Changeset 988 for vendor/current/source4/auth

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source4/auth

Files:

• auth.h (modified) (11 diffs)
• credentials (deleted)
• gensec/cyrus_sasl.c (deleted)
• gensec/gensec.c (deleted)
• gensec/gensec.h (deleted)
• gensec/gensec.pc.in (deleted)
• gensec/gensec_gssapi.c (modified) (44 diffs)
• gensec/gensec_gssapi.h (modified) (6 diffs)
• gensec/gensec_krb5.c (modified) (24 diffs)
• gensec/gensec_krb5_util.c (added)
• gensec/gensec_krb5_util.h (added)
• gensec/gensec_tstream.c (modified) (2 diffs)
• gensec/pygensec.c (modified) (21 diffs)
• gensec/schannel.c (deleted)
• gensec/socket.c (deleted)
• gensec/spnego.c (deleted)
• gensec/tests (deleted)
• gensec/wscript_build (modified) (2 diffs)
• kerberos/clikrb5.c (deleted)
• kerberos/gssapi_parse.c (deleted)
• kerberos/kerberos-notes.txt (modified) (3 diffs)
• kerberos/kerberos.c (deleted)
• kerberos/kerberos.h (modified) (6 diffs)
• kerberos/kerberos_credentials.h (modified) (1 diff)
• kerberos/kerberos_heimdal.c (deleted)
• kerberos/kerberos_pac.c (modified) (10 diffs)
• kerberos/kerberos_util.c (modified) (16 diffs)
• kerberos/keytab_copy.c (deleted)
• kerberos/krb5_init_context.c (modified) (20 diffs)
• kerberos/krb5_init_context.h (modified) (3 diffs)
• kerberos/srv_keytab.c (added)
• kerberos/wscript_build (modified) (2 diffs)
• ntlm/auth.c (modified) (21 diffs)
• ntlm/auth_anonymous.c (modified) (3 diffs)
• ntlm/auth_developer.c (modified) (3 diffs)
• ntlm/auth_sam.c (modified) (12 diffs)
• ntlm/auth_server.c (deleted)
• ntlm/auth_simple.c (modified) (3 diffs)
• ntlm/auth_unix.c (modified) (12 diffs)
• ntlm/auth_util.c (modified) (6 diffs)
• ntlm/auth_winbind.c (modified) (9 diffs)
• ntlm/wscript_build (modified) (6 diffs)
• ntlmssp (deleted)
• pyauth.c (modified) (11 diffs)
• pyauth.h (modified) (1 diff)
• sam.c (modified) (19 diffs)
• samba_server_gensec.c (modified) (3 diffs)
• session.c (modified) (13 diffs)
• system_session.c (modified) (2 diffs)
• tests (deleted)
• unix_token.c (added)
• wscript_build (modified) (4 diffs)
• wscript_configure (modified) (1 diff)

vendor/current/source4/auth/auth.h

@@ -44 +44 @@
 /* version 4 - subsequent samba4 version - metze */
 /* version 0 - till samba4 is stable - metze */
-#define AUTH_INTERFACE_VERSION 0
-
-#define AUTH_SESSION_INFO_DEFAULT_GROUPS     0x01 /* Add the user to the default world and network groups */
-#define AUTH_SESSION_INFO_AUTHENTICATED      0x02 /* Add the user to the 'authenticated users' group */
-#define AUTH_SESSION_INFO_SIMPLE_PRIVILEGES  0x04 /* Use a trivial map between users and privilages, rather than a DB */
+#define AUTH4_INTERFACE_VERSION 0
 
 struct auth_method_context;
 struct auth_check_password_request;
-struct auth_context;
+struct auth4_context;
 struct auth_session_info;
 struct ldb_dn;
+struct smb_krb5_context;
 
 struct auth_operations {
         const char *name;
-
-        /* If you are using this interface, then you are probably
-         * getting something wrong.  This interface is only for
-         * security=server, and makes a number of compromises to allow
-         * that.  It is not compatible with being a PDC.  */
-
-        NTSTATUS (*get_challenge)(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, uint8_t chal[8]);
 
         /* Given the user supplied info, check if this backend want to handle the password checking */
@@ -79 +69 @@
         /* Lookup a 'session info interim' return based only on the principal or DN */
         NTSTATUS (*get_user_info_dc_principal)(TALLOC_CTX *mem_ctx,
-                                                       struct auth_context *auth_context,
+                                                       struct auth4_context *auth_context,
                                                        const char *principal,
                                                        struct ldb_dn *user_dn,
                                                        struct auth_user_info_dc **interim_info);
+        uint32_t flags;
 };
 
 struct auth_method_context {
         struct auth_method_context *prev, *next;
-        struct auth_context *auth_ctx;
+        struct auth4_context *auth_ctx;
         const struct auth_operations *ops;
         int depth;
         void *private_data;
-};
-
-struct auth_context {
-        struct {
-                /* Who set this up in the first place? */
-                const char *set_by;
-
-                bool may_be_modified;
-
-                DATA_BLOB data;
-        } challenge;
-
-        /* methods, in the order they should be called */
-        struct auth_method_context *methods;
-
-        /* the event context to use for calls that can block */
-        struct tevent_context *event_ctx;
-
-        /* the messaging context which can be used by backends */
-        struct messaging_context *msg_ctx;
-
-        /* loadparm context */
-        struct loadparm_context *lp_ctx;
-
-        /* SAM database for this local machine - to fill in local groups, or to authenticate local NTLM users */
-        struct ldb_context *sam_ctx;
-
-        NTSTATUS (*check_password)(struct auth_context *auth_ctx,
-                                   TALLOC_CTX *mem_ctx,
-                                   const struct auth_usersupplied_info *user_info,
-                                   struct auth_user_info_dc **user_info_dc);
-
-        NTSTATUS (*get_challenge)(struct auth_context *auth_ctx, uint8_t chal[8]);
-
-        bool (*challenge_may_be_modified)(struct auth_context *auth_ctx);
-
-        NTSTATUS (*set_challenge)(struct auth_context *auth_ctx, const uint8_t chal[8], const char *set_by);
-
-        NTSTATUS (*get_user_info_dc_principal)(TALLOC_CTX *mem_ctx,
-                                                       struct auth_context *auth_ctx,
-                                                       const char *principal,
-                                                       struct ldb_dn *user_dn,
-                                                       struct auth_user_info_dc **user_info_dc);
-
-        NTSTATUS (*generate_session_info)(TALLOC_CTX *mem_ctx,
-                                          struct auth_context *auth_context,
-                                          struct auth_user_info_dc *user_info_dc,
-                                          uint32_t session_info_flags,
-                                          struct auth_session_info **session_info);
 };
 
@@ -152 +94 @@
 };
 
- NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth_context *auth_context,
+ NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth4_context *auth_context,
                            enum auth_password_state to_state,
                            const struct auth_usersupplied_info *user_info_in,
@@ -158 +100 @@
 
 #include "auth/session.h"
+#include "auth/unix_token_proto.h"
 #include "auth/system_session_proto.h"
 #include "libcli/security/security.h"
@@ -166 +109 @@
 struct cli_credentials;
 
-NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, uint8_t chal[8]);
+NTSTATUS auth_get_challenge(struct auth4_context *auth_ctx, uint8_t chal[8]);
 NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
                             struct ldb_context *sam_ctx,
@@ -176 +119 @@
                             bool allow_domain_trust,
                             bool password_change);
-NTSTATUS authsam_expand_nested_groups(struct ldb_context *sam_ctx,
-                                      struct ldb_val *dn_val, const bool only_childs, const char *filter,
-                                      TALLOC_CTX *res_sids_ctx, struct dom_sid ***res_sids,
-                                      unsigned int *num_res_sids);
+
 struct auth_session_info *system_session(struct loadparm_context *lp_ctx);
 NTSTATUS authsam_make_user_info_dc(TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
@@ -192 +132 @@
                                            struct auth_session_info **_session_info) ;
 
-NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods,
+NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char * const *methods,
                                      struct tevent_context *ev,
-                                     struct messaging_context *msg,
+                                     struct imessaging_context *msg,
                                      struct loadparm_context *lp_ctx,
                                      struct ldb_context *sam_ctx,
-                                     struct auth_context **auth_ctx);
+                                     struct auth4_context **auth_ctx);
 const char **auth_methods_from_lp(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
 
 NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx,
                              struct tevent_context *ev,
-                             struct messaging_context *msg,
+                             struct imessaging_context *msg,
                              struct loadparm_context *lp_ctx,
-                             struct auth_context **auth_ctx);
-NTSTATUS auth_context_create_from_ldb(TALLOC_CTX *mem_ctx, struct ldb_context *ldb, struct auth_context **auth_ctx);
+                             struct auth4_context **auth_ctx);
 
-NTSTATUS auth_check_password(struct auth_context *auth_ctx,
+NTSTATUS auth_check_password_wrapper(struct auth4_context *auth_ctx,
                              TALLOC_CTX *mem_ctx,
-                             const struct auth_usersupplied_info *user_info,
+                             const struct auth_usersupplied_info *user_info, 
+                             void **server_returned_info,
+                             DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key);
+
+NTSTATUS auth_check_password(struct auth4_context *auth_ctx,
+                             TALLOC_CTX *mem_ctx,
+                             const struct auth_usersupplied_info *user_info, 
                              struct auth_user_info_dc **user_info_dc);
 NTSTATUS auth4_init(void);
@@ -216 +161 @@
 NTSTATUS authenticate_username_pw(TALLOC_CTX *mem_ctx,
                                   struct tevent_context *ev,
-                                  struct messaging_context *msg,
+                                  struct imessaging_context *msg,
                                   struct loadparm_context *lp_ctx,
                                   const char *nt4_domain,
@@ -226 +171 @@
 struct tevent_req *auth_check_password_send(TALLOC_CTX *mem_ctx,
                                             struct tevent_context *ev,
-                                            struct auth_context *auth_ctx,
+                                            struct auth4_context *auth_ctx,
                                             const struct auth_usersupplied_info *user_info);
 NTSTATUS auth_check_password_recv(struct tevent_req *req,
@@ -232 +177 @@
                                   struct auth_user_info_dc **user_info_dc);
 
-bool auth_challenge_may_be_modified(struct auth_context *auth_ctx);
-NTSTATUS auth_context_set_challenge(struct auth_context *auth_ctx, const uint8_t chal[8], const char *set_by);
+bool auth_challenge_may_be_modified(struct auth4_context *auth_ctx);
+NTSTATUS auth_context_set_challenge(struct auth4_context *auth_ctx, const uint8_t chal[8], const char *set_by);
 
 NTSTATUS auth_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
-                                        struct auth_context *auth_ctx,
+                                        struct auth4_context *auth_ctx,
                                         const char *principal,
                                         struct ldb_dn *user_dn,
@@ -243 +188 @@
 NTSTATUS samba_server_gensec_start(TALLOC_CTX *mem_ctx,
                                    struct tevent_context *event_ctx,
-                                   struct messaging_context *msg_ctx,
+                                   struct imessaging_context *msg_ctx,
                                    struct loadparm_context *lp_ctx,
                                    struct cli_credentials *server_credentials,

vendor/current/source4/auth/gensec/gensec_gssapi.c

@@ -25 +25 @@
 #include "lib/events/events.h"
 #include "system/kerberos.h"
+#include "system/gssapi.h"
 #include "auth/kerberos/kerberos.h"
 #include "librpc/gen_ndr/krb5pac.h"
@@ -30 +31 @@
 #include <ldb.h>
 #include "auth/auth_sam.h"
-#include "librpc/rpc/dcerpc.h"
+#include "librpc/gen_ndr/dcerpc.h"
 #include "auth/credentials/credentials.h"
 #include "auth/credentials/credentials_krb5.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h"
 #include "auth/gensec/gensec_proto.h"
+#include "auth/gensec/gensec_toplevel_proto.h"
 #include "param/param.h"
 #include "auth/session_proto.h"
-#include <gssapi/gssapi.h>
-#include <gssapi/gssapi_krb5.h>
-#include <gssapi/gssapi_spnego.h>
-#include "auth/gensec/gensec_gssapi.h"
+#include "gensec_gssapi.h"
 #include "lib/util/util_net.h"
+#include "auth/kerberos/pac_utils.h"
+#include "auth/kerberos/gssapi_helper.h"
+
+#ifndef gss_mech_spnego
+gss_OID_desc spnego_mech_oid_desc =
+                { 6, discard_const_p(void, "\x2b\x06\x01\x05\x05\x02") };
+#define gss_mech_spnego (&spnego_mech_oid_desc)
+#endif
+
+_PUBLIC_ NTSTATUS gensec_gssapi_init(void);
 
 static size_t gensec_gssapi_max_input_size(struct gensec_security *gensec_security);
 static size_t gensec_gssapi_max_wrapped_size(struct gensec_security *gensec_security);
-
-static char *gssapi_error_string(TALLOC_CTX *mem_ctx, 
-                                 OM_uint32 maj_stat, OM_uint32 min_stat, 
-                                 const gss_OID mech)
-{
-        OM_uint32 disp_min_stat, disp_maj_stat;
-        gss_buffer_desc maj_error_message;
-        gss_buffer_desc min_error_message;
-        char *maj_error_string, *min_error_string;
-        OM_uint32 msg_ctx = 0;
-
-        char *ret;
-
-        maj_error_message.value = NULL;
-        min_error_message.value = NULL;
-        maj_error_message.length = 0;
-        min_error_message.length = 0;
-        
-        disp_maj_stat = gss_display_status(&disp_min_stat, maj_stat, GSS_C_GSS_CODE,
-                           mech, &msg_ctx, &maj_error_message);
-        disp_maj_stat = gss_display_status(&disp_min_stat, min_stat, GSS_C_MECH_CODE,
-                           mech, &msg_ctx, &min_error_message);
-        
-        maj_error_string = talloc_strndup(mem_ctx, (char *)maj_error_message.value, maj_error_message.length);
-
-        min_error_string = talloc_strndup(mem_ctx, (char *)min_error_message.value, min_error_message.length);
-
-        ret = talloc_asprintf(mem_ctx, "%s: %s", maj_error_string, min_error_string);
-
-        talloc_free(maj_error_string);
-        talloc_free(min_error_string);
-
-        gss_release_buffer(&disp_min_stat, &maj_error_message);
-        gss_release_buffer(&disp_min_stat, &min_error_message);
-
-        return ret;
-}
-
+static size_t gensec_gssapi_sig_size(struct gensec_security *gensec_security, size_t data_size);
 
 static int gensec_gssapi_destructor(struct gensec_gssapi_state *gensec_gssapi_state)
 {
-        OM_uint32 maj_stat, min_stat;
-        
+        OM_uint32 min_stat;
+
         if (gensec_gssapi_state->delegated_cred_handle != GSS_C_NO_CREDENTIAL) {
-                maj_stat = gss_release_cred(&min_stat, 
-                                            &gensec_gssapi_state->delegated_cred_handle);
+                gss_release_cred(&min_stat,
+                                 &gensec_gssapi_state->delegated_cred_handle);
         }
 
         if (gensec_gssapi_state->gssapi_context != GSS_C_NO_CONTEXT) {
-                maj_stat = gss_delete_sec_context (&min_stat,
-                                                   &gensec_gssapi_state->gssapi_context,
-                                                   GSS_C_NO_BUFFER);
+                gss_delete_sec_context(&min_stat,
+                                       &gensec_gssapi_state->gssapi_context,
+                                       GSS_C_NO_BUFFER);
         }
 
         if (gensec_gssapi_state->server_name != GSS_C_NO_NAME) {
-                maj_stat = gss_release_name(&min_stat, &gensec_gssapi_state->server_name);
+                gss_release_name(&min_stat,
+                                 &gensec_gssapi_state->server_name);
         }
         if (gensec_gssapi_state->client_name != GSS_C_NO_NAME) {
-                maj_stat = gss_release_name(&min_stat, &gensec_gssapi_state->client_name);
-        }
-
-        if (gensec_gssapi_state->lucid) {
-                gss_krb5_free_lucid_sec_context(&min_stat, gensec_gssapi_state->lucid);
+                gss_release_name(&min_stat,
+                                 &gensec_gssapi_state->client_name);
         }
 
         return 0;
-}
-
-static NTSTATUS gensec_gssapi_init_lucid(struct gensec_gssapi_state *gensec_gssapi_state)
-{
-        OM_uint32 maj_stat, min_stat;
-
-        if (gensec_gssapi_state->lucid) {
-                return NT_STATUS_OK;
-        }
-
-        maj_stat = gss_krb5_export_lucid_sec_context(&min_stat,
-                                                     &gensec_gssapi_state->gssapi_context,
-                                                     1,
-                                                     (void **)&gensec_gssapi_state->lucid);
-        if (maj_stat != GSS_S_COMPLETE) {
-                DEBUG(0,("gensec_gssapi_init_lucid: %s\n",
-                        gssapi_error_string(gensec_gssapi_state,
-                                            maj_stat, min_stat,
-                                            gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        if (gensec_gssapi_state->lucid->version != 1) {
-                DEBUG(0,("gensec_gssapi_init_lucid: lucid version[%d] != 1\n",
-                        gensec_gssapi_state->lucid->version));
-                gss_krb5_free_lucid_sec_context(&min_stat, gensec_gssapi_state->lucid);
-                gensec_gssapi_state->lucid = NULL;
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        return NT_STATUS_OK;
 }
 
@@ -148 +88 @@
         struct gensec_gssapi_state *gensec_gssapi_state;
         krb5_error_code ret;
+#ifdef SAMBA4_USES_HEIMDAL
         const char *realm;
+#endif
 
         gensec_gssapi_state = talloc_zero(gensec_security, struct gensec_gssapi_state);
@@ -165 +107 @@
         gensec_gssapi_state->client_name = GSS_C_NO_NAME;
         
-        gensec_gssapi_state->want_flags = 0;
+        gensec_gssapi_state->gss_want_flags = 0;
+        gensec_gssapi_state->expire_time = GENSEC_EXPIRE_TIME_INFINITY;
 
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation_by_kdc_policy", true)) {
-                gensec_gssapi_state->want_flags |= GSS_C_DELEG_POLICY_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_DELEG_POLICY_FLAG;
         }
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "mutual", true)) {
-                gensec_gssapi_state->want_flags |= GSS_C_MUTUAL_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_MUTUAL_FLAG;
         }
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", true)) {
-                gensec_gssapi_state->want_flags |= GSS_C_DELEG_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_DELEG_FLAG;
         }
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "replay", true)) {
-                gensec_gssapi_state->want_flags |= GSS_C_REPLAY_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_REPLAY_FLAG;
         }
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "sequence", true)) {
-                gensec_gssapi_state->want_flags |= GSS_C_SEQUENCE_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_SEQUENCE_FLAG;
         }
 
         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
-                gensec_gssapi_state->want_flags |= GSS_C_INTEG_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_INTEG_FLAG;
         }
         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
-                gensec_gssapi_state->want_flags |= GSS_C_CONF_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_INTEG_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_CONF_FLAG;
         }
         if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
-                gensec_gssapi_state->want_flags |= GSS_C_DCE_STYLE;
-        }
-
-        gensec_gssapi_state->got_flags = 0;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_DCE_STYLE;
+        }
+
+        gensec_gssapi_state->gss_got_flags = 0;
 
         switch (gensec_security->ops->auth_type) {
@@ -201 +145 @@
         case DCERPC_AUTH_TYPE_KRB5:
         default:
-                gensec_gssapi_state->gss_oid = gss_mech_krb5;
+                gensec_gssapi_state->gss_oid =
+                        discard_const_p(void, gss_mech_krb5);
                 break;
         }
 
-        gensec_gssapi_state->session_key = data_blob(NULL, 0);
-        gensec_gssapi_state->pac = data_blob(NULL, 0);
-
         ret = smb_krb5_init_context(gensec_gssapi_state,
-                                    NULL,
                                     gensec_security->settings->lp_ctx,
                                     &gensec_gssapi_state->smb_krb5_context);
         if (ret) {
-                DEBUG(1,("gensec_krb5_start: krb5_init_context failed (%s)\n",
+                DEBUG(1,("gensec_gssapi_start: smb_krb5_init_context failed (%s)\n",
                          error_message(ret)));
                 talloc_free(gensec_gssapi_state);
@@ -221 +162 @@
         gensec_gssapi_state->client_cred = NULL;
         gensec_gssapi_state->server_cred = NULL;
-
-        gensec_gssapi_state->lucid = NULL;
 
         gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
@@ -237 +176 @@
         talloc_set_destructor(gensec_gssapi_state, gensec_gssapi_destructor);
 
+#ifdef SAMBA4_USES_HEIMDAL
         realm = lpcfg_realm(gensec_security->settings->lp_ctx);
         if (realm != NULL) {
                 ret = gsskrb5_set_default_realm(realm);
                 if (ret) {
-                        DEBUG(1,("gensec_krb5_start: gsskrb5_set_default_realm failed\n"));
+                        DEBUG(1,("gensec_gssapi_start: gsskrb5_set_default_realm failed\n"));
                         talloc_free(gensec_gssapi_state);
                         return NT_STATUS_INTERNAL_ERROR;
@@ -250 +190 @@
         ret = gsskrb5_set_dns_canonicalize(gensec_setting_bool(gensec_security->settings, "krb5", "set_dns_canonicalize", false));
         if (ret) {
-                DEBUG(1,("gensec_krb5_start: gsskrb5_set_dns_canonicalize failed\n"));
+                DEBUG(1,("gensec_gssapi_start: gsskrb5_set_dns_canonicalize failed\n"));
                 talloc_free(gensec_gssapi_state);
                 return NT_STATUS_INTERNAL_ERROR;
         }
-
+#endif
         return NT_STATUS_OK;
 }
@@ -306 +246 @@
 }
 
-static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_security)
+static NTSTATUS gensec_gssapi_client_creds(struct gensec_security *gensec_security,
+                                           struct tevent_context *ev)
 {
         struct gensec_gssapi_state *gensec_gssapi_state;
+        struct gssapi_creds_container *gcc;
         struct cli_credentials *creds = gensec_get_credentials(gensec_security);
-        krb5_error_code ret;
-        NTSTATUS nt_status;
-        gss_buffer_desc name_token;
-        gss_OID name_type;
-        OM_uint32 maj_stat, min_stat;
-        const char *hostname = gensec_get_target_hostname(gensec_security);
-        struct gssapi_creds_container *gcc;
         const char *error_string;
-
-        if (!hostname) {
-                DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-        if (is_ipaddress(hostname)) {
-                DEBUG(2, ("Cannot do GSSAPI to an IP address\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-        if (strcmp(hostname, "localhost") == 0) {
-                DEBUG(2, ("GSSAPI to 'localhost' does not make sense\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        nt_status = gensec_gssapi_start(gensec_security);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                return nt_status;
-        }
+        int ret;
 
         gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 
-        gensec_gssapi_state->target_principal = gensec_get_target_principal(gensec_security);
-        if (gensec_gssapi_state->target_principal) {
-                name_type = GSS_C_NULL_OID;
-        } else {
-                gensec_gssapi_state->target_principal = talloc_asprintf(gensec_gssapi_state, "%s/%s@%s",
-                                            gensec_get_target_service(gensec_security), 
-                                            hostname, lpcfg_realm(gensec_security->settings->lp_ctx));
-
-                name_type = GSS_C_NT_USER_NAME;
-        }
-        name_token.value  = discard_const_p(uint8_t, gensec_gssapi_state->target_principal);
-        name_token.length = strlen(gensec_gssapi_state->target_principal);
-
-
-        maj_stat = gss_import_name (&min_stat,
-                                    &name_token,
-                                    name_type,
-                                    &gensec_gssapi_state->server_name);
-        if (maj_stat) {
-                DEBUG(2, ("GSS Import name of %s failed: %s\n",
-                          (char *)name_token.value,
-                          gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        ret = cli_credentials_get_client_gss_creds(creds, 
-                                                   gensec_security->event_ctx, 
+        /* Only run this the first time the update() call is made */
+        if (gensec_gssapi_state->client_cred) {
+                return NT_STATUS_OK;
+        }
+
+        ret = cli_credentials_get_client_gss_creds(creds,
+                                                   ev,
                                                    gensec_security->settings->lp_ctx, &gcc, &error_string);
         switch (ret) {
         case 0:
                 break;
+        case EINVAL:
+                DEBUG(3, ("Cannot obtain client GSS credentials we need to contact %s : %s\n", gensec_gssapi_state->target_principal, error_string));
+                return NT_STATUS_INVALID_PARAMETER;
         case KRB5KDC_ERR_PREAUTH_FAILED:
         case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
+        case KRB5KRB_AP_ERR_BAD_INTEGRITY:
                 DEBUG(1, ("Wrong username or password: %s\n", error_string));
                 return NT_STATUS_LOGON_FAILURE;
+        case KRB5KDC_ERR_CLIENT_REVOKED:
+                DEBUG(1, ("Account locked out: %s\n", error_string));
+                return NT_STATUS_ACCOUNT_LOCKED_OUT;
+        case KRB5_REALM_UNKNOWN:
         case KRB5_KDC_UNREACH:
                 DEBUG(3, ("Cannot reach a KDC we require to contact %s : %s\n", gensec_gssapi_state->target_principal, error_string));
@@ -390 +296 @@
                 return NT_STATUS_NO_MEMORY;
         }
-        
+
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_security)
+{
+        struct gensec_gssapi_state *gensec_gssapi_state;
+        struct cli_credentials *creds = gensec_get_credentials(gensec_security);
+        NTSTATUS nt_status;
+        gss_buffer_desc name_token;
+        gss_OID name_type;
+        OM_uint32 maj_stat, min_stat;
+        const char *hostname = gensec_get_target_hostname(gensec_security);
+
+        if (!hostname) {
+                DEBUG(3, ("No hostname for target computer passed in, cannot use kerberos for this connection\n"));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        if (is_ipaddress(hostname)) {
+                DEBUG(2, ("Cannot do GSSAPI to an IP address\n"));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        if (strcmp(hostname, "localhost") == 0) {
+                DEBUG(2, ("GSSAPI to 'localhost' does not make sense\n"));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        nt_status = gensec_gssapi_start(gensec_security);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
+
+        if (cli_credentials_get_impersonate_principal(creds)) {
+                gensec_gssapi_state->gss_want_flags &= ~(GSS_C_DELEG_FLAG|GSS_C_DELEG_POLICY_FLAG);
+        }
+
+        gensec_gssapi_state->target_principal = gensec_get_target_principal(gensec_security);
+        if (gensec_gssapi_state->target_principal) {
+                name_type = GSS_C_NULL_OID;
+        } else {
+                gensec_gssapi_state->target_principal = talloc_asprintf(gensec_gssapi_state, "%s/%s@%s",
+                                            gensec_get_target_service(gensec_security), 
+                                            hostname, lpcfg_realm(gensec_security->settings->lp_ctx));
+
+                name_type = GSS_C_NT_USER_NAME;
+        }
+        name_token.value  = discard_const_p(uint8_t, gensec_gssapi_state->target_principal);
+        name_token.length = strlen(gensec_gssapi_state->target_principal);
+
+
+        maj_stat = gss_import_name (&min_stat,
+                                    &name_token,
+                                    name_type,
+                                    &gensec_gssapi_state->server_name);
+        if (maj_stat) {
+                DEBUG(2, ("GSS Import name of %s failed: %s\n",
+                          (char *)name_token.value,
+                          gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
         return NT_STATUS_OK;
 }
@@ -405 +373 @@
         }
         return nt_status;
-}
-
-
-/**
- * Check if the packet is one for this mechansim
- * 
- * @param gensec_security GENSEC state
- * @param in The request, as a DATA_BLOB
- * @return Error, INVALID_PARAMETER if it's not a packet for us
- *                or NT_STATUS_OK if the packet is ok. 
- */
-
-static NTSTATUS gensec_gssapi_magic(struct gensec_security *gensec_security, 
-                                    const DATA_BLOB *in) 
-{
-        if (gensec_gssapi_check_oid(in, GENSEC_OID_KERBEROS5)) {
-                return NT_STATUS_OK;
-        } else {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
 }
 
