if (userAccountControl & UF_USE_DES_KEY_ONLY) {
-                                switch (pkb3->keys[i].keytype) {
-                                case ENCTYPE_DES_CBC_CRC:
-                                case ENCTYPE_DES_CBC_MD5:
-                                        break;
-                                default:
-                                        use = false;
-                                        break;
-                                }
-                        }
-
-                        if (!use) continue;
-
-                        key.mkvno = 0;
-                        key.salt = NULL;
-
-                        if (pkb3->salt.string) {
-                                DATA_BLOB salt;
-
-                                salt = data_blob_string_const(pkb3->salt.string);
-
-                                key.salt = calloc(1, sizeof(*key.salt));
-                                if (key.salt == NULL) {
-                                        ret = ENOMEM;
-                                        goto out;
-                                }
-
-                                key.salt->type = hdb_pw_salt;
-
-                                ret = krb5_data_copy(&key.salt->salt, salt.data, salt.length);
-                                if (ret) {
-                                        free(key.salt);
-                                        key.salt = NULL;
-                                        goto out;
-                                }
-                        }
-
-                        ret = krb5_keyblock_init(context,
-                                                 pkb3->keys[i].keytype,
-                                                 pkb3->keys[i].value->data,
-                                                 pkb3->keys[i].value->length,
-                                                 &key.key);
-                        if (ret) {
-                                if (key.salt) {
-                                        free_Salt(key.salt);
-                                        free(key.salt);
-                                        key.salt = NULL;
-                                }
-                                goto out;
-                        }
-
-                        entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
-                        entry_ex->entry.keys.len++;
-                }
-        }
-
-out:
-        if (ret != 0) {
-                entry_ex->entry.keys.len = 0;
-        }
-        if (entry_ex->entry.keys.len == 0 && entry_ex->entry.keys.val) {
-                free(entry_ex->entry.keys.val);
-                entry_ex->entry.keys.val = NULL;
-        }
-        return ret;
-}
-
-/*
- * Construct an hdb_entry from a directory entry.
- */
-static krb5_error_code hdb_samba4_message2entry(krb5_context context, HDB *db, 
-                                         struct loadparm_context *lp_ctx, 
-                                         TALLOC_CTX *mem_ctx, krb5_const_principal principal,
-                                         enum hdb_samba4_ent_type ent_type,
-                                         struct ldb_dn *realm_dn,
-                                         struct ldb_message *msg,
-                                         hdb_entry_ex *entry_ex)
-{
-        unsigned int userAccountControl;
-        int i;
-        krb5_error_code ret = 0;
-        krb5_boolean is_computer = FALSE;
-        char *realm = strupper_talloc(mem_ctx, lp_realm(lp_ctx));
-
-        struct hdb_samba4_private *p;
-        NTTIME acct_expiry;
-        NTSTATUS status;
-
-        uint32_t rid;
-        struct ldb_message_element *objectclasses;
-        struct ldb_val computer_val;
-        const char *samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
-        computer_val.data = discard_const_p(uint8_t,"computer");
-        computer_val.length = strlen((const char *)computer_val.data);
-        
-        if (!samAccountName) {
-                ret = ENOENT;
-                krb5_set_error_message(context, ret, "hdb_samba4_message2entry: no samAccountName present");
-                goto out;
-        }
-
-        objectclasses = ldb_msg_find_element(msg, "objectClass");
-        
-        if (objectclasses && ldb_msg_find_val(objectclasses, &computer_val)) {
-                is_computer = TRUE;
-        }
-
-        memset(entry_ex, 0, sizeof(*entry_ex));
-
-        if (!realm) {
-                ret = ENOMEM;
-                krb5_set_error_message(context, ret, "talloc_strdup: out of memory");
-                goto out;
-        }
-                        
-        p = talloc(mem_ctx, struct hdb_samba4_private);
-        if (!p) {
-                ret = ENOMEM;
-                goto out;
-        }
-
-        p->entry_ex = entry_ex;
-        p->iconv_convenience = lp_iconv_convenience(lp_ctx);
-        p->lp_ctx = lp_ctx;
-        p->realm_dn = talloc_reference(p, realm_dn);
-        if (!p->realm_dn) {
-                ret = ENOMEM;
-                goto out;
-        }
-
-        talloc_set_destructor(p, hdb_samba4_destructor);
-
-        entry_ex->ctx = p;
-        entry_ex->free_entry = hdb_samba4_free_entry;
-
-        userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
-
-        
-        entry_ex->entry.principal = malloc(sizeof(*(entry_ex->entry.principal)));
-        if (ent_type == HDB_SAMBA4_ENT_TYPE_ANY && principal == NULL) {
-                krb5_make_principal(context, &entry_ex->entry.principal, realm, samAccountName, NULL);
-        } else {
-                ret = copy_Principal(principal, entry_ex->entry.principal);
-                if (ret) {
-                        krb5_clear_error_message(context);
-                        goto out;
-                }
-
-                /* While we have copied the client principal, tests
-                 * show that Win2k3 returns the 'corrected' realm, not
-                 * the client-specified realm.  This code attempts to
-                 * replace the client principal's realm with the one
-                 * we determine from our records */
-                
-                /* this has to be with malloc() */
-                krb5_principal_set_realm(context, entry_ex->entry.principal, realm);
-        }
-
-        /* First try and figure out the flags based on the userAccountControl */
-        entry_ex->entry.flags = uf2HDBFlags(context, userAccountControl, ent_type);
-
-        /* Windows 2008 seems to enforce this (very sensible) rule by
-         * default - don't allow offline attacks on a user's password
-         * by asking for a ticket to them as a service (encrypted with
-         * their probably patheticly insecure password) */
-
-        if (entry_ex->entry.flags.server
-            && lp_parm_bool(lp_ctx, NULL, "kdc", "require spn for service", true)) {
-                if (!is_computer && !ldb_msg_find_attr_as_string(msg, "servicePrincipalName", NULL)) {
-                        entry_ex->entry.flags.server = 0;
-                }
-        }
-
-        {
-                /* These (created_by, modified_by) parts of the entry are not relevant for Samba4's use
-                 * of the Heimdal KDC.  They are stored in a the traditional
-                 * DB for audit purposes, and still form part of the structure
-                 * we must return */
-                
-                /* use 'whenCreated' */
-                entry_ex->entry.created_by.time = ldb_msg_find_krb5time_ldap_time(msg, "whenCreated", 0);
-                /* use '???' */
-                entry_ex->entry.created_by.principal = NULL;
-                
-                entry_ex->entry.modified_by = (Event *) malloc(sizeof(Event));
-                if (entry_ex->entry.modified_by == NULL) {
-                        ret = ENOMEM;
-                        krb5_set_error_message(context, ret, "malloc: out of memory");
-                        goto out;
-                }
-                
-                /* use 'whenChanged' */
-                entry_ex->entry.modified_by->time = ldb_msg_find_krb5time_ldap_time(msg, "whenChanged", 0);
-                /* use '???' */
-                entry_ex->entry.modified_by->principal = NULL;
-        }
-
-
-        /* The lack of password controls etc applies to krbtgt by
-         * virtue of being that particular RID */
-        status = dom_sid_split_rid(NULL, samdb_result_dom_sid(mem_ctx, msg, "objectSid"), NULL, &rid);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                ret = EINVAL;
-                goto out;
-        }
-
-        if (rid == DOMAIN_RID_KRBTGT) {
-                entry_ex->entry.valid_end = NULL;
-                entry_ex->entry.pw_end = NULL;
-
-                entry_ex->entry.flags.invalid = 0;
-                entry_ex->entry.flags.server = 1;
-
-                /* Don't mark all requests for the krbtgt/realm as
-                 * 'change password', as otherwise we could get into
-                 * trouble, and not enforce the password expirty.
-                 * Instead, only do it when request is for the kpasswd service */
-                if (ent_type == HDB_SAMBA4_ENT_TYPE_SERVER
-                    && principal->name.name_string.len == 2
-                    && (strcmp(principal->name.name_string.val[0], "kadmin") == 0)
-                    && (strcmp(principal->name.name_string.val[1], "changepw") == 0)
-                    && lp_is_my_domain_or_realm(lp_ctx, principal->realm)) {
-                        entry_ex->entry.flags.change_pw = 1;
-                }
-                entry_ex->entry.flags.client = 0;
-                entry_ex->entry.flags.forwardable = 1;
-                entry_ex->entry.flags.ok_as_delegate = 1;
-        } else if (entry_ex->entry.flags.server && ent_type == HDB_SAMBA4_ENT_TYPE_SERVER) {
-                /* The account/password expiry only applies when the account is used as a
-                 * client (ie password login), not when used as a server */
-
-                /* Make very well sure we don't use this for a client,
-                 * it could bypass the password restrictions */
-                entry_ex->entry.flags.client = 0;
-
-                entry_ex->entry.valid_end = NULL;
-                entry_ex->entry.pw_end = NULL;
-
-        } else {
-                NTTIME must_change_time
-                        = samdb_result_force_password_change((struct ldb_context *)db->hdb_db, mem_ctx, 
-                                                             realm_dn, msg);
-                if (must_change_time == 0x7FFFFFFFFFFFFFFFULL) {
-                        entry_ex->entry.pw_end = NULL;
-                } else {
-                        entry_ex->entry.pw_end = malloc(sizeof(*entry_ex->entry.pw_end));
-                        if (entry_ex->entry.pw_end == NULL) {
-                                ret = ENOMEM;
-                                goto out;
-                        }
-                        *entry_ex->entry.pw_end = nt_time_to_unix(must_change_time);
-                }
-
-                acct_expiry = samdb_result_account_expires(msg);
-                if (acct_expiry == 0x7FFFFFFFFFFFFFFFULL) {
-                        entry_ex->entry.valid_end = NULL;
-                } else {
-                        entry_ex->entry.valid_end = malloc(sizeof(*entry_ex->entry.valid_end));
-                        if (entry_ex->entry.valid_end == NULL) {
-                                ret = ENOMEM;
-                                goto out;
-                        }
-                        *entry_ex->entry.valid_end = nt_time_to_unix(acct_expiry);
-                }
-        }
-
-        entry_ex->entry.valid_start = NULL;
-
-        entry_ex->entry.max_life = NULL;
-
-        entry_ex->entry.max_renew = NULL;
-
-        entry_ex->entry.generation = NULL;
-
-        /* Get keys from the db */
-        ret = hdb_samba4_message2entry_keys(context, p->iconv_convenience, p, msg, userAccountControl, entry_ex);
-        if (ret) {
-                /* Could be bougus data in the entry, or out of memory */
-                goto out;
-        }
-
-        entry_ex->entry.etypes = malloc(sizeof(*(entry_ex->entry.etypes)));
-        if (entry_ex->entry.etypes == NULL) {
-                krb5_clear_error_message(context);
-                ret = ENOMEM;
-                goto out;
-        }
-        entry_ex->entry.etypes->len = entry_ex->entry.keys.len;
-        entry_ex->entry.etypes->val = calloc(entry_ex->entry.etypes->len, sizeof(int));
-        if (entry_ex->entry.etypes->val == NULL) {
-                krb5_clear_error_message(context);
-                ret = ENOMEM;
-                goto out;
-        }
-        for (i=0; i < entry_ex->entry.etypes->len; i++) {
-                entry_ex->entry.etypes->val[i] = entry_ex->entry.keys.val[i].key.keytype;
-        }
-
-
-        p->msg = talloc_steal(p, msg);
-        p->samdb = (struct ldb_context *)db->hdb_db;
-        
-out:
-        if (ret != 0) {
-                /* This doesn't free ent itself, that is for the eventual caller to do */
-                hdb_free_entry(context, entry_ex);
-        } else {
-                talloc_steal(db, entry_ex->ctx);
-        }
-
-        return ret;
-}
-
-/*
- * Construct an hdb_entry from a directory entry.
- */
-static krb5_error_code hdb_samba4_trust_message2entry(krb5_context context, HDB *db, 
-                                               struct loadparm_context *lp_ctx,
-                                               TALLOC_CTX *mem_ctx, krb5_const_principal principal,
-                                               enum trust_direction direction,
-                                               struct ldb_dn *realm_dn,
-                                               struct ldb_message *msg,
-                                               hdb_entry_ex *entry_ex)
-{
-        
-        const char *dnsdomain;
-        char *realm;
-        DATA_BLOB password_utf16;
-        struct samr_Password password_hash;
-        const struct ldb_val *password_val;
-        struct trustAuthInOutBlob password_blob;
-        struct hdb_samba4_private *p;
-
-        enum ndr_err_code ndr_err;
-        int i, ret, trust_direction_flags;
-
-        p = talloc(mem_ctx, struct hdb_samba4_private);
-        if (!p) {
-                ret = ENOMEM;
-                goto out;
-        }
-
-        p->entry_ex = entry_ex;
-        p->iconv_convenience = lp_iconv_convenience(lp_ctx);
-        p->lp_ctx = lp_ctx;
-        p->realm_dn = realm_dn;
-
-        talloc_set_destructor(p, hdb_samba4_destructor);
-
-        entry_ex->ctx = p;
-        entry_ex->free_entry = hdb_samba4_free_entry;
-
-        /* use 'whenCreated' */
-        entry_ex->entry.created_by.time = ldb_msg_find_krb5time_ldap_time(msg, "whenCreated", 0);
-        /* use '???' */
-        entry_ex->entry.created_by.principal = NULL;
-
-        entry_ex->entry.valid_start = NULL;
-
-        trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
-
-        if (direction == INBOUND) {
-                realm = strupper_talloc(mem_ctx, lp_realm(lp_ctx));
-                password_val = ldb_msg_find_ldb_val(msg, "trustAuthIncoming");
-
-        } else { /* OUTBOUND */
-                dnsdomain = ldb_msg_find_attr_as_string(msg, "trustPartner", NULL);
-                realm = strupper_talloc(mem_ctx, dnsdomain);
-                password_val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing");
-        }
-
-        if (!password_val || !(trust_direction_flags & direction)) {
-                ret = ENOENT;
-                goto out;
-        }
-
-        ndr_err = ndr_pull_struct_blob(password_val, mem_ctx, p->iconv_convenience, &password_blob,
-                                           (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                ret = EINVAL;
-                goto out;
-        }
-
-        entry_ex->entry.kvno = -1;
-        for (i=0; i < password_blob.count; i++) {
-                if (password_blob.current->array[i].AuthType == TRUST_AUTH_TYPE_VERSION) {
-                        entry_ex->entry.kvno = password_blob.current->array[i].AuthInfo.version.version;
-                }
-        }
-
-        for (i=0; i < password_blob.count; i++) {
-                if (password_blob.current->array[i].AuthType == TRUST_AUTH_TYPE_CLEAR) {
-                        password_utf16 = data_blob_const(password_blob.current->array[i].AuthInfo.clear.password,
-                                                         password_blob.current->array[i].AuthInfo.clear.size);
-                        /* In the future, generate all sorts of
-                         * hashes, but for now we can't safely convert
-                         * the random strings windows uses into
-                         * utf8 */
-
-                        /* but as it is utf16 already, we can get the NT password/arcfour-hmac-md5 key */
-                        mdfour(password_hash.hash, password_utf16.data, password_utf16.length);
-                        break;
-                } else if (password_blob.current->array[i].AuthType == TRUST_AUTH_TYPE_NT4OWF) {
-                        password_hash = password_blob.current->array[i].AuthInfo.nt4owf.password;
-                        break;
-                }
-        }
-        entry_ex->entry.keys.len = 0;
-        entry_ex->entry.keys.val = NULL;
-
-        if (i < password_blob.count) {
-                Key key;
-                /* Must have found a cleartext or MD4 password */
-                entry_ex->entry.keys.val = calloc(1, sizeof(Key));
-
-                key.mkvno = 0;
-                key.salt = NULL; /* No salt for this enc type */
-
-                if (entry_ex->entry.keys.val == NULL) {
-                        ret = ENOMEM;
-                        goto out;
-                }
-                
-                ret = krb5_keyblock_init(context,
-                                         ENCTYPE_ARCFOUR_HMAC,
-                                         password_hash.hash, sizeof(password_hash.hash), 
-                                         &key.key);
-                
-                entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
-                entry_ex->entry.keys.len++;
-        }
-                
-        entry_ex->entry.principal = malloc(sizeof(*(entry_ex->entry.principal)));
-
-        ret = copy_Principal(principal, entry_ex->entry.principal);
-        if (ret) {
-                krb5_clear_error_message(context);
-                goto out;
-        }
-        
-        /* While we have copied the client principal, tests
-         * show that Win2k3 returns the 'corrected' realm, not
-         * the client-specified realm.  This code attempts to
-         * replace the client principal's realm with the one
-         * we determine from our records */
-        
-        krb5_principal_set_realm(context, entry_ex->entry.principal, realm);
-        entry_ex->entry.flags = int2HDBFlags(0);
-        entry_ex->entry.flags.immutable = 1;
-        entry_ex->entry.flags.invalid = 0;
-        entry_ex->entry.flags.server = 1;
-        entry_ex->entry.flags.require_preauth = 1;
-
-        entry_ex->entry.pw_end = NULL;
-                        
-        entry_ex->entry.max_life = NULL;
-
-        entry_ex->entry.max_renew = NULL;
-
-        entry_ex->entry.generation = NULL;
-
-        entry_ex->entry.etypes = malloc(sizeof(*(entry_ex->entry.etypes)));
-        if (entry_ex->entry.etypes == NULL) {
-                krb5_clear_error_message(context);
-                ret = ENOMEM;
-                goto out;
-        }
-        entry_ex->entry.etypes->len = entry_ex->entry.keys.len;
-        entry_ex->entry.etypes->val = calloc(entry_ex->entry.etypes->len, sizeof(int));
-        if (entry_ex->entry.etypes->val == NULL) {
-                krb5_clear_error_message(context);
-                ret = ENOMEM;
-                goto out;
-        }
-        for (i=0; i < entry_ex->entry.etypes->len; i++) {
-                entry_ex->entry.etypes->val[i] = entry_ex->entry.keys.val[i].key.keytype;
-        }
-
-
-        p->msg = talloc_steal(p, msg);
-        p->samdb = (struct ldb_context *)db->hdb_db;
-        
-out:
-        if (ret != 0) {
-                /* This doesn't free ent itself, that is for the eventual caller to do */
-                hdb_free_entry(context, entry_ex);
-        } else {
-                talloc_steal(db, entry_ex->ctx);
-        }
-
-        return ret;
-
-}
-
-static krb5_error_code hdb_samba4_lookup_trust(krb5_context context, struct ldb_context *ldb_ctx,                                       
-                                        TALLOC_CTX *mem_ctx,
-                                        const char *realm,
-                                        struct ldb_dn *realm_dn,
-                                        struct ldb_message **pmsg)
-{
-        int lret;
-        krb5_error_code ret;
-        char *filter = NULL;
-        const char * const *attrs = trust_attrs;
-
-        struct ldb_result *res = NULL;
-        filter = talloc_asprintf(mem_ctx, "(&(objectClass=trustedDomain)(|(flatname=%s)(trustPartner=%s)))", realm, realm);
-
-        if (!filter) {
-                ret = ENOMEM;
-                krb5_set_error_message(context, ret, "talloc_asprintf: out of memory");
-                return ret;
-        }
-
-        lret = ldb_search(ldb_ctx, mem_ctx, &res,
-                          ldb_get_default_basedn(ldb_ctx),
-                          LDB_SCOPE_SUBTREE, attrs, "%s", filter);
-        if (lret != LDB_SUCCESS) {
-                DEBUG(3, ("Failed to search for %s: %s\n", filter, ldb_errstring(ldb_ctx)));
-                return HDB_ERR_NOENTRY;
-        } else if (res->count == 0 || res->count > 1) {
-                DEBUG(3, ("Failed find a single entry for %s: got %d\n", filter, res->count));
-                talloc_free(res);
-                return HDB_ERR_NOENTRY;
-        }
-        talloc_steal(mem_ctx, res->msgs);
-        *pmsg = res->msgs[0];
-        talloc_free(res);
-        return 0;
-}
+#include "kdc/kdc-glue.h"
+#include "kdc/db-glue.h"
 
