Changeset 745 for trunk/server/source3/libads/krb5_setpw.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/libads/krb5_setpw.c (modified) (7 diffs)

trunk/server/source3/libads/krb5_setpw.c

@@ -21 +21 @@
 #include "includes.h"
 #include "smb_krb5.h"
+#include "libads/kerberos_proto.h"
+#include "../lib/util/asn1.h"
 
 #ifdef HAVE_KRB5
@@ -574 +576 @@
         krb5_error_code ret = 0;
         krb5_context context = NULL;
-        krb5_principal principal = NULL;
-        char *princ_name = NULL;
-        char *realm = NULL;
+        const char *realm = NULL;
+        unsigned int realm_len = 0;
         krb5_creds creds, *credsp = NULL;
-#if KRB5_PRINC_REALM_RETURNS_REALM
-        krb5_realm orig_realm;
-#else
-        krb5_data orig_realm;
-#endif
         krb5_ccache ccache = NULL;
 
@@ -605 +601 @@
         }
 
-        realm = strchr_m(princ, '@');
-        if (!realm) {
-                krb5_cc_close(context, ccache);
-                krb5_free_context(context);
-                DEBUG(1,("Failed to get realm\n"));
-                return ADS_ERROR_KRB5(-1);
-        }
-        realm++;
-
-        if (asprintf(&princ_name, "kadmin/changepw@%s", realm) == -1) {
+        ret = krb5_cc_get_principal(context, ccache, &creds.client);
+        if (ret) {
                 krb5_cc_close(context, ccache);
                 krb5_free_context(context);
-                DEBUG(1,("asprintf failed\n"));
-                return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-        }
-
-        ret = smb_krb5_parse_name(context, princ_name, &creds.server);
-        if (ret) {
-                krb5_cc_close(context, ccache);
-                krb5_free_context(context);
-                DEBUG(1,("Failed to parse kadmin/changepw (%s)\n", error_message(ret)));
-                return ADS_ERROR_KRB5(ret);
-        }
-
-        /* parse the principal we got as a function argument */
-        ret = smb_krb5_parse_name(context, princ, &principal);
-        if (ret) {
-                krb5_cc_close(context, ccache);
-                krb5_free_principal(context, creds.server);
-                krb5_free_context(context);
-                DEBUG(1,("Failed to parse %s (%s)\n", princ_name, error_message(ret)));
-                free(princ_name);
-                return ADS_ERROR_KRB5(ret);
-        }
-
-        free(princ_name);
-
-        /* The creds.server principal takes ownership of this memory.
-                Remember to set back to original value before freeing. */
-        orig_realm = *krb5_princ_realm(context, creds.server);
-        krb5_princ_set_realm(context, creds.server, krb5_princ_realm(context, principal));
-        
-        ret = krb5_cc_get_principal(context, ccache, &creds.client);
-        if (ret) {
-                krb5_cc_close(context, ccache);
-                krb5_princ_set_realm(context, creds.server, &orig_realm);
-                krb5_free_principal(context, creds.server);
-                krb5_free_principal(context, principal);
-                krb5_free_context(context);
-                DEBUG(1,("Failed to get principal from ccache (%s)\n", 
+                DEBUG(1,("Failed to get principal from ccache (%s)\n",
                          error_message(ret)));
                 return ADS_ERROR_KRB5(ret);
         }
-        
-        ret = krb5_get_credentials(context, 0, ccache, &creds, &credsp); 
+
+        realm = smb_krb5_principal_get_realm(context, creds.client);
+        realm_len = strlen(realm);
+        ret = krb5_build_principal(context,
+                                   &creds.server,
+                                   realm_len,
+                                   realm, "kadmin", "changepw", NULL);
+
+        ret = krb5_get_credentials(context, 0, ccache, &creds, &credsp);
         if (ret) {
                 krb5_cc_close(context, ccache);
                 krb5_free_principal(context, creds.client);
-                krb5_princ_set_realm(context, creds.server, &orig_realm);
                 krb5_free_principal(context, creds.server);
-                krb5_free_principal(context, principal);
+                krb5_free_context(context);
+                DEBUG(1,("krb5_build_prinipal_ext (%s)\n", error_message(ret)));
+                return ADS_ERROR_KRB5(ret);
+        }
+        
+        ret = krb5_get_credentials(context, 0, ccache, &creds, &credsp); 
+        if (ret) {
+                krb5_cc_close(context, ccache);
+                krb5_free_principal(context, creds.client);
+                krb5_free_principal(context, creds.server);
                 krb5_free_context(context);
                 DEBUG(1,("krb5_get_credentials failed (%s)\n", error_message(ret)));
@@ -679 +645 @@
         krb5_free_creds(context, credsp);
         krb5_free_principal(context, creds.client);
-        krb5_princ_set_realm(context, creds.server, &orig_realm);
         krb5_free_principal(context, creds.server);
-        krb5_free_principal(context, principal);
         krb5_cc_close(context, ccache);
         krb5_free_context(context);
@@ -729 +693 @@
     krb5_creds creds;
     char *chpw_princ = NULL, *password;
+    const char *realm = NULL;
 
     initialize_krb5_error_table();
@@ -750 +715 @@
     krb5_get_init_creds_opt_set_proxiable(&opts, 0);
 
+    realm = smb_krb5_principal_get_realm(context, princ);
+
     /* We have to obtain an INITIAL changepw ticket for changing password */
-    if (asprintf(&chpw_princ, "kadmin/changepw@%s",
-                                (char *) krb5_princ_realm(context, princ)) == -1) {
+    if (asprintf(&chpw_princ, "kadmin/changepw@%s", realm) == -1) {
         krb5_free_context(context);
         DEBUG(1,("ads_krb5_chg_password: asprintf fail\n"));
@@ -807 +773 @@
 }
 
-
-/**
- * Set the machine account password
- * @param ads connection to ads server
- * @param hostname machine whose password is being set
- * @param password new password
- * @return status of password change
- **/
-ADS_STATUS ads_set_machine_password(ADS_STRUCT *ads,
-                                    const char *machine_account,
-                                    const char *password)
-{
-        ADS_STATUS status;
-        char *principal = NULL; 
-
-        /*
-          we need to use the '$' form of the name here (the machine account name), 
-          as otherwise the server might end up setting the password for a user
-          instead
-         */
-        if (asprintf(&principal, "%s@%s", machine_account, ads->config.realm) < 0) {
-                return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-        }
-        
-        status = ads_krb5_set_password(ads->auth.kdc_server, principal, 
-                                       password, ads->auth.time_offset);
-        
-        SAFE_FREE(principal);
-        return status;
-}
 #endif