@@ -440 +388 @@
 
 static NTSTATUS gensec_gssapi_update(struct gensec_security *gensec_security, 
-                                   TALLOC_CTX *out_mem_ctx, 
-                                   const DATA_BLOB in, DATA_BLOB *out) 
+                                     TALLOC_CTX *out_mem_ctx,
+                                     struct tevent_context *ev,
+                                     const DATA_BLOB in, DATA_BLOB *out)
 {
         struct gensec_gssapi_state *gensec_gssapi_state
@@ -448 +397 @@
         OM_uint32 maj_stat, min_stat;
         OM_uint32 min_stat2;
-        gss_buffer_desc input_token, output_token;
+        gss_buffer_desc input_token = { 0, NULL };
+        gss_buffer_desc output_token = { 0, NULL };
+
         gss_OID gss_oid_p = NULL;
+        OM_uint32 time_req = 0;
+        OM_uint32 time_rec = 0;
+        struct timeval tv;
+
+        time_req = gensec_setting_int(gensec_security->settings,
+                                      "gensec_gssapi", "requested_life_time",
+                                      time_req);
+
         input_token.length = in.length;
         input_token.value = in.data;
@@ -459 +418 @@
                 case GENSEC_CLIENT:
                 {
+#ifdef SAMBA4_USES_HEIMDAL
                         struct gsskrb5_send_to_kdc send_to_kdc;
                         krb5_error_code ret;
+#endif
+
+                        nt_status = gensec_gssapi_client_creds(gensec_security, ev);
+                        if (!NT_STATUS_IS_OK(nt_status)) {
+                                return nt_status;
+                        }
+
+#ifdef SAMBA4_USES_HEIMDAL
                         send_to_kdc.func = smb_krb5_send_and_recv_func;
-                        send_to_kdc.ptr = gensec_security->event_ctx;
+                        send_to_kdc.ptr = ev;
 
                         min_stat = gsskrb5_set_send_to_kdc(&send_to_kdc);
                         if (min_stat) {
-                                DEBUG(1,("gensec_krb5_start: gsskrb5_set_send_to_kdc failed\n"));
+                                DEBUG(1,("gensec_gssapi_update: gsskrb5_set_send_to_kdc failed\n"));
                                 return NT_STATUS_INTERNAL_ERROR;
                         }
-
+#endif
                         maj_stat = gss_init_sec_context(&min_stat, 
                                                         gensec_gssapi_state->client_cred->creds,
@@ -475 +443 @@
                                                         gensec_gssapi_state->server_name, 
                                                         gensec_gssapi_state->gss_oid,
-                                                        gensec_gssapi_state->want_flags, 
-                                                        0, 
+                                                        gensec_gssapi_state->gss_want_flags, 
+                                                        time_req,
                                                         gensec_gssapi_state->input_chan_bindings,
                                                         &input_token, 
                                                         &gss_oid_p,
                                                         &output_token, 
-                                                        &gensec_gssapi_state->got_flags, /* ret flags */
-                                                        NULL);
+                                                        &gensec_gssapi_state->gss_got_flags, /* ret flags */
+                                                        &time_rec);
                         if (gss_oid_p) {
                                 gensec_gssapi_state->gss_oid = gss_oid_p;
                         }
 
+#ifdef SAMBA4_USES_HEIMDAL
                         send_to_kdc.func = smb_krb5_send_and_recv_func;
                         send_to_kdc.ptr = NULL;
@@ -492 +461 @@
                         ret = gsskrb5_set_send_to_kdc(&send_to_kdc);
                         if (ret) {
-                                DEBUG(1,("gensec_krb5_start: gsskrb5_set_send_to_kdc failed\n"));
+                                DEBUG(1,("gensec_gssapi_update: gsskrb5_set_send_to_kdc failed\n"));
                                 return NT_STATUS_INTERNAL_ERROR;
                         }
-
+#endif
                         break;
                 }
@@ -508 +477 @@
                                                           &gss_oid_p,
                                                           &output_token, 
-                                                          &gensec_gssapi_state->got_flags, 
-                                                          NULL, 
+                                                          &gensec_gssapi_state->gss_got_flags, 
+                                                          &time_rec,
                                                           &gensec_gssapi_state->delegated_cred_handle);
                         if (gss_oid_p) {
@@ -527 +496 @@
                         gss_release_buffer(&min_stat2, &output_token);
                         
-                        if (gensec_gssapi_state->got_flags & GSS_C_DELEG_FLAG) {
+                        if (gensec_gssapi_state->gss_got_flags & GSS_C_DELEG_FLAG &&
+                            gensec_gssapi_state->delegated_cred_handle != GSS_C_NO_CREDENTIAL) {
                                 DEBUG(5, ("gensec_gssapi: credentials were delegated\n"));
                         } else {
                                 DEBUG(5, ("gensec_gssapi: NO credentials were delegated\n"));
                         }
+
+                        tv = timeval_current_ofs(time_rec, 0);
+                        gensec_gssapi_state->expire_time = timeval_to_nttime(&tv);
 
                         /* We may have been invoked as SASL, so there
@@ -556 +529 @@
                         
                         return NT_STATUS_MORE_PROCESSING_REQUIRED;
-                } else if (gss_oid_equal(gensec_gssapi_state->gss_oid, gss_mech_krb5)) {
+                } else if (maj_stat == GSS_S_CONTEXT_EXPIRED) {
+                        gss_cred_id_t creds = NULL;
+                        gss_name_t name;
+                        gss_buffer_desc buffer;
+                        OM_uint32 lifetime = 0;
+                        gss_cred_usage_t usage;
+                        const char *role = NULL;
+                        DEBUG(0, ("GSS %s Update(krb5)(%d) Update failed, credentials expired during GSSAPI handshake!\n",
+                                  role,
+                                  gensec_gssapi_state->gss_exchange_count));
+
+                        
+                        switch (gensec_security->gensec_role) {
+                        case GENSEC_CLIENT:
+                                creds = gensec_gssapi_state->client_cred->creds;
+                                role = "client";
+                                break;
+                        case GENSEC_SERVER:
+                                creds = gensec_gssapi_state->server_cred->creds;
+                                role = "server";
+                                break;
+                        }
+
+                        maj_stat = gss_inquire_cred(&min_stat, 
+                                                    creds,
+                                                    &name, &lifetime, &usage, NULL);
+
+                        if (maj_stat == GSS_S_COMPLETE) {
+                                const char *usage_string = NULL;
+                                switch (usage) {
+                                case GSS_C_BOTH:
+                                        usage_string = "GSS_C_BOTH";
+                                        break;
+                                case GSS_C_ACCEPT:
+                                        usage_string = "GSS_C_ACCEPT";
+                                        break;
+                                case GSS_C_INITIATE:
+                                        usage_string = "GSS_C_INITIATE";
+                                        break;
+                                }
+                                maj_stat = gss_display_name(&min_stat, name, &buffer, NULL);
+                                if (maj_stat) {
+                                        buffer.value = NULL;
+                                        buffer.length = 0;
+                                }
+                                if (lifetime > 0) {
+                                        DEBUG(0, ("GSSAPI gss_inquire_cred indicates expiry of %*.*s in %u sec for %s\n", 
+                                                  (int)buffer.length, (int)buffer.length, (char *)buffer.value, 
+                                                  lifetime, usage_string));
+                                } else {
+                                        DEBUG(0, ("GSSAPI gss_inquire_cred indicates %*.*s has already expired for %s\n", 
+                                                  (int)buffer.length, (int)buffer.length, (char *)buffer.value, 
+                                                  usage_string));
+                                }
+                                gss_release_buffer(&min_stat, &buffer);
+                                gss_release_name(&min_stat, &name);
+                        } else if (maj_stat != GSS_S_COMPLETE) {
+                                DEBUG(0, ("inquiry of credential lifefime via GSSAPI gss_inquire_cred failed: %s\n",
+                                          gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                        }
+                        return NT_STATUS_INVALID_PARAMETER;
+                } else if (smb_gss_oid_equal(gensec_gssapi_state->gss_oid,
+                                             gss_mech_krb5)) {
                         switch (min_stat) {
                         case KRB5KRB_AP_ERR_TKT_NYV:
@@ -569 +604 @@
                                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
                         case KRB5_KDC_UNREACH:
-                                DEBUG(3, ("Cannot reach a KDC we require in order to obtain a ticetk to %s: %s\n",
+                                DEBUG(3, ("Cannot reach a KDC we require in order to obtain a ticket to %s: %s\n",
                                           gensec_gssapi_state->target_principal,
                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
@@ -586 +621 @@
                                           gensec_gssapi_state->gss_exchange_count,
                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                                return nt_status;
+                                return NT_STATUS_LOGON_FAILURE;
                         }
                 } else {
@@ -593 +628 @@
                                   gensec_gssapi_state->gss_exchange_count,
                                   gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                        return nt_status;
+                        return NT_STATUS_LOGON_FAILURE;
                 }
                 break;
@@ -942 +977 @@
         if (GSS_ERROR(maj_stat)) {
                 TALLOC_CTX *mem_ctx = talloc_new(NULL); 
-                DEBUG(1, ("gensec_gssapi_max_input_size: determinaing signature size with gss_wrap_size_limit failed: %s\n", 
+                DEBUG(1, ("gensec_gssapi_max_input_size: determining signature size with gss_wrap_size_limit failed: %s\n",
                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
                 talloc_free(mem_ctx);
@@ -966 +1001 @@
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        OM_uint32 maj_stat, min_stat;
-        gss_buffer_desc input_token, output_token;
-        int conf_state;
-        ssize_t sig_length;
-
-        input_token.length = length;
-        input_token.value = data;
-        
-        maj_stat = gss_wrap(&min_stat, 
-                            gensec_gssapi_state->gssapi_context,
-                            gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
-                            GSS_C_QOP_DEFAULT,
-                            &input_token,
-                            &conf_state,
-                            &output_token);
-        if (GSS_ERROR(maj_stat)) {
-                DEBUG(1, ("gensec_gssapi_seal_packet: GSS Wrap failed: %s\n", 
-                          gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        if (output_token.length < input_token.length) {
-                DEBUG(1, ("gensec_gssapi_seal_packet: GSS Wrap length [%ld] *less* than caller length [%ld]\n", 
-                          (long)output_token.length, (long)length));
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-        sig_length = output_token.length - input_token.length;
-
-        memcpy(data, ((uint8_t *)output_token.value) + sig_length, length);
-        *sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, sig_length);
-
-        dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
-        dump_data_pw("gensec_gssapi_seal_packet: clear\n", data, length);
-        dump_data_pw("gensec_gssapi_seal_packet: sealed\n", ((uint8_t *)output_token.value) + sig_length, output_token.length - sig_length);
-
-        gss_release_buffer(&min_stat, &output_token);
-
-        if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
-            && !conf_state) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
+        bool hdr_signing = false;
+        size_t sig_size = 0;
+        NTSTATUS status;
+
+        if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+                hdr_signing = true;
+        }
+
+        sig_size = gensec_gssapi_sig_size(gensec_security, length);
+
+        status = gssapi_seal_packet(gensec_gssapi_state->gssapi_context,
+                                    gensec_gssapi_state->gss_oid,
+                                    hdr_signing, sig_size,
+                                    data, length,
+                                    whole_pdu, pdu_length,
+                                    mem_ctx, sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("gssapi_seal_packet(hdr_signing=%u,sig_size=%zu,"
+                          "data=%zu,pdu=%zu) failed: %s\n",
+                          hdr_signing, sig_size, length, pdu_length,
+                          nt_errstr(status)));
+                return status;
+        }
+
         return NT_STATUS_OK;
 }
 
 static NTSTATUS gensec_gssapi_unseal_packet(struct gensec_security *gensec_security, 
-                                            TALLOC_CTX *mem_ctx, 
                                             uint8_t *data, size_t length, 
                                             const uint8_t *whole_pdu, size_t pdu_length,
@@ -1018 +1035 @@
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        OM_uint32 maj_stat, min_stat;
-        gss_buffer_desc input_token, output_token;
-        int conf_state;
-        gss_qop_t qop_state;
-        DATA_BLOB in;
-
-        dump_data_pw("gensec_gssapi_unseal_packet: sig\n", sig->data, sig->length);
-
-        in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
-
-        memcpy(in.data, sig->data, sig->length);
-        memcpy(in.data + sig->length, data, length);
-
-        input_token.length = in.length;
-        input_token.value = in.data;
-        
-        maj_stat = gss_unwrap(&min_stat, 
-                              gensec_gssapi_state->gssapi_context, 
-                              &input_token,
-                              &output_token, 
-                              &conf_state,
-                              &qop_state);
-        if (GSS_ERROR(maj_stat)) {
-                DEBUG(1, ("gensec_gssapi_unseal_packet: GSS UnWrap failed: %s\n", 
-                          gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        if (output_token.length != length) {
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        memcpy(data, output_token.value, length);
-
-        gss_release_buffer(&min_stat, &output_token);
-        
-        if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
-            && !conf_state) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
+        bool hdr_signing = false;
+        NTSTATUS status;
+
+        if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+                hdr_signing = true;
+        }
+
+        status = gssapi_unseal_packet(gensec_gssapi_state->gssapi_context,
+                                      gensec_gssapi_state->gss_oid,
+                                      hdr_signing,
+                                      data, length,
+                                      whole_pdu, pdu_length,
+                                      sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("gssapi_unseal_packet(hdr_signing=%u,sig_size=%zu,"
+                          "data=%zu,pdu=%zu) failed: %s\n",
+                          hdr_signing, sig->length, length, pdu_length,
+                          nt_errstr(status)));
+                return status;
+        }
+
         return NT_STATUS_OK;
 }
@@ -1069 +1067 @@
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        OM_uint32 maj_stat, min_stat;
-        gss_buffer_desc input_token, output_token;
+        bool hdr_signing = false;
+        NTSTATUS status;
 
         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
-                input_token.length = pdu_length;
-                input_token.value = discard_const_p(uint8_t *, whole_pdu);
-        } else {
-                input_token.length = length;
-                input_token.value = discard_const_p(uint8_t *, data);
-        }
-
-        maj_stat = gss_get_mic(&min_stat,
-                            gensec_gssapi_state->gssapi_context,
-                            GSS_C_QOP_DEFAULT,
-                            &input_token,
-                            &output_token);
-        if (GSS_ERROR(maj_stat)) {
-                DEBUG(1, ("GSS GetMic failed: %s\n",
-                          gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        *sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, output_token.length);
-
-        dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
-
-        gss_release_buffer(&min_stat, &output_token);
+                hdr_signing = true;
+        }
+
+        status = gssapi_sign_packet(gensec_gssapi_state->gssapi_context,
+                                    gensec_gssapi_state->gss_oid,
+                                    hdr_signing,
+                                    data, length,
+                                    whole_pdu, pdu_length,
+                                    mem_ctx, sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("gssapi_sign_packet(hdr_signing=%u,"
+                          "data=%zu,pdu=%zu) failed: %s\n",
+                          hdr_signing, length, pdu_length,
+                          nt_errstr(status)));
+                return status;
+        }
 
         return NT_STATUS_OK;
@@ -1101 +1092 @@
 
 static NTSTATUS gensec_gssapi_check_packet(struct gensec_security *gensec_security, 
-                                           TALLOC_CTX *mem_ctx, 
                                            const uint8_t *data, size_t length, 
                                            const uint8_t *whole_pdu, size_t pdu_length, 
@@ -1108 +1098 @@
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        OM_uint32 maj_stat, min_stat;
-        gss_buffer_desc input_token;
-        gss_buffer_desc input_message;
-        gss_qop_t qop_state;
-
-        dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
+        bool hdr_signing = false;
+        NTSTATUS status;
 
         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
-                input_message.length = pdu_length;
-                input_message.value = discard_const(whole_pdu);
-        } else {
-                input_message.length = length;
-                input_message.value = discard_const(data);
-        }
-
-        input_token.length = sig->length;
-        input_token.value = sig->data;
-
-        maj_stat = gss_verify_mic(&min_stat,
-                              gensec_gssapi_state->gssapi_context, 
-                              &input_message,
-                              &input_token,
-                              &qop_state);
-        if (GSS_ERROR(maj_stat)) {
-                DEBUG(1, ("GSS VerifyMic failed: %s\n",
-                          gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_ACCESS_DENIED;
+                hdr_signing = true;
+        }
+
+        status = gssapi_check_packet(gensec_gssapi_state->gssapi_context,
+                                     gensec_gssapi_state->gss_oid,
+                                     hdr_signing,
+                                     data, length,
+                                     whole_pdu, pdu_length,
+                                     sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("gssapi_check_packet(hdr_signing=%u,sig_size=%zu,"
+                          "data=%zu,pdu=%zu) failed: %s\n",
+                          hdr_signing, sig->length, length, pdu_length,
+                          nt_errstr(status)));
+                return status;
         }
 
@@ -1151 +1133 @@
                     && gensec_gssapi_state->sasl_state == STAGE_DONE) {
                         return ((gensec_gssapi_state->sasl_protection & NEG_SIGN) 
-                                && (gensec_gssapi_state->got_flags & GSS_C_INTEG_FLAG));
-                }
-                return gensec_gssapi_state->got_flags & GSS_C_INTEG_FLAG;
+                                && (gensec_gssapi_state->gss_got_flags & GSS_C_INTEG_FLAG));
+                }
+                return gensec_gssapi_state->gss_got_flags & GSS_C_INTEG_FLAG;
         }
         if (feature & GENSEC_FEATURE_SEAL) {
@@ -1160 +1142 @@
                     && gensec_gssapi_state->sasl_state == STAGE_DONE) {
                         return ((gensec_gssapi_state->sasl_protection & NEG_SEAL) 
-                                 && (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG));
-                }
-                return gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG;
+                                 && (gensec_gssapi_state->gss_got_flags & GSS_C_CONF_FLAG));
+                }
+                return gensec_gssapi_state->gss_got_flags & GSS_C_CONF_FLAG;
         }
         if (feature & GENSEC_FEATURE_SESSION_KEY) {
                 /* Only for GSSAPI/Krb5 */
-                if (gss_oid_equal(gensec_gssapi_state->gss_oid, gss_mech_krb5)) {
+                if (smb_gss_oid_equal(gensec_gssapi_state->gss_oid,
+                                      gss_mech_krb5)) {
                         return true;
                 }
         }
         if (feature & GENSEC_FEATURE_DCE_STYLE) {
-                return gensec_gssapi_state->got_flags & GSS_C_DCE_STYLE;
+                return gensec_gssapi_state->gss_got_flags & GSS_C_DCE_STYLE;
         }
         if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
                 NTSTATUS status;
-
-                if (!(gensec_gssapi_state->got_flags & GSS_C_INTEG_FLAG)) {
+                uint32_t keytype;
+
+                if (!(gensec_gssapi_state->gss_got_flags & GSS_C_INTEG_FLAG)) {
                         return false;
                 }
@@ -1187 +1171 @@
                 }
 
-                status = gensec_gssapi_init_lucid(gensec_gssapi_state);
-                if (!NT_STATUS_IS_OK(status)) {
-                        return false;
-                }
-
-                if (gensec_gssapi_state->lucid->protocol == 1) {
-                        return true;
-                }
-
-                return false;
+                status = gssapi_get_session_key(gensec_gssapi_state,
+                                                gensec_gssapi_state->gssapi_context, NULL, &keytype);
+                /* 
+                 * We should do a proper sig on the mechListMic unless
+                 * we know we have to be backwards compatible with
+                 * earlier windows versions.  
+                 * 
+                 * Negotiating a non-krb5
+                 * mech for example should be regarded as having
+                 * NEW_SPNEGO
+                 */
+                if (NT_STATUS_IS_OK(status)) {
+                        switch (keytype) {
+                        case ENCTYPE_DES_CBC_CRC:
+                        case ENCTYPE_DES_CBC_MD5:
+                        case ENCTYPE_ARCFOUR_HMAC:
+                        case ENCTYPE_DES3_CBC_SHA1:
+                                return false;
+                        }
+                }
+                return true;
         }
         /* We can always do async (rather than strict request/reply) packets.  */
@@ -1202 +1197 @@
                 return true;
         }
+        if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+                if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
+                        return true;
+                }
+
+                if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
+                        return true;
+                }
+
+                return false;
+        }
         return false;
+}
+
+static NTTIME gensec_gssapi_expire_time(struct gensec_security *gensec_security)
+{
+        struct gensec_gssapi_state *gensec_gssapi_state =
+                talloc_get_type_abort(gensec_security->private_data,
+                struct gensec_gssapi_state);
+
+        return gensec_gssapi_state->expire_time;
 }
 
@@ -1212 +1227 @@
  */
 static NTSTATUS gensec_gssapi_session_key(struct gensec_security *gensec_security, 
+                                          TALLOC_CTX *mem_ctx,
                                           DATA_BLOB *session_key) 
 {
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        OM_uint32 maj_stat, min_stat;
-        krb5_keyblock *subkey;
-
-        if (gensec_gssapi_state->sasl_state != STAGE_DONE) {
-                return NT_STATUS_NO_USER_SESSION_KEY;
-        }
-
-        if (gensec_gssapi_state->session_key.data) {
-                *session_key = gensec_gssapi_state->session_key;
-                return NT_STATUS_OK;
-        }
-
-        maj_stat = gsskrb5_get_subkey(&min_stat,
-                                      gensec_gssapi_state->gssapi_context,
-                                      &subkey);
-        if (maj_stat != 0) {
-                DEBUG(1, ("NO session key for this mech\n"));
-                return NT_STATUS_NO_USER_SESSION_KEY;
-        }
-        
-        DEBUG(10, ("Got KRB5 session key of length %d%s\n",
-                   (int)KRB5_KEY_LENGTH(subkey),
-                   (gensec_gssapi_state->sasl_state == STAGE_DONE)?" (done)":""));
-        *session_key = data_blob_talloc(gensec_gssapi_state,
-                                        KRB5_KEY_DATA(subkey), KRB5_KEY_LENGTH(subkey));
-        krb5_free_keyblock(gensec_gssapi_state->smb_krb5_context->krb5_context, subkey);
-        gensec_gssapi_state->session_key = *session_key;
-        dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
-
-        return NT_STATUS_OK;
+        return gssapi_get_session_key(mem_ctx, gensec_gssapi_state->gssapi_context, session_key, NULL);
 }
 
@@ -1252 +1239 @@
  * database lookup */
 static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_security,
+                                           TALLOC_CTX *mem_ctx,
                                            struct auth_session_info **_session_info) 
 {
         NTSTATUS nt_status;
-        TALLOC_CTX *mem_ctx;
+        TALLOC_CTX *tmp_ctx;
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        struct auth_user_info_dc *user_info_dc = NULL;
         struct auth_session_info *session_info = NULL;
         OM_uint32 maj_stat, min_stat;
-        gss_buffer_desc pac;
-        DATA_BLOB pac_blob;
-        struct PAC_SIGNATURE_DATA *pac_srv_sig = NULL;
-        struct PAC_SIGNATURE_DATA *pac_kdc_sig = NULL;
+        DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
+
+        gss_buffer_desc name_token;
+        char *principal_string;
         
-        if ((gensec_gssapi_state->gss_oid->length != gss_mech_krb5->length)
-            || (memcmp(gensec_gssapi_state->gss_oid->elements, gss_mech_krb5->elements, 
-                       gensec_gssapi_state->gss_oid->length) != 0)) {
-                DEBUG(1, ("NO session info available for this mech\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-                
-        mem_ctx = talloc_named(gensec_gssapi_state, 0, "gensec_gssapi_session_info context"); 
-        NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
-
-        maj_stat = gsskrb5_extract_authz_data_from_sec_context(&min_stat, 
-                                                               gensec_gssapi_state->gssapi_context, 
-                                                               KRB5_AUTHDATA_WIN2K_PAC,
-                                                               &pac);
-        
-        
-        if (maj_stat == 0) {
-                pac_blob = data_blob_talloc(mem_ctx, pac.value, pac.length);
-                gss_release_buffer(&min_stat, &pac);
-
-        } else {
-                pac_blob = data_blob(NULL, 0);
-        }
+        tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gssapi_session_info context");
+        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
+
+        maj_stat = gss_display_name (&min_stat,
+                                     gensec_gssapi_state->client_name,
+                                     &name_token,
+                                     NULL);
+        if (GSS_ERROR(maj_stat)) {
+                DEBUG(1, ("GSS display_name failed: %s\n",
+                          gssapi_error_string(tmp_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                talloc_free(tmp_ctx);
+                return NT_STATUS_FOOBAR;
+        }
+
+        principal_string = talloc_strndup(tmp_ctx,
+                                          (const char *)name_token.value,
+                                          name_token.length);
+
+        gss_release_buffer(&min_stat, &name_token);
+
+        if (!principal_string) {
+                talloc_free(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        nt_status = gssapi_obtain_pac_blob(tmp_ctx,  gensec_gssapi_state->gssapi_context,
+                                           gensec_gssapi_state->client_name,
+                                           &pac_blob);
         