 static krb5_error_code hdb_samba4_open(krb5_context context, HDB *db, int flags, mode_t mode)
@@ -960 +44 @@
                 krb5_set_error_message(context, ret, "hdb_samba4_open: use of a master key incompatible with LDB\n");
                 return ret;
-        }               
+        }
 
         return 0;
@@ -985 +69 @@
 }
 
-static krb5_error_code hdb_samba4_lookup_client(krb5_context context, HDB *db, 
-                                                struct loadparm_context *lp_ctx, 
-                                                TALLOC_CTX *mem_ctx, 
-                                                krb5_const_principal principal,
-                                                const char **attrs,
-                                                struct ldb_dn **realm_dn, 
-                                                struct ldb_message **msg) {
-        NTSTATUS nt_status;
-        char *principal_string;
-        krb5_error_code ret;
-
-        ret = krb5_unparse_name(context, principal, &principal_string);
-        
-        if (ret != 0) {
-                return ret;
-        }
-        
-        nt_status = sam_get_results_principal((struct ldb_context *)db->hdb_db,
-                                              mem_ctx, principal_string, attrs, 
-                                              realm_dn, msg);
-        free(principal_string);
-        if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) {
-                return HDB_ERR_NOENTRY;
-        } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) {
-                return ENOMEM;
-        } else if (!NT_STATUS_IS_OK(nt_status)) {
-                return EINVAL;
-        }
-        
-        return ret;
-}
-
-static krb5_error_code hdb_samba4_fetch_client(krb5_context context, HDB *db, 
-                                               struct loadparm_context *lp_ctx, 
-                                               TALLOC_CTX *mem_ctx, 
-                                               krb5_const_principal principal,
-                                               unsigned flags,
-                                               hdb_entry_ex *entry_ex) {
-        struct ldb_dn *realm_dn;
-        krb5_error_code ret;
-        struct ldb_message *msg = NULL;
-
-        ret = hdb_samba4_lookup_client(context, db, lp_ctx, 
-                                       mem_ctx, principal, user_attrs, 
-                                       &realm_dn, &msg);
-        if (ret != 0) {
-                return ret;
-        }
-        
-        ret = hdb_samba4_message2entry(context, db, lp_ctx, mem_ctx, 
-                                       principal, HDB_SAMBA4_ENT_TYPE_CLIENT,
-                                       realm_dn, msg, entry_ex);
-        return ret;
-}
-
-static krb5_error_code hdb_samba4_fetch_krbtgt(krb5_context context, HDB *db, 
-                                        struct loadparm_context *lp_ctx, 
-                                        TALLOC_CTX *mem_ctx, 
-                                        krb5_const_principal principal,
-                                        unsigned flags,
-                                        hdb_entry_ex *entry_ex)
-{
-        krb5_error_code ret;
-        struct ldb_message *msg = NULL;
-        struct ldb_dn *realm_dn = ldb_get_default_basedn(db->hdb_db);
-        const char *realm;
-
-        krb5_principal alloc_principal = NULL;
-        if (principal->name.name_string.len != 2
-            || (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) != 0)) {
-                /* Not a krbtgt */
-                return HDB_ERR_NOENTRY;
-        }
-
-        /* krbtgt case.  Either us or a trusted realm */
-
-        if (lp_is_my_domain_or_realm(lp_ctx, principal->realm)
-            && lp_is_my_domain_or_realm(lp_ctx, principal->name.name_string.val[1])) {
-                /* us */                
-                /* Cludge, cludge cludge.  If the realm part of krbtgt/realm,
-                 * is in our db, then direct the caller at our primary
-                 * krbtgt */
-
-                int lret;
-                char *realm_fixed;
-                
-                lret = gendb_search_single_extended_dn(db->hdb_db, mem_ctx, 
-                                                       realm_dn, LDB_SCOPE_SUBTREE,
-                                                       &msg, krbtgt_attrs, 
-                                                       "(&(objectClass=user)(samAccountName=krbtgt))"); 
-                if (lret == LDB_ERR_NO_SUCH_OBJECT) {
-                        krb5_warnx(context, "hdb_samba4_fetch: could not find own KRBTGT in DB!");
-                        krb5_set_error_message(context, HDB_ERR_NOENTRY, "hdb_samba4_fetch: could not find own KRBTGT in DB!");
-                        return HDB_ERR_NOENTRY;
-                } else if (lret != LDB_SUCCESS) {
-                        krb5_warnx(context, "hdb_samba4_fetch: could not find own KRBTGT in DB: %s", ldb_errstring(db->hdb_db));
-                        krb5_set_error_message(context, HDB_ERR_NOENTRY, "hdb_samba4_fetch: could not find own KRBTGT in DB: %s", ldb_errstring(db->hdb_db));
-                        return HDB_ERR_NOENTRY;
-                }
-                
-                realm_fixed = strupper_talloc(mem_ctx, lp_realm(lp_ctx));
-                if (!realm_fixed) {
-                        ret = ENOMEM;
-                        krb5_set_error_message(context, ret, "strupper_talloc: out of memory");
-                        return ret;
-                }
-                
-                ret = krb5_copy_principal(context, principal, &alloc_principal);
-                if (ret) {
-                        return ret;
-                }
- 
-                free(alloc_principal->name.name_string.val[1]);
-                alloc_principal->name.name_string.val[1] = strdup(realm_fixed);
-                talloc_free(realm_fixed);
-                if (!alloc_principal->name.name_string.val[1]) {
-                        ret = ENOMEM;
-                        krb5_set_error_message(context, ret, "hdb_samba4_fetch: strdup() failed!");
-                        return ret;
-                }
-                principal = alloc_principal;
-
-                ret = hdb_samba4_message2entry(context, db, lp_ctx, mem_ctx, 
-                                        principal, HDB_SAMBA4_ENT_TYPE_KRBTGT, 
-                                        realm_dn, msg, entry_ex);
-                if (ret != 0) {
-                        krb5_warnx(context, "hdb_samba4_fetch: self krbtgt message2entry failed");      
-                }
-                return ret;
-
-        } else {
-                enum trust_direction direction = UNKNOWN;
-
-                /* Either an inbound or outbound trust */
-
-                if (strcasecmp(lp_realm(lp_ctx), principal->realm) == 0) {
-                        /* look for inbound trust */
-                        direction = INBOUND;
-                        realm = principal->name.name_string.val[1];
-                }
-
-                if (strcasecmp(lp_realm(lp_ctx), principal->name.name_string.val[1]) == 0) {
-                        /* look for outbound trust */
-                        direction = OUTBOUND;
-                        realm = principal->realm;
-                }
-
-                /* Trusted domains are under CN=system */
-                
-                ret = hdb_samba4_lookup_trust(context, (struct ldb_context *)db->hdb_db, 
-                                       mem_ctx, 
-                                       realm, realm_dn, &msg);
-                
-                if (ret != 0) {
-                        krb5_warnx(context, "hdb_samba4_fetch: could not find principal in DB");
-                        krb5_set_error_message(context, ret, "hdb_samba4_fetch: could not find principal in DB");
-                        return ret;
-                }
-                
-                ret = hdb_samba4_trust_message2entry(context, db, lp_ctx, mem_ctx, 
-                                              principal, direction, 
-                                              realm_dn, msg, entry_ex);
-                if (ret != 0) {
-                        krb5_warnx(context, "hdb_samba4_fetch: trust_message2entry failed");    
-                }
-                return ret;
-
-                
-                /* we should lookup trusted domains */
-                return HDB_ERR_NOENTRY;
-        }
-
-}
-
-static krb5_error_code hdb_samba4_lookup_server(krb5_context context, HDB *db, 
-                                                struct loadparm_context *lp_ctx,
-                                                TALLOC_CTX *mem_ctx, 
-                                                krb5_const_principal principal,
-                                                const char **attrs,
-                                                struct ldb_dn **realm_dn,
-                                                struct ldb_message **msg)
-{
-        krb5_error_code ret;
-        const char *realm;
-        if (principal->name.name_string.len >= 2) {
-                /* 'normal server' case */
-                int ldb_ret;
-                NTSTATUS nt_status;
-                struct ldb_dn *user_dn;
-                char *principal_string;
-                
-                ret = krb5_unparse_name_flags(context, principal, 
-                                              KRB5_PRINCIPAL_UNPARSE_NO_REALM, 
-                                              &principal_string);
-                if (ret != 0) {
-                        return ret;
-                }
-                
-                /* At this point we may find the host is known to be
-                 * in a different realm, so we should generate a
-                 * referral instead */
-                nt_status = crack_service_principal_name((struct ldb_context *)db->hdb_db,
-                                                         mem_ctx, principal_string, 
-                                                         &user_dn, realm_dn);
-                free(principal_string);
-                
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        return HDB_ERR_NOENTRY;
-                }
-                
-                ldb_ret = gendb_search_single_extended_dn((struct ldb_context *)db->hdb_db,
-                                                          mem_ctx, 
-                                                          user_dn, LDB_SCOPE_BASE,
-                                                          msg, attrs,
-                                                          "(objectClass=*)");
-                if (ldb_ret != LDB_SUCCESS) {
-                        return HDB_ERR_NOENTRY;
-                }
-                
-        } else {
-                int lret;
-                char *filter = NULL;
-                char *short_princ;
-                /* server as client principal case, but we must not lookup userPrincipalNames */
-                *realm_dn = ldb_get_default_basedn(db->hdb_db);
-                realm = krb5_principal_get_realm(context, principal);
-                
-                /* TODO: Check if it is our realm, otherwise give referall */
-                
-                ret = krb5_unparse_name_flags(context, principal,  KRB5_PRINCIPAL_UNPARSE_NO_REALM, &short_princ);
-                
-                if (ret != 0) {
-                        krb5_set_error_message(context, ret, "hdb_samba4_lookup_principal: could not parse principal");
-                        krb5_warnx(context, "hdb_samba4_lookup_principal: could not parse principal");
-                        return ret;
-                }
-                
-                lret = gendb_search_single_extended_dn(db->hdb_db, mem_ctx, 
-                                                       *realm_dn, LDB_SCOPE_SUBTREE,
-                                                       msg, attrs, "(&(objectClass=user)(samAccountName=%s))", 
-                                                       ldb_binary_encode_string(mem_ctx, short_princ));
-                free(short_princ);
-                if (lret == LDB_ERR_NO_SUCH_OBJECT) {
-                        DEBUG(3, ("Failed find a entry for %s\n", filter));
-                        return HDB_ERR_NOENTRY;
-                }
-                if (lret != LDB_SUCCESS) {
-                        DEBUG(3, ("Failed single search for for %s - %s\n", 
-                                  filter, ldb_errstring(db->hdb_db)));
-                        return HDB_ERR_NOENTRY;
-                }
-        }
-
-        return 0;
-}
-
-static krb5_error_code hdb_samba4_fetch_server(krb5_context context, HDB *db, 
-                                               struct loadparm_context *lp_ctx,
-                                               TALLOC_CTX *mem_ctx, 
-                                               krb5_const_principal principal,
-                                               unsigned flags,
-                                               hdb_entry_ex *entry_ex)
-{
-        krb5_error_code ret;
-        struct ldb_dn *realm_dn;
-        struct ldb_message *msg;
-
-        ret = hdb_samba4_lookup_server(context, db, lp_ctx, mem_ctx, principal, 
-                                       server_attrs, &realm_dn, &msg);
-        if (ret != 0) {
-                return ret;
-        }
-
-        ret = hdb_samba4_message2entry(context, db, lp_ctx, mem_ctx, 
-                                principal, HDB_SAMBA4_ENT_TYPE_SERVER,
-                                realm_dn, msg, entry_ex);
-        if (ret != 0) {
-                krb5_warnx(context, "hdb_samba4_fetch: message2entry failed");  
-        }
-
-        return ret;
-}
-                        
-static krb5_error_code hdb_samba4_fetch(krb5_context context, HDB *db, 
-                                 krb5_const_principal principal,
-                                 unsigned flags,
-                                 hdb_entry_ex *entry_ex)
-{
-        krb5_error_code ret = HDB_ERR_NOENTRY;
-        TALLOC_CTX *mem_ctx = talloc_named(db, 0, "hdb_samba4_fetch context");
-        struct loadparm_context *lp_ctx = talloc_get_type(ldb_get_opaque(db->hdb_db, "loadparm"), struct loadparm_context);
-
-        if (!mem_ctx) {
-                ret = ENOMEM;
-                krb5_set_error_message(context, ret, "hdb_samba4_fetch: talloc_named() failed!");
-                return ret;
-        }
-
-        if (flags & HDB_F_GET_CLIENT) {
-                ret = hdb_samba4_fetch_client(context, db, lp_ctx, mem_ctx, principal, flags, entry_ex);
-                if (ret != HDB_ERR_NOENTRY) goto done;
-        }
-        if (flags & HDB_F_GET_SERVER) {
-                /* krbtgt fits into this situation for trusted realms, and for resolving different versions of our own realm name */
-                ret = hdb_samba4_fetch_krbtgt(context, db, lp_ctx, mem_ctx, principal, flags, entry_ex);
-                if (ret != HDB_ERR_NOENTRY) goto done;
-
-                /* We return 'no entry' if it does not start with krbtgt/, so move to the common case quickly */
-                ret = hdb_samba4_fetch_server(context, db, lp_ctx, mem_ctx, principal, flags, entry_ex);
-                if (ret != HDB_ERR_NOENTRY) goto done;
-        }
-        if (flags & HDB_F_GET_KRBTGT) {
-                ret = hdb_samba4_fetch_krbtgt(context, db, lp_ctx, mem_ctx, principal, flags, entry_ex);
-                if (ret != HDB_ERR_NOENTRY) goto done;
-        }
-
-done:
-        talloc_free(mem_ctx);
-        return ret;
-}
-
 static krb5_error_code hdb_samba4_store(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry)
 {
@@ -1316 +79 @@
 }
 
-struct hdb_samba4_seq {
-        struct ldb_context *ctx;
-        struct loadparm_context *lp_ctx;
-        int index;
-        int count;
-        struct ldb_message **msgs;
-        struct ldb_dn *realm_dn;
-};
-
-static krb5_error_code hdb_samba4_seq(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry)
-{
-        krb5_error_code ret;
-        struct hdb_samba4_seq *priv = (struct hdb_samba4_seq *)db->hdb_dbc;
-        TALLOC_CTX *mem_ctx;
-        hdb_entry_ex entry_ex;
-        memset(&entry_ex, '\0', sizeof(entry_ex));
-
-        if (!priv) {
-                return HDB_ERR_NOENTRY;
-        }
-
-        mem_ctx = talloc_named(priv, 0, "hdb_samba4_seq context");
-
-        if (!mem_ctx) {
-                ret = ENOMEM;
-                krb5_set_error_message(context, ret, "hdb_samba4_seq: talloc_named() failed!");
-                return ret;
-        }
-
-        if (priv->index < priv->count) {
-                ret = hdb_samba4_message2entry(context, db, priv->lp_ctx, 
-                                        mem_ctx, 
-                                        NULL, HDB_SAMBA4_ENT_TYPE_ANY, 
-                                        priv->realm_dn, priv->msgs[priv->index++], entry);
-        } else {
-                ret = HDB_ERR_NOENTRY;
-        }
-
-        if (ret != 0) {
-                db->hdb_dbc = NULL;
-        } else {
-                talloc_free(mem_ctx);
-        }
-
-        return ret;
+static krb5_error_code hdb_samba4_fetch_kvno(krb5_context context, HDB *db,
+                                             krb5_const_principal principal,
+                                             unsigned flags,
+                                             krb5_kvno kvno,
+                                             hdb_entry_ex *entry_ex)
+{
+        struct samba_kdc_db_context *kdc_db_ctx;
+
+        kdc_db_ctx = talloc_get_type_abort(db->hdb_db,
+                                           struct samba_kdc_db_context);
+
+        return samba_kdc_fetch(context, kdc_db_ctx, principal, flags, kvno, entry_ex);
 }
 
@@ -1366 +96 @@
                                         hdb_entry_ex *entry)
 {
-        struct ldb_context *ldb_ctx = (struct ldb_context *)db->hdb_db;
-        struct loadparm_context *lp_ctx = talloc_get_type(ldb_get_opaque(ldb_ctx, "loadparm"), 
-                                                          struct loadparm_context);
-        struct hdb_samba4_seq *priv = (struct hdb_samba4_seq *)db->hdb_dbc;
-        char *realm;
-        struct ldb_result *res = NULL;
-        krb5_error_code ret;
-        TALLOC_CTX *mem_ctx;
-        int lret;
-
-        if (priv) {
-                talloc_free(priv);
-                db->hdb_dbc = NULL;
-        }
-
-        priv = (struct hdb_samba4_seq *) talloc(db, struct hdb_samba4_seq);
-        if (!priv) {
-                ret = ENOMEM;
-                krb5_set_error_message(context, ret, "talloc: out of memory");
-                return ret;
-        }
-
-        priv->ctx = ldb_ctx;
-        priv->lp_ctx = lp_ctx;
-        priv->index = 0;
-        priv->msgs = NULL;
-        priv->realm_dn = ldb_get_default_basedn(ldb_ctx);
-        priv->count = 0;
-
-        mem_ctx = talloc_named(priv, 0, "hdb_samba4_firstkey context");
-
-        if (!mem_ctx) {
-                ret = ENOMEM;
-                krb5_set_error_message(context, ret, "hdb_samba4_firstkey: talloc_named() failed!");
-                return ret;
-        }
-
-        ret = krb5_get_default_realm(context, &realm);
-        if (ret != 0) {
-                talloc_free(priv);
-                return ret;
-        }
-                
-        lret = ldb_search(ldb_ctx, priv, &res,
-                          priv->realm_dn, LDB_SCOPE_SUBTREE, user_attrs,
-                          "(objectClass=user)");
-
-        if (lret != LDB_SUCCESS) {
-                talloc_free(priv);
-                return HDB_ERR_NOENTRY;
-        }
-
-        priv->count = res->count;
-        priv->msgs = talloc_steal(priv, res->msgs);
-        talloc_free(res);
-
-        db->hdb_dbc = priv;
-
-        ret = hdb_samba4_seq(context, db, flags, entry);
-
-        if (ret != 0) {
-                talloc_free(priv);
-                db->hdb_dbc = NULL;
-        } else {
-                talloc_free(mem_ctx);
-        }
-        return ret;
+        struct samba_kdc_db_context *kdc_db_ctx;
+
+        kdc_db_ctx = talloc_get_type_abort(db->hdb_db,
+                                           struct samba_kdc_db_context);
+
+        return samba_kdc_firstkey(context, kdc_db_ctx, entry);
 }
 
@@ -1438 +107 @@
                                    hdb_entry_ex *entry)
 {
-        return hdb_samba4_seq(context, db, flags, entry);
+        struct samba_kdc_db_context *kdc_db_ctx;
+
+        kdc_db_ctx = talloc_get_type_abort(db->hdb_db,
+                                           struct samba_kdc_db_context);
+
+        return samba_kdc_nextkey(context, kdc_db_ctx, entry);
 }
 
@@ -1447 +121 @@
 }
 
-
-/* Check if a given entry may delegate to this target principal
- *
- * This is currently a very nasty hack - allowing only delegation to itself. 
- */
-krb5_error_code hdb_samba4_check_constrained_delegation(krb5_context context, HDB *db, 
-                                                        hdb_entry_ex *entry,
-                                                        krb5_const_principal target_principal)
-{
-        struct ldb_context *ldb_ctx = (struct ldb_context *)db->hdb_db;
-        struct loadparm_context *lp_ctx = talloc_get_type(ldb_get_opaque(ldb_ctx, "loadparm"), 
-                                                          struct loadparm_context);
-        krb5_error_code ret;
-        krb5_principal enterprise_prinicpal = NULL;
-        struct ldb_dn *realm_dn;
-        struct ldb_message *msg;
-        struct dom_sid *orig_sid;
-        struct dom_sid *target_sid;
-        struct hdb_samba4_private *p = talloc_get_type(entry->ctx, struct hdb_samba4_private);
-        const char *delegation_check_attrs[] = {
-                "objectSid", NULL
-        };
-        
-        TALLOC_CTX *mem_ctx = talloc_named(db, 0, "hdb_samba4_check_constrained_delegation");
-
-        if (!mem_ctx) {
-                ret = ENOMEM;
-                krb5_set_error_message(context, ret, "hdb_samba4_fetch: talloc_named() failed!");
-                return ret;
-        }
-
-        if (target_principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
-                /* Need to reparse the enterprise principal to find the real target */
-                if (target_principal->name.name_string.len != 1) {
-                        ret = KRB5_PARSE_MALFORMED;
-                        krb5_set_error_message(context, ret, "hdb_samba4_check_constrained_delegation: request for delegation to enterprise principal with wrong (%d) number of components", 
-                                               target_principal->name.name_string.len);   
-                        talloc_free(mem_ctx);
-                        return ret;
-                }
-                ret = krb5_parse_name(context, target_principal->name.name_string.val[0], 
-                                      &enterprise_prinicpal);
-                if (ret) {
-                        talloc_free(mem_ctx);
-                        return ret;
-                }
-                target_principal = enterprise_prinicpal;
-        }
-
-        ret = hdb_samba4_lookup_server(context, db, lp_ctx, mem_ctx, target_principal, 
-                                       delegation_check_attrs, &realm_dn, &msg);
-
-        krb5_free_principal(context, enterprise_prinicpal);
-
-        if (ret != 0) {
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        orig_sid = samdb_result_dom_sid(mem_ctx, p->msg, "objectSid");
-        target_sid = samdb_result_dom_sid(mem_ctx, msg, "objectSid");
-
-        /* Allow delegation to the same principal, even if by a different
-         * name.  The easy and safe way to prove this is by SID
-         * comparison */
-        if (!(orig_sid && target_sid && dom_sid_equal(orig_sid, target_sid))) {
-                talloc_free(mem_ctx);
-                return KRB5KDC_ERR_BADOPTION;
-        }
-
-        talloc_free(mem_ctx);
-        return ret;
-}
-
-/* Certificates printed by a the Certificate Authority might have a
- * slightly different form of the user principal name to that in the
- * database.  Allow a mismatch where they both refer to the same
- * SID */
-
-krb5_error_code hdb_samba4_check_pkinit_ms_upn_match(krb5_context context, HDB *db, 
-                                                     hdb_entry_ex *entry,
-                                                     krb5_const_principal certificate_principal)
-{
-        struct ldb_context *ldb_ctx = (struct ldb_context *)db->hdb_db;
-        struct loadparm_context *lp_ctx = talloc_get_type(ldb_get_opaque(ldb_ctx, "loadparm"), 
-                                                          struct loadparm_context);
-        krb5_error_code ret;
-        struct ldb_dn *realm_dn;
-        struct ldb_message *msg;
-        struct dom_sid *orig_sid;
-        struct dom_sid *target_sid;
-        struct hdb_samba4_private *p = talloc_get_type(entry->ctx, struct hdb_samba4_private);
-        const char *ms_upn_check_attrs[] = {
-                "objectSid", NULL
-        };
-        
-        TALLOC_CTX *mem_ctx = talloc_named(db, 0, "hdb_samba4_check_constrained_delegation");
-
-        if (!mem_ctx) {
-                ret = ENOMEM;
-                krb5_set_error_message(context, ret, "hdb_samba4_fetch: talloc_named() failed!");
-                return ret;
-        }
-
-        ret = hdb_samba4_lookup_client(context, db, lp_ctx, 
-                                       mem_ctx, certificate_principal,
-                                       ms_upn_check_attrs, &realm_dn, &msg);
-        
-        if (ret != 0) {
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        orig_sid = samdb_result_dom_sid(mem_ctx, p->msg, "objectSid");
-        target_sid = samdb_result_dom_sid(mem_ctx, msg, "objectSid");
-
-        /* Consider these to be the same principal, even if by a different
-         * name.  The easy and safe way to prove this is by SID
-         * comparison */
-        if (!(orig_sid && target_sid && dom_sid_equal(orig_sid, target_sid))) {
-                talloc_free(mem_ctx);
-                return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
-        }
-
-        talloc_free(mem_ctx);
-        return ret;
-}
-
-/* This interface is to be called by the KDC and libnet_keytab_dump, which is expecting Samba
- * calling conventions.  It is also called by a wrapper
- * (hdb_samba4_create) from the kpasswdd -> krb5 -> keytab_hdb -> hdb
- * code */
-
-NTSTATUS hdb_samba4_create_kdc(TALLOC_CTX *mem_ctx, 
-                              struct tevent_context *ev_ctx, 
-                              struct loadparm_context *lp_ctx,
-                              krb5_context context, struct HDB **db)
-{
+static krb5_error_code
+hdb_samba4_check_identical_client_and_server(krb5_context context, HDB *db,
+                                        hdb_entry_ex *entry,
+                                        krb5_const_principal target_principal)
+{
+        struct samba_kdc_db_context *kdc_db_ctx;
+
+        kdc_db_ctx = talloc_get_type_abort(db->hdb_db,
+                                           struct samba_kdc_db_context);
+
+        return samba_kdc_check_identical_client_and_server(context, kdc_db_ctx,
+                                                           entry,
+                                                           target_principal);
+}
+
+static krb5_error_code
+hdb_samba4_check_pkinit_ms_upn_match(krb5_context context, HDB *db,
+                                     hdb_entry_ex *entry,
+                                     krb5_const_principal certificate_principal)
+{
+        struct samba_kdc_db_context *kdc_db_ctx;
+
+        kdc_db_ctx = talloc_get_type_abort(db->hdb_db,
+                                           struct samba_kdc_db_context);
+
+        return samba_kdc_check_pkinit_ms_upn_match(context, kdc_db_ctx,
+                                                   entry,
+                                                   certificate_principal);
+}
+
+/* This interface is to be called by the KDC and libnet_keytab_dump,
+ * which is expecting Samba calling conventions.
+ * It is also called by a wrapper (hdb_samba4_create) from the
+ * kpasswdd -> krb5 -> keytab_hdb -> hdb code */
+
+NTSTATUS hdb_samba4_create_kdc(struct samba_kdc_base_context *base_ctx,
+                               krb5_context context, struct HDB **db)
+{
+        struct samba_kdc_db_context *kdc_db_ctx;
         NTSTATUS nt_status;
-        struct auth_session_info *session_info;
-        *db = talloc(mem_ctx, HDB);
+
+        *db = talloc(base_ctx, HDB);
         if (!*db) {
                 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
@@ -1597 +172 @@
         (*db)->hdb_capability_flags = 0;
 
-        nt_status = auth_system_session_info(*db, lp_ctx, &session_info);
+        nt_status = samba_kdc_setup_db_ctx(*db, base_ctx, &kdc_db_ctx);
         if (!NT_STATUS_IS_OK(nt_status)) {
+                talloc_free(*db);
                 return nt_status;
         }
-        
-        /* The idea here is very simple.  Using Kerberos to
-         * authenticate the KDC to the LDAP server is higly likely to
-         * be circular.
-         *
-         * In future we may set this up to use EXERNAL and SSL
-         * certificates, for now it will almost certainly be NTLMSSP
-        */
-        
-        cli_credentials_set_kerberos_state(session_info->credentials, 
-                                           CRED_DONT_USE_KERBEROS);
-
-        /* Setup the link to LDB */
-        (*db)->hdb_db = samdb_connect(*db, ev_ctx, lp_ctx, session_info);
-        if ((*db)->hdb_db == NULL) {
-                DEBUG(1, ("hdb_samba4_create: Cannot open samdb for KDC backend!"));
-                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
-        }
+        (*db)->hdb_db = kdc_db_ctx;
 
         (*db)->hdb_dbc = NULL;
         (*db)->hdb_open = hdb_samba4_open;
         (*db)->hdb_close = hdb_samba4_close;
-        (*db)->hdb_fetch = hdb_samba4_fetch;
+        (*db)->hdb_fetch_kvno = hdb_samba4_fetch_kvno;
         (*db)->hdb_store = hdb_samba4_store;
         (*db)->hdb_remove = hdb_samba4_remove;
@@ -1639 +198 @@
 
         (*db)->hdb_auth_status = NULL;
-        (*db)->hdb_check_constrained_delegation = hdb_samba4_check_constrained_delegation;
+        (*db)->hdb_check_constrained_delegation = hdb_samba4_check_identical_client_and_server;
         (*db)->hdb_check_pkinit_ms_upn_match = hdb_samba4_check_pkinit_ms_upn_match;
+        (*db)->hdb_check_s4u2self = hdb_samba4_check_identical_client_and_server;
 
         return NT_STATUS_OK;
@@ -1649 +209 @@
         NTSTATUS nt_status;
         void *ptr;
-        struct hdb_samba4_context *hdb_samba4_context;
+        struct samba_kdc_base_context *base_ctx;
+
         if (sscanf(arg, "&%p", &ptr) != 1) {
                 return EINVAL;
         }
-        hdb_samba4_context = talloc_get_type_abort(ptr, struct hdb_samba4_context);
+        base_ctx = talloc_get_type_abort(ptr, struct samba_kdc_base_context);
         /* The global kdc_mem_ctx and kdc_lp_ctx, Disgusting, ugly hack, but it means one less private hook */
-        nt_status = hdb_samba4_create_kdc(hdb_samba4_context, hdb_samba4_context->ev_ctx, hdb_samba4_context->lp_ctx,
-                                          context, db);
+        nt_status = hdb_samba4_create_kdc(base_ctx, context, db);
 
         if (NT_STATUS_IS_OK(nt_status)) {
@@ -1673 +233 @@
 struct hdb_method hdb_samba4 = {
         .interface_version = HDB_INTERFACE_VERSION,
-        .prefix = "samba4", 
+        .prefix = "samba4",
         .create = hdb_samba4_create
 };

vendor/current/source4/kdc/kdc.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -12 +12 @@
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -23 +23 @@
 
 #include "includes.h"
-#include "smbd/service_task.h"
-#include "smbd/service.h"
-#include "smbd/service_stream.h"
 #include "smbd/process_model.h"
-#include "lib/events/events.h"
-#include "lib/socket/socket.h"
-#include "system/network.h"
-#include "../lib/util/dlinklist.h"
+#include "lib/tsocket/tsocket.h"
+#include "libcli/util/tstream.h"
 #include "lib/messaging/irpc.h"
-#include "lib/stream/packet.h"
-#include "librpc/gen_ndr/samr.h"
 #include "librpc/gen_ndr/ndr_irpc.h"
 #include "librpc/gen_ndr/ndr_krb5pac.h"
+#include "lib/stream/packet.h"
 #include "lib/socket/netif.h"
 #include "param/param.h"
-#include "kdc/kdc.h"
-#include "librpc/gen_ndr/ndr_misc.h"
-
-
-/* Disgusting hack to get a mem_ctx and lp_ctx into the hdb plugin, when 
- * used as a keytab */
-TALLOC_CTX *hdb_samba4_mem_ctx;
-struct tevent_context *hdb_samba4_ev_ctx;
-struct loadparm_context *hdb_samba4_lp_ctx;
-
-/* hold all the info needed to send a reply */
-struct kdc_reply {
-        struct kdc_reply *next, *prev;
-        struct socket_address *dest;
-        DATA_BLOB packet;
-};
-
-typedef bool (*kdc_process_fn_t)(struct kdc_server *kdc,
-                                 TALLOC_CTX *mem_ctx, 
-                                 DATA_BLOB *input, 
-                                 DATA_BLOB *reply,
-                                 struct socket_address *peer_addr, 
-                                 struct socket_address *my_addr, 
-                                 int datagram);
+#include "kdc/kdc-glue.h"
+#include "dsdb/samdb/samdb.h"
+#include "auth/session.h"
+
+extern struct krb5plugin_windc_ftable windc_plugin_table;
+extern struct hdb_method hdb_samba4;
+
+static NTSTATUS kdc_proxy_unavailable_error(struct kdc_server *kdc,
+                                            TALLOC_CTX *mem_ctx,
+                                            DATA_BLOB *out)
+{
+        int kret;
+        krb5_data k5_error_blob;
+
+        kret = krb5_mk_error(kdc->smb_krb5_context->krb5_context,
+                             KRB5KDC_ERR_SVC_UNAVAILABLE, NULL, NULL,
+                             NULL, NULL, NULL, NULL, &k5_error_blob);
+        if (kret != 0) {
+                DEBUG(2,(__location__ ": Unable to form krb5 error reply\n"));
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        *out = data_blob_talloc(mem_ctx, k5_error_blob.data, k5_error_blob.length);
+        krb5_data_free(&k5_error_blob);
+        if (!out->data) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        return NT_STATUS_OK;
+}
+
+typedef enum kdc_process_ret (*kdc_process_fn_t)(struct kdc_server *kdc,
+                                                 TALLOC_CTX *mem_ctx,
+                                                 DATA_BLOB *input,
+                                                 DATA_BLOB *reply,
+                                                 struct tsocket_address *peer_addr,
+                                                 struct tsocket_address *my_addr,
+                                                 int datagram);
 
 /* hold information about one kdc socket */
 struct kdc_socket {
-        struct socket_context *sock;
         struct kdc_server *kdc;
-        struct tevent_fd *fde;
-
-        /* a queue of outgoing replies that have been deferred */
-        struct kdc_reply *send_queue;
-
+        struct tsocket_address *local_address;
         kdc_process_fn_t process;
 };
+
+struct kdc_tcp_call {
+        struct kdc_tcp_connection *kdc_conn;
+        DATA_BLOB in;
+        DATA_BLOB out;
+        uint8_t out_hdr[4];
+        struct iovec out_iov[2];
+};
+
 /*
   state of an open tcp connection
@@ -82 +94 @@
 
         /* the kdc_server the connection belongs to */
-        struct kdc_server *kdc;
-
-        struct packet_context *packet;
-
-        kdc_process_fn_t process;
+        struct kdc_socket *kdc_socket;
+
+        struct tstream_context *tstream;
+
+        struct tevent_queue *send_queue;
 };
 