         /* IF we have the PAC - otherwise we need to get this
@@ -1294 +1286 @@
          * kind... 
          */
-        if (pac_blob.length) {
-                pac_srv_sig = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
-                if (!pac_srv_sig) {
-                        talloc_free(mem_ctx);
-                        return NT_STATUS_NO_MEMORY;
-                }
-                pac_kdc_sig = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
-                if (!pac_kdc_sig) {
-                        talloc_free(mem_ctx);
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                nt_status = kerberos_pac_blob_to_user_info_dc(mem_ctx,
-                                                              pac_blob,
-                                                              gensec_gssapi_state->smb_krb5_context->krb5_context,
-                                                              &user_info_dc,
-                                                              pac_srv_sig,
-                                                              pac_kdc_sig);
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        talloc_free(mem_ctx);
-                        return nt_status;
-                }
-        } else {
-                gss_buffer_desc name_token;
-                char *principal_string;
-
-                maj_stat = gss_display_name (&min_stat,
-                                             gensec_gssapi_state->client_name,
-                                             &name_token,
-                                             NULL);
-                if (GSS_ERROR(maj_stat)) {
-                        DEBUG(1, ("GSS display_name failed: %s\n", 
-                                  gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                        talloc_free(mem_ctx);
-                        return NT_STATUS_FOOBAR;
-                }
-                
-                principal_string = talloc_strndup(mem_ctx, 
-                                                  (const char *)name_token.value, 
-                                                  name_token.length);
-                
-                gss_release_buffer(&min_stat, &name_token);
-                
-                if (!principal_string) {
-                        talloc_free(mem_ctx);
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                if (gensec_security->auth_context && 
-                    !gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
-                        DEBUG(1, ("Unable to find PAC, resorting to local user lookup: %s\n",
-                                  gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                        nt_status = gensec_security->auth_context->get_user_info_dc_principal(mem_ctx,
-                                                                                             gensec_security->auth_context, 
-                                                                                             principal_string,
-                                                                                             NULL,
-                                                                                             &user_info_dc);
-                        
-                        if (!NT_STATUS_IS_OK(nt_status)) {
-                                talloc_free(mem_ctx);
-                                return nt_status;
-                        }
-                } else {
-                        DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access: %s\n",
-                                  principal_string,
-                                  gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        /* references the user_info_dc into the session_info */
-        nt_status = gensec_generate_session_info(mem_ctx, gensec_security,
-                                                 user_info_dc, &session_info);
+        if (NT_STATUS_IS_OK(nt_status)) {
+                pac_blob_ptr = &pac_blob;
+        }
+        nt_status = gensec_generate_session_info_pac(tmp_ctx,
+                                                     gensec_security,
+                                                     gensec_gssapi_state->smb_krb5_context,
+                                                     pac_blob_ptr, principal_string,
+                                                     gensec_get_remote_address(gensec_security),
+                                                     &session_info);
         if (!NT_STATUS_IS_OK(nt_status)) {
-                talloc_free(mem_ctx);
+                talloc_free(tmp_ctx);
                 return nt_status;
         }
 
-        nt_status = gensec_gssapi_session_key(gensec_security, &session_info->session_key);
+        nt_status = gensec_gssapi_session_key(gensec_security, session_info, &session_info->session_key);
         if (!NT_STATUS_IS_OK(nt_status)) {
-                talloc_free(mem_ctx);
+                talloc_free(tmp_ctx);
                 return nt_status;
         }
 
-        /* Allow torture tests to check the PAC signatures */
-        if (session_info->torture) {
-                session_info->torture->pac_srv_sig = talloc_steal(session_info->torture, pac_srv_sig);
-                session_info->torture->pac_kdc_sig = talloc_steal(session_info->torture, pac_kdc_sig);
-        }
-
-        if (!(gensec_gssapi_state->got_flags & GSS_C_DELEG_FLAG)) {
-                DEBUG(10, ("gensec_gssapi: NO delegated credentials supplied by client\n"));
-        } else {
+        if (gensec_gssapi_state->gss_got_flags & GSS_C_DELEG_FLAG &&
+            gensec_gssapi_state->delegated_cred_handle != GSS_C_NO_CREDENTIAL) {
                 krb5_error_code ret;
                 const char *error_string;
@@ -1393 +1314 @@
                 session_info->credentials = cli_credentials_init(session_info);
                 if (!session_info->credentials) {
-                        talloc_free(mem_ctx);
+                        talloc_free(tmp_ctx);
                         return NT_STATUS_NO_MEMORY;
                 }
@@ -1406 +1327 @@
                                                            CRED_SPECIFIED, &error_string);
                 if (ret) {
-                        talloc_free(mem_ctx);
+                        talloc_free(tmp_ctx);
                         DEBUG(2,("Failed to get gss creds: %s\n", error_string));
                         return NT_STATUS_NO_MEMORY;
@@ -1416 +1337 @@
                 /* It has been taken from this place... */
                 gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
-        }
-        talloc_steal(gensec_gssapi_state, session_info);
-        talloc_free(mem_ctx);
-        *_session_info = session_info;
+        } else {
+                DEBUG(10, ("gensec_gssapi: NO delegated credentials supplied by client\n"));
+        }
+
+        *_session_info = talloc_steal(mem_ctx, session_info);
+        talloc_free(tmp_ctx);
 
         return NT_STATUS_OK;
@@ -1428 +1351 @@
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        NTSTATUS status;
-
-        if (gensec_gssapi_state->sig_size) {
+        size_t sig_size;
+
+        if (gensec_gssapi_state->sig_size > 0) {
                 return gensec_gssapi_state->sig_size;
         }
 
-        if (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG) {
-                gensec_gssapi_state->sig_size = 45;
-        } else {
-                gensec_gssapi_state->sig_size = 37;
-        }
-
-        status = gensec_gssapi_init_lucid(gensec_gssapi_state);
-        if (!NT_STATUS_IS_OK(status)) {
-                return gensec_gssapi_state->sig_size;
-        }
-
-        if (gensec_gssapi_state->lucid->protocol == 1) {
-                if (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG) {
-                        /*
-                         * TODO: windows uses 76 here, but we don't know
-                         *       gss_wrap works with aes keys yet
-                         */
-                        gensec_gssapi_state->sig_size = 76;
-                } else {
-                        gensec_gssapi_state->sig_size = 28;
-                }
-        } else if (gensec_gssapi_state->lucid->protocol == 0) {
-                switch (gensec_gssapi_state->lucid->rfc1964_kd.ctx_key.type) {
-                case KEYTYPE_DES:
-                case KEYTYPE_ARCFOUR:
-                case KEYTYPE_ARCFOUR_56:
-                        if (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG) {
-                                gensec_gssapi_state->sig_size = 45;
-                        } else {
-                                gensec_gssapi_state->sig_size = 37;
-                        }
-                        break;
-                case KEYTYPE_DES3:
-                        if (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG) {
-                                gensec_gssapi_state->sig_size = 57;
-                        } else {
-                                gensec_gssapi_state->sig_size = 49;
-                        }
-                        break;
-                }
-        }
-
+        sig_size = gssapi_get_sig_size(gensec_gssapi_state->gssapi_context,
+                                       gensec_gssapi_state->gss_oid,
+                                       gensec_gssapi_state->gss_want_flags,
+                                       data_size);
+
+        gensec_gssapi_state->sig_size = sig_size;
         return gensec_gssapi_state->sig_size;
 }
@@ -1498 +1385 @@
         .client_start   = gensec_gssapi_client_start,
         .server_start   = gensec_gssapi_server_start,
-        .magic          = gensec_gssapi_magic,
+        .magic          = gensec_magic_check_krb5_oid,
         .update         = gensec_gssapi_update,
         .session_key    = gensec_gssapi_session_key,
@@ -1506 +1393 @@
         .seal_packet    = gensec_gssapi_seal_packet,
         .unseal_packet  = gensec_gssapi_unseal_packet,
+        .max_input_size   = gensec_gssapi_max_input_size,
+        .max_wrapped_size = gensec_gssapi_max_wrapped_size,
         .wrap           = gensec_gssapi_wrap,
         .unwrap         = gensec_gssapi_unwrap,
         .have_feature   = gensec_gssapi_have_feature,
+        .expire_time    = gensec_gssapi_expire_time,
         .enabled        = false,
         .kerberos       = true,
@@ -1521 +1411 @@
         .client_start   = gensec_gssapi_client_start,
         .server_start   = gensec_gssapi_server_start,
-        .magic          = gensec_gssapi_magic,
+        .magic          = gensec_magic_check_krb5_oid,
         .update         = gensec_gssapi_update,
         .session_key    = gensec_gssapi_session_key,
@@ -1530 +1420 @@
         .seal_packet    = gensec_gssapi_seal_packet,
         .unseal_packet  = gensec_gssapi_unseal_packet,
+        .max_input_size   = gensec_gssapi_max_input_size,
+        .max_wrapped_size = gensec_gssapi_max_wrapped_size,
         .wrap           = gensec_gssapi_wrap,
         .unwrap         = gensec_gssapi_unwrap,
         .have_feature   = gensec_gssapi_have_feature,
+        .expire_time    = gensec_gssapi_expire_time,
         .enabled        = true,
         .kerberos       = true,
@@ -1552 +1445 @@
         .unwrap           = gensec_gssapi_unwrap,
         .have_feature     = gensec_gssapi_have_feature,
+        .expire_time      = gensec_gssapi_expire_time,
         .enabled          = true,
         .kerberos         = true,

vendor/current/source4/auth/gensec/gensec_gssapi.h

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
    Kerberos backend for GENSEC
-   
+
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
    Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
@@ -11 +11 @@
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -17 +17 @@
    GNU General Public License for more details.
 
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -24 +24 @@
 /* This structure described here, so the RPC-PAC test can get at the PAC provided */
 
-enum gensec_gssapi_sasl_state 
+enum gensec_gssapi_sasl_state
 {
         STAGE_GSS_NEG,
@@ -38 +38 @@
 struct gensec_gssapi_state {
         gss_ctx_id_t gssapi_context;
-        struct gss_channel_bindings_struct *input_chan_bindings;
         gss_name_t server_name;
         gss_name_t client_name;
-        OM_uint32 want_flags, got_flags;
+        OM_uint32 gss_want_flags, gss_got_flags;
+
+        gss_cred_id_t delegated_cred_handle;
+
+        NTTIME expire_time;
+
+        /* gensec_gssapi only */
         gss_OID gss_oid;
 
-        DATA_BLOB session_key;
-        DATA_BLOB pac;
-
+        struct gss_channel_bindings_struct *input_chan_bindings;
         struct smb_krb5_context *smb_krb5_context;
         struct gssapi_creds_container *client_cred;
         struct gssapi_creds_container *server_cred;
-        gss_krb5_lucid_context_v1_t *lucid;
-
-        gss_cred_id_t delegated_cred_handle;
 
         bool sasl; /* We have two different mechs in this file: One
@@ -68 +68 @@
         const char *target_principal;
 };
-

vendor/current/source4/auth/gensec/gensec_krb5.c

@@ -28 +28 @@
 #include "auth/kerberos/kerberos.h"
 #include "auth/auth.h"
-#include "lib/socket/socket.h"
 #include "lib/tsocket/tsocket.h"
-#include "librpc/rpc/dcerpc.h"
+#include "librpc/gen_ndr/dcerpc.h"
 #include "auth/credentials/credentials.h"
 #include "auth/credentials/credentials_krb5.h"
 #include "auth/kerberos/kerberos_credentials.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h"
 #include "auth/gensec/gensec_proto.h"
+#include "auth/gensec/gensec_toplevel_proto.h"
 #include "param/param.h"
 #include "auth/auth_sam_reply.h"
 #include "lib/util/util_net.h"
+#include "../lib/util/asn1.h"
+#include "auth/kerberos/pac_utils.h"
+#include "gensec_krb5_util.h"
+
+_PUBLIC_ NTSTATUS gensec_krb5_init(void);
 
 enum GENSEC_KRB5_STATE {
@@ -48 +54 @@
 
 struct gensec_krb5_state {
-        DATA_BLOB session_key;
-        DATA_BLOB pac;
         enum GENSEC_KRB5_STATE state_position;
         struct smb_krb5_context *smb_krb5_context;
@@ -113 +117 @@
         ZERO_STRUCT(gensec_krb5_state->enc_ticket);
         gensec_krb5_state->keyblock = NULL;
-        gensec_krb5_state->session_key = data_blob(NULL, 0);
-        gensec_krb5_state->pac = data_blob(NULL, 0);
         gensec_krb5_state->gssapi = gssapi;
 
@@ -234 +236 @@
 static NTSTATUS gensec_krb5_common_client_start(struct gensec_security *gensec_security, bool gssapi)
 {
+        const char *hostname;
         struct gensec_krb5_state *gensec_krb5_state;
-        krb5_error_code ret;
         NTSTATUS nt_status;
-        struct ccache_container *ccache_container;
-        const char *hostname;
-        const char *error_string;
-        const char *principal;
-        krb5_data in_data;
-        struct tevent_context *previous_ev;
-
         hostname = gensec_get_target_hostname(gensec_security);
         if (!hostname) {
-                DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
+                DEBUG(3, ("No hostname for target computer passed in, cannot use kerberos for this connection\n"));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -268 +263 @@
 
         if (gensec_krb5_state->gssapi) {
-                /* The Fake GSSAPI modal emulates Samba3, which does not do mutual authentication */
+                /* The Fake GSSAPI model emulates Samba3, which does not do mutual authentication */
                 if (gensec_setting_bool(gensec_security->settings, "gensec_fake_gssapi_krb5", "mutual", false)) {
                         gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
@@ -278 +273 @@
                 }
         }
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_krb5_common_client_creds(struct gensec_security *gensec_security,
+                                                struct tevent_context *ev,
+                                                bool gssapi)
+{
+        struct gensec_krb5_state *gensec_krb5_state;
+        krb5_error_code ret;
+        struct ccache_container *ccache_container;
+        const char *error_string;
+        const char *principal;
+        const char *hostname;
+        krb5_data in_data = { .length = 0 };
+        krb5_data *in_data_p = NULL;
+        struct tevent_context *previous_ev;
+
+        if (lpcfg_parm_bool(gensec_security->settings->lp_ctx,
+                            NULL, "gensec_krb5", "send_authenticator_checksum", true)) {
+                in_data_p = &in_data;
+        }
+        
+        gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 
         principal = gensec_get_target_principal(gensec_security);
+        hostname = gensec_get_target_hostname(gensec_security);
 
         ret = cli_credentials_get_ccache(gensec_get_credentials(gensec_security), 
-                                         gensec_security->event_ctx, 
+                                         ev,
                                          gensec_security->settings->lp_ctx, &ccache_container, &error_string);
         switch (ret) {
@@ -301 +320 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        in_data.length = 0;
         
         /* Do this every time, in case we have weird recursive issues here */
-        ret = smb_krb5_context_set_event_ctx(gensec_krb5_state->smb_krb5_context, gensec_security->event_ctx, &previous_ev);
+        ret = smb_krb5_context_set_event_ctx(gensec_krb5_state->smb_krb5_context, ev, &previous_ev);
         if (ret != 0) {
                 DEBUG(1, ("gensec_krb5_start: Setting event context failed\n"));
@@ -318 +336 @@
                                                 gensec_krb5_state->ap_req_options, 
                                                 target_principal,
-                                                &in_data, ccache_container->ccache, 
+                                                in_data_p, ccache_container->ccache, 
                                                 &gensec_krb5_state->enc_ticket);
                         krb5_free_principal(gensec_krb5_state->smb_krb5_context->krb5_context, 
@@ -329 +347 @@
                                   gensec_get_target_service(gensec_security),
                                   hostname,
-                                  &in_data, ccache_container->ccache, 
+                                  in_data_p, ccache_container->ccache, 
                                   &gensec_krb5_state->enc_ticket);
         }
 
-        smb_krb5_context_remove_event_ctx(gensec_krb5_state->smb_krb5_context, previous_ev, gensec_security->event_ctx);
+        smb_krb5_context_remove_event_ctx(gensec_krb5_state->smb_krb5_context, previous_ev, ev);
 
         switch (ret) {
@@ -383 +401 @@
 }
 
-/**
- * Check if the packet is one for this mechansim
- * 
- * @param gensec_security GENSEC state
- * @param in The request, as a DATA_BLOB
- * @return Error, INVALID_PARAMETER if it's not a packet for us
- *                or NT_STATUS_OK if the packet is ok. 
- */
-
-static NTSTATUS gensec_fake_gssapi_krb5_magic(struct gensec_security *gensec_security, 
-                                  const DATA_BLOB *in) 
-{
-        if (gensec_gssapi_check_oid(in, GENSEC_OID_KERBEROS5)) {
-                return NT_STATUS_OK;
+
+/*
+  generate a krb5 GSS-API wrapper packet given a ticket
+*/
+static DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *ticket, const uint8_t tok_id[2])
+{
+        struct asn1_data *data;
+        DATA_BLOB ret = data_blob_null;
+
+        data = asn1_init(mem_ctx);
+        if (!data || !ticket->data) {
+                return ret;
+        }
+
+        if (!asn1_push_tag(data, ASN1_APPLICATION(0))) goto err;
+        if (!asn1_write_OID(data, GENSEC_OID_KERBEROS5)) goto err;
+
+        if (!asn1_write(data, tok_id, 2)) goto err;
+        if (!asn1_write(data, ticket->data, ticket->length)) goto err;
+        if (!asn1_pop_tag(data)) goto err;
+
+
+        if (!asn1_extract_blob(data, mem_ctx, &ret)) {
+                goto err;
+        }
+        asn1_free(data);
+
+        return ret;
+
+  err:
+
+        DEBUG(1, ("Failed to build krb5 wrapper at offset %d\n",
+                  (int)asn1_current_ofs(data)));
+        asn1_free(data);
+        return ret;
+}
+
+/*
+  parse a krb5 GSS-API wrapper packet giving a ticket
+*/
+static bool gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, DATA_BLOB *ticket, uint8_t tok_id[2])
+{
+        bool ret = false;
+        struct asn1_data *data = asn1_init(mem_ctx);
+        int data_remaining;
+
+        if (!data) {
+                return false;
+        }
+
+        if (!asn1_load(data, *blob)) goto err;
+        if (!asn1_start_tag(data, ASN1_APPLICATION(0))) goto err;
+        if (!asn1_check_OID(data, GENSEC_OID_KERBEROS5)) goto err;
+
+        data_remaining = asn1_tag_remaining(data);
+
+        if (data_remaining < 3) {
+                asn1_set_error(data);
         } else {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-}
-
+                if (!asn1_read(data, tok_id, 2)) goto err;
+                data_remaining -= 2;
+                *ticket = data_blob_talloc(mem_ctx, NULL, data_remaining);
+                if (!asn1_read(data, ticket->data, ticket->length)) goto err;
+        }
+
+        if (!asn1_end_tag(data)) goto err;
+
+        ret = !asn1_has_error(data);
+
+  err:
+
+        asn1_free(data);
+
+        return ret;
+}
 
 /**
@@ -416 +490 @@
 static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security, 
                                    TALLOC_CTX *out_mem_ctx, 
+                                   struct tevent_context *ev,
                                    const DATA_BLOB in, DATA_BLOB *out) 
 {
@@ -427 +502 @@
                 DATA_BLOB unwrapped_out;
                 
+                nt_status = gensec_krb5_common_client_creds(gensec_security, ev, gensec_krb5_state->gssapi);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+
                 if (gensec_krb5_state->gssapi) {
                         unwrapped_out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
@@ -506 +586 @@
                 }
                 
-                /* This ensures we lookup the correct entry in that keytab */
+                /* This ensures we lookup the correct entry in that
+                 * keytab.  A NULL principal is acceptable, and means
+                 * that the krb5 libs should search the keytab at
+                 * accept time for any matching key */
                 ret = principal_from_credentials(out_mem_ctx, gensec_get_credentials(gensec_security), 
                                                  gensec_krb5_state->smb_krb5_context, 
@@ -514 +597 @@
                         DEBUG(2,("Failed to make credentials from principal: %s\n", error_string));
                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+                }
+
+                if (keytab->password_based || obtained < CRED_SPECIFIED) {
+                        /* 
+                         * Use match-by-key in this case (matches
+                         * cli_credentials_get_server_gss_creds()
+                         * behaviour).  No need to free the memory,
+                         * this is handled with a talloc destructor.
+                         */
+                        server_in_keytab = NULL;
                 }
 
@@ -557 +650 @@
 
 static NTSTATUS gensec_krb5_session_key(struct gensec_security *gensec_security, 
+                                        TALLOC_CTX *mem_ctx,
                                         DATA_BLOB *session_key) 
 {
@@ -567 +661 @@
         if (gensec_krb5_state->state_position != GENSEC_KRB5_DONE) {
                 return NT_STATUS_NO_USER_SESSION_KEY;
-        }
-
-        if (gensec_krb5_state->session_key.data) {
-                *session_key = gensec_krb5_state->session_key;
-                return NT_STATUS_OK;
         }
 
@@ -585 +674 @@
                 DEBUG(10, ("Got KRB5 session key of length %d\n",  
                            (int)KRB5_KEY_LENGTH(skey)));
-                gensec_krb5_state->session_key = data_blob_talloc(gensec_krb5_state, 
-                                                KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
-                *session_key = gensec_krb5_state->session_key;
+                *session_key = data_blob_talloc(mem_ctx,
+                                               KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 
@@ -599 +687 @@
 
 static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security,
+                                         TALLOC_CTX *mem_ctx,
                                          struct auth_session_info **_session_info) 
 {
@@ -604 +693 @@
         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
-        struct auth_user_info_dc *user_info_dc = NULL;
         struct auth_session_info *session_info = NULL;
-        struct PAC_LOGON_INFO *logon_info;
 
         krb5_principal client_principal;
         char *principal_string;
         
-        DATA_BLOB pac;
+        DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
         krb5_data pac_data;
 
         krb5_error_code ret;
 
-        TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
-        if (!mem_ctx) {
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
                 return NT_STATUS_NO_MEMORY;
         }
@@ -625 +712 @@
                 DEBUG(5, ("krb5_ticket_get_client failed to get cleint principal: %s\n", 
                           smb_get_krb5_error_message(context, 
-                                                     ret, mem_ctx)));
-                talloc_free(mem_ctx);
+                                                     ret, tmp_ctx)));
+                talloc_free(tmp_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
@@ -635 +722 @@
                 DEBUG(1, ("Unable to parse client principal: %s\n",
                           smb_get_krb5_error_message(context, 
-                                                     ret, mem_ctx)));
+                                                     ret, tmp_ctx)));
                 krb5_free_principal(context, client_principal);
-                talloc_free(mem_ctx);
+                talloc_free(tmp_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
@@ -645 +732 @@
                                                       &pac_data);
         
-        if (ret && gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
-                DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access: %s \n",
-                          principal_string,
-                          smb_get_krb5_error_message(context, 
-                                                     ret, mem_ctx)));
-                free(principal_string);
-                krb5_free_principal(context, client_principal);
-                talloc_free(mem_ctx);
-                return NT_STATUS_ACCESS_DENIED;
-        } else if (ret) {
+        if (ret) {
                 /* NO pac */
                 DEBUG(5, ("krb5_ticket_get_authorization_data_type failed to find PAC: %s\n", 
                           smb_get_krb5_error_message(context, 
-                                                     ret, mem_ctx)));
-                if (gensec_security->auth_context && 
-                    !gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
-                        DEBUG(1, ("Unable to find PAC for %s, resorting to local user lookup: %s",
-                                  principal_string, smb_get_krb5_error_message(context, 
-                                                     ret, mem_ctx)));
-                        nt_status = gensec_security->auth_context->get_user_info_dc_principal(mem_ctx,
-                                                                                             gensec_security->auth_context, 
-                                                                                             principal_string,
-                                                                                             NULL, &user_info_dc);
-                        if (!NT_STATUS_IS_OK(nt_status)) {
-                                free(principal_string);
-                                krb5_free_principal(context, client_principal);
-                                talloc_free(mem_ctx);
-                                return nt_status;
-                        }
-                } else {
-                        DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access\n",
-                                  principal_string));
+                                                     ret, tmp_ctx)));
+        } else {
+                /* Found pac */
+                pac_blob = data_blob_talloc(tmp_ctx, pac_data.data, pac_data.length);
+                kerberos_free_data_contents(context, &pac_data);
+                if (!pac_blob.data) {
                         free(principal_string);
                         krb5_free_principal(context, client_principal);
-                        talloc_free(mem_ctx);
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        } else {
-                /* Found pac */
-                union netr_Validation validation;
-
-                pac = data_blob_talloc(mem_ctx, pac_data.data, pac_data.length);
-                if (!pac.data) {
-                        free(principal_string);
-                        krb5_free_principal(context, client_principal);
-                        talloc_free(mem_ctx);
+                        talloc_free(tmp_ctx);
                         return NT_STATUS_NO_MEMORY;
                 }
 
                 /* decode and verify the pac */
-                nt_status = kerberos_pac_logon_info(gensec_krb5_state, 
-                                                    &logon_info, pac,
-                                                    gensec_krb5_state->smb_krb5_context->krb5_context,
-                                                    NULL, gensec_krb5_state->keyblock,
-                                                    client_principal,
-                                                    gensec_krb5_state->ticket->ticket.authtime, NULL);
+                nt_status = kerberos_decode_pac(gensec_krb5_state,
+                                                pac_blob,
+                                                gensec_krb5_state->smb_krb5_context->krb5_context,
+                                                NULL, gensec_krb5_state->keyblock,
+                                                client_principal,
+                                                gensec_krb5_state->ticket->ticket.authtime, NULL);
 
                 if (!NT_STATUS_IS_OK(nt_status)) {
                         free(principal_string);
                         krb5_free_principal(context, client_principal);
-                        talloc_free(mem_ctx);
+                        talloc_free(tmp_ctx);
                         return nt_status;
                 }
 
-                validation.sam3 = &logon_info->info3;
-                nt_status = make_user_info_dc_netlogon_validation(mem_ctx,
-                                                                 NULL,
-                                                                 3, &validation,
-                                                                 &user_info_dc);
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        free(principal_string);
-                        krb5_free_principal(context, client_principal);
-                        talloc_free(mem_ctx);
-                        return nt_status;
-                }
-        }
+                pac_blob_ptr = &pac_blob;
+        }
+
+        nt_status = gensec_generate_session_info_pac(tmp_ctx,
+                                                     gensec_security,
+                                                     gensec_krb5_state->smb_krb5_context,
+                                                     pac_blob_ptr, principal_string,
+                                                     gensec_get_remote_address(gensec_security),
+                                                     &session_info);
 
         free(principal_string);
         krb5_free_principal(context, client_principal);
 
-        /* references the user_info_dc into the session_info */
-        nt_status = gensec_generate_session_info(mem_ctx, gensec_security, user_info_dc, &session_info);
-
         if (!NT_STATUS_IS_OK(nt_status)) {
-                talloc_free(mem_ctx);
+                talloc_free(tmp_ctx);
                 return nt_status;
         }
 