-/*
-  handle fd send events on a KDC socket
-*/
-static void kdc_send_handler(struct kdc_socket *kdc_socket)
-{
-        while (kdc_socket->send_queue) {
-                struct kdc_reply *rep = kdc_socket->send_queue;
-                NTSTATUS status;
-                size_t sendlen;
-
-                status = socket_sendto(kdc_socket->sock, &rep->packet, &sendlen,
-                                       rep->dest);
-                if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
-                        break;
-                }
-                if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_BUFFER_SIZE)) {
-                        /* Replace with a krb err, response to big */
-                }
-                
-                DLIST_REMOVE(kdc_socket->send_queue, rep);
-                talloc_free(rep);
-        }
-
-        if (kdc_socket->send_queue == NULL) {
-                EVENT_FD_NOT_WRITEABLE(kdc_socket->fde);
-        }
-}
-
-
-/*
-  handle fd recv events on a KDC socket
-*/
-static void kdc_recv_handler(struct kdc_socket *kdc_socket)
-{
-        NTSTATUS status;
-        TALLOC_CTX *tmp_ctx = talloc_new(kdc_socket);
-        DATA_BLOB blob;
-        struct kdc_reply *rep;
-        DATA_BLOB reply;
-        size_t nread, dsize;
-        struct socket_address *src;
-        struct socket_address *my_addr;
-        int ret;
-
-        status = socket_pending(kdc_socket->sock, &dsize);
-        if (!NT_STATUS_IS_OK(status)) {
-                talloc_free(tmp_ctx);
-                return;
-        }
-
-        blob = data_blob_talloc(tmp_ctx, NULL, dsize);
-        if (blob.data == NULL) {
-                /* hope this is a temporary low memory condition */
-                talloc_free(tmp_ctx);
-                return;
-        }
-
-        status = socket_recvfrom(kdc_socket->sock, blob.data, blob.length, &nread,
-                                 tmp_ctx, &src);
-        if (!NT_STATUS_IS_OK(status)) {
-                talloc_free(tmp_ctx);
-                return;
-        }
-        blob.length = nread;
-        
-        DEBUG(10,("Received krb5 UDP packet of length %lu from %s:%u\n", 
-                 (long)blob.length, src->addr, (uint16_t)src->port));
-        
-        my_addr = socket_get_my_addr(kdc_socket->sock, tmp_ctx);
-        if (!my_addr) {
-                talloc_free(tmp_ctx);
-                return;
-        }
-
-
-        /* Call krb5 */
-        ret = kdc_socket->process(kdc_socket->kdc, 
-                                  tmp_ctx, 
-                                  &blob,  
-                                  &reply,
-                                  src, my_addr,
-                                  1 /* Datagram */);
-        if (!ret) {
-                talloc_free(tmp_ctx);
-                return;
-        }
-
-        /* queue a pending reply */
-        rep = talloc(kdc_socket, struct kdc_reply);
-        if (rep == NULL) {
-                talloc_free(tmp_ctx);
-                return;
-        }
-        rep->dest         = talloc_steal(rep, src);
-        rep->packet       = reply;
-        talloc_steal(rep, reply.data);
-
-        if (rep->packet.data == NULL) {
-                talloc_free(rep);
-                talloc_free(tmp_ctx);
-                return;
-        }
-
-        DLIST_ADD_END(kdc_socket->send_queue, rep, struct kdc_reply *);
-        EVENT_FD_WRITEABLE(kdc_socket->fde);
-        talloc_free(tmp_ctx);
-}
-
-/*
-  handle fd events on a KDC socket
-*/
-static void kdc_socket_handler(struct tevent_context *ev, struct tevent_fd *fde,
-                               uint16_t flags, void *private_data)
-{
-        struct kdc_socket *kdc_socket = talloc_get_type(private_data, struct kdc_socket);
-        if (flags & EVENT_FD_WRITE) {
-                kdc_send_handler(kdc_socket);
-        } 
-        if (flags & EVENT_FD_READ) {
-                kdc_recv_handler(kdc_socket);
-        }
-}
 
 static void kdc_tcp_terminate_connection(struct kdc_tcp_connection *kdcconn, const char *reason)
@@ -217 +107 @@
 }
 
-/*
-  receive a full packet on a KDC connection
-*/
-static NTSTATUS kdc_tcp_recv(void *private_data, DATA_BLOB blob)
-{
-        struct kdc_tcp_connection *kdcconn = talloc_get_type(private_data,
-                                                             struct kdc_tcp_connection);
-        NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
-        TALLOC_CTX *tmp_ctx = talloc_new(kdcconn);
-        int ret;
-        DATA_BLOB input, reply;
-        struct socket_address *src_addr;
-        struct socket_address *my_addr;
-
-        talloc_steal(tmp_ctx, blob.data);
-
-        src_addr = socket_get_peer_addr(kdcconn->conn->socket, tmp_ctx);
-        if (!src_addr) {
-                talloc_free(tmp_ctx);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        my_addr = socket_get_my_addr(kdcconn->conn->socket, tmp_ctx);
-        if (!my_addr) {
-                talloc_free(tmp_ctx);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* Call krb5 */
-        input = data_blob_const(blob.data + 4, blob.length - 4); 
-
-        ret = kdcconn->process(kdcconn->kdc, 
-                               tmp_ctx,
-                               &input,
-                               &reply,
-                               src_addr,
-                               my_addr,
-                               0 /* Not datagram */);
-        if (!ret) {
-                talloc_free(tmp_ctx);
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        /* and now encode the reply */
-        blob = data_blob_talloc(kdcconn, NULL, reply.length + 4);
-        if (!blob.data) {
-                talloc_free(tmp_ctx);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        RSIVAL(blob.data, 0, reply.length);
-        memcpy(blob.data + 4, reply.data, reply.length);        
-
-        status = packet_send(kdcconn->packet, blob);
-        if (!NT_STATUS_IS_OK(status)) {
-                talloc_free(tmp_ctx);
-                return status;
-        }
-
-        /* the call isn't needed any more */
-        talloc_free(tmp_ctx);
-        return NT_STATUS_OK;
-}
-
-/*
-  receive some data on a KDC connection
-*/
-static void kdc_tcp_recv_handler(struct stream_connection *conn, uint16_t flags)
+static void kdc_tcp_recv(struct stream_connection *conn, uint16_t flags)
 {
         struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
                                                              struct kdc_tcp_connection);
-        packet_recv(kdcconn->packet);
-}
-
-/*
-  called on a tcp recv error
-*/
-static void kdc_tcp_recv_error(void *private_data, NTSTATUS status)
-{
-        struct kdc_tcp_connection *kdcconn = talloc_get_type(private_data,
-                                             struct kdc_tcp_connection);
-        kdc_tcp_terminate_connection(kdcconn, nt_errstr(status));
-}
-
-/*
-  called when we can write to a connection
-*/
+        /* this should never be triggered! */
+        kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_recv: called");
+}
+
 static void kdc_tcp_send(struct stream_connection *conn, uint16_t flags)
 {
         struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
                                                              struct kdc_tcp_connection);
-        packet_queue_run(kdcconn->packet);
+        /* this should never be triggered! */
+        kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_send: called");
 }
 
@@ -316 +128 @@
 */
 
-static bool kdc_process(struct kdc_server *kdc,
-                        TALLOC_CTX *mem_ctx, 
-                        DATA_BLOB *input, 
-                        DATA_BLOB *reply,
-                        struct socket_address *peer_addr, 
-                        struct socket_address *my_addr,
-                        int datagram_reply)
-{
-        int ret;        
+static enum kdc_process_ret kdc_process(struct kdc_server *kdc,
+                                        TALLOC_CTX *mem_ctx,
+                                        DATA_BLOB *input,
+                                        DATA_BLOB *reply,
+                                        struct tsocket_address *peer_addr,
+                                        struct tsocket_address *my_addr,
+                                        int datagram_reply)
+{
+        int ret;
+        char *pa;
+        struct sockaddr_storage ss;
         krb5_data k5_reply;
         krb5_data_zero(&k5_reply);
@@ -330 +144 @@
         krb5_kdc_update_time(NULL);
 
-        DEBUG(10,("Received KDC packet of length %lu from %s:%d\n", 
-                  (long)input->length - 4, peer_addr->addr, peer_addr->port));
-
-        ret = krb5_kdc_process_krb5_request(kdc->smb_krb5_context->krb5_context, 
+        ret = tsocket_address_bsd_sockaddr(peer_addr, (struct sockaddr *) &ss,
+                                sizeof(struct sockaddr_storage));
+        if (ret < 0) {
+                return KDC_PROCESS_FAILED;
+        }
+        pa = tsocket_address_string(peer_addr, mem_ctx);
+        if (pa == NULL) {
+                return KDC_PROCESS_FAILED;
+        }
+
+        DEBUG(10,("Received KDC packet of length %lu from %s\n",
+                                (long)input->length - 4, pa));
+
+        ret = krb5_kdc_process_krb5_request(kdc->smb_krb5_context->krb5_context,
                                             kdc->config,
                                             input->data, input->length,
                                             &k5_reply,
-                                            peer_addr->addr,
-                                            peer_addr->sockaddr,
+                                            pa,
+                                            (struct sockaddr *) &ss,
                                             datagram_reply);
         if (ret == -1) {
                 *reply = data_blob(NULL, 0);
-                return false;
-        }
+                return KDC_PROCESS_FAILED;
+        }
+
+        if (ret == HDB_ERR_NOT_FOUND_HERE) {
+                *reply = data_blob(NULL, 0);
+                return KDC_PROCESS_PROXY;
+        }
+
         if (k5_reply.length) {
                 *reply = data_blob_talloc(mem_ctx, k5_reply.data, k5_reply.length);
                 krb5_data_free(&k5_reply);
         } else {
-                *reply = data_blob(NULL, 0);    
-        }
-        return true;
+                *reply = data_blob(NULL, 0);
+        }
+        return KDC_PROCESS_OK;
+}
+
+static void kdc_tcp_call_proxy_done(struct tevent_req *subreq);
+static void kdc_tcp_call_writev_done(struct tevent_req *subreq);
+
+static void kdc_tcp_call_loop(struct tevent_req *subreq)
+{
+        struct kdc_tcp_connection *kdc_conn = tevent_req_callback_data(subreq,
+                                      struct kdc_tcp_connection);
+        struct kdc_tcp_call *call;
+        NTSTATUS status;
+        enum kdc_process_ret ret;
+
+        call = talloc(kdc_conn, struct kdc_tcp_call);
+        if (call == NULL) {
+                kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
+                                "no memory for kdc_tcp_call");
+                return;
+        }
+        call->kdc_conn = kdc_conn;
+
+        status = tstream_read_pdu_blob_recv(subreq,
+                                            call,
+                                            &call->in);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                const char *reason;
+
+                reason = talloc_asprintf(call, "kdc_tcp_call_loop: "
+                                         "tstream_read_pdu_blob_recv() - %s",
+                                         nt_errstr(status));
+                if (!reason) {
+                        reason = nt_errstr(status);
+                }
+
+                kdc_tcp_terminate_connection(kdc_conn, reason);
+                return;
+        }
+
+        DEBUG(10,("Received krb5 TCP packet of length %lu from %s\n",
+                 (long) call->in.length,
+                 tsocket_address_string(kdc_conn->conn->remote_address, call)));
+
+        /* skip length header */
+        call->in.data +=4;
+        call->in.length -= 4;
+
+        /* Call krb5 */
+        ret = kdc_conn->kdc_socket->process(kdc_conn->kdc_socket->kdc,
+                                           call,
+                                           &call->in,
+                                           &call->out,
+                                           kdc_conn->conn->remote_address,
+                                           kdc_conn->conn->local_address,
+                                           0 /* Stream */);
+        if (ret == KDC_PROCESS_FAILED) {
+                kdc_tcp_terminate_connection(kdc_conn,
+                                "kdc_tcp_call_loop: process function failed");
+                return;
+        }
+
+        if (ret == KDC_PROCESS_PROXY) {
+                uint16_t port;
+
+                if (!kdc_conn->kdc_socket->kdc->am_rodc) {
+                        kdc_tcp_terminate_connection(kdc_conn,
+                                                     "kdc_tcp_call_loop: proxying requested when not RODC");
+                        return;
+                }
+                port = tsocket_address_inet_port(kdc_conn->conn->local_address);
+
+                subreq = kdc_tcp_proxy_send(call,
+                                            kdc_conn->conn->event.ctx,
+                                            kdc_conn->kdc_socket->kdc,
+                                            port,
+                                            call->in);
+                if (subreq == NULL) {
+                        kdc_tcp_terminate_connection(kdc_conn,
+                                "kdc_tcp_call_loop: kdc_tcp_proxy_send failed");
+                        return;
+                }
+                tevent_req_set_callback(subreq, kdc_tcp_call_proxy_done, call);
+                return;
+        }
+
+        /* First add the length of the out buffer */
+        RSIVAL(call->out_hdr, 0, call->out.length);
+        call->out_iov[0].iov_base = (char *) call->out_hdr;
+        call->out_iov[0].iov_len = 4;
+
+        call->out_iov[1].iov_base = (char *) call->out.data;
+        call->out_iov[1].iov_len = call->out.length;
+
+        subreq = tstream_writev_queue_send(call,
+                                           kdc_conn->conn->event.ctx,
+                                           kdc_conn->tstream,
+                                           kdc_conn->send_queue,
+                                           call->out_iov, 2);
+        if (subreq == NULL) {
+                kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
+                                "no memory for tstream_writev_queue_send");
+                return;
+        }
+        tevent_req_set_callback(subreq, kdc_tcp_call_writev_done, call);
+
+        /*
+         * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
+         * packet_full_request_u32 provides the pdu length then.
+         */
+        subreq = tstream_read_pdu_blob_send(kdc_conn,
+                                            kdc_conn->conn->event.ctx,
+                                            kdc_conn->tstream,
+                                            4, /* initial_read_size */
+                                            packet_full_request_u32,
+                                            kdc_conn);
+        if (subreq == NULL) {
+                kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
+                                "no memory for tstream_read_pdu_blob_send");
+                return;
+        }
+        tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
+}
+
+static void kdc_tcp_call_proxy_done(struct tevent_req *subreq)
+{
+        struct kdc_tcp_call *call = tevent_req_callback_data(subreq,
+                        struct kdc_tcp_call);
+        struct kdc_tcp_connection *kdc_conn = call->kdc_conn;
+        NTSTATUS status;
+
+        status = kdc_tcp_proxy_recv(subreq, call, &call->out);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                /* generate an error packet */
+                status = kdc_proxy_unavailable_error(kdc_conn->kdc_socket->kdc,
+                                                     call, &call->out);
+        }
+
+        if (!NT_STATUS_IS_OK(status)) {
+                const char *reason;
+
+                reason = talloc_asprintf(call, "kdc_tcp_call_proxy_done: "
+                                         "kdc_proxy_unavailable_error - %s",
+                                         nt_errstr(status));
+                if (!reason) {
+                        reason = "kdc_tcp_call_proxy_done: kdc_proxy_unavailable_error() failed";
+                }
+
+                kdc_tcp_terminate_connection(call->kdc_conn, reason);
+                return;
+        }
+
+        /* First add the length of the out buffer */
+        RSIVAL(call->out_hdr, 0, call->out.length);
+        call->out_iov[0].iov_base = (char *) call->out_hdr;
+        call->out_iov[0].iov_len = 4;
+
+        call->out_iov[1].iov_base = (char *) call->out.data;
+        call->out_iov[1].iov_len = call->out.length;
+
+        subreq = tstream_writev_queue_send(call,
+                                           kdc_conn->conn->event.ctx,
+                                           kdc_conn->tstream,
+                                           kdc_conn->send_queue,
+                                           call->out_iov, 2);
+        if (subreq == NULL) {
+                kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
+                                "no memory for tstream_writev_queue_send");
+                return;
+        }
+        tevent_req_set_callback(subreq, kdc_tcp_call_writev_done, call);
+
+        /*
+         * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
+         * packet_full_request_u32 provides the pdu length then.
+         */
+        subreq = tstream_read_pdu_blob_send(kdc_conn,
+                                            kdc_conn->conn->event.ctx,
+                                            kdc_conn->tstream,
+                                            4, /* initial_read_size */
+                                            packet_full_request_u32,
+                                            kdc_conn);
+        if (subreq == NULL) {
+                kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
+                                "no memory for tstream_read_pdu_blob_send");
+                return;
+        }
+        tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
+}
+
+static void kdc_tcp_call_writev_done(struct tevent_req *subreq)
+{
+        struct kdc_tcp_call *call = tevent_req_callback_data(subreq,
+                        struct kdc_tcp_call);
+        int sys_errno;
+        int rc;
+
+        rc = tstream_writev_queue_recv(subreq, &sys_errno);
+        TALLOC_FREE(subreq);
+        if (rc == -1) {
+                const char *reason;
+
+                reason = talloc_asprintf(call, "kdc_tcp_call_writev_done: "
+                                         "tstream_writev_queue_recv() - %d:%s",
+                                         sys_errno, strerror(sys_errno));
+                if (!reason) {
+                        reason = "kdc_tcp_call_writev_done: tstream_writev_queue_recv() failed";
+                }
+
+                kdc_tcp_terminate_connection(call->kdc_conn, reason);
+                return;
+        }
+
+        /* We don't care about errors */
+
+        talloc_free(call);
 }
 
@@ -356 +402 @@
   called when we get a new connection
 */
-static void kdc_tcp_generic_accept(struct stream_connection *conn, kdc_process_fn_t process_fn)
-{
-        struct kdc_server *kdc = talloc_get_type(conn->private_data, struct kdc_server);
-        struct kdc_tcp_connection *kdcconn;
-
-        kdcconn = talloc_zero(conn, struct kdc_tcp_connection);
-        if (!kdcconn) {
-                stream_terminate_connection(conn, "kdc_tcp_accept: out of memory");
-                return;
-        }
-        kdcconn->conn    = conn;
-        kdcconn->kdc     = kdc;
-        kdcconn->process = process_fn;
-        conn->private_data    = kdcconn;
-
-        kdcconn->packet = packet_init(kdcconn);
-        if (kdcconn->packet == NULL) {
-                kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_accept: out of memory");
-                return;
-        }
-        packet_set_private(kdcconn->packet, kdcconn);
-        packet_set_socket(kdcconn->packet, conn->socket);
-        packet_set_callback(kdcconn->packet, kdc_tcp_recv);
-        packet_set_full_request(kdcconn->packet, packet_full_request_u32);
-        packet_set_error_handler(kdcconn->packet, kdc_tcp_recv_error);
-        packet_set_event_context(kdcconn->packet, conn->event.ctx);
-        packet_set_fde(kdcconn->packet, conn->event.fde);
-        packet_set_serialise(kdcconn->packet);
-}
-
 static void kdc_tcp_accept(struct stream_connection *conn)
 {
-        kdc_tcp_generic_accept(conn, kdc_process);
+        struct kdc_socket *kdc_socket;
+        struct kdc_tcp_connection *kdc_conn;
+        struct tevent_req *subreq;
+        int rc;
+
+        kdc_conn = talloc_zero(conn, struct kdc_tcp_connection);
+        if (kdc_conn == NULL) {
+                stream_terminate_connection(conn,
+                                "kdc_tcp_accept: out of memory");
+                return;
+        }
+
+        kdc_conn->send_queue = tevent_queue_create(conn, "kdc_tcp_accept");
+        if (kdc_conn->send_queue == NULL) {
+                stream_terminate_connection(conn,
+                                "kdc_tcp_accept: out of memory");
+                return;
+        }
+
+        kdc_socket = talloc_get_type(conn->private_data, struct kdc_socket);
+
+        TALLOC_FREE(conn->event.fde);
+
+        rc = tstream_bsd_existing_socket(kdc_conn,
+                        socket_get_fd(conn->socket),
+                        &kdc_conn->tstream);
+        if (rc < 0) {
+                stream_terminate_connection(conn,
+                                "kdc_tcp_accept: out of memory");
+                return;
+        }
+
+        kdc_conn->conn = conn;
+        kdc_conn->kdc_socket = kdc_socket;
+        conn->private_data = kdc_conn;
+
+        /*
+         * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
+         * packet_full_request_u32 provides the pdu length then.
+         */
+        subreq = tstream_read_pdu_blob_send(kdc_conn,
+                                            kdc_conn->conn->event.ctx,
+                                            kdc_conn->tstream,
+                                            4, /* initial_read_size */
+                                            packet_full_request_u32,
+                                            kdc_conn);
+        if (subreq == NULL) {
+                kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_accept: "
+                                "no memory for tstream_read_pdu_blob_send");
+                return;
+        }
+        tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
 }
 