-        nt_status = gensec_krb5_session_key(gensec_security, &session_info->session_key);
+        nt_status = gensec_krb5_session_key(gensec_security, session_info, &session_info->session_key);
 
         if (!NT_STATUS_IS_OK(nt_status)) {
-                talloc_free(mem_ctx);
+                talloc_free(tmp_ctx);
                 return nt_status;
         }
 
-        *_session_info = session_info;
-
-        talloc_steal(gensec_krb5_state, session_info);
-        talloc_free(mem_ctx);
+        *_session_info = talloc_steal(mem_ctx, session_info);
+
+        talloc_free(tmp_ctx);
         return NT_STATUS_OK;
 }
@@ -836 +883 @@
         .server_start   = gensec_fake_gssapi_krb5_server_start,
         .update         = gensec_krb5_update,
-        .magic          = gensec_fake_gssapi_krb5_magic,
+        .magic          = gensec_magic_check_krb5_oid,
         .session_key    = gensec_krb5_session_key,
         .session_info   = gensec_krb5_session_info,
@@ -874 +921 @@
         if (!NT_STATUS_IS_OK(ret)) {
                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
-                        gensec_krb5_security_ops.name));
+                        gensec_fake_gssapi_krb5_security_ops.name));
                 return ret;
         }

vendor/current/source4/auth/gensec/gensec_tstream.c

@@ -28 +28 @@
 #include "lib/tsocket/tsocket.h"
 #include "lib/tsocket/tsocket_internal.h"
-
+#include "auth/gensec/gensec_toplevel_proto.h"
 
 static const struct tstream_context_ops tstream_gensec_ops;
@@ -248 +248 @@
                 vector[0].iov_len = sizeof(state->wrapped.hdr);
         } else if (!state->wrapped.asked_for_blob) {
+                uint32_t msg_len;
+
                 state->wrapped.asked_for_blob = true;
-                uint32_t msg_len;
 
                 msg_len = RIVAL(state->wrapped.hdr, 0);
 
-                if (msg_len > 0x00FFFFFF) {
+                /*
+                 * I got a Windows 2012R2 server responding with
+                 * a message of 0x1b28a33.
+                 */
+                if (msg_len > 0x0FFFFFFF) {
                         errno = EMSGSIZE;
                         return -1;

vendor/current/source4/auth/gensec/pygensec.c

@@ -21 +21 @@
 #include "param/pyparam.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h" /* TODO: remove this */
 #include "auth/credentials/pycredentials.h"
 #include "libcli/util/pyerrors.h"
-#include "scripting/python/modules.h"
-#include "lib/talloc/pytalloc.h"
+#include "python/modules.h"
+#include <pytalloc.h>
 #include <tevent.h>
 #include "librpc/rpc/pyrpc_util.h"
@@ -37 +38 @@
                 return NULL;
 
-        security = py_talloc_get_type(self, struct gensec_security);
+        security = pytalloc_get_type(self, struct gensec_security);
 
         name = gensec_get_name_by_authtype(security, type);
@@ -79 +80 @@
 {
         NTSTATUS status;
-        py_talloc_Object *self;
+        PyObject *self;
         struct gensec_settings *settings;
         const char *kwnames[] = { "settings", NULL };
-        PyObject *py_settings;
-        struct tevent_context *ev;
+        PyObject *py_settings = Py_None;
         struct gensec_security *gensec;
+        TALLOC_CTX *frame;
 
         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|O", discard_const_p(char *, kwnames), &py_settings))
                 return NULL;
 
-        self = (py_talloc_Object*)type->tp_alloc(type, 0);
-        if (self == NULL) {
-                PyErr_NoMemory();
-                return NULL;
-        }
-        self->talloc_ctx = talloc_new(NULL);
-        if (self->talloc_ctx == NULL) {
-                PyErr_NoMemory();
-                return NULL;
-        }
+        frame = talloc_stackframe();
 
         if (py_settings != Py_None) {
-                settings = settings_from_object(self->talloc_ctx, py_settings);
+                settings = settings_from_object(frame, py_settings);
                 if (settings == NULL) {
-                        PyObject_DEL(self);
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
                         return NULL;
                 }
         } else {
-                settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
+                settings = talloc_zero(frame, struct gensec_settings);
                 if (settings == NULL) {
-                        PyObject_DEL(self);
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
                         return NULL;
                 }
 
                 settings->lp_ctx = loadparm_init_global(true);
-        }
-
-        ev = tevent_context_init(self->talloc_ctx);
-        if (ev == NULL) {
-                PyErr_NoMemory();
-                PyObject_Del(self);
-                return NULL;
-        }
-
-        status = gensec_init(settings->lp_ctx);
-        if (!NT_STATUS_IS_OK(status)) {
-                PyErr_SetNTSTATUS(status);
-                PyObject_DEL(self);
-                return NULL;
-        }
-
-        status = gensec_client_start(self->talloc_ctx, &gensec, ev, settings);
-        if (!NT_STATUS_IS_OK(status)) {
-                PyErr_SetNTSTATUS(status);
-                PyObject_DEL(self);
-                return NULL;
-        }
-
-        self->ptr = gensec;
+                if (settings->lp_ctx == NULL) {
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
+                        return NULL;
+                }
+        }
+
+        status = gensec_init();
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                TALLOC_FREE(frame);
+                return NULL;
+        }
+
+        status = gensec_client_start(frame, &gensec, settings);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                TALLOC_FREE(frame);
+                return NULL;
+        }
+
+        self = pytalloc_steal(type, gensec);
+        TALLOC_FREE(frame);
 
         return (PyObject *)self;
@@ -145 +138 @@
 {
         NTSTATUS status;
-        py_talloc_Object *self;
+        PyObject *self;
         struct gensec_settings *settings = NULL;
         const char *kwnames[] = { "settings", "auth_context", NULL };
         PyObject *py_settings = Py_None;
         PyObject *py_auth_context = Py_None;
-        struct tevent_context *ev;
         struct gensec_security *gensec;
-        struct auth_context *auth_context = NULL;
+        struct auth4_context *auth_context = NULL;
+        TALLOC_CTX *frame;
 
         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OO", discard_const_p(char *, kwnames), &py_settings, &py_auth_context))
                 return NULL;
 
-        self = (py_talloc_Object*)type->tp_alloc(type, 0);
-        if (self == NULL) {
-                PyErr_NoMemory();
-                return NULL;
-        }
-        self->talloc_ctx = talloc_new(NULL);
-        if (self->talloc_ctx == NULL) {
-                PyErr_NoMemory();
-                return NULL;
-        }
+        frame = talloc_stackframe();
 
         if (py_settings != Py_None) {
-                settings = settings_from_object(self->talloc_ctx, py_settings);
+                settings = settings_from_object(frame, py_settings);
                 if (settings == NULL) {
-                        PyObject_DEL(self);
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
                         return NULL;
                 }
         } else {
-                settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
+                settings = talloc_zero(frame, struct gensec_settings);
                 if (settings == NULL) {
-                        PyObject_DEL(self);
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
                         return NULL;
                 }
 
                 settings->lp_ctx = loadparm_init_global(true);
-        }
-
-        ev = tevent_context_init(self->talloc_ctx);
-        if (ev == NULL) {
-                PyErr_NoMemory();
-                PyObject_Del(self);
-                return NULL;
+                if (settings->lp_ctx == NULL) {
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
+                        return NULL;
+                }
         }
 
         if (py_auth_context != Py_None) {
-                auth_context = py_talloc_get_type(py_auth_context, struct auth_context);
+                auth_context = pytalloc_get_type(py_auth_context, struct auth4_context);
                 if (!auth_context) {
                         PyErr_Format(PyExc_TypeError,
                                      "Expected auth.AuthContext for auth_context argument, got %s",
-                                     talloc_get_name(py_talloc_get_ptr(py_auth_context)));
+                                     talloc_get_name(pytalloc_get_ptr(py_auth_context)));
                         return NULL;
                 }
         }
 
-        status = gensec_init(settings->lp_ctx);
-        if (!NT_STATUS_IS_OK(status)) {
-                PyErr_SetNTSTATUS(status);
-                PyObject_DEL(self);
-                return NULL;
-        }
-
-        status = gensec_server_start(self->talloc_ctx, ev, settings, auth_context, &gensec);
-        if (!NT_STATUS_IS_OK(status)) {
-                PyErr_SetNTSTATUS(status);
-                PyObject_DEL(self);
-                return NULL;
-        }
-
-        self->ptr = gensec;
-
-        return (PyObject *)self;
+        status = gensec_init();
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                TALLOC_FREE(frame);
+                return NULL;
+        }
+
+        status = gensec_server_start(frame, settings, auth_context, &gensec);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                TALLOC_FREE(frame);
+                return NULL;
+        }
+
+        self = pytalloc_steal(type, gensec);
+        TALLOC_FREE(frame);
+
+        return self;
+}
+
+static PyObject *py_gensec_set_target_hostname(PyObject *self, PyObject *args)
+{
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        char *target_hostname;
+        NTSTATUS status;
+
+        if (!PyArg_ParseTuple(args, "s", &target_hostname))
+                return NULL;
+
+        status = gensec_set_target_hostname(security, target_hostname);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+        
+        Py_RETURN_NONE;
+}
+
+static PyObject *py_gensec_set_target_service(PyObject *self, PyObject *args)
+{
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        char *target_service;
+        NTSTATUS status;
+
+        if (!PyArg_ParseTuple(args, "s", &target_service))
+                return NULL;
+
+        status = gensec_set_target_service(security, target_service);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+        
+        Py_RETURN_NONE;
 }
 
@@ -224 +245 @@
         PyObject *py_creds = Py_None;
         struct cli_credentials *creds;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         NTSTATUS status;
 
@@ -234 +255 @@
                 PyErr_Format(PyExc_TypeError,
                              "Expected samba.credentaials for credentials argument got  %s",
-                             talloc_get_name(py_talloc_get_ptr(py_creds)));
+                             talloc_get_name(pytalloc_get_ptr(py_creds)));
         }
 
@@ -248 +269 @@
 static PyObject *py_gensec_session_info(PyObject *self)
 {
+        TALLOC_CTX *mem_ctx;
         NTSTATUS status;
         PyObject *py_session_info;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         struct auth_session_info *info;
         if (security->ops == NULL) {
@@ -256 +278 @@
                 return NULL;
         }
-        status = gensec_session_info(security, &info);
+        mem_ctx = talloc_new(NULL);
+
+        status = gensec_session_info(security, mem_ctx, &info);
         if (NT_STATUS_IS_ERR(status)) {
                 PyErr_SetNTSTATUS(status);
@@ -262 +286 @@
         }
 
-        py_session_info = py_return_ndr_struct("samba.auth", "AuthSession",
+        py_session_info = py_return_ndr_struct("samba.dcerpc.auth", "session_info",
                                                  info, info);
+        talloc_free(mem_ctx);
         return py_session_info;
 }
 
+static PyObject *py_gensec_session_key(PyObject *self)
+{
+        TALLOC_CTX *mem_ctx;
+        NTSTATUS status;
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        DATA_BLOB session_key = data_blob_null;
+        static PyObject *session_key_obj = NULL;
+
+        if (security->ops == NULL) {
+                PyErr_SetString(PyExc_RuntimeError, "no mechanism selected");
+                return NULL;
+        }
+        mem_ctx = talloc_new(NULL);
+
+        status = gensec_session_key(security, mem_ctx, &session_key);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(mem_ctx);
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+
+        session_key_obj = PyString_FromStringAndSize((const char *)session_key.data,
+                                                     session_key.length);
+        talloc_free(mem_ctx);
+        return session_key_obj;
+}
+
 static PyObject *py_gensec_start_mech_by_name(PyObject *self, PyObject *args)
 {
         char *name;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         NTSTATUS status;
 
@@ -288 +340 @@
 {
         char *sasl_name;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         NTSTATUS status;
 
@@ -306 +358 @@
 {
         int authtype, level;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         NTSTATUS status;
         if (!PyArg_ParseTuple(args, "ii", &authtype, &level))
@@ -323 +375 @@
 {
         int feature;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
         if (!PyArg_ParseTuple(args, "i", &feature))
@@ -336 +388 @@
 {
         int feature;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
         if (!PyArg_ParseTuple(args, "i", &feature))
@@ -347 +399 @@
 }
 
+static PyObject *py_gensec_set_max_update_size(PyObject *self, PyObject *args)
+{
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        unsigned int max_update_size = 0;
+
+        if (!PyArg_ParseTuple(args, "I", &max_update_size))
+                return NULL;
+
+        gensec_set_max_update_size(security, max_update_size);
+
+        Py_RETURN_NONE;
+}
+
+static PyObject *py_gensec_max_update_size(PyObject *self)
+{
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        unsigned int max_update_size = gensec_max_update_size(security);
+
+        return PyInt_FromLong(max_update_size);
+}
+
 static PyObject *py_gensec_update(PyObject *self, PyObject *args)
 {
@@ -353 +426 @@
         DATA_BLOB in, out;
         PyObject *ret, *py_in;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         PyObject *finished_processing;
 
@@ -396 +469 @@
         DATA_BLOB in, out;
         PyObject *ret, *py_in;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 
         if (!PyArg_ParseTuple(args, "O", &py_in))
@@ -430 +503 @@
         DATA_BLOB in, out;
         PyObject *ret, *py_in;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 
         if (!PyArg_ParseTuple(args, "O", &py_in))
@@ -456 +529 @@
         talloc_free(mem_ctx);
         return ret;
+}
+
+static PyObject *py_gensec_sig_size(PyObject *self, PyObject *args)
+{
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        Py_ssize_t data_size = 0;
+        size_t sig_size = 0;
+
+        if (!PyArg_ParseTuple(args, "n", &data_size)) {
+                return NULL;
+        }
+
+        sig_size = gensec_sig_size(security, data_size);
+
+        return PyLong_FromSize_t(sig_size);
+}
+
+static PyObject *py_gensec_sign_packet(PyObject *self, PyObject *args)
+{
+        NTSTATUS status;
+        TALLOC_CTX *mem_ctx = NULL;
+        Py_ssize_t data_length = 0;
+        Py_ssize_t pdu_length = 0;
+        DATA_BLOB data, pdu, sig;
+        PyObject *py_sig;
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+
+        if (!PyArg_ParseTuple(args, "z#z#", &data.data, &data_length, &pdu.data, &pdu_length)) {
+                return NULL;
+        }
+        data.length = data_length;
+        pdu.length = pdu_length;
+
+        mem_ctx = talloc_new(NULL);
+
+        status = gensec_sign_packet(security, mem_ctx,
+                                    data.data, data.length,
+                                    pdu.data, pdu.length, &sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+
+        py_sig = PyBytes_FromStringAndSize((const char *)sig.data, sig.length);
+        talloc_free(mem_ctx);
+        return py_sig;
+}
+
+static PyObject *py_gensec_check_packet(PyObject *self, PyObject *args)
+{
+        NTSTATUS status;
+        Py_ssize_t data_length = 0;
+        Py_ssize_t pdu_length = 0;
+        Py_ssize_t sig_length = 0;
+        DATA_BLOB data, pdu, sig;
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+
+        if (!PyArg_ParseTuple(args, "z#z#z#",
+                              &data.data, &data_length,
+                              &pdu.data, &pdu_length,
+                              &sig.data, &sig_length)) {
+                return NULL;
+        }
+        data.length = data_length;
+        pdu.length = pdu_length;
+        sig.length = sig_length;
+
+        status = gensec_check_packet(security,
+                                     data.data, data.length,
+                                     pdu.data, pdu.length, &sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+
+        Py_RETURN_NONE;
 }
 
@@ -465 +615 @@
         { "set_credentials", (PyCFunction)py_gensec_set_credentials, METH_VARARGS, 
                 "S.start_client(credentials)" },
+        { "set_target_hostname", (PyCFunction)py_gensec_set_target_hostname, METH_VARARGS, 
+                "S.start_target_hostname(target_hostname)" },
+        { "set_target_service", (PyCFunction)py_gensec_set_target_service, METH_VARARGS, 
+                "S.start_target_service(target_service)" },
         { "session_info", (PyCFunction)py_gensec_session_info, METH_NOARGS,
-                "S.session_info() -> info" },
+                "S.session_info() -> info" },
+        { "session_key", (PyCFunction)py_gensec_session_key, METH_NOARGS,
+                "S.session_key() -> key" },
         { "start_mech_by_name", (PyCFunction)py_gensec_start_mech_by_name, METH_VARARGS,
-        "S.start_mech_by_name(name)" },
+                "S.start_mech_by_name(name)" },
         { "start_mech_by_sasl_name", (PyCFunction)py_gensec_start_mech_by_sasl_name, METH_VARARGS,
-        "S.start_mech_by_sasl_name(name)" },
-        { "start_mech_by_authtype", (PyCFunction)py_gensec_start_mech_by_authtype, METH_VARARGS, "S.start_mech_by_authtype(authtype, level)" },
+                "S.start_mech_by_sasl_name(name)" },
+        { "start_mech_by_authtype", (PyCFunction)py_gensec_start_mech_by_authtype, METH_VARARGS,
+                "S.start_mech_by_authtype(authtype, level)" },
         { "get_name_by_authtype", (PyCFunction)py_get_name_by_authtype, METH_VARARGS,
                 "S.get_name_by_authtype(authtype) -> name\nLookup an auth type." },
         { "want_feature", (PyCFunction)py_gensec_want_feature, METH_VARARGS,
-          "S.want_feature(feature)\n Request that GENSEC negotiate a particular feature." },
+                "S.want_feature(feature)\n Request that GENSEC negotiate a particular feature." },
         { "have_feature", (PyCFunction)py_gensec_have_feature, METH_VARARGS,
-          "S.have_feature()\n Return True if GENSEC negotiated a particular feature." },
+                "S.have_feature()\n Return True if GENSEC negotiated a particular feature." },
+        { "set_max_update_size",  (PyCFunction)py_gensec_set_max_update_size, METH_VARARGS,
+                "S.set_max_update_size(max_size) \n Some mechs can fragment update packets, needs to be use before the mech is started." },
+        { "max_update_size",  (PyCFunction)py_gensec_max_update_size, 0,
+                "S.max_update_size() \n Return the current max_update_size." },
         { "update",  (PyCFunction)py_gensec_update, METH_VARARGS,
                 "S.update(blob_in) -> (finished, blob_out)\nPerform one step in a GENSEC dance.  Repeat with new packets until finished is true or exception." },
@@ -484 +645 @@
         { "unwrap",  (PyCFunction)py_gensec_unwrap, METH_VARARGS,
                 "S.unwrap(blob_in) -> blob_out\nPerform one wrapped GENSEC packet into a clear packet." },
-
+        { "sig_size",  (PyCFunction)py_gensec_sig_size, METH_VARARGS,
+                "S.sig_size(data_size) -> sig_size\nSize of the DCERPC packet signature" },
+        { "sign_packet",  (PyCFunction)py_gensec_sign_packet, METH_VARARGS,
+                "S.sign_packet(data, whole_pdu) -> sig\nSign a DCERPC packet." },
+        { "check_packet",  (PyCFunction)py_gensec_check_packet, METH_VARARGS,
+                "S.check_packet(data, whole_pdu, sig)\nCheck a DCERPC packet." },
         { NULL }
 };
 
 static PyTypeObject Py_Security = {
-        .tp_name = "Security",
+        .tp_name = "gensec.Security",
         .tp_flags = Py_TPFLAGS_DEFAULT,
         .tp_methods = py_gensec_security_methods,
-        .tp_basicsize = sizeof(py_talloc_Object),
 };
 
@@ -500 +665 @@
         PyObject *m;
 
-        Py_Security.tp_base = PyTalloc_GetObjectType();
-        if (Py_Security.tp_base == NULL)
-                return;
-
-        if (PyType_Ready(&Py_Security) < 0)
+        if (pytalloc_BaseObject_PyType_Ready(&Py_Security) < 0)
                 return;
 

vendor/current/source4/auth/gensec/wscript_build

@@ -1 +1 @@
 #!/usr/bin/env python
 
-bld.SAMBA_LIBRARY('gensec',
-        source='gensec.c socket.c gensec_tstream.c',
-        pc_files='gensec.pc',
-        autoproto='gensec_proto.h',
-        public_deps='UTIL_TEVENT samba-util errors LIBPACKET auth_system_session',
-        public_headers='gensec.h',
-        deps='com_err',
-        vnum='0.0.1'
-        )
+bld.SAMBA_SUBSYSTEM('gensec_util',
+                    source='gensec_tstream.c',
+                    deps='tevent-util tevent samba-util LIBTSOCKET',
+                    autoproto='gensec_proto.h')
 
 bld.SAMBA_MODULE('gensec_krb5',
-        source='gensec_krb5.c',
+        source='gensec_krb5.c gensec_krb5_util.c',
         subsystem='gensec',
         init_function='gensec_krb5_init',
-        deps='credentials authkrb5 auth_session com_err',
+        deps='samba-credentials authkrb5 com_err gensec_util',
         internal_module=False,
+        enabled=bld.AD_DC_BUILD_IS_ENABLED() and bld.CONFIG_SET('SAMBA4_USES_HEIMDAL')
         )
 
@@ -24 +20 @@
         subsystem='gensec',
         init_function='gensec_gssapi_init',
-        deps='gssapi credentials authkrb5 com_err'
+        deps='gssapi samba-credentials authkrb5 com_err gensec_util'
         )
-
-
-bld.SAMBA_MODULE('cyrus_sasl',
-        source='cyrus_sasl.c',
-        subsystem='gensec',
-        init_function='gensec_sasl_init',
-        deps='credentials sasl2',
-        enabled=bld.CONFIG_SET('HAVE_SASL')
-        )
-
-
-bld.SAMBA_MODULE('gensec_spnego',
-        source='spnego.c',
-        autoproto='spnego_proto.h',
-        subsystem='gensec',
-        init_function='gensec_spnego_init',
-        deps='ASN1_UTIL credentials SPNEGO_PARSE'
-        )
-
-
-bld.SAMBA_MODULE('gensec_schannel',
-        source='schannel.c',
-        subsystem='gensec',
-        deps='COMMON_SCHANNEL NDR_SCHANNEL credentials ndr auth_session',
-        internal_module=True,
-        autoproto='schannel_proto.h',
-        init_function='gensec_schannel_init'
-        )
-
 
 bld.SAMBA_PYTHON('pygensec',

vendor/current/source4/auth/kerberos/kerberos-notes.txt

@@ -7 +7 @@
 ------------------------------------
 
-This document should be read in conjuction with the Samba4 source code.  
+This document should be read in conjunction with the Samba4 source code.  
 DAL and KDC requirements are expressed (as an implementation against Heimdal's 
 HDB abstraction layer) in Samba4's source4/kdc/hdb-samba4.c in particular.
@@ -160 +160 @@
 correctly implement the GSSAPI specification, particularly on top of the 
 (inflexible) MIT Kerberos API.  It did not seem possible to write a correct, 
-seperate GSSAPI implementation on top of MIT Kerberos's public krb5lib API, 
+separate GSSAPI implementation on top of MIT Kerberos's public krb5lib API,
 and at the time, the effort did not need to extend beyond what Windows would 
 require.  
@@ -528 +528 @@
 
 Traditional 'MIT' behaviour is to use a keytab, containing salted key
-data, extracted from the KDC.  (In this modal, there is no 'service
+data, extracted from the KDC.  (In this model, there is no 'service
 password', instead the keys are often simply application of random
 bytes).  Heimdal also implements this behaviour.
 