@@ -394 +461 @@
         .name                   = "kdc_tcp",
         .accept_connection      = kdc_tcp_accept,
-        .recv_handler           = kdc_tcp_recv_handler,
+        .recv_handler           = kdc_tcp_recv,
         .send_handler           = kdc_tcp_send
 };
 
-static void kpasswdd_tcp_accept(struct stream_connection *conn)
-{
-        kdc_tcp_generic_accept(conn, kpasswdd_process);
-}
-
-static const struct stream_server_ops kpasswdd_tcp_stream_ops = {
-        .name                   = "kpasswdd_tcp",
-        .accept_connection      = kpasswdd_tcp_accept,
-        .recv_handler           = kdc_tcp_recv_handler,
-        .send_handler           = kdc_tcp_send
+/* hold information about one kdc/kpasswd udp socket */
+struct kdc_udp_socket {
+        struct kdc_socket *kdc_socket;
+        struct tdgram_context *dgram;
+        struct tevent_queue *send_queue;
 };
+
+struct kdc_udp_call {
+        struct kdc_udp_socket *sock;
+        struct tsocket_address *src;
+        DATA_BLOB in;
+        DATA_BLOB out;
+};
+
+static void kdc_udp_call_proxy_done(struct tevent_req *subreq);
+static void kdc_udp_call_sendto_done(struct tevent_req *subreq);
+
+static void kdc_udp_call_loop(struct tevent_req *subreq)
+{
+        struct kdc_udp_socket *sock = tevent_req_callback_data(subreq,
+                                      struct kdc_udp_socket);
+        struct kdc_udp_call *call;
+        uint8_t *buf;
+        ssize_t len;
+        int sys_errno;
+        enum kdc_process_ret ret;
+
+        call = talloc(sock, struct kdc_udp_call);
+        if (call == NULL) {
+                talloc_free(call);
+                goto done;
+        }
+        call->sock = sock;
+
+        len = tdgram_recvfrom_recv(subreq, &sys_errno,
+                                   call, &buf, &call->src);
+        TALLOC_FREE(subreq);
+        if (len == -1) {
+                talloc_free(call);
+                goto done;
+        }
+
+        call->in.data = buf;
+        call->in.length = len;
+
+        DEBUG(10,("Received krb5 UDP packet of length %lu from %s\n",
+                 (long)call->in.length,
+                 tsocket_address_string(call->src, call)));
+
+        /* Call krb5 */
+        ret = sock->kdc_socket->process(sock->kdc_socket->kdc,
+                                       call,
+                                       &call->in,
+                                       &call->out,
+                                       call->src,
+                                       sock->kdc_socket->local_address,
+                                       1 /* Datagram */);
+        if (ret == KDC_PROCESS_FAILED) {
+                talloc_free(call);
+                goto done;
+        }
+
+        if (ret == KDC_PROCESS_PROXY) {
+                uint16_t port;
+
+                if (!sock->kdc_socket->kdc->am_rodc) {
+                        DEBUG(0,("kdc_udp_call_loop: proxying requested when not RODC"));
+                        talloc_free(call);
+                        goto done;
+                }
+
+                port = tsocket_address_inet_port(sock->kdc_socket->local_address);
+
+                subreq = kdc_udp_proxy_send(call,
+                                            sock->kdc_socket->kdc->task->event_ctx,
+                                            sock->kdc_socket->kdc,
+                                            port,
+                                            call->in);
+                if (subreq == NULL) {
+                        talloc_free(call);
+                        goto done;
+                }
+                tevent_req_set_callback(subreq, kdc_udp_call_proxy_done, call);
+                goto done;
+        }
+
+        subreq = tdgram_sendto_queue_send(call,
+                                          sock->kdc_socket->kdc->task->event_ctx,
+                                          sock->dgram,
+                                          sock->send_queue,
+                                          call->out.data,
+                                          call->out.length,
+                                          call->src);
+        if (subreq == NULL) {
+                talloc_free(call);
+                goto done;
+        }
+        tevent_req_set_callback(subreq, kdc_udp_call_sendto_done, call);
+
+done:
+        subreq = tdgram_recvfrom_send(sock,
+                                      sock->kdc_socket->kdc->task->event_ctx,
+                                      sock->dgram);
+        if (subreq == NULL) {
+                task_server_terminate(sock->kdc_socket->kdc->task,
+                                      "no memory for tdgram_recvfrom_send",
+                                      true);
+                return;
+        }
+        tevent_req_set_callback(subreq, kdc_udp_call_loop, sock);
+}
+
+static void kdc_udp_call_proxy_done(struct tevent_req *subreq)
+{
+        struct kdc_udp_call *call =
+                tevent_req_callback_data(subreq,
+                struct kdc_udp_call);
+        NTSTATUS status;
+
+        status = kdc_udp_proxy_recv(subreq, call, &call->out);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                /* generate an error packet */
+                status = kdc_proxy_unavailable_error(call->sock->kdc_socket->kdc,
+                                                     call, &call->out);
+        }
+
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(call);
+                return;
+        }
+
+        subreq = tdgram_sendto_queue_send(call,
+                                          call->sock->kdc_socket->kdc->task->event_ctx,
+                                          call->sock->dgram,
+                                          call->sock->send_queue,
+                                          call->out.data,
+                                          call->out.length,
+                                          call->src);
+        if (subreq == NULL) {
+                talloc_free(call);
+                return;
+        }
+
+        tevent_req_set_callback(subreq, kdc_udp_call_sendto_done, call);
+}
+
+static void kdc_udp_call_sendto_done(struct tevent_req *subreq)
+{
+        struct kdc_udp_call *call = tevent_req_callback_data(subreq,
+                                       struct kdc_udp_call);
+        ssize_t ret;
+        int sys_errno;
+
+        ret = tdgram_sendto_queue_recv(subreq, &sys_errno);
+
+        /* We don't care about errors */
+
+        talloc_free(call);
+}
 
 /*
   start listening on the given address
 */
-static NTSTATUS kdc_add_socket(struct kdc_server *kdc, const char *address,
-                               uint16_t kdc_port, uint16_t kpasswd_port)
-{
-        const struct model_ops *model_ops;
-        struct kdc_socket *kdc_socket;
-        struct kdc_socket *kpasswd_socket;
-        struct socket_address *kdc_address, *kpasswd_address;
+static NTSTATUS kdc_add_socket(struct kdc_server *kdc,
+                               const struct model_ops *model_ops,
+                               const char *name,
+                               const char *address,
+                               uint16_t port,
+                               kdc_process_fn_t process,
+                               bool udp_only)
+{
+        struct kdc_socket *kdc_socket;
+        struct kdc_udp_socket *kdc_udp_socket;
+        struct tevent_req *udpsubreq;
         NTSTATUS status;
+        int ret;
 
         kdc_socket = talloc(kdc, struct kdc_socket);
         NT_STATUS_HAVE_NO_MEMORY(kdc_socket);
 
-        kpasswd_socket = talloc(kdc, struct kdc_socket);
-        NT_STATUS_HAVE_NO_MEMORY(kpasswd_socket);
-
-        status = socket_create("ip", SOCKET_TYPE_DGRAM, &kdc_socket->sock, 0);
-        if (!NT_STATUS_IS_OK(status)) {
-                talloc_free(kdc_socket);
+        kdc_socket->kdc = kdc;
+        kdc_socket->process = process;
+
+        ret = tsocket_address_inet_from_strings(kdc_socket, "ip",
+                                                address, port,
+                                                &kdc_socket->local_address);
+        if (ret != 0) {
+                status = map_nt_error_from_unix(errno);
                 return status;
         }
 
-        status = socket_create("ip", SOCKET_TYPE_DGRAM, &kpasswd_socket->sock, 0);
-        if (!NT_STATUS_IS_OK(status)) {
-                talloc_free(kpasswd_socket);
+        if (!udp_only) {
+                status = stream_setup_socket(kdc->task,
+                                             kdc->task->event_ctx,
+                                             kdc->task->lp_ctx,
+                                             model_ops,
+                                             &kdc_tcp_stream_ops,
+                                             "ip", address, &port,
+                                             lpcfg_socket_options(kdc->task->lp_ctx),
+                                             kdc_socket);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0,("Failed to bind to %s:%u TCP - %s\n",
+                                 address, port, nt_errstr(status)));
+                        talloc_free(kdc_socket);
+                        return status;
+                }
+        }
+
+        kdc_udp_socket = talloc(kdc_socket, struct kdc_udp_socket);
+        NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket);
+
+        kdc_udp_socket->kdc_socket = kdc_socket;
+
+        ret = tdgram_inet_udp_socket(kdc_socket->local_address,
+                                     NULL,
+                                     kdc_udp_socket,
+                                     &kdc_udp_socket->dgram);
+        if (ret != 0) {
+                status = map_nt_error_from_unix(errno);
+                DEBUG(0,("Failed to bind to %s:%u UDP - %s\n",
+                         address, port, nt_errstr(status)));
                 return status;
         }
 
-        kdc_socket->kdc = kdc;
-        kdc_socket->send_queue = NULL;
-        kdc_socket->process = kdc_process;
-
-        talloc_steal(kdc_socket, kdc_socket->sock);
-
-        kdc_socket->fde = event_add_fd(kdc->task->event_ctx, kdc, 
-                                       socket_get_fd(kdc_socket->sock), EVENT_FD_READ,
-                                       kdc_socket_handler, kdc_socket);
-
-        kdc_address = socket_address_from_strings(kdc_socket, kdc_socket->sock->backend_name, 
-                                                  address, kdc_port);
-        NT_STATUS_HAVE_NO_MEMORY(kdc_address);
-
-        status = socket_listen(kdc_socket->sock, kdc_address, 0, 0);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("Failed to bind to %s:%d UDP for kdc - %s\n", 
-                         address, kdc_port, nt_errstr(status)));
-                talloc_free(kdc_socket);
-                return status;
-        }
-
-        kpasswd_socket->kdc = kdc;
-        kpasswd_socket->send_queue = NULL;
-        kpasswd_socket->process = kpasswdd_process;
-
-        talloc_steal(kpasswd_socket, kpasswd_socket->sock);
-
-        kpasswd_socket->fde = event_add_fd(kdc->task->event_ctx, kdc, 
-                                           socket_get_fd(kpasswd_socket->sock), EVENT_FD_READ,
-                                           kdc_socket_handler, kpasswd_socket);
-        
-        kpasswd_address = socket_address_from_strings(kpasswd_socket, kpasswd_socket->sock->backend_name, 
-                                                      address, kpasswd_port);
-        NT_STATUS_HAVE_NO_MEMORY(kpasswd_address);
-
-        status = socket_listen(kpasswd_socket->sock, kpasswd_address, 0, 0);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("Failed to bind to %s:%d UDP for kpasswd - %s\n", 
-                         address, kpasswd_port, nt_errstr(status)));
-                talloc_free(kpasswd_socket);
-                return status;
-        }
-
-        /* within the kdc task we want to be a single process, so
-           ask for the single process model ops and pass these to the
-           stream_setup_socket() call. */
-        model_ops = process_model_startup(kdc->task->event_ctx, "single");
-        if (!model_ops) {
-                DEBUG(0,("Can't find 'single' process model_ops\n"));
-                talloc_free(kdc_socket);
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        status = stream_setup_socket(kdc->task->event_ctx, 
-                                     kdc->task->lp_ctx,
-                                     model_ops, 
-                                     &kdc_tcp_stream_ops, 
-                                     "ip", address, &kdc_port, 
-                                     lp_socket_options(kdc->task->lp_ctx), 
-                                     kdc);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("Failed to bind to %s:%u TCP - %s\n",
-                         address, kdc_port, nt_errstr(status)));
-                talloc_free(kdc_socket);
-                return status;
-        }
-
-        status = stream_setup_socket(kdc->task->event_ctx, 
-                                     kdc->task->lp_ctx,
-                                     model_ops, 
-                                     &kpasswdd_tcp_stream_ops, 
-                                     "ip", address, &kpasswd_port, 
-                                     lp_socket_options(kdc->task->lp_ctx), 
-                                     kdc);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("Failed to bind to %s:%u TCP - %s\n",
-                         address, kpasswd_port, nt_errstr(status)));
-                talloc_free(kdc_socket);
-                return status;
-        }
+        kdc_udp_socket->send_queue = tevent_queue_create(kdc_udp_socket,
+                                                         "kdc_udp_send_queue");
+        NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket->send_queue);
+
+        udpsubreq = tdgram_recvfrom_send(kdc_udp_socket,
+                                         kdc->task->event_ctx,
+                                         kdc_udp_socket->dgram);
+        NT_STATUS_HAVE_NO_MEMORY(udpsubreq);
+        tevent_req_set_callback(udpsubreq, kdc_udp_call_loop, kdc_udp_socket);
 
         return NT_STATUS_OK;
@@ -532 +710 @@
                                        struct interface *ifaces)
 {
+        const struct model_ops *model_ops;
         int num_interfaces;
         TALLOC_CTX *tmp_ctx = talloc_new(kdc);
         NTSTATUS status;
         int i;
+        uint16_t kdc_port = lpcfg_krb5_port(lp_ctx);
+        uint16_t kpasswd_port = lpcfg_kpasswd_port(lp_ctx);
+        bool done_wildcard = false;
+
+        /* within the kdc task we want to be a single process, so
+           ask for the single process model ops and pass these to the
+           stream_setup_socket() call. */
+        model_ops = process_model_startup("single");
+        if (!model_ops) {
+                DEBUG(0,("Can't find 'single' process model_ops\n"));
+                return NT_STATUS_INTERNAL_ERROR;
+        }
 
         num_interfaces = iface_count(ifaces);
-        
+
+        /* if we are allowing incoming packets from any address, then
+           we need to bind to the wildcard address */
+        if (!lpcfg_bind_interfaces_only(lp_ctx)) {
+                if (kdc_port) {
+                        status = kdc_add_socket(kdc, model_ops,
+                                                "kdc", "0.0.0.0", kdc_port,
+                                                kdc_process, false);
+                        NT_STATUS_NOT_OK_RETURN(status);
+                }
+
+                if (kpasswd_port) {
+                        status = kdc_add_socket(kdc, model_ops,
+                                                "kpasswd", "0.0.0.0", kpasswd_port,
+                                                kpasswdd_process, false);
+                        NT_STATUS_NOT_OK_RETURN(status);
+                }
+                done_wildcard = true;
+        }
+
         for (i=0; i<num_interfaces; i++) {
                 const char *address = talloc_strdup(tmp_ctx, iface_n_ip(ifaces, i));
-                status = kdc_add_socket(kdc, address, lp_krb5_port(lp_ctx), 
-                                        lp_kpasswd_port(lp_ctx));
-                NT_STATUS_NOT_OK_RETURN(status);
+
+                if (kdc_port) {
+                        status = kdc_add_socket(kdc, model_ops,
+                                                "kdc", address, kdc_port,
+                                                kdc_process, done_wildcard);
+                        NT_STATUS_NOT_OK_RETURN(status);
+                }
+
+                if (kpasswd_port) {
+                        status = kdc_add_socket(kdc, model_ops,
+                                                "kpasswd", address, kpasswd_port,
+                                                kpasswdd_process, done_wildcard);
+                        NT_STATUS_NOT_OK_RETURN(status);
+                }
         }
 
@@ -552 +773 @@
 
 
-static NTSTATUS kdc_check_generic_kerberos(struct irpc_message *msg, 
+static NTSTATUS kdc_check_generic_kerberos(struct irpc_message *msg,
                                  struct kdc_check_generic_kerberos *r)
 {
@@ -570 +791 @@
         r->out.generic_reply = data_blob(NULL, 0);
 
-        ndr_err = ndr_pull_struct_blob(&r->in.generic_request, msg, 
-                                       lp_iconv_convenience(kdc->task->lp_ctx), 
-                                       &pac_validate,
+        ndr_err = ndr_pull_struct_blob(&r->in.generic_request, msg, &pac_validate,
                                        (ndr_pull_flags_fn_t)ndr_pull_PAC_Validate);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 return NT_STATUS_INVALID_PARAMETER;
         }
-        
+
         if (pac_validate.MessageType != 3) {
                 /* We don't implement any other message types - such as certificate validation - yet */
@@ -588 +807 @@
                 return NT_STATUS_INVALID_PARAMETER;
         }
-        
-        srv_sig = data_blob_const(pac_validate.ChecksumAndSignature.data, 
+
+        srv_sig = data_blob_const(pac_validate.ChecksumAndSignature.data,
                                   pac_validate.ChecksumLength);
-        
+
         if (pac_validate.SignatureType == CKSUMTYPE_HMAC_MD5) {
                 etype = ETYPE_ARCFOUR_HMAC_MD5;
@@ -602 +821 @@
         }
 
-        ret = krb5_make_principal(kdc->smb_krb5_context->krb5_context, &principal, 
-                                  lp_realm(kdc->task->lp_ctx), 
-                                  "krbtgt", lp_realm(kdc->task->lp_ctx), 
+        ret = krb5_make_principal(kdc->smb_krb5_context->krb5_context, &principal,
+                                  lpcfg_realm(kdc->task->lp_ctx),
+                                  "krbtgt", lpcfg_realm(kdc->task->lp_ctx),
                                   NULL);
 
@@ -611 +830 @@
         }
 
-        ret = kdc->config->db[0]->hdb_fetch(kdc->smb_krb5_context->krb5_context, 
-                                            kdc->config->db[0],
-                                            principal,
-                                            HDB_F_GET_KRBTGT | HDB_F_DECRYPT,
-                                            &ent);
-
+        ret = kdc->config->db[0]->hdb_fetch_kvno(kdc->smb_krb5_context->krb5_context,
+                                                 kdc->config->db[0],
+                                                 principal,
+                                                 HDB_F_GET_KRBTGT | HDB_F_DECRYPT,
+                                                 0,
+                                                 &ent);
+        
         if (ret != 0) {
                 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
                 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
-        
+
                 return NT_STATUS_LOGON_FAILURE;
         }
-        
+
         ret = hdb_enctype2key(kdc->smb_krb5_context->krb5_context, &ent.entry, etype, &key);
 
@@ -633 +853 @@
 
         keyblock = key->key;
-        
+
         kdc_sig.type = pac_validate.SignatureType;
         kdc_sig.signature = data_blob_const(&pac_validate.ChecksumAndSignature.data[pac_validate.ChecksumLength],
                                             pac_validate.SignatureLength);
-        ret = check_pac_checksum(msg, srv_sig, &kdc_sig, 
+        ret = check_pac_checksum(msg, srv_sig, &kdc_sig,
                            kdc->smb_krb5_context->krb5_context, &keyblock);
 
@@ -646 +866 @@
                 return NT_STATUS_LOGON_FAILURE;
         }
-        
+
         return NT_STATUS_OK;
 }
@@ -660 +880 @@
         krb5_error_code ret;
         struct interface *ifaces;
-
-        switch (lp_server_role(task->lp_ctx)) {
+        int ldb_ret;
+
+        switch (lpcfg_server_role(task->lp_ctx)) {
         case ROLE_STANDALONE:
                 task_server_terminate(task, "kdc: no KDC required in standalone configuration", false);
@@ -673 +894 @@
         }
 
-        load_interfaces(task, lp_interfaces(task->lp_ctx), &ifaces);
+        load_interfaces(task, lpcfg_interfaces(task->lp_ctx), &ifaces);
 
         if (iface_count(ifaces) == 0) {
@@ -682 +903 @@
         task_server_set_title(task, "task[kdc]");
 
-        kdc = talloc(task, struct kdc_server);
+        kdc = talloc_zero(task, struct kdc_server);
         if (kdc == NULL) {
                 task_server_terminate(task, "kdc: out of memory", true);
@@ -690 +911 @@
         kdc->task = task;
 
+
+        /* get a samdb connection */
+        kdc->samdb = samdb_connect(kdc, kdc->task->event_ctx, kdc->task->lp_ctx,
+                                   system_session(kdc->task->lp_ctx), 0);
+        if (!kdc->samdb) {
+                DEBUG(1,("kdc_task_init: unable to connect to samdb\n"));
+                task_server_terminate(task, "kdc: krb5_init_context samdb connect failed", true);
+                return;
+        }
+
+        ldb_ret = samdb_rodc(kdc->samdb, &kdc->am_rodc);
+        if (ldb_ret != LDB_SUCCESS) {
+                DEBUG(1, ("kdc_task_init: Cannot determine if we are an RODC: %s\n",
+                          ldb_errstring(kdc->samdb)));
+                task_server_terminate(task, "kdc: krb5_init_context samdb RODC connect failed", true);
+                return;
+        }
+
+        kdc->proxy_timeout = lpcfg_parm_int(kdc->task->lp_ctx, NULL, "kdc", "proxy timeout", 5);
+
         initialize_krb5_error_table();
 
         ret = smb_krb5_init_context(kdc, task->event_ctx, task->lp_ctx, &kdc->smb_krb5_context);
         if (ret) {
-                DEBUG(1,("kdc_task_init: krb5_init_context failed (%s)\n", 
+                DEBUG(1,("kdc_task_init: krb5_init_context failed (%s)\n",
                          error_message(ret)));
                 task_server_terminate(task, "kdc: krb5_init_context failed", true);
-                return; 
+                return;
         }
 
         krb5_add_et_list(kdc->smb_krb5_context->krb5_context, initialize_hdb_error_table_r);
 
-        ret = krb5_kdc_get_config(kdc->smb_krb5_context->krb5_context, 
+        ret = krb5_kdc_get_config(kdc->smb_krb5_context->krb5_context,
                                   &kdc->config);
         if(ret) {
@@ -708 +949 @@
                 return;
         }
- 
+
         kdc->config->logf = kdc->smb_krb5_context->logf;
         kdc->config->db = talloc(kdc, struct HDB *);
@@ -716 +957 @@
         }
         kdc->config->num_db = 1;
-                
-        status = hdb_samba4_create_kdc(kdc, task->event_ctx, task->lp_ctx, 
-                                       kdc->smb_krb5_context->krb5_context, 
+
+        /* Register hdb-samba4 hooks for use as a keytab */
+
+        kdc->base_ctx = talloc_zero(kdc, struct samba_kdc_base_context);
+        if (!kdc->base_ctx) {
+                task_server_terminate(task, "kdc: out of memory", true);
+                return;
+        }
+
+        kdc->base_ctx->ev_ctx = task->event_ctx;
+        kdc->base_ctx->lp_ctx = task->lp_ctx;
+
+        status = hdb_samba4_create_kdc(kdc->base_ctx,
+                                       kdc->smb_krb5_context->krb5_context,
                                        &kdc->config->db[0]);
         if (!NT_STATUS_IS_OK(status)) {
                 task_server_terminate(task, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
-                return; 
-        }
-
-        /* Register hdb-samba4 hooks for use as a keytab */
-
-        kdc->hdb_samba4_context = talloc(kdc, struct hdb_samba4_context);
-        if (!kdc->hdb_samba4_context) {
-                task_server_terminate(task, "kdc: out of memory", true);
-                return; 
-        }
-
-        kdc->hdb_samba4_context->ev_ctx = task->event_ctx;
-        kdc->hdb_samba4_context->lp_ctx = task->lp_ctx;
-
-        ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context, 
+                return;
+        }
+
+        ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context,
                                    PLUGIN_TYPE_DATA, "hdb",
                                    &hdb_samba4);
         if(ret) {
-                task_server_terminate(task, "kdc: failed to register hdb keytab", true);
+                task_server_terminate(task, "kdc: failed to register hdb plugin", true);
                 return;
         }
@@ -746 +987 @@
         ret = krb5_kt_register(kdc->smb_krb5_context->krb5_context, &hdb_kt_ops);
         if(ret) {
-                task_server_terminate(task, "kdc: failed to register hdb keytab", true);
-                return;
-        }
-
-        /* Registar WinDC hooks */
-        ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context, 
+                task_server_terminate(task, "kdc: failed to register keytab plugin", true);
+                return;
+        }
+
+        /* Register WinDC hooks */
+        ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context,
                                    PLUGIN_TYPE_DATA, "windc",
                                    &windc_plugin_table);
         if(ret) {
-                task_server_terminate(task, "kdc: failed to register hdb keytab", true);
-                return;
-        }
-
-        krb5_kdc_windc_init(kdc->smb_krb5_context->krb5_context);
+                task_server_terminate(task, "kdc: failed to register windc plugin", true);
+                return;
+        }
+
+        ret = krb5_kdc_windc_init(kdc->smb_krb5_context->krb5_context);
+
+        if(ret) {
+                task_server_terminate(task, "kdc: failed to init windc plugin", true);
+                return;
+        }
+
+        ret = krb5_kdc_pkinit_config(kdc->smb_krb5_context->krb5_context, kdc->config);
+
+        if(ret) {
+                task_server_terminate(task, "kdc: failed to init kdc pkinit subsystem", true);
+                return;
+        }
 
         /* start listening on the configured network interfaces */
@@ -768 +1021 @@
         }
 
-        status = IRPC_REGISTER(task->msg_ctx, irpc, KDC_CHECK_GENERIC_KERBEROS, 
+        status = IRPC_REGISTER(task->msg_ctx, irpc, KDC_CHECK_GENERIC_KERBEROS,
                                kdc_check_generic_kerberos, kdc);
         if (!NT_STATUS_IS_OK(status)) {
-                task_server_terminate(task, "nbtd failed to setup monitoring", true);
+                task_server_terminate(task, "kdc failed to setup monitoring", true);
                 return;
         }

vendor/current/source4/kdc/kpasswdd.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -11 +11 @@
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -23 +23 @@
 #include "includes.h"
 #include "smbd/service_task.h"
-#include "lib/events/events.h"
-#include "lib/socket/socket.h"
-#include "system/network.h"
-#include "../lib/util/dlinklist.h"
-#include "lib/ldb/include/ldb.h"
 #include "auth/gensec/gensec.h"
 #include "auth/credentials/credentials.h"
-#include "auth/credentials/credentials_krb5.h"
 #include "auth/auth.h"
 #include "dsdb/samdb/samdb.h"
-#include "rpc_server/dcerpc_server.h"
-#include "rpc_server/samr/proto.h"
+#include "../lib/util/util_ldb.h"
 #include "libcli/security/security.h"
 #include "param/param.h"
-#include "kdc/kdc.h"
-
-/* TODO: remove all SAMBA4_INTERNAL_HEIMDAL stuff from this file */
-#ifdef SAMBA4_INTERNAL_HEIMDAL
-#include "heimdal_build/kpasswdd-glue.h"
-#endif
-
-/* hold information about one kdc socket */
-struct kpasswd_socket {
-        struct socket_context *sock;
-        struct kdc_server *kdc;
-        struct tevent_fd *fde;
-
-        /* a queue of outgoing replies that have been deferred */
-        struct kdc_reply *send_queue;
-};
+#include "kdc/kdc-glue.h"
 
 /* Return true if there is a valid error packet formed in the error_blob */
-static bool kpasswdd_make_error_reply(struct kdc_server *kdc, 
-                                     TALLOC_CTX *mem_ctx, 
-                                     uint16_t result_code, 
-                                     const char *error_string, 
-                                     DATA_BLOB *error_blob) 
+static bool kpasswdd_make_error_reply(struct kdc_server *kdc,
+                                     TALLOC_CTX *mem_ctx,
+                                     uint16_t result_code,
+                                     const char *error_string,
+                                     DATA_BLOB *error_blob)
 {
         char *error_string_utf8;
         size_t len;
-        
+
         DEBUG(result_code ? 3 : 10, ("kpasswdd: %s\n", error_string));
 
@@ -80 +58 @@
 
 /* Return true if there is a valid error packet formed in the error_blob */
-static bool kpasswdd_make_unauth_error_reply(struct kdc_server *kdc, 
-                                            TALLOC_CTX *mem_ctx, 
-                                            uint16_t result_code, 
-                                            const char *error_string, 
-                                            DATA_BLOB *error_blob) 
+static bool kpasswdd_make_unauth_error_reply(struct kdc_server *kdc,
+                                            TALLOC_CTX *mem_ctx,
+                                            uint16_t result_code,
+                                            const char *error_string,
+                                            DATA_BLOB *error_blob)
 {
         bool ret;
@@ -90 +68 @@
         DATA_BLOB error_bytes;
         krb5_data k5_error_bytes, k5_error_blob;
-        ret = kpasswdd_make_error_reply(kdc, mem_ctx, result_code, error_string, 
+        ret = kpasswdd_make_error_reply(kdc, mem_ctx, result_code, error_string,
                                        &error_bytes);
         if (!ret) {
@@ -98 +76 @@
         k5_error_bytes.length = error_bytes.length;
         kret = krb5_mk_error(kdc->smb_krb5_context->krb5_context,
-                             result_code, NULL, &k5_error_bytes, 
+                             result_code, NULL, &k5_error_bytes,
                              NULL, NULL, NULL, NULL, &k5_error_blob);
         if (kret) {
@@ -111 +89 @@
 }
 
-static bool kpasswd_make_pwchange_reply(struct kdc_server *kdc, 
-                                        TALLOC_CTX *mem_ctx, 
-                                        NTSTATUS status, 
-                                        enum samr_RejectReason reject_reason,
+static bool kpasswd_make_pwchange_reply(struct kdc_server *kdc,
+                                        TALLOC_CTX *mem_ctx,
+                                        NTSTATUS status,
+                                        enum samPwdChangeReason reject_reason,
                                         struct samr_DomInfo1 *dominfo,
-                                        DATA_BLOB *error_blob) 
+                                        DATA_BLOB *error_blob)
 {
         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
-                return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                 KRB5_KPASSWD_ACCESSDENIED,
                                                 "No such user when changing password",
@@ -125 +103 @@
         }
         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
-                return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                 KRB5_KPASSWD_ACCESSDENIED,
                                                 "Not permitted to change password",
@@ -133 +111 @@
                 const char *reject_string;
                 switch (reject_reason) {
-                case SAMR_REJECT_TOO_SHORT:
+                case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT:
                         reject_string = talloc_asprintf(mem_ctx, "Password too short, password must be at least %d characters long",
                                                         dominfo->min_password_length);
                         break;
-                case SAMR_REJECT_COMPLEXITY:
+                case SAM_PWD_CHANGE_NOT_COMPLEX:
                         reject_string = "Password does not meet complexity requirements";
                         break;
-                case SAMR_REJECT_IN_HISTORY:
+                case SAM_PWD_CHANGE_PWD_IN_HISTORY:
                         reject_string = "Password is already in password history";
                         break;
-                case SAMR_REJECT_OTHER:
                 default:
                         reject_string = talloc_asprintf(mem_ctx, "Password must be at least %d characters long, and cannot match any of your %d previous passwords",
@@ -149 +126 @@
                         break;
                 }
-                return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                 KRB5_KPASSWD_SOFTERROR,
                                                 reject_string,
@@ -155 +132 @@
         }
         if (!NT_STATUS_IS_OK(status)) {
-                return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                  KRB5_KPASSWD_HARDERROR,
                                                  talloc_asprintf(mem_ctx, "failed to set password: %s", nt_errstr(status)),
                                                  error_blob);
-                
+
         }
         return kpasswdd_make_error_reply(kdc, mem_ctx, KRB5_KPASSWD_SUCCESS,
@@ -166 +143 @@
 }
 
-/* 
+/*
    A user password change
-   
-   Return true if there is a valid error packet (or sucess) formed in
+
+   Return true if there is a valid error packet (or success) formed in
    the error_blob
 */
 static bool kpasswdd_change_password(struct kdc_server *kdc,
-                                     TALLOC_CTX *mem_ctx, 
+                                     TALLOC_CTX *mem_ctx,
                                      struct auth_session_info *session_info,
                                      const DATA_BLOB *password,
@@ -179 +156 @@
 {
         NTSTATUS status;
-        enum samr_RejectReason reject_reason;
+        enum samPwdChangeReason reject_reason;
         struct samr_DomInfo1 *dominfo;
+        struct samr_Password *oldLmHash, *oldNtHash;
         struct ldb_context *samdb;
-
-        samdb = samdb_connect(mem_ctx, kdc->task->event_ctx, kdc->task->lp_ctx, system_session(mem_ctx, kdc->task->lp_ctx));
+        const char * const attrs[] = { "dBCSPwd", "unicodePwd", NULL };
+        struct ldb_message **res;
+        int ret;
+
+        /* Fetch the old hashes to get the old password in order to perform
+         * the password change operation. Naturally it would be much better to
+         * have a password hash from an authentication around but this doesn't
+         * seem to be the case here. */
+        ret = gendb_search(kdc->samdb, mem_ctx, NULL, &res, attrs,
+                           "(&(objectClass=user)(sAMAccountName=%s))",
+                           session_info->info->account_name);
+        if (ret != 1) {
+                return kpasswdd_make_error_reply(kdc, mem_ctx,
+                                                KRB5_KPASSWD_ACCESSDENIED,
+                                                "No such user when changing password",
+                                                reply);
+        }
+
+        status = samdb_result_passwords(mem_ctx, kdc->task->lp_ctx, res[0],
+                                        &oldLmHash, &oldNtHash);
+        if (!NT_STATUS_IS_OK(status)) {
+                return kpasswdd_make_error_reply(kdc, mem_ctx,
+                                                KRB5_KPASSWD_ACCESSDENIED,
+                                                "Not permitted to change password",
+                                                reply);
+        }
+
+        /* Start a SAM with user privileges for the password change */
+        samdb = samdb_connect(mem_ctx, kdc->task->event_ctx, kdc->task->lp_ctx,
+                              session_info, 0);
         if (!samdb) {
-                return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                 KRB5_KPASSWD_HARDERROR,
                                                 "Failed to open samdb",
                                                 reply);
         }
-        
-        DEBUG(3, ("Changing password of %s\\%s (%s)\n", 
-                  session_info->server_info->domain_name,
-                  session_info->server_info->account_name,
-                  dom_sid_string(mem_ctx, session_info->security_token->user_sid)));
-
-        /* User password change */
-        status = samdb_set_password_sid(samdb, mem_ctx, 
-                                        session_info->security_token->user_sid,
-                                        password, NULL, NULL, 
-                                        true, /* this is a user password change */
+
+        DEBUG(3, ("Changing password of %s\\%s (%s)\n",
+                  session_info->info->domain_name,
+                  session_info->info->account_name,
+                  dom_sid_string(mem_ctx, &session_info->security_token->sids[PRIMARY_USER_SID_INDEX])));
+
+        /* Performs the password change */
+        status = samdb_set_password_sid(samdb, mem_ctx,
+                                        &session_info->security_token->sids[PRIMARY_USER_SID_INDEX],
+                                        password, NULL, NULL,
+                                        oldLmHash, oldNtHash, /* this is a user password change */
                                         &reject_reason,
                                         &dominfo);
-        return kpasswd_make_pwchange_reply(kdc, mem_ctx, 
-                                           status, 
+        return kpasswd_make_pwchange_reply(kdc, mem_ctx,
+                                           status,
                                            reject_reason,
-                                           dominfo, 
+                                           dominfo,
                                            reply);
 
@@ -212 +218 @@
 
 static bool kpasswd_process_request(struct kdc_server *kdc,
-                                    TALLOC_CTX *mem_ctx, 
+                                    TALLOC_CTX *mem_ctx,
                                     struct gensec_security *gensec_security,
                                     uint16_t version,
-                                    DATA_BLOB *input, 
+                                    DATA_BLOB *input,
                                     DATA_BLOB *reply)
 {
@@ -221 +227 @@
         size_t pw_len;
 
-        if (!NT_STATUS_IS_OK(gensec_session_info(gensec_security, 
+        if (!NT_STATUS_IS_OK(gensec_session_info(gensec_security,
                                                  &session_info))) {
-                return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                 KRB5_KPASSWD_HARDERROR,
                                                 "gensec_session_info failed!",
@@ -233 +239 @@
         {
                 DATA_BLOB password;
-                if (!convert_string_talloc_convenience(mem_ctx, lp_iconv_convenience(kdc->task->lp_ctx), 
-                                               CH_UTF8, CH_UTF16, 
-                                               (const char *)input->data, 
+                if (!convert_string_talloc_convenience(mem_ctx, lpcfg_iconv_convenience(kdc->task->lp_ctx),
+                                               CH_UTF8, CH_UTF16,
+                                               (const char *)input->data,
                                                input->length,
                                                (void **)&password.data, &pw_len, false)) {
@@ -241 +247 @@
                 }
                 password.length = pw_len;
-        
-                return kpasswdd_change_password(kdc, mem_ctx, session_info, 
+
+                return kpasswdd_change_password(kdc, mem_ctx, session_info,
                                                 &password, reply);
-                break;
         }
         case KRB5_KPASSWD_VERS_SETPW:
         {
                 NTSTATUS status;
-                enum samr_RejectReason reject_reason = SAMR_REJECT_OTHER;
+                enum samPwdChangeReason reject_reason = SAM_PWD_CHANGE_NO_ERROR;
                 struct samr_DomInfo1 *dominfo = NULL;
                 struct ldb_context *samdb;
-                struct ldb_message *msg;
                 krb5_context context = kdc->smb_krb5_context->krb5_context;
 