-The windows modal is very different - instead of sharing a keytab with
+The windows model is very different - instead of sharing a keytab with
 each member server, a random utf-16 pseudo-textual password is stored 
 for the whole machine.  

vendor/current/source4/auth/kerberos/kerberos.h

@@ -19 +19 @@
 */
 
+#ifndef _AUTH_KERBEROS_H_
+#define _AUTH_KERBEROS_H_
+
 #if defined(HAVE_KRB5)
 
+#include "system/kerberos.h"
 #include "auth/kerberos/krb5_init_context.h"
 #include "librpc/gen_ndr/krb5pac.h"
+#include "lib/krb5_wrap/krb5_samba.h"
+#include "lib/krb5_wrap/gss_samba.h"
 
 struct auth_user_info_dc;
@@ -35 +41 @@
         struct smb_krb5_context *smb_krb5_context;
         krb5_keytab keytab;
+        bool password_based;
 };
 
@@ -44 +51 @@
 #define TOK_ID_GSS_WRAP         ((const uint8_t *)"\x02\x01")
 
-#ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE
-#define KRB5_KEY_TYPE(k)        ((k)->keytype)
-#define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
-#define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
-#else
-#define KRB5_KEY_TYPE(k)        ((k)->enctype)
-#define KRB5_KEY_LENGTH(k)      ((k)->length)
-#define KRB5_KEY_DATA(k)        ((k)->contents)
-#endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
-
 #define ENC_ALL_TYPES (ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5 |     \
                        ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256)
-
-#ifndef HAVE_KRB5_SET_REAL_TIME
-krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds);
-#endif
 
 #ifndef HAVE_KRB5_SET_DEFAULT_TGS_KTYPES
@@ -69 +62 @@
 #endif
 
-#ifndef HAVE_KRB5_FREE_UNPARSED_NAME
-void krb5_free_unparsed_name(krb5_context ctx, char *val);
-#endif
-
 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
@@ -78 +67 @@
 
 /* Samba wrapper function for krb5 functionality. */
-void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr);
-int create_kerberos_key_from_string(krb5_context context, krb5_principal host_princ, krb5_data *password, krb5_keyblock *key, krb5_enctype enctype);
-int create_kerberos_key_from_string_direct(krb5_context context, krb5_principal host_princ, krb5_data *password, krb5_keyblock *key, krb5_enctype enctype);
-krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt);
-krb5_error_code get_kerberos_allowed_etypes(krb5_context context, krb5_enctype **enctypes);
-void free_kerberos_etypes(krb5_context context, krb5_enctype *enctypes);
-bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote);
-krb5_error_code ads_krb5_mk_req(krb5_context context, 
-                                krb5_auth_context *auth_context, 
-                                const krb5_flags ap_req_options,
-                                const char *principal,
-                                krb5_ccache ccache, 
-                                krb5_data *outbuf);
-bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
-krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
-                                           krb5_principal principal, const char *password,
-                                           krb5_principal impersonate_principal, const char *target_service,
-                                           krb5_get_init_creds_opt *krb_options,
-                                           time_t *expire_time, time_t *kdc_time);
-krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
-                                           krb5_principal principal, krb5_keyblock *keyblock,
-                                           const char *target_service,
-                                           krb5_get_init_creds_opt *krb_options,
-                                           time_t *expire_time, time_t *kdc_time);
-krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
-                                                        krb5_principal host_princ,
-                                                        int enctype);
-void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype);
-bool kerberos_compatible_enctypes(krb5_context context, krb5_enctype enctype1, krb5_enctype enctype2);
-void kerberos_free_data_contents(krb5_context context, krb5_data *pdata);
-krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry);
-char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx);
-NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
-                             struct PAC_DATA **pac_data_out,
-                             DATA_BLOB blob,
-                             krb5_context context,
-                             const krb5_keyblock *krbtgt_keyblock,
-                             const krb5_keyblock *service_keyblock,
-                             krb5_const_principal client_principal,
-                             time_t tgs_authtime,
-                             krb5_error_code *k5ret);
- NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
-                                  struct PAC_LOGON_INFO **logon_info,
-                                  DATA_BLOB blob,
-                                  krb5_context context,
-                                  const krb5_keyblock *krbtgt_keyblock,
-                                  const krb5_keyblock *service_keyblock,
-                                  krb5_const_principal client_principal,
-                                  time_t tgs_authtime, 
-                                  krb5_error_code *k5ret);
  krb5_error_code kerberos_encode_pac(TALLOC_CTX *mem_ctx,
                                     struct PAC_DATA *pac_data,
@@ -142 +81 @@
                                      time_t tgs_authtime,
                                      DATA_BLOB *pac);
-struct loadparm_context;
-struct ldb_message;
-struct ldb_context;
-uint32_t kerberos_enctype_to_bitmap(krb5_enctype enc_type_enum);
-/* Translate between the Microsoft msDS-SupportedEncryptionTypes values and the IETF encryption type values */
-krb5_enctype kerberos_enctype_bitmap_to_enctype(uint32_t enctype_bitmap);
-krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
-                                       struct smb_krb5_context *smb_krb5_context,
-                                       struct ldb_context *ldb, 
-                                       struct ldb_message *msg,
-                                       bool delete_all_kvno,
-                                       const char **error_string);
 
 #include "auth/kerberos/proto.h"
 
 #endif /* HAVE_KRB5 */
+
+#endif /* _AUTH_KERBEROS_H_ */

vendor/current/source4/auth/kerberos/kerberos_credentials.h

@@ -28 +28 @@
                                 enum credentials_obtained *obtained,
                                 const char **error_string);
+
+/* Manually prototyped here to avoid needing krb5 headers in most callers */
+krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
+                                struct cli_credentials *credentials,
+                                struct smb_krb5_context *smb_krb5_context,
+                                krb5_principal *princ,
+                                enum credentials_obtained *obtained,
+                                const char **error_string);

vendor/current/source4/auth/kerberos/kerberos_pac.c

@@ -31 +31 @@
 #include <ldb.h>
 #include "auth/auth_sam_reply.h"
-
-krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
-                                   DATA_BLOB pac_data,
-                                   struct PAC_SIGNATURE_DATA *sig,
-                                   krb5_context context,
-                                   const krb5_keyblock *keyblock)
-{
-        krb5_error_code ret;
-        krb5_crypto crypto;
-        Checksum cksum;
-
-        cksum.cksumtype         = (CKSUMTYPE)sig->type;
-        cksum.checksum.length   = sig->signature.length;
-        cksum.checksum.data     = sig->signature.data;
-
-        ret = krb5_crypto_init(context,
-                               keyblock,
-                               0,
-                               &crypto);
-        if (ret) {
-                DEBUG(0,("krb5_crypto_init() failed: %s\n",
-                          smb_get_krb5_error_message(context, ret, mem_ctx)));
-                return ret;
-        }
-        ret = krb5_verify_checksum(context,
-                                   crypto,
-                                   KRB5_KU_OTHER_CKSUM,
-                                   pac_data.data,
-                                   pac_data.length,
-                                   &cksum);
-        krb5_crypto_destroy(context, crypto);
-
-        return ret;
-}
-
- NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
-                              struct PAC_DATA **pac_data_out,
-                              DATA_BLOB blob,
-                              krb5_context context,
-                              const krb5_keyblock *krbtgt_keyblock,
-                              const krb5_keyblock *service_keyblock,
-                              krb5_const_principal client_principal,
-                              time_t tgs_authtime,
-                              krb5_error_code *k5ret)
-{
-        krb5_error_code ret;
-        NTSTATUS status;
-        enum ndr_err_code ndr_err;
-        struct PAC_SIGNATURE_DATA *srv_sig_ptr = NULL;
-        struct PAC_SIGNATURE_DATA *kdc_sig_ptr = NULL;
-        struct PAC_SIGNATURE_DATA *srv_sig_wipe = NULL;
-        struct PAC_SIGNATURE_DATA *kdc_sig_wipe = NULL;
-        struct PAC_LOGON_INFO *logon_info = NULL;
-        struct PAC_LOGON_NAME *logon_name = NULL;
-        struct PAC_DATA *pac_data;
-        struct PAC_DATA_RAW *pac_data_raw;
-
-        DATA_BLOB *srv_sig_blob = NULL;
-        DATA_BLOB *kdc_sig_blob = NULL;
-
-        DATA_BLOB modified_pac_blob;
-        NTTIME tgs_authtime_nttime;
-        krb5_principal client_principal_pac;
-        uint32_t i;
-
-        krb5_clear_error_message(context);
-
-        if (k5ret) {
-                *k5ret = KRB5_PARSE_MALFORMED;
-        }
-
-        pac_data = talloc(mem_ctx, struct PAC_DATA);
-        pac_data_raw = talloc(mem_ctx, struct PAC_DATA_RAW);
-        kdc_sig_wipe = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
-        srv_sig_wipe = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
-        if (!pac_data_raw || !pac_data || !kdc_sig_wipe || !srv_sig_wipe) {
-                if (k5ret) {
-                        *k5ret = ENOMEM;
-                }
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        ndr_err = ndr_pull_struct_blob(&blob, pac_data,
-                        pac_data, (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't parse the PAC: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        if (pac_data->num_buffers < 4) {
-                /* we need logon_ingo, service_key and kdc_key */
-                DEBUG(0,("less than 4 PAC buffers\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        ndr_err = ndr_pull_struct_blob(&blob, pac_data_raw,
-                                       pac_data_raw,
-                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA_RAW);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't parse the PAC: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        if (pac_data_raw->num_buffers < 4) {
-                /* we need logon_ingo, service_key and kdc_key */
-                DEBUG(0,("less than 4 PAC buffers\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (pac_data->num_buffers != pac_data_raw->num_buffers) {
-                /* we need logon_ingo, service_key and kdc_key */
-                DEBUG(0,("misparse!  PAC_DATA has %d buffers while PAC_DATA_RAW has %d\n",
-                         pac_data->num_buffers, pac_data_raw->num_buffers));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        for (i=0; i < pac_data->num_buffers; i++) {
-                if (pac_data->buffers[i].type != pac_data_raw->buffers[i].type) {
-                        DEBUG(0,("misparse!  PAC_DATA buffer %d has type %d while PAC_DATA_RAW has %d\n",
-                                 i, pac_data->buffers[i].type, pac_data->buffers[i].type));
-                        return NT_STATUS_INVALID_PARAMETER;
-                }
-                switch (pac_data->buffers[i].type) {
-                        case PAC_TYPE_LOGON_INFO:
-                                if (!pac_data->buffers[i].info) {
-                                        break;
-                                }
-                                logon_info = pac_data->buffers[i].info->logon_info.info;
-                                break;
-                        case PAC_TYPE_SRV_CHECKSUM:
-                                if (!pac_data->buffers[i].info) {
-                                        break;
-                                }
-                                srv_sig_ptr = &pac_data->buffers[i].info->srv_cksum;
-                                srv_sig_blob = &pac_data_raw->buffers[i].info->remaining;
-                                break;
-                        case PAC_TYPE_KDC_CHECKSUM:
-                                if (!pac_data->buffers[i].info) {
-                                        break;
-                                }
-                                kdc_sig_ptr = &pac_data->buffers[i].info->kdc_cksum;
-                                kdc_sig_blob = &pac_data_raw->buffers[i].info->remaining;
-                                break;
-                        case PAC_TYPE_LOGON_NAME:
-                                logon_name = &pac_data->buffers[i].info->logon_name;
-                                break;
-                        default:
-                                break;
-                }
-        }
-
-        if (!logon_info) {
-                DEBUG(0,("PAC no logon_info\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!logon_name) {
-                DEBUG(0,("PAC no logon_name\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!srv_sig_ptr || !srv_sig_blob) {
-                DEBUG(0,("PAC no srv_key\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!kdc_sig_ptr || !kdc_sig_blob) {
-                DEBUG(0,("PAC no kdc_key\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* Find and zero out the signatures, as required by the signing algorithm */
-
-        /* We find the data blobs above, now we parse them to get at the exact portion we should zero */
-        ndr_err = ndr_pull_struct_blob(kdc_sig_blob, kdc_sig_wipe,
-                                       kdc_sig_wipe,
-                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't parse the KDC signature: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        ndr_err = ndr_pull_struct_blob(srv_sig_blob, srv_sig_wipe,
-                                       srv_sig_wipe,
-                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't parse the SRV signature: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        /* Now zero the decoded structure */
-        memset(kdc_sig_wipe->signature.data, '\0', kdc_sig_wipe->signature.length);
-        memset(srv_sig_wipe->signature.data, '\0', srv_sig_wipe->signature.length);
-
-        /* and reencode, back into the same place it came from */
-        ndr_err = ndr_push_struct_blob(kdc_sig_blob, pac_data_raw,
-                                       kdc_sig_wipe,
-                                       (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't repack the KDC signature: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-        ndr_err = ndr_push_struct_blob(srv_sig_blob, pac_data_raw,
-                                       srv_sig_wipe,
-                                       (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't repack the SRV signature: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        /* push out the whole structure, but now with zero'ed signatures */
-        ndr_err = ndr_push_struct_blob(&modified_pac_blob, pac_data_raw,
-                                       pac_data_raw,
-                                       (ndr_push_flags_fn_t)ndr_push_PAC_DATA_RAW);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't repack the RAW PAC: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        /* verify by service_key */
-        ret = check_pac_checksum(mem_ctx,
-                                 modified_pac_blob, srv_sig_ptr,
-                                 context,
-                                 service_keyblock);
-        if (ret) {
-                DEBUG(1, ("PAC Decode: Failed to verify the service signature: %s\n",
-                          smb_get_krb5_error_message(context, ret, mem_ctx)));
-                if (k5ret) {
-                        *k5ret = ret;
-                }
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        if (krbtgt_keyblock) {
-                ret = check_pac_checksum(mem_ctx,
-                                            srv_sig_ptr->signature, kdc_sig_ptr,
-                                            context, krbtgt_keyblock);
-                if (ret) {
-                        DEBUG(1, ("PAC Decode: Failed to verify the KDC signature: %s\n",
-                                  smb_get_krb5_error_message(context, ret, mem_ctx)));
-                        if (k5ret) {
-                                *k5ret = ret;
-                        }
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        /* Convert to NT time, so as not to loose accuracy in comparison */
-        unix_to_nt_time(&tgs_authtime_nttime, tgs_authtime);
-
-        if (tgs_authtime_nttime != logon_name->logon_time) {
-                DEBUG(2, ("PAC Decode: Logon time mismatch between ticket and PAC!\n"));
-                DEBUG(2, ("PAC Decode: PAC: %s\n", nt_time_string(mem_ctx, logon_name->logon_time)));
-                DEBUG(2, ("PAC Decode: Ticket: %s\n", nt_time_string(mem_ctx, tgs_authtime_nttime)));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        ret = krb5_parse_name_flags(context, logon_name->account_name, KRB5_PRINCIPAL_PARSE_NO_REALM,
-                                    &client_principal_pac);
-        if (ret) {
-                DEBUG(2, ("Could not parse name from incoming PAC: [%s]: %s\n",
-                          logon_name->account_name,
-                          smb_get_krb5_error_message(context, ret, mem_ctx)));
-                if (k5ret) {
-                        *k5ret = ret;
-                }
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!krb5_principal_compare_any_realm(context, client_principal, client_principal_pac)) {
-                DEBUG(2, ("Name in PAC [%s] does not match principal name in ticket\n",
-                          logon_name->account_name));
-                krb5_free_principal(context, client_principal_pac);
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        krb5_free_principal(context, client_principal_pac);
-
-#if 0
-        if (strcasecmp(logon_info->info3.base.account_name.string,
-                       "Administrator")== 0) {
-                file_save("tmp_pac_data-admin.dat",blob.data,blob.length);
-        }
-#endif
-
-        DEBUG(3,("Found account name from PAC: %s [%s]\n",
-                 logon_info->info3.base.account_name.string,
-                 logon_info->info3.base.full_name.string));
-        *pac_data_out = pac_data;
-
-        return NT_STATUS_OK;
-}
-
-_PUBLIC_  NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
-                                  struct PAC_LOGON_INFO **logon_info,
-                                  DATA_BLOB blob,
-                                  krb5_context context,
-                                  const krb5_keyblock *krbtgt_keyblock,
-                                  const krb5_keyblock *service_keyblock,
-                                  krb5_const_principal client_principal,
-                                  time_t tgs_authtime,
-                                  krb5_error_code *k5ret)
-{
-        NTSTATUS nt_status;
-        struct PAC_DATA *pac_data;
-        int i;
-        nt_status = kerberos_decode_pac(mem_ctx,
-                                        &pac_data,
-                                        blob,
-                                        context,
-                                        krbtgt_keyblock,
-                                        service_keyblock,
-                                        client_principal,
-                                        tgs_authtime,
-                                        k5ret);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                return nt_status;
-        }
-
-        *logon_info = NULL;
-        for (i=0; i < pac_data->num_buffers; i++) {
-                if (pac_data->buffers[i].type != PAC_TYPE_LOGON_INFO) {
-                        continue;
-                }
-                *logon_info = pac_data->buffers[i].info->logon_info.info;
-        }
-        if (!*logon_info) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-        return NT_STATUS_OK;
-}
-
-static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
-                                         DATA_BLOB *pac_data,
-                                         struct PAC_SIGNATURE_DATA *sig,
-                                         krb5_context context,
-                                         const krb5_keyblock *keyblock)
-{
-        krb5_error_code ret;
-        krb5_crypto crypto;
-        Checksum cksum;
-
-
-        ret = krb5_crypto_init(context,
-                               keyblock,
-                               0,
-                               &crypto);
-        if (ret) {
-                DEBUG(0,("krb5_crypto_init() failed: %s\n",
-                          smb_get_krb5_error_message(context, ret, mem_ctx)));
-                return ret;
-        }
-        ret = krb5_create_checksum(context,
-                                   crypto,
-                                   KRB5_KU_OTHER_CKSUM,
-                                   0,
-                                   pac_data->data,
-                                   pac_data->length,
-                                   &cksum);
-        if (ret) {
-                DEBUG(2, ("PAC Verification failed: %s\n",
-                          smb_get_krb5_error_message(context, ret, mem_ctx)));
-        }
-
-        krb5_crypto_destroy(context, crypto);
-
-        if (ret) {
-                return ret;
-        }
-
-        sig->type = cksum.cksumtype;
-        sig->signature = data_blob_talloc(mem_ctx, cksum.checksum.data, cksum.checksum.length);
-        free_Checksum(&cksum);
-
-        return 0;
-}
+#include "auth/credentials/credentials.h"
+#include "auth/kerberos/kerberos_util.h"
+#include "auth/kerberos/pac_utils.h"
 
  krb5_error_code kerberos_encode_pac(TALLOC_CTX *mem_ctx,
@@ -444 +57 @@
                 }
                 kdc_checksum = &pac_data->buffers[i].info->kdc_cksum,
-                ret = make_pac_checksum(mem_ctx, &zero_blob,
-                                        kdc_checksum,
-                                        context, krbtgt_keyblock);
+                ret = smb_krb5_make_pac_checksum(mem_ctx,
+                                                 &zero_blob,
+                                                 context,
+                                                 krbtgt_keyblock,
+                                                 &kdc_checksum->type,
+                                                 &kdc_checksum->signature);
                 if (ret) {
                         DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
@@ -460 +76 @@
                 }
                 srv_checksum = &pac_data->buffers[i].info->srv_cksum;
-                ret = make_pac_checksum(mem_ctx, &zero_blob,
-                                        srv_checksum,
-                                        context, service_keyblock);
+                ret = smb_krb5_make_pac_checksum(mem_ctx,
+                                                 &zero_blob,
+                                                 context,
+                                                 service_keyblock,
+                                                 &srv_checksum->type,
+                                                 &srv_checksum->signature);
                 if (ret) {
                         DEBUG(2, ("making service PAC checksum failed: %s\n",
@@ -495 +114 @@
 
         /* Then sign the result of the previous push, where the sig was zero'ed out */
-        ret = make_pac_checksum(mem_ctx, &tmp_blob, srv_checksum,
-                                context, service_keyblock);
+        ret = smb_krb5_make_pac_checksum(mem_ctx,
+                                         &tmp_blob,
+                                         context,
+                                         service_keyblock,
+                                         &srv_checksum->type,
+                                         &srv_checksum->signature);
 
         /* Then sign Server checksum */
-        ret = make_pac_checksum(mem_ctx, &srv_checksum->signature, kdc_checksum, context, krbtgt_keyblock);
+        ret = smb_krb5_make_pac_checksum(mem_ctx,
+                                         &srv_checksum->signature,
+                                         context,
+                                         krbtgt_keyblock,
+                                         &kdc_checksum->type,
+                                         &kdc_checksum->signature);
         if (ret) {
                 DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
@@ -624 +252 @@
 
         ret = krb5_unparse_name_flags(context, client_principal,
-                                      KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
+                                      KRB5_PRINCIPAL_UNPARSE_NO_REALM |
+                                      KRB5_PRINCIPAL_UNPARSE_DISPLAY,
+                                      &name);
         if (ret) {
                 return ret;
@@ -680 +310 @@
                                       PAC_TYPE_LOGON_INFO,
                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
-        krb5_data_free(&k5pac_logon_info_in);
+        kerberos_free_data_contents(context, &k5pac_logon_info_in);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err) || !info.logon_info.info) {
                 nt_status = ndr_map_error2ntstatus(ndr_err);
@@ -709 +339 @@
                                                pac_srv_sig,
                                                (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
-                krb5_data_free(&k5pac_srv_checksum_in);
+                kerberos_free_data_contents(context, &k5pac_srv_checksum_in);
                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                         nt_status = ndr_map_error2ntstatus(ndr_err);
@@ -730 +360 @@
                                                pac_kdc_sig,
                                                (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
-                krb5_data_free(&k5pac_kdc_checksum_in);
+                kerberos_free_data_contents(context, &k5pac_kdc_checksum_in);
                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                         nt_status = ndr_map_error2ntstatus(ndr_err);
@@ -757 +387 @@
                              &pac);
         if (ret) {
-                return map_nt_error_from_unix(ret);
+                return map_nt_error_from_unix_common(ret);
         }
 
@@ -764 +394 @@
         krb5_pac_free(context, pac);
         if (ret) {
-                return map_nt_error_from_unix(ret);
+                return map_nt_error_from_unix_common(ret);
         }
         return NT_STATUS_OK;

vendor/current/source4/auth/kerberos/kerberos_util.c

@@ -29 +29 @@
 #include "auth/kerberos/kerberos_credentials.h"
 #include "auth/kerberos/kerberos_util.h"
-#include <ldb.h>
-#include "param/secrets.h"
 
 struct principal_container {
@@ -64 +62 @@
 
         if (ret) {
-                (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
+                (*error_string) = smb_get_krb5_error_message(
+                                                smb_krb5_context->krb5_context,
+                                                ret, parent_ctx);
                 return ret;
         }
@@ -76 +76 @@
         /* This song-and-dance effectivly puts the principal
          * into talloc, so we can't loose it. */
-        mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+        mem_ctx->smb_krb5_context = talloc_reference(mem_ctx,
+                                                     smb_krb5_context);
         mem_ctx->principal = *princ;
         talloc_set_destructor(mem_ctx, free_principal);
         return 0;
-}
-
-static krb5_error_code principals_from_msg(TALLOC_CTX *parent_ctx,
-                                           struct ldb_message *msg,
-                                           struct smb_krb5_context *smb_krb5_context,
-                                           struct principal_container ***principals_out,
-                                           const char **error_string)
-{
-        unsigned int i;
-        krb5_error_code ret;
-        char *upper_realm;
-        const char *realm = ldb_msg_find_attr_as_string(msg, "realm", NULL);
-        const char *samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
-        struct ldb_message_element *spn_el = ldb_msg_find_element(msg, "servicePrincipalName");
-        TALLOC_CTX *tmp_ctx;
-        struct principal_container **principals;
-        tmp_ctx = talloc_new(parent_ctx);
-        if (!tmp_ctx) {
-                *error_string = "Cannot allocate tmp_ctx";
-                return ENOMEM;
-        }
-
-        if (!realm) {
-                *error_string = "Cannot have a kerberos secret in secrets.ldb without a realm";
-                return EINVAL;
-        }
-
-        upper_realm = strupper_talloc(tmp_ctx, realm);
-        if (!upper_realm) {
-                talloc_free(tmp_ctx);
-                *error_string = "Cannot allocate full upper case realm";
-                return ENOMEM;
-        }
-
-        principals = talloc_array(tmp_ctx, struct principal_container *, spn_el ? (spn_el->num_values + 2) : 2);
-
-        spn_el = ldb_msg_find_element(msg, "servicePrincipalName");
-        for (i=0; spn_el && i < spn_el->num_values; i++) {
-                principals[i] = talloc(principals, struct principal_container);
-                if (!principals[i]) {
-                        talloc_free(tmp_ctx);
-                        *error_string = "Cannot allocate mem_ctx";
-                        return ENOMEM;
-                }
-
-                principals[i]->smb_krb5_context = talloc_reference(principals[i], smb_krb5_context);
-                principals[i]->string_form = talloc_asprintf(principals[i], "%*.*s@%s",
-                                                             (int)spn_el->values[i].length,
-                                                             (int)spn_el->values[i].length,
-                                                             (const char *)spn_el->values[i].data, upper_realm);
-                if (!principals[i]->string_form) {
-                        talloc_free(tmp_ctx);
-                        *error_string = "Cannot allocate full samAccountName";
-                        return ENOMEM;
-                }
-
-                ret = krb5_parse_name(smb_krb5_context->krb5_context,
-                                      principals[i]->string_form, &principals[i]->principal);
-                
-                if (ret) {
-                        talloc_free(tmp_ctx);
-                        (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
-                        return ret;
-                }
-
-                /* This song-and-dance effectivly puts the principal
-                 * into talloc, so we can't loose it. */
-                talloc_set_destructor(principals[i], free_principal);
-        }
-
-        if (samAccountName) {
-                principals[i] = talloc(principals, struct principal_container);
-                if (!principals[i]) {
-                        talloc_free(tmp_ctx);
-                        *error_string = "Cannot allocate mem_ctx";
-                        return ENOMEM;
-                }
-
-                principals[i]->smb_krb5_context = talloc_reference(principals[i], smb_krb5_context);
-                principals[i]->string_form = talloc_asprintf(parent_ctx, "%s@%s", samAccountName, upper_realm);
-                if (!principals[i]->string_form) {
-                        talloc_free(tmp_ctx);
-                        *error_string = "Cannot allocate full samAccountName";
-                        return ENOMEM;
-                }
-                
-                ret = krb5_make_principal(smb_krb5_context->krb5_context, &principals[i]->principal, upper_realm, samAccountName,
-                                          NULL);
-                if (ret) {
-                        talloc_free(tmp_ctx);
-                        (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
-                        return ret;
-                }
-                
-                /* This song-and-dance effectivly puts the principal
-                 * into talloc, so we can't loose it. */
-                talloc_set_destructor(principals[i], free_principal);
-                i++;
-        }
-
-        principals[i] = NULL;
-        *principals_out = talloc_steal(parent_ctx, principals);
-
-        talloc_free(tmp_ctx);
-        return ret;
-}
-
-static krb5_error_code salt_principal_from_msg(TALLOC_CTX *parent_ctx, 
-                                               struct ldb_message *msg, 
-                                               struct smb_krb5_context *smb_krb5_context,
-                                               krb5_principal *salt_princ,
-                                               const char **error_string)
-{
-        const char *salt_principal = ldb_msg_find_attr_as_string(msg, "saltPrincipal", NULL);
-        const char *samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
-        const char *realm = ldb_msg_find_attr_as_string(msg, "realm", NULL);
-        if (salt_principal) {
-                return parse_principal(parent_ctx, salt_principal, smb_krb5_context, salt_princ, error_string);
-        } else if (samAccountName) {
-                krb5_error_code ret;
-                char *machine_username;
-                char *salt_body;
-                char *lower_realm;
-                char *upper_realm;
-
-                TALLOC_CTX *tmp_ctx;
-                struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
-                if (!mem_ctx) {
-                        *error_string = "Cannot allocate mem_ctx";
-                        return ENOMEM;
-                }
-
-                tmp_ctx = talloc_new(mem_ctx);
-                if (!tmp_ctx) {
-                        talloc_free(mem_ctx);
-                        *error_string = "Cannot allocate tmp_ctx";
-                        return ENOMEM;
-                }
-
-                if (!realm) {
-                        *error_string = "Cannot have a kerberos secret in secrets.ldb without a realm";
-                        return EINVAL;
-                }
-                
-                machine_username = talloc_strdup(tmp_ctx, samAccountName);
-                if (!machine_username) {
-                        talloc_free(mem_ctx);
-                        *error_string = "Cannot duplicate samAccountName";
-                        return ENOMEM;
-                }
-                
-                if (machine_username[strlen(machine_username)-1] == '$') {
-                        machine_username[strlen(machine_username)-1] = '\0';
-                }
-
-                lower_realm = strlower_talloc(tmp_ctx, realm);
-                if (!lower_realm) {
-                        talloc_free(mem_ctx);
-                        *error_string = "Cannot allocate to lower case realm";
-                        return ENOMEM;
-                }
-                
-                upper_realm = strupper_talloc(tmp_ctx, realm);
-                if (!upper_realm) {
-                        talloc_free(mem_ctx);
-                        *error_string = "Cannot allocate to upper case realm";
-                        return ENOMEM;
-                }
-                
-                salt_body = talloc_asprintf(tmp_ctx, "%s.%s", machine_username, 
-                                            lower_realm);
-                talloc_free(lower_realm);
-                talloc_free(machine_username);
-                if (!salt_body) {
-                        talloc_free(mem_ctx);
-                        *error_string = "Cannot form salt principal body";
-                        return ENOMEM;
-                }
-                
-                ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ, 
-                                          upper_realm,
-                                          "host", salt_body, NULL);
-                if (ret == 0) {
-                        /* This song-and-dance effectivly puts the principal
-                         * into talloc, so we can't loose it. */
-                        mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
-                        mem_ctx->principal = *salt_princ;
-                        talloc_set_destructor(mem_ctx, free_principal);
-                } else {
-                        (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
-                }
-                talloc_free(tmp_ctx);
-                return ret;
-        } else {
-                (*error_string) = "Cannot determine salt principal, no saltPrincipal or samAccountName specified";
-                return EINVAL;
-        }
 }
 