@@ -261 +265 @@
                 char *set_password_on_princ;
                 struct ldb_dn *set_password_on_dn;
+                bool service_principal_name = false;
 
                 size_t len;
                 int ret;
-
-                msg = ldb_msg_new(mem_ctx);
-                if (!msg) {
-                        return false;
-                }
 
                 ret = decode_ChangePasswdDataMS(input->data, input->length,
                                                 &chpw, &len);
                 if (ret) {
-                        return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                        return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                         KRB5_KPASSWD_MALFORMED,
                                                         "failed to decode password change structure",
                                                         reply);
                 }
-                
-                if (!convert_string_talloc_convenience(mem_ctx, lp_iconv_convenience(kdc->task->lp_ctx), 
-                                               CH_UTF8, CH_UTF16, 
-                                               (const char *)chpw.newpasswd.data, 
+
+                if (!convert_string_talloc_convenience(mem_ctx, lpcfg_iconv_convenience(kdc->task->lp_ctx),
+                                               CH_UTF8, CH_UTF16,
+                                               (const char *)chpw.newpasswd.data,
                                                chpw.newpasswd.length,
                                                (void **)&password.data, &pw_len, false)) {
@@ -287 +287 @@
                         return false;
                 }
-                
+
                 password.length = pw_len;
-        
-                if ((chpw.targname && !chpw.targrealm) 
+
+                if ((chpw.targname && !chpw.targrealm)
                     || (!chpw.targname && chpw.targrealm)) {
-                        return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                        free_ChangePasswdDataMS(&chpw);
+                        return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                         KRB5_KPASSWD_MALFORMED,
                                                         "Realm and principal must be both present, or neither present",
@@ -298 +299 @@
                 }
                 if (chpw.targname && chpw.targrealm) {
-#ifdef SAMBA4_INTERNAL_HEIMDAL
-                        if (_krb5_principalname2krb5_principal(kdc->smb_krb5_context->krb5_context,
-                                                               &principal, *chpw.targname, 
-                                                               *chpw.targrealm) != 0) {
+                        ret = krb5_build_principal_ext(kdc->smb_krb5_context->krb5_context,
+                                                       &principal,
+                                                       strlen(*chpw.targrealm),
+                                                       *chpw.targrealm, 0);
+                        if (ret) {
                                 free_ChangePasswdDataMS(&chpw);
-                                return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                                return kpasswdd_make_error_reply(kdc, mem_ctx,
+                                                                KRB5_KPASSWD_MALFORMED,
+                                                                "failed to get principal",
+                                                                reply);
+                        }
+                        if (copy_PrincipalName(chpw.targname, &principal->name)) {
+                                free_ChangePasswdDataMS(&chpw);
+                                krb5_free_principal(context, principal);
+                                return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                                 KRB5_KPASSWD_MALFORMED,
                                                                 "failed to extract principal to set",
                                                                 reply);
-                                
                         }
-#else /* SAMBA4_INTERNAL_HEIMDAL */
-                                return kpasswdd_make_error_reply(kdc, mem_ctx,
-                                                                KRB5_KPASSWD_BAD_VERSION,
-                                                                "Operation Not Implemented",
-                                                                reply);
-#endif /* SAMBA4_INTERNAL_HEIMDAL */
                 } else {
                         free_ChangePasswdDataMS(&chpw);
-                        return kpasswdd_change_password(kdc, mem_ctx, session_info, 
+                        return kpasswdd_change_password(kdc, mem_ctx, session_info,
                                                         &password, reply);
                 }
                 free_ChangePasswdDataMS(&chpw);
 
-                if (krb5_unparse_name(context, principal, &set_password_on_princ) != 0) {
-                        krb5_free_principal(context, principal);
-                        return kpasswdd_make_error_reply(kdc, mem_ctx, 
-                                                        KRB5_KPASSWD_MALFORMED,
-                                                        "krb5_unparse_name failed!",
-                                                        reply);
-                }
-                
+                if (principal->name.name_string.len >= 2) {
+                        service_principal_name = true;
+
+                        /* We use this, rather than 'no realm' flag,
+                         * as we don't want to accept a password
+                         * change on a principal from another realm */
+
+                        if (krb5_unparse_name_short(context, principal, &set_password_on_princ) != 0) {
+                                krb5_free_principal(context, principal);
+                                return kpasswdd_make_error_reply(kdc, mem_ctx,
+                                                                 KRB5_KPASSWD_MALFORMED,
+                                                                 "krb5_unparse_name failed!",
+                                                                 reply);
+                        }
+                } else {
+                        if (krb5_unparse_name(context, principal, &set_password_on_princ) != 0) {
+                                krb5_free_principal(context, principal);
+                                return kpasswdd_make_error_reply(kdc, mem_ctx,
+                                                                 KRB5_KPASSWD_MALFORMED,
+                                                                 "krb5_unparse_name failed!",
+                                                                 reply);
+                        }
+                }
                 krb5_free_principal(context, principal);
-                
-                samdb = samdb_connect(mem_ctx, kdc->task->event_ctx, kdc->task->lp_ctx, session_info);
+
+                samdb = samdb_connect(mem_ctx, kdc->task->event_ctx, kdc->task->lp_ctx, session_info, 0);
                 if (!samdb) {
-                        return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                        free(set_password_on_princ);
+                        return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                          KRB5_KPASSWD_HARDERROR,
                                                          "Unable to open database!",
@@ -340 +359 @@
                 }
 
-                DEBUG(3, ("%s\\%s (%s) is changing password of %s\n", 
-                          session_info->server_info->domain_name,
-                          session_info->server_info->account_name,
-                          dom_sid_string(mem_ctx, session_info->security_token->user_sid), 
+                DEBUG(3, ("%s\\%s (%s) is changing password of %s\n",
+                          session_info->info->domain_name,
+                          session_info->info->account_name,
+                          dom_sid_string(mem_ctx, &session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
                           set_password_on_princ));
                 ret = ldb_transaction_start(samdb);
-                if (ret) {
+                if (ret != LDB_SUCCESS) {
+                        free(set_password_on_princ);
                         status = NT_STATUS_TRANSACTION_ABORTED;
-                        return kpasswd_make_pwchange_reply(kdc, mem_ctx, 
+                        return kpasswd_make_pwchange_reply(kdc, mem_ctx,
                                                            status,
-                                                           SAMR_REJECT_OTHER, 
-                                                           NULL, 
+                                                           SAM_PWD_CHANGE_NO_ERROR,
+                                                           NULL,
                                                            reply);
                 }
 
-                status = crack_user_principal_name(samdb, mem_ctx, 
-                                                   set_password_on_princ, 
-                                                   &set_password_on_dn, NULL);
+                if (service_principal_name) {
+                        status = crack_service_principal_name(samdb, mem_ctx,
+                                                              set_password_on_princ,
+                                                              &set_password_on_dn, NULL);
+                } else {
+                        status = crack_user_principal_name(samdb, mem_ctx,
+                                                           set_password_on_princ,
+                                                           &set_password_on_dn, NULL);
+                }
                 free(set_password_on_princ);
                 if (!NT_STATUS_IS_OK(status)) {
                         ldb_transaction_cancel(samdb);
-                        return kpasswd_make_pwchange_reply(kdc, mem_ctx, 
+                        return kpasswd_make_pwchange_reply(kdc, mem_ctx,
                                                            status,
-                                                           SAMR_REJECT_OTHER, 
-                                                           NULL, 
+                                                           SAM_PWD_CHANGE_NO_ERROR,
+                                                           NULL,
                                                            reply);
-                }
-
-                msg = ldb_msg_new(mem_ctx);
-                if (msg == NULL) {
-                        ldb_transaction_cancel(samdb);
-                        status = NT_STATUS_NO_MEMORY;
-                } else {
-                        msg->dn = ldb_dn_copy(msg, set_password_on_dn);
-                        if (!msg->dn) {
-                                status = NT_STATUS_NO_MEMORY;
-                        }
                 }
 
@@ -383 +398 @@
                         status = samdb_set_password(samdb, mem_ctx,
                                                     set_password_on_dn, NULL,
-                                                    msg, &password, NULL, NULL, 
-                                                    false, /* this is not a user password change */
+                                                    &password, NULL, NULL,
+                                                    NULL, NULL, /* this is not a user password change */
                                                     &reject_reason, &dominfo);
                 }
 
-                if (NT_STATUS_IS_OK(status)) {
-                        /* modify the samdb record */
-                        ret = samdb_replace(samdb, mem_ctx, msg);
-                        if (ret != 0) {
-                                DEBUG(2,("Failed to modify record to set password on %s: %s\n",
-                                         ldb_dn_get_linearized(msg->dn),
-                                         ldb_errstring(samdb)));
-                                status = NT_STATUS_ACCESS_DENIED;
-                        }
-                }
                 if (NT_STATUS_IS_OK(status)) {
                         ret = ldb_transaction_commit(samdb);
-                        if (ret != 0) {
+                        if (ret != LDB_SUCCESS) {
                                 DEBUG(1,("Failed to commit transaction to set password on %s: %s\n",
-                                         ldb_dn_get_linearized(msg->dn),
+                                         ldb_dn_get_linearized(set_password_on_dn),
                                          ldb_errstring(samdb)));
                                 status = NT_STATUS_TRANSACTION_ABORTED;
@@ -409 +414 @@
                         ldb_transaction_cancel(samdb);
                 }
-                return kpasswd_make_pwchange_reply(kdc, mem_ctx, 
+                return kpasswd_make_pwchange_reply(kdc, mem_ctx,
                                                    status,
-                                                   reject_reason, 
-                                                   dominfo, 
+                                                   reject_reason,
+                                                   dominfo,
                                                    reply);
         }
         default:
-                return kpasswdd_make_error_reply(kdc, mem_ctx, 
+                return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                  KRB5_KPASSWD_BAD_VERSION,
-                                                 talloc_asprintf(mem_ctx, 
-                                                                 "Protocol version %u not supported", 
+                                                 talloc_asprintf(mem_ctx,
+                                                                 "Protocol version %u not supported",
                                                                  version),
                                                  reply);
         }
-        return true;
 }
 
-bool kpasswdd_process(struct kdc_server *kdc,
-                      TALLOC_CTX *mem_ctx, 
-                      DATA_BLOB *input, 
-                      DATA_BLOB *reply,
-                      struct socket_address *peer_addr,
-                      struct socket_address *my_addr,
-                      int datagram_reply)
+enum kdc_process_ret kpasswdd_process(struct kdc_server *kdc,
+                                      TALLOC_CTX *mem_ctx,
+                                      DATA_BLOB *input,
+                                      DATA_BLOB *reply,
+                                      struct tsocket_address *peer_addr,
+                                      struct tsocket_address *my_addr,
+                                      int datagram_reply)
 {
         bool ret;
@@ -452 +456 @@
 
         if (!tmp_ctx) {
-                return false;
+                return KDC_PROCESS_FAILED;
+        }
+
+        if (kdc->am_rodc) {
+                talloc_free(tmp_ctx);
+                return KDC_PROCESS_PROXY;
         }
 
@@ -459 +468 @@
         if (input->length <= header_len) {
                 talloc_free(tmp_ctx);
-                return false;
+                return KDC_PROCESS_FAILED;
         }
 
@@ -465 +474 @@
         if (input->length != len) {
                 talloc_free(tmp_ctx);
-                return false;
+                return KDC_PROCESS_FAILED;
         }
 
@@ -475 +484 @@
         if ((ap_req_len >= len) || (ap_req_len + header_len) >= len) {
                 talloc_free(tmp_ctx);
-                return false;
-        }
-        
+                return KDC_PROCESS_FAILED;
+        }
+
         krb_priv_len = len - ap_req_len;
         ap_req = data_blob_const(&input->data[header_len], ap_req_len);
         krb_priv_req = data_blob_const(&input->data[header_len + ap_req_len], krb_priv_len);
-        
+
         server_credentials = cli_credentials_init(tmp_ctx);
         if (!server_credentials) {
                 DEBUG(1, ("Failed to init server credentials\n"));
-                return false;
+                talloc_free(tmp_ctx);
+                return KDC_PROCESS_FAILED;
         }
 
         /* We want the credentials subsystem to use the krb5 context
-         * we already have, rather than a new context */        
+         * we already have, rather than a new context */
         cli_credentials_set_krb5_context(server_credentials, kdc->smb_krb5_context);
         cli_credentials_set_conf(server_credentials, kdc->task->lp_ctx);
 
-        keytab_name = talloc_asprintf(server_credentials, "HDB:samba4&%p", kdc->hdb_samba4_context);
+        keytab_name = talloc_asprintf(server_credentials, "HDB:samba4&%p", kdc->base_ctx);
 
         cli_credentials_set_username(server_credentials, "kadmin/changepw", CRED_SPECIFIED);
-        ret = cli_credentials_set_keytab_name(server_credentials, kdc->task->event_ctx, kdc->task->lp_ctx, keytab_name, CRED_SPECIFIED);
+        ret = cli_credentials_set_keytab_name(server_credentials, kdc->task->lp_ctx, keytab_name, CRED_SPECIFIED);
         if (ret != 0) {
-                ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx, 
+                ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
                                                        KRB5_KPASSWD_HARDERROR,
-                                                       talloc_asprintf(mem_ctx, 
-                                                                       "Failed to obtain server credentials for kadmin/changepw: %s\n", 
-                                                                       nt_errstr(nt_status)),
+                                                       talloc_asprintf(mem_ctx,
+                                                                       "Failed to obtain server credentials for kadmin/changepw!"),
                                                        &krb_priv_rep);
                 ap_rep.length = 0;
@@ -511 +520 @@
                 return ret;
         }
-        
+
         /* We don't strictly need to call this wrapper, and could call
          * gensec_server_start directly, as we have no need for NTLM
          * and we have a PAC, but this ensures that the wrapper can be
          * safely extended for other helpful things in future */
-        nt_status = samba_server_gensec_start(tmp_ctx, kdc->task->event_ctx, 
+        nt_status = samba_server_gensec_start(tmp_ctx, kdc->task->event_ctx,
                                               kdc->task->msg_ctx,
                                               kdc->task->lp_ctx,
                                               server_credentials,
-                                              "kpasswd", 
+                                              "kpasswd",
                                               &gensec_security);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
-                return false;
+                return KDC_PROCESS_FAILED;
         }
 
@@ -535 +544 @@
          * complex code */
 
-        nt_status = gensec_set_peer_addr(gensec_security, peer_addr);
+        nt_status = gensec_set_local_address(gensec_security, peer_addr);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
-                return false;
+                return KDC_PROCESS_FAILED;
         }
 #endif
 
-        nt_status = gensec_set_my_addr(gensec_security, my_addr);
+        nt_status = gensec_set_local_address(gensec_security, my_addr);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
-                return false;
+                return KDC_PROCESS_FAILED;
         }
 
@@ -554 +563 @@
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
-                return false;
+                return KDC_PROCESS_FAILED;
         }
 
@@ -560 +569 @@
         nt_status = gensec_update(gensec_security, tmp_ctx, ap_req, &ap_rep);
         if (!NT_STATUS_IS_OK(nt_status) && !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-                
-                ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx, 
+
+                ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
                                                        KRB5_KPASSWD_HARDERROR,
-                                                       talloc_asprintf(mem_ctx, 
-                                                                       "gensec_update failed: %s", 
+                                                       talloc_asprintf(mem_ctx,
+                                                                       "gensec_update failed: %s",
                                                                        nt_errstr(nt_status)),
                                                        &krb_priv_rep);
@@ -572 +581 @@
                 }
                 talloc_free(tmp_ctx);
-                return ret;
+                return KDC_PROCESS_FAILED;
         }
 
@@ -578 +587 @@
         nt_status = gensec_unwrap(gensec_security, tmp_ctx, &krb_priv_req, &kpasswd_req);
         if (!NT_STATUS_IS_OK(nt_status)) {
-                ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx, 
+                ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
                                                        KRB5_KPASSWD_HARDERROR,
-                                                       talloc_asprintf(mem_ctx, 
-                                                                       "gensec_unwrap failed: %s", 
+                                                       talloc_asprintf(mem_ctx,
+                                                                       "gensec_unwrap failed: %s",
                                                                        nt_errstr(nt_status)),
                                                        &krb_priv_rep);
@@ -589 +598 @@
                 }
                 talloc_free(tmp_ctx);
-                return ret;
+                return KDC_PROCESS_FAILED;
         }
 
         /* Figure out something to do with it (probably changing a password...) */
-        ret = kpasswd_process_request(kdc, tmp_ctx, 
-                                      gensec_security, 
-                                      version, 
-                                      &kpasswd_req, &kpasswd_rep); 
+        ret = kpasswd_process_request(kdc, tmp_ctx,
+                                      gensec_security,
+                                      version,
+                                      &kpasswd_req, &kpasswd_rep);
         if (!ret) {
                 /* Argh! */
-                return false;
+                talloc_free(tmp_ctx);
+                return KDC_PROCESS_FAILED;
         }
 
         /* And wrap up the reply: This ensures that the error message
          * or success can be verified by the client */
-        nt_status = gensec_wrap(gensec_security, tmp_ctx, 
+        nt_status = gensec_wrap(gensec_security, tmp_ctx,
                                 &kpasswd_rep, &krb_priv_rep);
         if (!NT_STATUS_IS_OK(nt_status)) {
-                ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx, 
+                ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
                                                        KRB5_KPASSWD_HARDERROR,
-                                                       talloc_asprintf(mem_ctx, 
-                                                                       "gensec_wrap failed: %s", 
+                                                       talloc_asprintf(mem_ctx,
+                                                                       "gensec_wrap failed: %s",
                                                                        nt_errstr(nt_status)),
                                                        &krb_priv_rep);
@@ -618 +628 @@
                 }
                 talloc_free(tmp_ctx);
-                return ret;
-        }
-        
+                return KDC_PROCESS_FAILED;
+        }
+
 reply:
         *reply = data_blob_talloc(mem_ctx, NULL, krb_priv_rep.length + ap_rep.length + header_len);
         if (!reply->data) {
-                return false;
+                talloc_free(tmp_ctx);
+                return KDC_PROCESS_FAILED;
         }
 
@@ -630 +641 @@
         RSSVAL(reply->data, 2, 1); /* This is a version 1 reply, MS change/set or otherwise */
         RSSVAL(reply->data, 4, ap_rep.length);
-        memcpy(reply->data + header_len, 
-               ap_rep.data, 
+        memcpy(reply->data + header_len,
+               ap_rep.data,
                ap_rep.length);
-        memcpy(reply->data + header_len + ap_rep.length, 
-               krb_priv_rep.data, 
+        memcpy(reply->data + header_len + ap_rep.length,
+               krb_priv_rep.data,
                krb_priv_rep.length);
 
         talloc_free(tmp_ctx);
-        return ret;
+        return KDC_PROCESS_OK;
 }
 

vendor/current/source4/kdc/pac-glue.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
    PAC Glue between Samba and the KDC
-   
+
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
+   Copyright (C) Simo Sorce <idra@samba.org> 2010
 
    This program is free software; you can redistribute it and/or modify
@@ -10 +11 @@
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -16 +17 @@
    GNU General Public License for more details.
 