@@ -284 +88 @@
  * system by means of a destructor (do *not* free). */
 
-krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx, 
-                                            struct cli_credentials *credentials, 
-                                            struct smb_krb5_context *smb_krb5_context,
-                                            krb5_principal *princ,
-                                            enum credentials_obtained *obtained,
-                                            const char **error_string)
+krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
+                                struct cli_credentials *credentials,
+                                struct smb_krb5_context *smb_krb5_context,
+                                krb5_principal *princ,
+                                enum credentials_obtained *obtained,
+                                const char **error_string)
 {
         krb5_error_code ret;
         const char *princ_string;
         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
+        *obtained = CRED_UNINITIALISED;
+
         if (!mem_ctx) {
                 (*error_string) = error_message(ENOMEM);
                 return ENOMEM;
         }
-        princ_string = cli_credentials_get_principal_and_obtained(credentials, mem_ctx, obtained);
+        princ_string = cli_credentials_get_principal_and_obtained(credentials,
+                                                                  mem_ctx,
+                                                                  obtained);
         if (!princ_string) {
-                (*error_string) = error_message(ENOMEM);
-                return ENOMEM;
+                *princ = NULL;
+                return 0;
         }
 
@@ -315 +123 @@
  * system by means of a destructor (do *not* free). */
 
- krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
-                                                        struct cli_credentials *credentials,
-                                                        struct smb_krb5_context *smb_krb5_context,
-                                                        krb5_principal *princ,
-                                                        const char **error_string)
-{
-        return parse_principal(parent_ctx, cli_credentials_get_impersonate_principal(credentials),
-                               smb_krb5_context, princ, error_string);
+static krb5_error_code impersonate_principal_from_credentials(
+                                TALLOC_CTX *parent_ctx,
+                                struct cli_credentials *credentials,
+                                struct smb_krb5_context *smb_krb5_context,
+                                krb5_principal *princ,
+                                const char **error_string)
+{
+        return parse_principal(parent_ctx,
+                        cli_credentials_get_impersonate_principal(credentials),
+                        smb_krb5_context, princ, error_string);
+}
+
+krb5_error_code smb_krb5_create_principals_array(TALLOC_CTX *mem_ctx,
+                                                 krb5_context context,
+                                                 const char *account_name,
+                                                 const char *realm,
+                                                 uint32_t num_spns,
+                                                 const char *spns[],
+                                                 uint32_t *pnum_principals,
+                                                 krb5_principal **pprincipals,
+                                                 const char **error_string)
+{
+        krb5_error_code code;
+        TALLOC_CTX *tmp_ctx;
+        uint32_t num_principals = 0;
+        krb5_principal *principals;
+        uint32_t i;
+
+        tmp_ctx = talloc_new(mem_ctx);
+        if (tmp_ctx == NULL) {
+                *error_string = "Cannot allocate tmp_ctx";
+                return ENOMEM;
+        }
+
+        if (realm == NULL) {
+                *error_string = "Cannot create principal without a realm";
+                code = EINVAL;
+                goto done;
+        }
+
+        if (account_name == NULL && (num_spns == 0 || spns == NULL)) {
+                *error_string = "Cannot create principal without an account or SPN";
+                code = EINVAL;
+                goto done;
+        }
+
+        if (account_name != NULL && account_name[0] != '\0') {
+                num_principals++;
+        }
+        num_principals += num_spns;
+
+        principals = talloc_zero_array(tmp_ctx,
+                                       krb5_principal,
+                                       num_principals);
+        if (principals == NULL) {
+                *error_string = "Cannot allocate principals";
+                code = ENOMEM;
+                goto done;
+        }
+
+        for (i = 0; i < num_spns; i++) {
+                code = krb5_parse_name(context, spns[i], &(principals[i]));
+                if (code != 0) {
+                        *error_string = smb_get_krb5_error_message(context,
+                                                                   code,
+                                                                   mem_ctx);
+                        goto done;
+                }
+        }
+
+        if (account_name != NULL && account_name[0] != '\0') {
+                code = smb_krb5_make_principal(context,
+                                               &(principals[i]),
+                                               realm,
+                                               account_name,
+                                               NULL);
+                if (code != 0) {
+                        *error_string = smb_get_krb5_error_message(context,
+                                                                   code,
+                                                                   mem_ctx);
+                        goto done;
+                }
+        }
+
+        if (pnum_principals != NULL) {
+                *pnum_principals = num_principals;
+
+                if (pprincipals != NULL) {
+                        *pprincipals = talloc_steal(mem_ctx, principals);
+                }
+        }
+
+        code = 0;
+done:
+        talloc_free(tmp_ctx);
+        return code;
 }
 
@@ -339 +235 @@
 {
         krb5_error_code ret;
-        const char *password, *target_service;
+        const char *password;
+#ifdef SAMBA4_USES_HEIMDAL
+        const char *self_service;
+#endif
+        const char *target_service;
         time_t kdc_time = 0;
         krb5_principal princ;
@@ -358 +258 @@
         }
 
+        if (princ == NULL) {
+                (*error_string) = talloc_asprintf(credentials, "principal, username or realm was not specified in the credentials");
+                talloc_free(mem_ctx);
+                return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
+        }
+
         ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string);
         if (ret) {
@@ -364 +270 @@
         }
 
+#ifdef SAMBA4_USES_HEIMDAL
+        self_service = cli_credentials_get_self_service(credentials);
+#endif
         target_service = cli_credentials_get_target_service(credentials);
 
@@ -377 +286 @@
         }
 
+#ifdef SAMBA4_USES_HEIMDAL /* Disable for now MIT reads defaults when needed */
         /* get the defaults */
         krb5_get_init_creds_opt_set_default_flags(smb_krb5_context->krb5_context, NULL, NULL, krb_options);
-
+#endif
         /* set if we want a forwardable ticket */
         switch (cli_credentials_get_krb_forwardable(credentials)) {
@@ -392 +302 @@
         }
 
+#ifdef SAMBA4_USES_HEIMDAL /* FIXME: MIT does not have this yet */
+        /*
+         * In order to work against windows KDCs even if we use
+         * the netbios domain name as realm, we need to add the following
+         * flags:
+         * KRB5_INIT_CREDS_NO_C_CANON_CHECK;
+         * KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK;
+         *
+         * On MIT: Set pkinit_eku_checking to none
+         */
+        krb5_get_init_creds_opt_set_win2k(smb_krb5_context->krb5_context,
+                                          krb_options, true);
+#else /* MIT */
+        krb5_get_init_creds_opt_set_canonicalize(krb_options, true);
+#endif
+
         tries = 2;
         while (tries--) {
+#ifdef SAMBA4_USES_HEIMDAL
                 struct tevent_context *previous_ev;
                 /* Do this every time, in case we have weird recursive issues here */
@@ -401 +328 @@
                         return ret;
                 }
+#endif
                 if (password) {
-                        ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, ccache, 
-                                                         princ, password,
-                                                         impersonate_principal, target_service,
-                                                         krb_options,
-                                                         NULL, &kdc_time);
+                        if (impersonate_principal) {
+#ifdef SAMBA4_USES_HEIMDAL
+                                ret = kerberos_kinit_s4u2_cc(
+                                                smb_krb5_context->krb5_context,
+                                                ccache, princ, password,
+                                                impersonate_principal,
+                                                self_service, target_service,
+                                                krb_options, NULL, &kdc_time);
+#else
+                                talloc_free(mem_ctx);
+                                (*error_string) = "INTERNAL error: s4u2 ops "
+                                        "are not supported with MIT build yet";
+                                return EINVAL;
+#endif
+                        } else {
+                                ret = kerberos_kinit_password_cc(
+                                                smb_krb5_context->krb5_context,
+                                                ccache, princ, password,
+                                                target_service,
+                                                krb_options, NULL, &kdc_time);
+                        }
                 } else if (impersonate_principal) {
                         talloc_free(mem_ctx);
@@ -421 +365 @@
                                 (*error_string) = "kinit_to_ccache: No password available for kinit\n";
                                 krb5_get_init_creds_opt_free(smb_krb5_context->krb5_context, krb_options);
+#ifdef SAMBA4_USES_HEIMDAL
                                 smb_krb5_context_remove_event_ctx(smb_krb5_context, previous_ev, event_ctx);
+#endif
                                 return EINVAL;
                         }
-                        ret = krb5_keyblock_init(smb_krb5_context->krb5_context,
+                        ret = smb_krb5_keyblock_init_contents(smb_krb5_context->krb5_context,
                                                  ENCTYPE_ARCFOUR_HMAC,
                                                  mach_pwd->hash, sizeof(mach_pwd->hash), 
@@ -438 +384 @@
                 }
 
+#ifdef SAMBA4_USES_HEIMDAL
                 smb_krb5_context_remove_event_ctx(smb_krb5_context, previous_ev, event_ctx);
+#endif
 
                 if (ret == KRB5KRB_AP_ERR_SKEW || ret == KRB5_KDCREP_SKEW) {
@@ -485 +433 @@
                 talloc_free(mem_ctx);
                 return ret;
-        } 
+        }
+
+        DEBUG(10,("kinit for %s succeeded\n",
+                cli_credentials_get_principal(credentials, mem_ctx)));
+
+
         talloc_free(mem_ctx);
         return 0;
 }
 
-static krb5_error_code free_keytab(struct keytab_container *ktc)
+static krb5_error_code free_keytab_container(struct keytab_container *ktc)
 {
         return krb5_kt_close(ktc->smb_krb5_context->krb5_context, ktc->keytab);
 }
 
-krb5_error_code smb_krb5_open_keytab(TALLOC_CTX *mem_ctx,
-                         struct smb_krb5_context *smb_krb5_context, 
-                         const char *keytab_name, struct keytab_container **ktc) 
+krb5_error_code smb_krb5_get_keytab_container(TALLOC_CTX *mem_ctx,
+                                struct smb_krb5_context *smb_krb5_context,
+                                krb5_keytab opt_keytab,
+                                const char *keytab_name,
+                                struct keytab_container **ktc)
 {
         krb5_keytab keytab;
         krb5_error_code ret;
-        ret = krb5_kt_resolve(smb_krb5_context->krb5_context, keytab_name, &keytab);
-        if (ret) {
-                DEBUG(1,("failed to open krb5 keytab: %s\n", 
-                         smb_get_krb5_error_message(smb_krb5_context->krb5_context, 
-                                                    ret, mem_ctx)));
-                return ret;
+
+        if (opt_keytab) {
+                keytab = opt_keytab;
+        } else {
+                ret = krb5_kt_resolve(smb_krb5_context->krb5_context,
+                                                keytab_name, &keytab);
+                if (ret) {
+                        DEBUG(1,("failed to open krb5 keytab: %s\n",
+                                 smb_get_krb5_error_message(
+                                        smb_krb5_context->krb5_context,
+                                        ret, mem_ctx)));
+                        return ret;
+                }
         }
 
@@ -516 +478 @@
         (*ktc)->smb_krb5_context = talloc_reference(*ktc, smb_krb5_context);
         (*ktc)->keytab = keytab;
-        talloc_set_destructor(*ktc, free_keytab);
+        (*ktc)->password_based = false;
+        talloc_set_destructor(*ktc, free_keytab_container);
 
         return 0;
 }
 
-static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
-                                       struct principal_container **principals,
-                                       krb5_principal salt_princ,
-                                       int kvno,
-                                       const char *password_s,
-                                       struct smb_krb5_context *smb_krb5_context,
-                                       krb5_enctype *enctypes,
-                                       krb5_keytab keytab,
-                                       const char **error_string)
-{
-        unsigned int i, p;
-        krb5_error_code ret;
-        krb5_data password;
-
-        password.data = discard_const_p(char *, password_s);
-        password.length = strlen(password_s);
-
-        for (i=0; enctypes[i]; i++) {
-                krb5_keytab_entry entry;
-
-                ZERO_STRUCT(entry);
-
-                ret = create_kerberos_key_from_string(smb_krb5_context->krb5_context, 
-                                                      salt_princ, &password, &entry.keyblock, enctypes[i]);
-                if (ret != 0) {
-                        return ret;
-                }
-
-                entry.vno = kvno;
-
-                for (p=0; principals[p]; p++) {
-                        entry.principal = principals[p]->principal;
-                        ret = krb5_kt_add_entry(smb_krb5_context->krb5_context, keytab, &entry);
-                        if (ret != 0) {
-                                char *k5_error_string = smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                                                   ret, NULL);
-                                *error_string = talloc_asprintf(parent_ctx, "Failed to add enctype %d entry for %s(kvno %d) to keytab: %s\n",
-                                                                (int)enctypes[i],
-                                                                principals[p]->string_form,
-                                                                kvno,
-                                                                k5_error_string);
-                                talloc_free(k5_error_string);
-                                krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
-                                return ret;
-                        }
-
-                        DEBUG(5, ("Added %s(kvno %d) to keytab (enctype %d)\n", 
-                                  principals[p]->string_form, kvno,
-                                  (int)enctypes[i]));
-                }
-                krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
-        }
-        return 0;
-}
-
-static krb5_error_code create_keytab(TALLOC_CTX *parent_ctx,
-                                     struct ldb_message *msg,
-                                     struct principal_container **principals,
-                                     struct smb_krb5_context *smb_krb5_context,
-                                     krb5_keytab keytab,
-                                     bool add_old,
-                                     const char **error_string)
-{
-        krb5_error_code ret;
-        const char *password_s;
-        const char *old_secret;
-        int kvno;
-        uint32_t enctype_bitmap;
-        krb5_principal salt_princ;
-        krb5_enctype *enctypes;
-        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
-        if (!mem_ctx) {
-                *error_string = "unable to allocate tmp_ctx for create_keytab";
-                return ENOMEM;
-        }
-
-        /* The salt used to generate these entries may be different however, fetch that */
-        ret = salt_principal_from_msg(mem_ctx, msg,
-                                      smb_krb5_context, 
-                                      &salt_princ, error_string);
-        if (ret) {
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        kvno = ldb_msg_find_attr_as_int(msg, "msDS-KeyVersionNumber", 0);
-
-        /* Finally, do the dance to get the password to put in the entry */
-        password_s =  ldb_msg_find_attr_as_string(msg, "secret", NULL);
-
-        if (!password_s) {
-                /* There is no password here, so nothing to do */
-                talloc_free(mem_ctx);
-                return 0;
-        }
-
-        if (add_old && kvno != 0) {
-                old_secret = ldb_msg_find_attr_as_string(msg, "priorSecret", NULL);
-        } else {
-                old_secret = NULL;
-        }
-
-        enctype_bitmap = (uint32_t)ldb_msg_find_attr_as_int(msg, "msDS-SupportedEncryptionTypes", ENC_ALL_TYPES);
-        
-        ret = kerberos_enctype_bitmap_to_enctypes(mem_ctx, enctype_bitmap, &enctypes);
-        if (ret) {
-                *error_string = talloc_asprintf(parent_ctx, "create_keytab: generating list of encryption types failed (%s)\n",
-                                                smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                                           ret, mem_ctx));
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        ret = keytab_add_keys(mem_ctx, principals,
-                              salt_princ,
-                              kvno, password_s, smb_krb5_context,
-                              enctypes, keytab, error_string);
-        if (ret) {
-                talloc_free(mem_ctx);
-                return ret;
-        }
-        
-        if (old_secret) {
-                ret = keytab_add_keys(mem_ctx, principals,
-                                      salt_princ,
-                                      kvno - 1, old_secret, smb_krb5_context,
-                                      enctypes, keytab, error_string);
-                if (ret) {
-                        talloc_free(mem_ctx);
-                        return ret;
-                }
-        }
-
-        talloc_free(mem_ctx);
-        return ret;
-}
-
 /*
- * Walk the keytab, looking for entries of this principal name, with KVNO other than current kvno -1.
+ * Walk the keytab, looking for entries of this principal name,
+ * with KVNO other than current kvno -1.
  *
- * These entries are now stale, we only keep the current, and previous entries around.
+ * These entries are now stale,
+ * we only keep the current and previous entries around.
  *
  * Inspired by the code in Samba3 for 'use kerberos keytab'.
- *
  */
-
-static krb5_error_code remove_old_entries(TALLOC_CTX *parent_ctx,
-                                          struct ldb_message *msg,
-                                          struct principal_container **principals,
-                                          bool delete_all_kvno,
-                                          struct smb_krb5_context *smb_krb5_context,
-                                          krb5_keytab keytab, bool *found_previous,
-                                          const char **error_string)
-{
-        krb5_error_code ret, ret2;
+krb5_error_code smb_krb5_remove_obsolete_keytab_entries(TALLOC_CTX *mem_ctx,
+                                                        krb5_context context,
+                                                        krb5_keytab keytab,
+                                                        uint32_t num_principals,
+                                                        krb5_principal *principals,
+                                                        krb5_kvno kvno,
+                                                        bool *found_previous,
+                                                        const char **error_string)
+{
+        TALLOC_CTX *tmp_ctx;
+        krb5_error_code code;
         krb5_kt_cursor cursor;
-        int kvno;
-        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
-
-        if (!mem_ctx) {
+
+        tmp_ctx = talloc_new(mem_ctx);
+        if (tmp_ctx == NULL) {
+                *error_string = "Cannot allocate tmp_ctx";
                 return ENOMEM;
         }
 
-        *found_previous = false;
-
-        kvno = ldb_msg_find_attr_as_int(msg, "msDS-KeyVersionNumber", 0);
-
-        /* for each entry in the keytab */
-        ret = krb5_kt_start_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
-        switch (ret) {
+        *found_previous = true;
+
+        code = krb5_kt_start_seq_get(context, keytab, &cursor);
+        switch (code) {
         case 0:
                 break;
+#ifdef HEIM_ERR_OPNOTSUPP
         case HEIM_ERR_OPNOTSUPP:
+#endif
         case ENOENT:
         case KRB5_KT_END:
                 /* no point enumerating if there isn't anything here */
-                talloc_free(mem_ctx);
-                return 0;
+                code = 0;
+                goto done;
         default:
-                *error_string = talloc_asprintf(parent_ctx, "failed to open keytab for read of old entries: %s\n",
-                                                smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                                           ret, mem_ctx));
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        while (!ret) {
-                unsigned int i;
+                *error_string = talloc_asprintf(mem_ctx,
+                                                "failed to open keytab for read of old entries: %s\n",
+                                                smb_get_krb5_error_message(context, code, mem_ctx));
+                goto done;
+        }
+
+        do {
+                krb5_kvno old_kvno = kvno - 1;
+                krb5_keytab_entry entry;
                 bool matched = false;
-                krb5_keytab_entry entry;
-                ret = krb5_kt_next_entry(smb_krb5_context->krb5_context, keytab, &entry, &cursor);
-                if (ret) {
+                uint32_t i;
+
+                code = krb5_kt_next_entry(context, keytab, &entry, &cursor);
+                if (code) {
                         break;
                 }
-                for (i = 0; principals[i]; i++) {
-                        /* if it matches our principal */
-                        if (krb5_kt_compare(smb_krb5_context->krb5_context, &entry, principals[i]->principal, 0, 0)) {
+
+                for (i = 0; i < num_principals; i++) {
+                        krb5_boolean ok;
+
+                        ok = smb_krb5_kt_compare(context,
+                                                &entry,
+                                                principals[i],
+                                                0,
+                                                0);
+                        if (ok) {
                                 matched = true;
                                 break;
@@ -724 +559 @@
 
                 if (!matched) {
-                        /* Free the entry, it wasn't the one we were looking for anyway */
-                        krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
+                        /*
+                         * Free the entry, it wasn't the one we were looking
+                         * for anyway
+                         */
+                        krb5_kt_free_entry(context, &entry);
+                        /* Make sure we do not double free */
+                        ZERO_STRUCT(entry);
                         continue;
                 }
 
-                /* delete it, if it is not kvno -1 */
-                if (entry.vno != (kvno - 1 )) {
+                /*
+                 * Delete it, if it is not kvno - 1.
+                 *
+                 * Some keytab files store the kvno only in 8bits. Limit the
+                 * compare to 8bits, so that we don't miss old keys and delete
+                 * them.
+                 */
+                if ((entry.vno & 0xff) != (old_kvno & 0xff)) {
+                        krb5_error_code rc;
+
                         /* Release the enumeration.  We are going to
                          * have to start this from the top again,
                          * because deletes during enumeration may not
-                         * always be consistant.
+                         * always be consistent.
                          *
                          * Also, the enumeration locks a FILE: keytab
                          */
-                
-                        krb5_kt_end_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
-
-                        ret = krb5_kt_remove_entry(smb_krb5_context->krb5_context, keytab, &entry);
-                        krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
+                        krb5_kt_end_seq_get(context, keytab, &cursor);
+
+                        code = krb5_kt_remove_entry(context, keytab, &entry);
+                        krb5_kt_free_entry(context, &entry);
+
+                        /* Make sure we do not double free */
+                        ZERO_STRUCT(entry);
 
                         /* Deleted: Restart from the top */
-                        ret2 = krb5_kt_start_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
-                        if (ret2) {
-                                krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
-                                DEBUG(1,("failed to restart enumeration of keytab: %s\n",
-                                         smb_get_krb5_error_message(smb_krb5_context->krb5_context, 
-                                                                    ret, mem_ctx)));
-                                
-                                talloc_free(mem_ctx);
-                                return ret2;
+                        rc = krb5_kt_start_seq_get(context, keytab, &cursor);
+                        if (rc != 0) {
+                                krb5_kt_free_entry(context, &entry);
+
+                                /* Make sure we do not double free */
+                                ZERO_STRUCT(entry);
+
+                                DEBUG(1, ("failed to restart enumeration of keytab: %s\n",
+                                          smb_get_krb5_error_message(context,
+                                                                     code,
+                                                                     tmp_ctx)));
+
+                                talloc_free(tmp_ctx);
+                                return rc;
                         }
 
-                        if (ret) {
+                        if (code != 0) {
                                 break;
                         }
-                        
+
                 } else {
                         *found_previous = true;
                 }
-                
+
                 /* Free the entry, we don't need it any more */
-                krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
-                
-                
-        }
-        krb5_kt_end_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
-
-        switch (ret) {
+                krb5_kt_free_entry(context, &entry);
+                /* Make sure we do not double free */
+                ZERO_STRUCT(entry);
+        } while (code != 0);
+
+        krb5_kt_end_seq_get(context, keytab, &cursor);
+
+        switch (code) {
         case 0:
                 break;
         case ENOENT:
         case KRB5_KT_END:
-                ret = 0;
+                code = 0;
                 break;
         default:
-                *error_string = talloc_asprintf(parent_ctx, "failed in deleting old entries for principal: %s\n",
-                                                smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                                           ret, mem_ctx));
-        }
-        talloc_free(mem_ctx);
-        return ret;
-}
-
-krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
-                                       struct smb_krb5_context *smb_krb5_context,
-                                       struct ldb_context *ldb, 
-                                       struct ldb_message *msg,
-                                       bool delete_all_kvno,
-                                       const char **error_string)
-{
-        krb5_error_code ret;
-        bool found_previous;
-        TALLOC_CTX *mem_ctx = talloc_new(NULL);
-        struct keytab_container *keytab_container;
-        struct principal_container **principals;
-        const char *keytab_name;
-
-        if (!mem_ctx) {
-                return ENOMEM;
-        }
-
-        keytab_name = keytab_name_from_msg(mem_ctx, ldb, msg);
-        if (!keytab_name) {
-                return ENOENT;
-        }
-
-        ret = smb_krb5_open_keytab(mem_ctx, smb_krb5_context, keytab_name, &keytab_container);
-
-        if (ret != 0) {
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        DEBUG(5, ("Opened keytab %s\n", keytab_name));
-
-        /* Get the principal we will store the new keytab entries under */
-        ret = principals_from_msg(mem_ctx, msg, smb_krb5_context, &principals, error_string);
-
-        if (ret != 0) {
-                *error_string = talloc_asprintf(parent_ctx, "Failed to load principals from ldb message: %s\n", *error_string);
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        ret = remove_old_entries(mem_ctx, msg, principals, delete_all_kvno,
-                                 smb_krb5_context, keytab_container->keytab, &found_previous, error_string);
-        if (ret != 0) {
-                *error_string = talloc_asprintf(parent_ctx, "Failed to remove old principals from keytab: %s\n", *error_string);
-                talloc_free(mem_ctx);
-                return ret;
-        }
-        
-        if (!delete_all_kvno) {
-                /* Create a new keytab.  If during the cleanout we found
-                 * entires for kvno -1, then don't try and duplicate them.
-                 * Otherwise, add kvno, and kvno -1 */
-                
-                ret = create_keytab(mem_ctx, msg, principals,
-                                    smb_krb5_context,
-                                    keytab_container->keytab, 
-                                    found_previous ? false : true, error_string);
-        }
-        talloc_free(mem_ctx);
-        return ret;
-}
-
-krb5_error_code smb_krb5_create_memory_keytab(TALLOC_CTX *parent_ctx,
-                                           struct cli_credentials *machine_account,
-                                           struct smb_krb5_context *smb_krb5_context,
-                                           struct keytab_container **keytab_container) 
-{
-        krb5_error_code ret;
-        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
-        const char *rand_string;
-        const char *keytab_name;
-        struct ldb_message *msg;
-        const char *error_string;
-        if (!mem_ctx) {
-                return ENOMEM;
-        }
-        
-        *keytab_container = talloc(mem_ctx, struct keytab_container);
-
-        rand_string = generate_random_str(mem_ctx, 16);
-        if (!rand_string) {
-                talloc_free(mem_ctx);
-                return ENOMEM;
-        }
-
-        keytab_name = talloc_asprintf(mem_ctx, "MEMORY:%s", 
-                                      rand_string);
-        if (!keytab_name) {
-                talloc_free(mem_ctx);
-                return ENOMEM;
-        }
-
-        ret = smb_krb5_open_keytab(mem_ctx, smb_krb5_context, keytab_name, keytab_container);
-        if (ret) {
-                return ret;
-        }
-
-        msg = ldb_msg_new(mem_ctx);
-        if (!msg) {
-                talloc_free(mem_ctx);
-                return ENOMEM;
-        }
-        ldb_msg_add_string(msg, "krb5Keytab", keytab_name);
-        ldb_msg_add_string(msg, "secret", cli_credentials_get_password(machine_account));
-        ldb_msg_add_string(msg, "samAccountName", cli_credentials_get_username(machine_account));
-        ldb_msg_add_string(msg, "realm", cli_credentials_get_realm(machine_account));
-        ldb_msg_add_fmt(msg, "msDS-KeyVersionNumber", "%d", (int)cli_credentials_get_kvno(machine_account));
-
-        ret = smb_krb5_update_keytab(mem_ctx, smb_krb5_context, NULL, msg, false, &error_string);
-        if (ret == 0) {
-                talloc_steal(parent_ctx, *keytab_container);
-        } else {
-                DEBUG(0, ("Failed to create in-memory keytab: %s\n", error_string));
-                *keytab_container = NULL;
-        }
-        talloc_free(mem_ctx);
-        return ret;
-}
-/* Translate between the IETF encryption type values and the Microsoft msDS-SupportedEncryptionTypes values */
-uint32_t kerberos_enctype_to_bitmap(krb5_enctype enc_type_enum)
-{
-        switch (enc_type_enum) {
-        case ENCTYPE_DES_CBC_CRC:
-                return ENC_CRC32;
-        case ENCTYPE_DES_CBC_MD5:
-                return ENC_RSA_MD5;
-        case ENCTYPE_ARCFOUR_HMAC_MD5:
-                return ENC_RC4_HMAC_MD5;
-        case ENCTYPE_AES128_CTS_HMAC_SHA1_96:
-                return ENC_HMAC_SHA1_96_AES128;
-        case ENCTYPE_AES256_CTS_HMAC_SHA1_96:
-                return ENC_HMAC_SHA1_96_AES256;
-        default:
-                return 0;
-        }
-}
-
-/* Translate between the Microsoft msDS-SupportedEncryptionTypes values and the IETF encryption type values */
-krb5_enctype kerberos_enctype_bitmap_to_enctype(uint32_t enctype_bitmap)
-{
-        switch (enctype_bitmap) {
-        case ENC_CRC32:
-                return ENCTYPE_DES_CBC_CRC;
-        case ENC_RSA_MD5:
-                return ENCTYPE_DES_CBC_MD5;
-        case ENC_RC4_HMAC_MD5:
-                return ENCTYPE_ARCFOUR_HMAC_MD5;
-        case ENC_HMAC_SHA1_96_AES128:
-                return ENCTYPE_AES128_CTS_HMAC_SHA1_96;
-        case ENC_HMAC_SHA1_96_AES256:
-                return ENCTYPE_AES256_CTS_HMAC_SHA1_96;
-        default:
-                return 0;
-        }
-}
-
-/* Return an array of krb5_enctype values */
-krb5_error_code kerberos_enctype_bitmap_to_enctypes(TALLOC_CTX *mem_ctx, uint32_t enctype_bitmap, krb5_enctype **enctypes)
-{
-        unsigned int i, j = 0;
-        *enctypes = talloc_zero_array(mem_ctx, krb5_enctype, (8*sizeof(enctype_bitmap))+1);
-        if (!*enctypes) {
-                return ENOMEM;
-        }
-        for (i=0; i<(8*sizeof(enctype_bitmap)); i++) {
-                uint32_t bit_value = (1 << i) & enctype_bitmap;
-                if (bit_value & enctype_bitmap) {
-                        (*enctypes)[j] = kerberos_enctype_bitmap_to_enctype(bit_value);
-                        if (!(*enctypes)[j]) {
-                                continue;
-                        }
-                        j++;
-                }
-        }
-        (*enctypes)[j] = 0;
-        return 0;
-}
+                *error_string = talloc_asprintf(mem_ctx,
+                                                "failed in deleting old entries for principal: %s\n",
+                                                smb_get_krb5_error_message(context,
+                                                                           code,
+                                                                           mem_ctx));
+        }
+
+        code = 0;
+done:
+        talloc_free(tmp_ctx);
+        return code;
+}

vendor/current/source4/auth/kerberos/krb5_init_context.c

@@ -23 +23 @@
 #include "includes.h"
 #include "system/kerberos.h"
+#include "system/gssapi.h"
 #include <tevent.h>
 #include "auth/kerberos/kerberos.h"
@@ -31 +32 @@
 #include "libcli/resolve/resolve.h"
 #include "../lib/tsocket/tsocket.h"
-
+#include "krb5_init_context.h"
 /*
   context structure for operations on cldap packets
@@ -47 +48 @@
 
         size_t partial_read;
-
+#ifdef SAMBA4_USES_HEIMDAL
         krb5_krbhst_info *hi;
+#endif
 };
 
 static krb5_error_code smb_krb5_context_destroy(struct smb_krb5_context *ctx)
 {
-        /* Otherwise krb5_free_context will try and close what we have already free()ed */
-        krb5_set_warn_dest(ctx->krb5_context, NULL);
-        krb5_closelog(ctx->krb5_context, ctx->logf);
+#ifdef SAMBA4_USES_HEIMDAL
+        if (ctx->pvt_log_data) {
+                /* Otherwise krb5_free_context will try and close what we
+                 * have already free()ed */
+                krb5_set_warn_dest(ctx->krb5_context, NULL);
+                krb5_closelog(ctx->krb5_context,
+                                (krb5_log_facility *)ctx->pvt_log_data);
+        }
+#endif
         krb5_free_context(ctx->krb5_context);
         return 0;
 }
 
+#ifdef SAMBA4_USES_HEIMDAL
 /* We never close down the DEBUG system, and no need to unreference the use */
 static void smb_krb5_debug_close(void *private_data) {
         return;
 }
-
+#endif
+
+#ifdef SAMBA4_USES_HEIMDAL
 static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private_data)
 {
         DEBUG(3, ("Kerberos: %s\n", msg));
 }
-
+#endif
+
+#ifdef SAMBA4_USES_HEIMDAL
 /*
   handle recv events on a smb_krb5 socket
@@ -105 +118 @@
         }
 
-        DEBUG(2,("Received smb_krb5 packet of length %d\n",
+        DEBUG(4,("Received smb_krb5 packet of length %d\n",
                  (int)blob.length));
 
@@ -198 +211 @@
 }
 
-
-krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
-                                            void *data,
-                                            krb5_krbhst_info *hi,
-                                            time_t timeout,
-                                            const krb5_data *send_buf,
-                                            krb5_data *recv_buf)
+static krb5_error_code smb_krb5_send_and_recv_func_int(krb5_context context,
+                                                       struct tevent_context *ev,
+                                                       krb5_krbhst_info *hi,
+                                                       struct addrinfo *ai,
+                                                       krb5_send_to_kdc_func func,
+                                                       void *data,
+                                                       time_t timeout,
+                                                       const krb5_data *send_buf,
+                                                       krb5_data *recv_buf)
 {
         krb5_error_code ret;
         NTSTATUS status;
         const char *name;
-        struct addrinfo *ai, *a;
+        struct addrinfo *a;
         struct smb_krb5_socket *smb_krb5;
 
         DATA_BLOB send_blob;
 
-        struct tevent_context *ev;
-        TALLOC_CTX *tmp_ctx = talloc_new(NULL);
-        if (!tmp_ctx) {
+        TALLOC_CTX *frame = talloc_stackframe();
+        if (frame == NULL) {
                 return ENOMEM;
         }
 
-        if (!data) {
-                /* If no event context was available, then create one for this loop */
-                ev = tevent_context_init(tmp_ctx);
-                if (!ev) {
-                        talloc_free(tmp_ctx);
-                        return ENOMEM;
-                }
-        } else {
-                ev = talloc_get_type_abort(data, struct tevent_context);
-        }
-
         send_blob = data_blob_const(send_buf->data, send_buf->length);
-
-        ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
-        if (ret) {
-                talloc_free(tmp_ctx);
-                return ret;
-        }
 
         for (a = ai; a; a = a->ai_next) {
                 struct socket_address *remote_addr;
-                smb_krb5 = talloc(tmp_ctx, struct smb_krb5_socket);
+                smb_krb5 = talloc(frame, struct smb_krb5_socket);
                 if (!smb_krb5) {
-                        talloc_free(tmp_ctx);
+                        TALLOC_FREE(frame);
                         return ENOMEM;
                 }
@@ -258 +255 @@
 #endif
                 default:
-                        talloc_free(tmp_ctx);
+                        TALLOC_FREE(frame);
                         return EINVAL;
                 }
@@ -271 +268 @@
                         break;
                 case KRB5_KRBHST_HTTP:
-                        talloc_free(tmp_ctx);
+                        TALLOC_FREE(frame);
                         return EINVAL;
                 }
@@ -339 +336 @@
                         break;
                 case KRB5_KRBHST_HTTP:
-                        talloc_free(tmp_ctx);
+                        TALLOC_FREE(frame);
                         return EINVAL;
                 }
                 while ((NT_STATUS_IS_OK(smb_krb5->status)) && !smb_krb5->reply.length) {
                         if (tevent_loop_once(ev) != 0) {
-                                talloc_free(tmp_ctx);
+                                TALLOC_FREE(frame);
                                 return EINVAL;
                         }
 
-                        /* After each and every event loop, reset the
-                         * send_to_kdc pointers to what they were when
-                         * we entered this loop.  That way, if a
-                         * nested event has invalidated them, we put
-                         * it back before we return to the heimdal
-                         * code */
-                        ret = krb5_set_send_to_kdc_func(context,
-                                                        smb_krb5_send_and_recv_func,
-                                                        data);
-                        if (ret != 0) {
-                                talloc_free(tmp_ctx);
-                                return ret;
+                        if (func) {
+                                /* After each and every event loop, reset the
+                                 * send_to_kdc pointers to what they were when
+                                 * we entered this loop.  That way, if a
+                                 * nested event has invalidated them, we put
+                                 * it back before we return to the heimdal
+                                 * code */
+                                ret = krb5_set_send_to_kdc_func(context,
+                                                                func,
+                                                                data);
+                                if (ret != 0) {
+                                        TALLOC_FREE(frame);
+                                        return ret;
+                                }
                         }
                 }
@@ -383 +382 @@
                 ret = krb5_data_copy(recv_buf, smb_krb5->reply.data, smb_krb5->reply.length);
                 if (ret) {
-                        talloc_free(tmp_ctx);
+                        TALLOC_FREE(frame);
                         return ret;
                 }
@@ -390 +389 @@
                 break;
         }
-        talloc_free(tmp_ctx);
+        TALLOC_FREE(frame);
         if (a) {
                 return 0;
@@ -396 +395 @@
         return KRB5_KDC_UNREACH;
 }
+
+krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
+                                            void *data,
+                                            krb5_krbhst_info *hi,
+                                            time_t timeout,
+                                            const krb5_data *send_buf,
+                                            krb5_data *recv_buf)
+{
+        krb5_error_code ret;
+        struct addrinfo *ai;
+
+        struct tevent_context *ev;
+        TALLOC_CTX *frame = talloc_stackframe();
+        if (frame == NULL) {
+                return ENOMEM;
+        }
+
+        if (data == NULL) {
+                /* If no event context was available, then create one for this loop */
+                ev = samba_tevent_context_init(frame);
+                if (ev == NULL) {
+                        TALLOC_FREE(frame);
+                        return ENOMEM;
+                }
+        } else {
+                ev = talloc_get_type_abort(data, struct tevent_context);
+        }
+
+        ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
+        if (ret) {
+                TALLOC_FREE(frame);
+                return ret;
+        }
+
+        ret = smb_krb5_send_and_recv_func_int(context, ev, hi, ai, smb_krb5_send_and_recv_func, data, timeout, send_buf, recv_buf);
+        TALLOC_FREE(frame);
+        return ret;
+}
+
+krb5_error_code smb_krb5_send_and_recv_func_forced(krb5_context context,
+                                                   void *data, /* struct addrinfo */
+                                                   krb5_krbhst_info *hi,
+                                                   time_t timeout,
+                                                   const krb5_data *send_buf,
+                                                   krb5_data *recv_buf)
+{
+        krb5_error_code k5ret;
+        struct addrinfo *ai = data;
+
+        struct tevent_context *ev;
+        TALLOC_CTX *frame = talloc_stackframe();
+        if (frame == NULL) {
+                return ENOMEM;
+        }
+
+        /* no event context is passed in, create one for this loop */
+        ev = samba_tevent_context_init(frame);
+        if (ev == NULL) {
+                TALLOC_FREE(frame);
+                return ENOMEM;
+        }
+
+        /* No need to pass in send_and_recv functions, we won't nest on this private event loop */
+        k5ret = smb_krb5_send_and_recv_func_int(context, ev, hi, ai, NULL, NULL,
+                                                timeout, send_buf, recv_buf);
+        TALLOC_FREE(frame);
+        return k5ret;
+}
+#endif
 
 krb5_error_code
@@ -403 +471 @@
 {
         krb5_error_code ret;
+#ifdef SAMBA4_USES_HEIMDAL
         char **config_files;
         const char *config_file, *realm;
+#endif
         krb5_context krb5_ctx;
 
@@ -416 +486 @@
         }
 
-        config_file = config_path(tmp_ctx, lp_ctx, "krb5.conf");
+        /* The MIT Kerberos build relies on using the system krb5.conf file.
+         * If you really want to use another file please set KRB5_CONFIG
+         * accordingly. */
+#ifdef SAMBA4_USES_HEIMDAL
+        config_file = lpcfg_config_path(tmp_ctx, lp_ctx, "krb5.conf");
         if (!config_file) {
                 krb5_free_context(krb5_ctx);
@@ -423 +497 @@
 
         /* Use our local krb5.conf file by default */
-        ret = krb5_prepend_config_files_default(config_file == NULL?"":config_file, &config_files);
+        ret = krb5_prepend_config_files_default(config_file, &config_files);
         if (ret) {
                 DEBUG(1,("krb5_prepend_config_files_default failed (%s)\n",
@@ -450 +524 @@
                 }
         }
-
+#endif
         *_krb5_context = krb5_ctx;
         return 0;
@@ -456 +530 @@
 
 krb5_error_code smb_krb5_init_context(void *parent_ctx,
-                                      struct tevent_context *ev,
                                       struct loadparm_context *lp_ctx,
                                       struct smb_krb5_context **smb_krb5_context)
@@ -462 +535 @@
         krb5_error_code ret;
         TALLOC_CTX *tmp_ctx;
+        krb5_context kctx;
+#ifdef SAMBA4_USES_HEIMDAL
+        krb5_log_facility *logf;
+#endif
 
         initialize_krb5_error_table();
@@ -473 +550 @@
         }
 
-        ret = smb_krb5_init_context_basic(tmp_ctx, lp_ctx,
-                                          &(*smb_krb5_context)->krb5_context);
+        ret = smb_krb5_init_context_basic(tmp_ctx, lp_ctx, &kctx);
         if (ret) {
                 DEBUG(1,("smb_krb5_context_init_basic failed (%s)\n",
@@ -481 +557 @@
                 return ret;
         }
-
+        (*smb_krb5_context)->krb5_context = kctx;
+
+        talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy);
+
+#ifdef SAMBA4_USES_HEIMDAL
         /* TODO: Should we have a different name here? */
-        ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf);
+        ret = krb5_initlog(kctx, "Samba", &logf);
 
         if (ret) {
                 DEBUG(1,("krb5_initlog failed (%s)\n",
-                         smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
-                krb5_free_context((*smb_krb5_context)->krb5_context);
-                talloc_free(tmp_ctx);
-                return ret;
-        }
-
-        talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy);
-
-        ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */,
-                               smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL);
+                         smb_get_krb5_error_message(kctx, ret, tmp_ctx)));
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        (*smb_krb5_context)->pvt_log_data = logf;
+
+        ret = krb5_addlog_func(kctx, logf, 0 /* min */, -1 /* max */,
+                               smb_krb5_debug_wrapper,
+                                smb_krb5_debug_close, NULL);
         if (ret) {
                 DEBUG(1,("krb5_addlog_func failed (%s)\n",
-                         smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
-                talloc_free(tmp_ctx);
-                return ret;
-        }
-        krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf);
-
-        /* Set use of our socket lib */
-        if (ev) {
-                struct tevent_context *previous_ev;
-                ret = smb_krb5_context_set_event_ctx(*smb_krb5_context,
-                                                     ev, &previous_ev);
-                if (ret) {
-                        talloc_free(tmp_ctx);
-                        return ret;
-                }
-        }
-
+                         smb_get_krb5_error_message(kctx, ret, tmp_ctx)));
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        krb5_set_warn_dest(kctx, logf);
+
+        /* Set options in kerberos */
+
+        krb5_set_dns_canonicalize_hostname(kctx,
+                        lpcfg_parm_bool(lp_ctx, NULL, "krb5",
+                                        "set_dns_canonicalize", false));
+#endif
         talloc_steal(parent_ctx, *smb_krb5_context);
         talloc_free(tmp_ctx);
 
-        /* Set options in kerberos */
-
-        krb5_set_dns_canonicalize_hostname((*smb_krb5_context)->krb5_context,
-                                           lpcfg_parm_bool(lp_ctx, NULL, "krb5", "set_dns_canonicalize", false));
-
         return 0;
 }
 
+#ifdef SAMBA4_USES_HEIMDAL
 krb5_error_code smb_krb5_context_set_event_ctx(struct smb_krb5_context *smb_krb5_context,
                                                struct tevent_context *ev,
@@ -580 +650 @@
         return 0;
 }
+#endif

vendor/current/source4/auth/kerberos/krb5_init_context.h

@@ -18 +18 @@
 */
 
+#ifndef _KRB5_INIT_CONTEXT_H_
+#define _KRB5_INIT_CONTEXT_H_
+
 struct smb_krb5_context {
         krb5_context krb5_context;
-        krb5_log_facility *logf;
+        void *pvt_log_data;
         struct tevent_context *current_ev;
 };
-        
+
 struct tevent_context;
 struct loadparm_context;
@@ -32 +35 @@
                             krb5_context *_krb5_context);
 
-krb5_error_code smb_krb5_init_context(void *parent_ctx, struct tevent_context *ev,
+krb5_error_code smb_krb5_init_context(void *parent_ctx,
                                       struct loadparm_context *lp_ctx,
                                       struct smb_krb5_context **smb_krb5_context); 
 
+#ifdef SAMBA4_USES_HEIMDAL
 krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
                                             void *data,
@@ -42 +46 @@
                                             const krb5_data *send_buf,
                                             krb5_data *recv_buf);
+krb5_error_code smb_krb5_send_and_recv_func_forced(krb5_context context,
+                                                   void *data, /* struct addrinfo */
+                                                   krb5_krbhst_info *hi,
+                                                   time_t timeout,
+                                                   const krb5_data *send_buf,
+                                                   krb5_data *recv_buf);
+krb5_error_code smb_krb5_context_set_event_ctx(struct smb_krb5_context *smb_krb5_context,
+                                               struct tevent_context *ev,
+                                               struct tevent_context **previous_ev);
+krb5_error_code smb_krb5_context_remove_event_ctx(struct smb_krb5_context *smb_krb5_context,
+                                                  struct tevent_context *previous_ev,
+                                                  struct tevent_context *ev);
+#endif
+
+#endif /* _KRB5_INIT_CONTEXT_H_ */

vendor/current/source4/auth/kerberos/wscript_build

@@ -1 +1 @@
 #!/usr/bin/env python
 
+bld.SAMBA_SUBSYSTEM('KRB_INIT_CTX',
+                    source='krb5_init_context.c',
+                    deps='gssapi krb5samba'
+                   )
+
 bld.SAMBA_LIBRARY('authkrb5',
-                  source='kerberos.c clikrb5.c kerberos_heimdal.c kerberos_pac.c gssapi_parse.c krb5_init_context.c keytab_copy.c',
+                  source='kerberos_pac.c',
                   autoproto='proto.h',
-                  public_deps='krb5 ndr-krb5pac samba_socket LIBCLI_RESOLVE com_err asn1',
-                  deps='ASN1_UTIL auth_sam_reply tevent LIBPACKET ndr ldb',
+                  public_deps='ndr-krb5pac krb5samba samba_socket LIBCLI_RESOLVE asn1',
+                  deps='auth_sam_reply tevent LIBPACKET ndr ldb krb5samba KRB_INIT_CTX KRB5_PAC samba-errors',
                   private_library=True
                   )
@@ -12 +17 @@
         autoproto='kerberos_util.h',
         source='kerberos_util.c',
-        deps='authkrb5 com_err ldb CREDENTIALS_KRB5 SECRETS',
+        deps='authkrb5 krb5samba com_err CREDENTIALS_KRB5',
         )
 
+bld.SAMBA_SUBSYSTEM('KERBEROS_SRV_KEYTAB',
+        autoproto='kerberos_srv_keytab.h',
+        source='srv_keytab.c',
+        deps='authkrb5',
+        )

vendor/current/source4/auth/ntlm/auth.c

@@ -27 +27 @@
 #include "param/param.h"
 #include "dsdb/samdb/samdb.h"
-
+#include "libcli/wbclient/wbclient.h"
+#include "lib/util/samba_modules.h"
+#include "auth/credentials/credentials.h"
+#include "system/kerberos.h"
+#include "auth/kerberos/kerberos.h"
+#include "auth/kerberos/kerberos_util.h"
+#include "libds/common/roles.h"
+
+static NTSTATUS auth_generate_session_info_wrapper(struct auth4_context *auth_context,
+                                                   TALLOC_CTX *mem_ctx,
+                                                  void *server_returned_info,
+                                                   const char *original_user_name,
+                                                   uint32_t session_info_flags,
+                                                   struct auth_session_info **session_info);
 
 /***************************************************************************
  Set a fixed challenge
 ***************************************************************************/
-_PUBLIC_ NTSTATUS auth_context_set_challenge(struct auth_context *auth_ctx, const uint8_t chal[8], const char *set_by) 
+_PUBLIC_ NTSTATUS auth_context_set_challenge(struct auth4_context *auth_ctx, const uint8_t chal[8], const char *set_by) 
 {
         auth_ctx->challenge.set_by = talloc_strdup(auth_ctx, set_by);
@@ -41 +54 @@
 
         return NT_STATUS_OK;
-}
-
-/***************************************************************************
- Set a fixed challenge
-***************************************************************************/
-_PUBLIC_ bool auth_challenge_may_be_modified(struct auth_context *auth_ctx)
-{
-        return auth_ctx->challenge.may_be_modified;
 }
 
@@ -55 +60 @@
  Returns a const char of length 8 bytes.
 ****************************************************************************/
-_PUBLIC_ NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, uint8_t chal[8])
-{
-        NTSTATUS nt_status;
-        struct auth_method_context *method;
+_PUBLIC_ NTSTATUS auth_get_challenge(struct auth4_context *auth_ctx, uint8_t chal[8])
+{
 
         if (auth_ctx->challenge.data.length == 8) {
@@ -67 +70 @@
         }
 
-        for (method = auth_ctx->methods; method; method = method->next) {
-                nt_status = method->ops->get_challenge(method, auth_ctx, chal);
-                if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOT_IMPLEMENTED)) {
-                        continue;
-                }
-
-                NT_STATUS_NOT_OK_RETURN(nt_status);
-
-                auth_ctx->challenge.data        = data_blob_talloc(auth_ctx, chal, 8);
-                NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.data.data);
-                auth_ctx->challenge.set_by      = method->ops->name;
-
-                break;
-        }
-
         if (!auth_ctx->challenge.set_by) {
                 generate_random_buffer(chal, 8);
@@ -88 +76 @@
                 NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.data.data);
                 auth_ctx->challenge.set_by              = "random";
-
-                auth_ctx->challenge.may_be_modified     = true;
         }
 
@@ -104 +90 @@
  Supply either a principal or a DN
 ****************************************************************************/
-_PUBLIC_ NTSTATUS auth_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
-                                                 struct auth_context *auth_ctx,
-                                                 const char *principal,
-                                                 struct ldb_dn *user_dn,
-                                                 struct auth_user_info_dc **user_info_dc)
+static NTSTATUS auth_generate_session_info_principal(struct auth4_context *auth_ctx,
+                                                  TALLOC_CTX *mem_ctx,
+                                                  const char *principal,
+                                                  struct ldb_dn *user_dn,
+                                                  uint32_t session_info_flags,
+                                                  struct auth_session_info **session_info)
 {
         NTSTATUS nt_status;
         struct auth_method_context *method;
+        struct auth_user_info_dc *user_info_dc;
 
         for (method = auth_ctx->methods; method; method = method->next) {
@@ -118 +106 @@
                 }
 
-                nt_status = method->ops->get_user_info_dc_principal(mem_ctx, auth_ctx, principal, user_dn, user_info_dc);
+                nt_status = method->ops->get_user_info_dc_principal(mem_ctx, auth_ctx, principal, user_dn, &user_info_dc);
                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOT_IMPLEMENTED)) {
                         continue;
                 }
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+
+                nt_status = auth_generate_session_info_wrapper(auth_ctx, mem_ctx, 
+                                                               user_info_dc,
+                                                               user_info_dc->info->account_name,
+                                                               session_info_flags, session_info);
+                talloc_free(user_info_dc);
 
                 return nt_status;
@@ -156 +153 @@
  **/
 
-_PUBLIC_ NTSTATUS auth_check_password(struct auth_context *auth_ctx,
+_PUBLIC_ NTSTATUS auth_check_password(struct auth4_context *auth_ctx,
                              TALLOC_CTX *mem_ctx,
                              const struct auth_usersupplied_info *user_info, 
@@ -188 +185 @@
 }
 
+_PUBLIC_ NTSTATUS auth_check_password_wrapper(struct auth4_context *auth_ctx,
+                                              TALLOC_CTX *mem_ctx,
+                                              const struct auth_usersupplied_info *user_info, 
+                                              void **server_returned_info,
+                                              DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
+{
+        struct auth_user_info_dc *user_info_dc;
+        NTSTATUS status = auth_check_password(auth_ctx, mem_ctx, user_info, &user_info_dc);
+
+        if (NT_STATUS_IS_OK(status)) {
+                *server_returned_info = user_info_dc;
+
+                if (user_session_key) {
+                        DEBUG(10, ("Got NT session key of length %u\n",
+                                   (unsigned)user_info_dc->user_session_key.length));
+                        *user_session_key = user_info_dc->user_session_key;
+                        talloc_steal(mem_ctx, user_session_key->data);
+                        user_info_dc->user_session_key = data_blob_null;
+                }
+
+                if (lm_session_key) {
+                        DEBUG(10, ("Got LM session key of length %u\n",
+                                   (unsigned)user_info_dc->lm_session_key.length));
+                        *lm_session_key = user_info_dc->lm_session_key;
+                        talloc_steal(mem_ctx, lm_session_key->data);
+                        user_info_dc->lm_session_key = data_blob_null;
+                }
+        }
+
+        return status;
+}
+
 struct auth_check_password_state {
-        struct auth_context *auth_ctx;
+        struct auth4_context *auth_ctx;
         const struct auth_usersupplied_info *user_info;
         struct auth_user_info_dc *user_info_dc;
@@ -226 +255 @@
 _PUBLIC_ struct tevent_req *auth_check_password_send(TALLOC_CTX *mem_ctx,
                                 struct tevent_context *ev,
-                                struct auth_context *auth_ctx,
+                                struct auth4_context *auth_ctx,
                                 const struct auth_usersupplied_info *user_info)
 {
@@ -252 +281 @@
 
         if (!user_info->mapped_state) {
-                nt_status = map_user_info(req, lpcfg_workgroup(auth_ctx->lp_ctx),
+                nt_status = map_user_info(auth_ctx->sam_ctx, req, lpcfg_workgroup(auth_ctx->lp_ctx),
                                           user_info, &user_info_tmp);
                 if (tevent_req_nterror(req, nt_status)) {
@@ -315 +344 @@
         for (method=state->auth_ctx->methods; method; method = method->next) {
 