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -23 +24 @@
 #include "includes.h"
 #include "../libds/common/flags.h"
-#include "lib/ldb/include/ldb.h"
+#include <ldb.h>
+#include "auth/auth.h"
+#include "auth/auth_sam_reply.h"
+#include "kdc/kdc-glue.h"
+#include "param/param.h"
 #include "librpc/gen_ndr/ndr_krb5pac.h"
-#include "librpc/gen_ndr/krb5pac.h"
-#include "auth/auth.h"
-#include "auth/auth_sam.h"
-#include "auth/auth_sam_reply.h"
-#include "kdc/kdc.h"
-#include "param/param.h"
-
-struct krb5_dh_moduli;
-struct _krb5_krb_auth_data;
-
-static krb5_error_code  samba_kdc_plugin_init(krb5_context context, void **ptr) 
-{
-        *ptr = NULL;
-        return 0;
-}
-
-static void     samba_kdc_plugin_fini(void *ptr) 
-{
-        return;
-}
-
-static krb5_error_code make_pac(krb5_context context,
-                                TALLOC_CTX *mem_ctx, 
-                                struct smb_iconv_convenience *iconv_convenience,
-                                struct auth_serversupplied_info *server_info,
-                                krb5_pac *pac) 
-{
-        union PAC_INFO info;
+
+static
+NTSTATUS samba_get_logon_info_pac_blob(TALLOC_CTX *mem_ctx,
+                                       struct auth_user_info_dc *info,
+                                       DATA_BLOB *pac_data)
+{
         struct netr_SamInfo3 *info3;
-        krb5_data pac_data;
-        NTSTATUS nt_status;
+        union PAC_INFO pac_info;
         enum ndr_err_code ndr_err;
-        DATA_BLOB pac_out;
-        krb5_error_code ret;
-
-        ZERO_STRUCT(info);
-
-        nt_status = auth_convert_server_info_saminfo3(mem_ctx, server_info, &info3);
+        NTSTATUS nt_status;
+
+        ZERO_STRUCT(pac_info);
+
+        nt_status = auth_convert_user_info_dc_saminfo3(mem_ctx, info, &info3);
         if (!NT_STATUS_IS_OK(nt_status)) {
-                DEBUG(1, ("Getting Samba info failed: %s\n", nt_errstr(nt_status)));
-                return EINVAL;
-        }
-
-        info.logon_info.info = talloc_zero(mem_ctx, struct PAC_LOGON_INFO);
+                DEBUG(1, ("Getting Samba info failed: %s\n",
+                          nt_errstr(nt_status)));
+                return nt_status;
+        }
+
+        pac_info.logon_info.info = talloc_zero(mem_ctx, struct PAC_LOGON_INFO);
         if (!mem_ctx) {
-                return ENOMEM;
-        }
-
-        info.logon_info.info->info3 = *info3;
-
-        ndr_err = ndr_push_union_blob(&pac_out, mem_ctx, iconv_convenience, &info,
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        pac_info.logon_info.info->info3 = *info3;
+
+        ndr_err = ndr_push_union_blob(pac_data, mem_ctx, &pac_info,
                                       PAC_TYPE_LOGON_INFO,
                                       (ndr_push_flags_fn_t)ndr_push_PAC_INFO);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 nt_status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(1, ("PAC (presig) push failed: %s\n", nt_errstr(nt_status)));
-                return EINVAL;
-        }
-
-        ret = krb5_data_copy(&pac_data, pac_out.data, pac_out.length);
+                DEBUG(1, ("PAC (presig) push failed: %s\n",
+                          nt_errstr(nt_status)));
+                return nt_status;
+        }
+
+        return NT_STATUS_OK;
+}
+
+krb5_error_code samba_make_krb5_pac(krb5_context context,
+                                    DATA_BLOB *pac_blob,
+                                    krb5_pac *pac)
+{
+        krb5_data pac_data;
+        krb5_error_code ret;
+
+        /* The user account may be set not to want the PAC */
+        if (!pac_blob) {
+                return 0;
+        }
+
+        ret = krb5_data_copy(&pac_data, pac_blob->data, pac_blob->length);
         if (ret != 0) {
                 return ret;
@@ -104 +102 @@
 }
 
-/* Given the right private pointer from hdb_samba4, get a PAC from the attached ldb messages */
-static krb5_error_code samba_kdc_get_pac(void *priv,
-                                         krb5_context context, 
-                                         struct hdb_entry_ex *client,
-                                         krb5_pac *pac)
-{
-        krb5_error_code ret;
-        NTSTATUS nt_status;
-        struct auth_serversupplied_info *server_info;
-        struct hdb_samba4_private *p = talloc_get_type(client->ctx, struct hdb_samba4_private);
-        TALLOC_CTX *mem_ctx = talloc_named(p, 0, "samba_get_pac context");
-        unsigned int userAccountControl;
-
-        if (!mem_ctx) {
-                return ENOMEM;
-        }
-
-        /* The user account may be set not to want the PAC */
+bool samba_princ_needs_pac(struct hdb_entry_ex *princ)
+{
+
+        struct samba_kdc_entry *p = talloc_get_type(princ->ctx, struct samba_kdc_entry);
+        uint32_t userAccountControl;
+
+
+        /* The service account may be set not to want the PAC */
         userAccountControl = ldb_msg_find_attr_as_uint(p->msg, "userAccountControl", 0);
         if (userAccountControl & UF_NO_AUTH_DATA_REQUIRED) {
-                *pac = NULL;
-                return 0;
-        }
-
-        nt_status = authsam_make_server_info(mem_ctx, p->samdb,
-                                             lp_netbios_name(p->lp_ctx),
-                                             lp_sam_name(p->lp_ctx),
+                return false;
+        }
+
+        return true;
+}
+
+/* Was the krbtgt an RODC (and we are not) */
+bool samba_krbtgt_was_untrusted_rodc(struct hdb_entry_ex *princ)
+{
+
+        struct samba_kdc_entry *p = talloc_get_type(princ->ctx, struct samba_kdc_entry);
+        int rodc_krbtgt_number;
+
+        /* Determine if this was printed by an RODC */
+        rodc_krbtgt_number = ldb_msg_find_attr_as_int(p->msg, "msDS-SecondaryKrbTgtNumber", -1);
+        if (rodc_krbtgt_number == -1) {
+                return false;
+        } else if (rodc_krbtgt_number != p->kdc_db_ctx->my_krbtgt_number) {
+                return true;
+        }
+
+        return false;
+}
+
+NTSTATUS samba_kdc_get_pac_blob(TALLOC_CTX *mem_ctx,
+                                struct hdb_entry_ex *client,
+                                DATA_BLOB **_pac_blob)
+{
+        struct samba_kdc_entry *p = talloc_get_type(client->ctx, struct samba_kdc_entry);
+        struct auth_user_info_dc *user_info_dc;
+        DATA_BLOB *pac_blob;
+        NTSTATUS nt_status;
+
+        /* The user account may be set not to want the PAC */
+        if ( ! samba_princ_needs_pac(client)) {
+                *_pac_blob = NULL;
+                return NT_STATUS_OK;
+        }
+
+        pac_blob = talloc_zero(mem_ctx, DATA_BLOB);
+        if (!pac_blob) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        nt_status = authsam_make_user_info_dc(mem_ctx, p->kdc_db_ctx->samdb,
+                                             lpcfg_netbios_name(p->kdc_db_ctx->lp_ctx),
+                                             lpcfg_sam_name(p->kdc_db_ctx->lp_ctx),
                                              p->realm_dn,
                                              p->msg,
                                              data_blob(NULL, 0),
                                              data_blob(NULL, 0),
-                                             &server_info);
+                                             &user_info_dc);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 DEBUG(0, ("Getting user info for PAC failed: %s\n",
                           nt_errstr(nt_status)));
-                return ENOMEM;
-        }
-
-        ret = make_pac(context, mem_ctx, p->iconv_convenience, server_info, pac);
-
-        talloc_free(mem_ctx);
-        return ret;
-}
-
-/* Resign (and reform, including possibly new groups) a PAC */
-
-static krb5_error_code samba_kdc_reget_pac(void *priv, krb5_context context,
-                                           const krb5_principal client_principal,
-                                           struct hdb_entry_ex *client,  
-                                           struct hdb_entry_ex *server, krb5_pac *pac)
-{
+                return nt_status;
+        }
+
+        nt_status = samba_get_logon_info_pac_blob(mem_ctx, user_info_dc, pac_blob);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                DEBUG(0, ("Building PAC failed: %s\n",
+                          nt_errstr(nt_status)));
+                return nt_status;
+        }
+
+        *_pac_blob = pac_blob;
+        return NT_STATUS_OK;
+}
+
+NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx,
+                                   krb5_context context,
+                                   krb5_pac *pac, DATA_BLOB *pac_blob)
+{
+        struct auth_user_info_dc *user_info_dc;
         krb5_error_code ret;
-
-        unsigned int userAccountControl;
-
-        struct hdb_samba4_private *p = talloc_get_type(server->ctx, struct hdb_samba4_private);
-
-        struct auth_serversupplied_info *server_info_out;
-
-        TALLOC_CTX *mem_ctx = talloc_named(p, 0, "samba_get_pac context");
-        
-        if (!mem_ctx) {
-                return ENOMEM;
-        }
-
-        /* The service account may be set not to want the PAC */
-        userAccountControl = ldb_msg_find_attr_as_uint(p->msg, "userAccountControl", 0);
-        if (userAccountControl & UF_NO_AUTH_DATA_REQUIRED) {
-                talloc_free(mem_ctx);
-                *pac = NULL;
-                return 0;
-        }
-
-        ret = kerberos_pac_to_server_info(mem_ctx, p->iconv_convenience,
-                                          *pac, context, &server_info_out);
-
-        /* We will compleatly regenerate this pac */
-        krb5_pac_free(context, *pac);
-
+        NTSTATUS nt_status;
+
+        ret = kerberos_pac_to_user_info_dc(mem_ctx, *pac,
+                                           context, &user_info_dc, NULL, NULL);
         if (ret) {
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        ret = make_pac(context, mem_ctx, p->iconv_convenience, server_info_out, pac);
-
-        talloc_free(mem_ctx);
-        return ret;
-}
-
-static void samba_kdc_build_edata_reply(TALLOC_CTX *tmp_ctx, krb5_data *e_data,
-                                       NTSTATUS nt_status)
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        nt_status = samba_get_logon_info_pac_blob(mem_ctx, 
+                                                  user_info_dc, pac_blob);
+
+        return nt_status;
+}
+
+/* this function allocates 'data' using malloc.
+ * The caller is responsible for freeing it */
+void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data)
 {
         PA_DATA pa;
@@ -227 +235 @@
 }
 
-/* Given an hdb entry (and in particular it's private member), consult
- * the account_ok routine in auth/auth_sam.c for consistancy */
-
-
-static krb5_error_code samba_kdc_check_client_access(void *priv, 
-                                                     krb5_context context, 
-                                                     krb5_kdc_configuration *config,
-                                                     hdb_entry_ex *client_ex, const char *client_name,
-                                                     hdb_entry_ex *server_ex, const char *server_name,
-                                                     KDC_REQ *req,
-                                                     krb5_data *e_data)
+/* function to map policy errors */
+krb5_error_code samba_kdc_map_policy_err(NTSTATUS nt_status)
 {
         krb5_error_code ret;
-        NTSTATUS nt_status;
+
+        if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_MUST_CHANGE))
+                ret = KRB5KDC_ERR_KEY_EXPIRED;
+        else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_EXPIRED))
+                ret = KRB5KDC_ERR_KEY_EXPIRED;
+        else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_EXPIRED))
+                ret = KRB5KDC_ERR_CLIENT_REVOKED;
+        else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_DISABLED))
+                ret = KRB5KDC_ERR_CLIENT_REVOKED;
+        else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_LOGON_HOURS))
+                ret = KRB5KDC_ERR_CLIENT_REVOKED;
+        else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_LOCKED_OUT))
+                ret = KRB5KDC_ERR_CLIENT_REVOKED;
+        else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_WORKSTATION))
+                ret = KRB5KDC_ERR_POLICY;
+        else
+                ret = KRB5KDC_ERR_POLICY;
+
+        return ret;
+}
+
+/* Given a kdc entry, consult the account_ok routine in auth/auth_sam.c
+ * for consistency */
+NTSTATUS samba_kdc_check_client_access(struct samba_kdc_entry *kdc_entry,
+                                       const char *client_name,
+                                       const char *workstation,
+                                       bool password_change)
+{
         TALLOC_CTX *tmp_ctx;
-        struct hdb_samba4_private *p;
-        char *workstation = NULL;
-        HostAddresses *addresses = req->req_body.addresses;
-        int i;
-        bool password_change;
-
-        tmp_ctx = talloc_new(client_ex->ctx);
-        p = talloc_get_type(client_ex->ctx, struct hdb_samba4_private);
-
+        NTSTATUS nt_status;
+
+        tmp_ctx = talloc_named(NULL, 0, "samba_kdc_check_client_access");
         if (!tmp_ctx) {
-                return ENOMEM;
-        }
-        
-        if (addresses) {
-                for (i=0; i < addresses->len; i++) {
-                        if (addresses->val->addr_type == KRB5_ADDRESS_NETBIOS) {
-                                workstation = talloc_strndup(tmp_ctx, addresses->val->address.data, MIN(addresses->val->address.length, 15));
-                                if (workstation) {
-                                        break;
-                                }
-                        }
-                }
-        }
-
-        /* Strip space padding */
-        if (workstation) {
-                i = MIN(strlen(workstation), 15);
-                for (; i > 0 && workstation[i - 1] == ' '; i--) {
-                        workstation[i - 1] = '\0';
-                }
-        }
-
-        password_change = (server_ex && server_ex->entry.flags.change_pw);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         /* we allow all kinds of trusts here */
-        nt_status = authsam_account_ok(tmp_ctx, 
-                                       p->samdb,
-                                       MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
-                                       p->realm_dn,
-                                       p->msg,
-                                       workstation,
-                                       client_name, true, password_change);
-
-        if (NT_STATUS_IS_OK(nt_status)) {
-                /* Now do the standard Heimdal check */
-                ret = kdc_check_flags(context, config,
-                                      client_ex, client_name,
-                                      server_ex, server_name,
-                                      req->msg_type == krb_as_req);
-        } else {
-                if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_MUST_CHANGE))
-                        ret = KRB5KDC_ERR_KEY_EXPIRED;
-                else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_EXPIRED))
-                        ret = KRB5KDC_ERR_KEY_EXPIRED;
-                else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_EXPIRED))
-                        ret = KRB5KDC_ERR_CLIENT_REVOKED;
-                else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_DISABLED))
-                        ret = KRB5KDC_ERR_CLIENT_REVOKED;
-                else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_LOGON_HOURS))
-                        ret = KRB5KDC_ERR_CLIENT_REVOKED;
-                else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_LOCKED_OUT))
-                        ret = KRB5KDC_ERR_CLIENT_REVOKED;
-                else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_WORKSTATION))
-                        ret = KRB5KDC_ERR_POLICY;
-                else
-                        ret = KRB5KDC_ERR_POLICY;
-
-                samba_kdc_build_edata_reply(tmp_ctx, e_data, nt_status);
-        }
-
-        return ret;
-}
-
-struct krb5plugin_windc_ftable windc_plugin_table = {
-        .minor_version = KRB5_WINDC_PLUGING_MINOR,
-        .init = samba_kdc_plugin_init,
-        .fini = samba_kdc_plugin_fini,
-        .pac_generate = samba_kdc_get_pac,
-        .pac_verify = samba_kdc_reget_pac,
-        .client_access = samba_kdc_check_client_access,
-};
-
+        nt_status = authsam_account_ok(tmp_ctx,
+                                       kdc_entry->kdc_db_ctx->samdb,
+                                       MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
+                                       MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
+                                       kdc_entry->realm_dn, kdc_entry->msg,
+                                       workstation, client_name,
+                                       true, password_change);
+
+        talloc_free(tmp_ctx);
+        return nt_status;
+}
+

vendor/current/source4/kdc/pac-glue.h

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
-   KDC Server startup
+   PAC Glue between Samba and the KDC
 
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
+   Copyright (C) Simo Sorce <idra@samba.org> 2010
 
    This program is free software; you can redistribute it and/or modify
@@ -10 +11 @@
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#ifndef __KDC_PAC_GLUE_H__
-#define __KDC_PAC_GLUE_H__
+krb5_error_code samba_make_krb5_pac(krb5_context context,
+                                    DATA_BLOB *pac_blob,
+                                    krb5_pac *pac);
 
-#include "kdc/pac-glue_proto.h"
+bool samba_princ_needs_pac(struct hdb_entry_ex *princ);
 
-extern struct krb5plugin_windc_ftable windc_plugin_table;
+bool samba_krbtgt_was_untrusted_rodc(struct hdb_entry_ex *princ);
 
-#endif /* __KDC_PAC_GLUE_H__ */
+NTSTATUS samba_kdc_get_pac_blob(TALLOC_CTX *mem_ctx,
+                                struct hdb_entry_ex *client,
+                                DATA_BLOB **_pac_blob);
 
+NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx,
+                                   krb5_context context,
+                                   krb5_pac *pac, DATA_BLOB *pac_blob);
+
+void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data);
+
+krb5_error_code samba_kdc_map_policy_err(NTSTATUS nt_status);
+
+NTSTATUS samba_kdc_check_client_access(struct samba_kdc_entry *kdc_entry,
+                                       const char *client_name,
+                                       const char *workstation,
+                                       bool password_change);