+                if (state->user_info->flags & USER_INFO_LOCAL_SAM_ONLY
+                    && !(method->ops->flags & AUTH_METHOD_LOCAL_SAM)) {
+                        continue;
+                }
+
                 /* we fill in state->method here so debug messages in
                    the callers know which method failed */
@@ -343 +377 @@
 
         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
-                /* don't expose the NT_STATUS_NOT_IMPLEMENTED
-                   internals */
-                status = NT_STATUS_NO_SUCH_USER;
+                if (!(state->user_info->flags & USER_INFO_LOCAL_SAM_ONLY)) {
+                        /* don't expose the NT_STATUS_NOT_IMPLEMENTED
+                         * internals, except when the caller is only probing
+                         * one method, as they may do the fallback 
+                         */
+                        status = NT_STATUS_NO_SUCH_USER;
+                }
         }
 
@@ -407 +445 @@
 }
 
+ /* Wrapper because we don't want to expose all callers to needing to
+  * know that session_info is generated from the main ldb, and because
+  * we need to break a depenency loop between the DCE/RPC layer and the
+  * generation of unix tokens via IRPC */
+static NTSTATUS auth_generate_session_info_wrapper(struct auth4_context *auth_context,
+                                                   TALLOC_CTX *mem_ctx,
+                                                   void *server_returned_info,
+                                                   const char *original_user_name,
+                                                  uint32_t session_info_flags,
+                                                  struct auth_session_info **session_info)
+{
+        NTSTATUS status;
+        struct auth_user_info_dc *user_info_dc = talloc_get_type_abort(server_returned_info, struct auth_user_info_dc);
+
+        if (user_info_dc->info->authenticated) {
+                session_info_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
+        }
+
+        status = auth_generate_session_info(mem_ctx, auth_context->lp_ctx,
+                                            auth_context->sam_ctx, user_info_dc,
+                                            session_info_flags, session_info);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        if ((session_info_flags & AUTH_SESSION_INFO_UNIX_TOKEN)
+            && NT_STATUS_IS_OK(status)) {
+                status = auth_session_info_fill_unix(auth_context->event_ctx,
+                                                     auth_context->lp_ctx,
+                                                     original_user_name, *session_info);
+                if (!NT_STATUS_IS_OK(status)) {
+                        TALLOC_FREE(*session_info);
+                }
+        }
+        return status;
+}
+
 /* Wrapper because we don't want to expose all callers to needing to
- * know that session_info is generated from the main ldb */
-static NTSTATUS auth_generate_session_info_wrapper(TALLOC_CTX *mem_ctx,
-                                                   struct auth_context *auth_context,
-                                                   struct auth_user_info_dc *user_info_dc,
-                                                   uint32_t session_info_flags,
-                                                   struct auth_session_info **session_info)
-{
-        return auth_generate_session_info(mem_ctx, auth_context->lp_ctx,
-                                          auth_context->sam_ctx, user_info_dc,
-                                          session_info_flags, session_info);
+ * know anything about the PAC or auth subsystem internal structures
+ * before we output a struct auth session_info */
+static NTSTATUS auth_generate_session_info_pac(struct auth4_context *auth_ctx,
+                                               TALLOC_CTX *mem_ctx,
+                                               struct smb_krb5_context *smb_krb5_context,
+                                               DATA_BLOB *pac_blob,
+                                               const char *principal_name,
+                                               const struct tsocket_address *remote_address,
+                                               uint32_t session_info_flags,
+                                               struct auth_session_info **session_info)
+{
+        NTSTATUS status;
+        struct auth_user_info_dc *user_info_dc;
+        TALLOC_CTX *tmp_ctx;
+
+        if (!pac_blob) {
+                return auth_generate_session_info_principal(auth_ctx, mem_ctx, principal_name,
+                                                       NULL, session_info_flags, session_info);
+        }
+
+        tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gssapi_session_info context");
+        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
+
+        status = kerberos_pac_blob_to_user_info_dc(tmp_ctx,
+                                                   *pac_blob,
+                                                   smb_krb5_context->krb5_context,
+                                                   &user_info_dc, NULL, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(tmp_ctx);
+                return status;
+        }
+
+        if (user_info_dc->info->authenticated) {
+                session_info_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
+        }
+
+        status = auth_generate_session_info_wrapper(auth_ctx, mem_ctx, 
+                                                    user_info_dc,
+                                                    user_info_dc->info->account_name,
+                                                    session_info_flags, session_info);
+        talloc_free(tmp_ctx);
+        return status;
 }
 
@@ -424 +531 @@
  - Allow the caller to specify the methods to use, including optionally the SAM to use
 ***************************************************************************/
-_PUBLIC_ NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods, 
+_PUBLIC_ NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char * const *methods, 
                                               struct tevent_context *ev,
-                                              struct messaging_context *msg,
+                                              struct imessaging_context *msg,
                                               struct loadparm_context *lp_ctx,
                                               struct ldb_context *sam_ctx,
-                                              struct auth_context **auth_ctx)
+                                              struct auth4_context **auth_ctx)
 {
         int i;
-        struct auth_context *ctx;
+        struct auth4_context *ctx;
 
         auth4_init();
@@ -441 +548 @@
         }
 
-        ctx = talloc(mem_ctx, struct auth_context);
+        ctx = talloc_zero(mem_ctx, struct auth4_context);
         NT_STATUS_HAVE_NO_MEMORY(ctx);
-        ctx->challenge.set_by           = NULL;
-        ctx->challenge.may_be_modified  = false;
         ctx->challenge.data             = data_blob(NULL, 0);
         ctx->methods                    = NULL;
@@ -471 +576 @@
                 method->auth_ctx        = ctx;
                 method->depth           = i;
-                DLIST_ADD_END(ctx->methods, method, struct auth_method_context *);
-        }
-
-        ctx->check_password = auth_check_password;
-        ctx->get_challenge = auth_get_challenge;
-        ctx->set_challenge = auth_context_set_challenge;
-        ctx->challenge_may_be_modified = auth_challenge_may_be_modified;
-        ctx->get_user_info_dc_principal = auth_get_user_info_dc_principal;
+                DLIST_ADD_END(ctx->methods, method);
+        }
+
+        ctx->check_ntlm_password = auth_check_password_wrapper;
+        ctx->get_ntlm_challenge = auth_get_challenge;
+        ctx->set_ntlm_challenge = auth_context_set_challenge;
         ctx->generate_session_info = auth_generate_session_info_wrapper;
+        ctx->generate_session_info_pac = auth_generate_session_info_pac;
 
         *auth_ctx = ctx;
@@ -488 +592 @@
 const char **auth_methods_from_lp(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
 {
-        const char **auth_methods = NULL;
+        char **auth_methods = NULL;
+
         switch (lpcfg_server_role(lp_ctx)) {
         case ROLE_STANDALONE:
-                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "standalone", NULL);
+                auth_methods = str_list_make(mem_ctx, "anonymous sam_ignoredomain", NULL);
                 break;
         case ROLE_DOMAIN_MEMBER:
-                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "member server", NULL);
+                auth_methods = str_list_make(mem_ctx, "anonymous sam winbind", NULL);
                 break;
-        case ROLE_DOMAIN_CONTROLLER:
-                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "domain controller", NULL);
+        case ROLE_DOMAIN_BDC:
+        case ROLE_DOMAIN_PDC:
+        case ROLE_ACTIVE_DIRECTORY_DC:
+                auth_methods = str_list_make(mem_ctx, "anonymous sam_ignoredomain winbind", NULL);
                 break;
         }
-        return auth_methods;
+        return discard_const_p(const char *, auth_methods);
 }
 
@@ -509 +616 @@
 _PUBLIC_ NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx,
                              struct tevent_context *ev,
-                             struct messaging_context *msg,
+                             struct imessaging_context *msg,
                              struct loadparm_context *lp_ctx,
-                             struct auth_context **auth_ctx)
+                             struct auth4_context **auth_ctx)
 {
         NTSTATUS status;
@@ -525 +632 @@
         }
         status = auth_context_create_methods(mem_ctx, auth_methods, ev, msg, lp_ctx, NULL, auth_ctx);
-        talloc_free(tmp_ctx);
-        return status;
-}
-
-/* Create an auth context from an open LDB.
-
-   This allows us not to re-open the LDB when we need to do a some authentication logic (such as tokenGroups)
-
- */
-NTSTATUS auth_context_create_from_ldb(TALLOC_CTX *mem_ctx, struct ldb_context *ldb, struct auth_context **auth_ctx)
-{
-        NTSTATUS status;
-        const char **auth_methods;
-        struct loadparm_context *lp_ctx = talloc_get_type_abort(ldb_get_opaque(ldb, "loadparm"), struct loadparm_context);
-        struct tevent_context *ev = ldb_get_event_context(ldb);
-
-        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
-        if (!tmp_ctx) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        auth_methods = auth_methods_from_lp(tmp_ctx, lp_ctx);
-        if (!auth_methods) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-        status = auth_context_create_methods(mem_ctx, auth_methods, ev, NULL, lp_ctx, ldb, auth_ctx);
         talloc_free(tmp_ctx);
         return status;
@@ -621 +702 @@
 {
         static const struct auth_critical_sizes critical_sizes = {
-                AUTH_INTERFACE_VERSION,
+                AUTH4_INTERFACE_VERSION,
                 sizeof(struct auth_operations),
                 sizeof(struct auth_method_context),
-                sizeof(struct auth_context),
+                sizeof(struct auth4_context),
                 sizeof(struct auth_usersupplied_info),
                 sizeof(struct auth_user_info_dc)

vendor/current/source4/auth/ntlm/auth_anonymous.c

@@ -25 +25 @@
 #include "param/param.h"
 
+_PUBLIC_ NTSTATUS auth4_anonymous_init(void);
+
 /**
  * Return a anonymous logon for anonymous users (username = "")
@@ -38 +40 @@
         if (user_info->client.account_name && *user_info->client.account_name) {
                 return NT_STATUS_NOT_IMPLEMENTED;
+        }
+
+        switch (user_info->password_state) {
+        case AUTH_PASSWORD_PLAIN:
+                if (user_info->password.plaintext != NULL &&
+                    strlen(user_info->password.plaintext) > 0)
+                {
+                        return NT_STATUS_NOT_IMPLEMENTED;
+                }
+                break;
+        case AUTH_PASSWORD_HASH:
+                if (user_info->password.hash.lanman != NULL) {
+                        return NT_STATUS_NOT_IMPLEMENTED;
+                }
+                if (user_info->password.hash.nt != NULL) {
+                        return NT_STATUS_NOT_IMPLEMENTED;
+                }
+                break;
+        case AUTH_PASSWORD_RESPONSE:
+                if (user_info->password.response.lanman.length == 1) {
+                        if (user_info->password.response.lanman.data[0] != '\0') {
+                                return NT_STATUS_NOT_IMPLEMENTED;
+                        }
+                } else if (user_info->password.response.lanman.length > 1) {
+                        return NT_STATUS_NOT_IMPLEMENTED;
+                }
+                if (user_info->password.response.nt.length > 0) {
+                        return NT_STATUS_NOT_IMPLEMENTED;
+                }
+                break;
         }
 
@@ -60 +92 @@
 static const struct auth_operations anonymous_auth_ops = {
         .name           = "anonymous",
-        .get_challenge  = auth_get_challenge_not_implemented,
         .want_check     = anonymous_want_check,
         .check_password = anonymous_check_password
 };
 
-_PUBLIC_ NTSTATUS auth_anonymous_init(void)
+_PUBLIC_ NTSTATUS auth4_anonymous_init(void)
 {
         NTSTATUS ret;

vendor/current/source4/auth/ntlm/auth_developer.c

@@ -24 +24 @@
 #include "auth/ntlm/auth_proto.h"
 #include "libcli/security/security.h"
+
+_PUBLIC_ NTSTATUS auth4_developer_init(void);
 
 static NTSTATUS name_to_ntstatus_want_check(struct auth_method_context *ctx,
@@ -132 +134 @@
 static const struct auth_operations name_to_ntstatus_auth_ops = {
         .name           = "name_to_ntstatus",
-        .get_challenge  = auth_get_challenge_not_implemented,
         .want_check     = name_to_ntstatus_want_check,
         .check_password = name_to_ntstatus_check_password
 };
 
-/** 
- * Return a 'fixed' challenge instead of a variable one.
- *
- * The idea of this function is to make packet snifs consistant
- * with a fixed challenge, so as to aid debugging.
- *
- * This module is of no value to end-users.
- *
- * This module does not actually authenticate the user, but
- * just pretenteds to need a specified challenge.  
- * This module removes *all* security from the challenge-response system
- *
- * @return NT_STATUS_UNSUCCESSFUL
- **/
-static NTSTATUS fixed_challenge_get_challenge(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, uint8_t chal[8])
-{
-        const char *challenge = "I am a teapot";
-
-        memcpy(chal, challenge, 8);
-
-        return NT_STATUS_OK;
-}
-
-static NTSTATUS fixed_challenge_want_check(struct auth_method_context *ctx,
-                                           TALLOC_CTX *mem_ctx,
-                                           const struct auth_usersupplied_info *user_info)
-{
-        /* don't handle any users */
-        return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-static NTSTATUS fixed_challenge_check_password(struct auth_method_context *ctx,
-                                               TALLOC_CTX *mem_ctx,
-                                               const struct auth_usersupplied_info *user_info,
-                                               struct auth_user_info_dc **_user_info_dc)
-{
-        /* don't handle any users */
-        return NT_STATUS_NO_SUCH_USER;
-}
-
-static const struct auth_operations fixed_challenge_auth_ops = {
-        .name           = "fixed_challenge",
-        .get_challenge  = fixed_challenge_get_challenge,
-        .want_check     = fixed_challenge_want_check,
-        .check_password = fixed_challenge_check_password
-};
-
-_PUBLIC_ NTSTATUS auth_developer_init(void)
+_PUBLIC_ NTSTATUS auth4_developer_init(void)
 {
         NTSTATUS ret;
@@ -194 +148 @@
         }
 
-        ret = auth_register(&fixed_challenge_auth_ops);
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(0,("Failed to register 'fixed_challenge' auth backend!\n"));
-                return ret;
-        }
-
         return ret;
 }

vendor/current/source4/auth/ntlm/auth_sam.c

@@ -34 +34 @@
 #include "librpc/gen_ndr/ndr_irpc_c.h"
 #include "lib/messaging/irpc.h"
+#include "libcli/auth/libcli_auth.h"
+#include "libds/common/roles.h"
+
+NTSTATUS auth_sam_init(void);
 
 extern const char *user_attrs[];
@@ -71 +75 @@
  the lanman and NT responses.
 ****************************************************************************/
-static NTSTATUS authsam_password_ok(struct auth_context *auth_context,
+static NTSTATUS authsam_password_ok(struct auth4_context *auth_context,
                                     TALLOC_CTX *mem_ctx,
                                     uint16_t acct_flags,
@@ -126 +130 @@
         }
 
-        if (user_sess_key && user_sess_key->data) {
-                talloc_steal(auth_context, user_sess_key->data);
-        }
-        if (lm_sess_key && lm_sess_key->data) {
-                talloc_steal(auth_context, lm_sess_key->data);
-        }
-
         return NT_STATUS_OK;
 }
@@ -141 +138 @@
   REPL_SECRET getncchanges extended op to fetch the users secrets
  */
-static void auth_sam_trigger_repl_secret(TALLOC_CTX *mem_ctx, struct auth_context *auth_context,
+static void auth_sam_trigger_repl_secret(struct auth4_context *auth_context,
                                          struct ldb_dn *user_dn)
 {
@@ -147 +144 @@
         struct drepl_trigger_repl_secret r;
         struct tevent_req *req;
-
-        irpc_handle = irpc_binding_handle_by_name(mem_ctx, auth_context->msg_ctx,
+        TALLOC_CTX *tmp_ctx;
+
+        tmp_ctx = talloc_new(auth_context);
+        if (tmp_ctx == NULL) {
+                return;
+        }
+
+        irpc_handle = irpc_binding_handle_by_name(tmp_ctx, auth_context->msg_ctx,
                                                   "dreplsrv",
                                                   &ndr_table_irpc);
         if (irpc_handle == NULL) {
                 DEBUG(1,(__location__ ": Unable to get binding handle for dreplsrv\n"));
+                TALLOC_FREE(tmp_ctx);
                 return;
         }
@@ -158 +162 @@
         r.in.user_dn = ldb_dn_get_linearized(user_dn);
 
-        req = dcerpc_drepl_trigger_repl_secret_r_send(mem_ctx,
+        /*
+         * This seem to rely on the current IRPC implementation,
+         * which delivers the message in the _send function.
+         *
+         * TODO: we need a ONE_WAY IRPC handle and register
+         * a callback and wait for it to be triggered!
+         */
+        req = dcerpc_drepl_trigger_repl_secret_r_send(tmp_ctx,
                                                       auth_context->event_ctx,
                                                       irpc_handle,
@@ -165 +176 @@
         /* we aren't interested in a reply */
         talloc_free(req);
-        talloc_free(irpc_handle);
-}
-
-
-static NTSTATUS authsam_authenticate(struct auth_context *auth_context, 
-                                     TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx, 
-                                     struct ldb_dn *domain_dn,
-                                     struct ldb_message *msg,
-                                     const struct auth_usersupplied_info *user_info, 
-                                     DATA_BLOB *user_sess_key, DATA_BLOB *lm_sess_key) 
-{
-        struct samr_Password *lm_pwd, *nt_pwd;
+        TALLOC_FREE(tmp_ctx);
+}
+
+
+/*
+ * Check that a password is OK, and update badPwdCount if required.
+ */
+
+static NTSTATUS authsam_password_check_and_record(struct auth4_context *auth_context,
+                                                  TALLOC_CTX *mem_ctx,
+                                                  struct ldb_dn *domain_dn,
+                                                  struct ldb_message *msg,
+                                                  uint16_t acct_flags,
+                                                  const struct auth_usersupplied_info *user_info,
+                                                  DATA_BLOB *user_sess_key,
+                                                  DATA_BLOB *lm_sess_key)
+{
         NTSTATUS nt_status;
-
-        uint16_t acct_flags = samdb_result_acct_flags(auth_context->sam_ctx, mem_ctx, msg, domain_dn);
-        
-        /* Quit if the account was locked out. */
-        if (acct_flags & ACB_AUTOLOCK) {
-                DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", 
-                         user_info->mapped.account_name));
-                return NT_STATUS_ACCOUNT_LOCKED_OUT;
-        }
-
-        /* You can only do an interactive login to normal accounts */
-        if (user_info->flags & USER_INFO_INTERACTIVE_LOGON) {
-                if (!(acct_flags & ACB_NORMAL)) {
-                        return NT_STATUS_NO_SUCH_USER;
-                }
-        }
-
-        nt_status = samdb_result_passwords(mem_ctx, auth_context->lp_ctx, msg, &lm_pwd, &nt_pwd);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
+        NTSTATUS auth_status;
+        TALLOC_CTX *tmp_ctx;
+        int i, ret;
+        int history_len = 0;
+        struct ldb_context *sam_ctx = auth_context->sam_ctx;
+        const char * const attrs[] = { "pwdHistoryLength", NULL };
+        struct ldb_message *dom_msg;
+        struct samr_Password *lm_pwd;
+        struct samr_Password *nt_pwd;
+
+        tmp_ctx = talloc_new(mem_ctx);
+        if (tmp_ctx == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /*
+         * This call does more than what it appears to do, it also
+         * checks for the account lockout.
+         *
+         * It is done here so that all parts of Samba that read the
+         * password refuse to even operate on it if the account is
+         * locked out, to avoid mistakes like CVE-2013-4496.
+         */
+        nt_status = samdb_result_passwords(tmp_ctx, auth_context->lp_ctx,
+                                           msg, &lm_pwd, &nt_pwd);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                TALLOC_FREE(tmp_ctx);
+                return nt_status;
+        }
 
         if (lm_pwd == NULL && nt_pwd == NULL) {
                 bool am_rodc;
                 if (samdb_rodc(auth_context->sam_ctx, &am_rodc) == LDB_SUCCESS && am_rodc) {
-                        /* we don't have passwords for this
+                        /*
+                         * we don't have passwords for this
                          * account. We are an RODC, and this account
                          * may be one for which we either are denied
@@ -212 +239 @@
                          * replicate the secrets for this account.
                          */
-                        auth_sam_trigger_repl_secret(mem_ctx, auth_context, msg->dn);
+                        auth_sam_trigger_repl_secret(auth_context, msg->dn);
+                        TALLOC_FREE(tmp_ctx);
                         return NT_STATUS_NOT_IMPLEMENTED;
                 }
         }
 
-        nt_status = authsam_password_ok(auth_context, mem_ctx, 
-                                        acct_flags, lm_pwd, nt_pwd,
-                                        user_info, user_sess_key, lm_sess_key);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
-
-        nt_status = authsam_account_ok(mem_ctx, auth_context->sam_ctx,
+        auth_status = authsam_password_ok(auth_context, tmp_ctx,
+                                          acct_flags,
+                                          lm_pwd, nt_pwd,
+                                          user_info,
+                                          user_sess_key, lm_sess_key);
+        if (NT_STATUS_IS_OK(auth_status)) {
+                if (user_sess_key->data) {
+                        talloc_steal(mem_ctx, user_sess_key->data);
+                }
+                if (lm_sess_key->data) {
+                        talloc_steal(mem_ctx, lm_sess_key->data);
+                }
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_OK;
+        }
+        *user_sess_key = data_blob_null;
+        *lm_sess_key = data_blob_null;
+
+        if (!NT_STATUS_EQUAL(auth_status, NT_STATUS_WRONG_PASSWORD)) {
+                TALLOC_FREE(tmp_ctx);
+                return auth_status;
+        }
+
+        /*
+         * We only continue if this was a wrong password
+         * and we'll always return NT_STATUS_WRONG_PASSWORD
+         * no matter what error happens.
+         */
+
+        /* pull the domain password property attributes */
+        ret = dsdb_search_one(sam_ctx, tmp_ctx, &dom_msg, domain_dn, LDB_SCOPE_BASE,
+                              attrs, 0, "objectClass=domain");
+        if (ret == LDB_SUCCESS) {
+                history_len = ldb_msg_find_attr_as_uint(dom_msg, "pwdHistoryLength", 0);
+        } else if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+                DEBUG(3,("Couldn't find domain %s: %s!\n",
+                         ldb_dn_get_linearized(domain_dn),
+                         ldb_errstring(sam_ctx)));
+        } else {
+                DEBUG(3,("error finding domain %s: %s!\n",
+                         ldb_dn_get_linearized(domain_dn),
+                         ldb_errstring(sam_ctx)));
+        }
+
+        for (i = 1; i < MIN(history_len, 3); i++) {
+                static const struct samr_Password zero_hash;
+                struct samr_Password zero_string_hash;
+                struct samr_Password zero_string_des_hash;
+                struct samr_Password *nt_history_pwd = NULL;
+                struct samr_Password *lm_history_pwd = NULL;
+                NTTIME pwdLastSet;
+                struct timeval tv_now;
+                NTTIME now;
+                int allowed_period_mins;
+                NTTIME allowed_period;
+
+                nt_status = samdb_result_passwords_from_history(tmp_ctx,
+                                                        auth_context->lp_ctx,
+                                                        msg, i,
+                                                        &lm_history_pwd,
+                                                        &nt_history_pwd);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        /*
+                         * If we don't find element 'i' we won't find
+                         * 'i+1' ...
+                         */
+                        break;
+                }
+
+                /*
+                 * We choose to avoid any issues
+                 * around different LM and NT history
+                 * lengths by only checking the NT
+                 * history
+                 */
+                if (nt_history_pwd == NULL) {
+                        /*
+                         * If we don't find element 'i' we won't find
+                         * 'i+1' ...
+                         */
+                        break;
+                }
+
+                /* Skip over all-zero hashes in the history */
+                if (memcmp(nt_history_pwd->hash, zero_hash.hash, 
+                           sizeof(zero_hash.hash)) == 0) {
+                        continue;
+                }
+
+                /*
+                 * This looks odd, but the password_hash module writes this in if
+                 * (somehow) we didn't have an old NT hash
+                 */
+
+                E_md4hash("", zero_string_hash.hash);
+                if (memcmp(nt_history_pwd->hash, zero_string_hash.hash, 16) == 0) {
+                        continue;
+                }
+
+                E_deshash("", zero_string_des_hash.hash);
+                if (!lm_history_pwd || memcmp(lm_history_pwd->hash, zero_string_des_hash.hash, 16) == 0) {
+                        lm_history_pwd = NULL;
+                }
+
+                auth_status = authsam_password_ok(auth_context, tmp_ctx,
+                                                  acct_flags,
+                                                  lm_history_pwd,
+                                                  nt_history_pwd,
+                                                  user_info,
+                                                  user_sess_key,
+                                                  lm_sess_key);
+                if (!NT_STATUS_IS_OK(auth_status)) {
+                        /*
+                         * If this was not a correct password, try the next
+                         * one from the history
+                         */
+                        *user_sess_key = data_blob_null;
+                        *lm_sess_key = data_blob_null;
+                        continue;
+                }
+
+                if (i != 1) {
+                        /*
+                         * The authentication was OK, but not against
+                         * the previous password, which is stored at index 1.
+                         *
+                         * We just return the original wrong password.
+                         * This skips the update of the bad pwd count,
+                         * because this is almost certainly user error
+                         * (or automatic login on a computer using a cached
+                         * password from before the password change),
+                         * not an attack.
+                         */
+                        TALLOC_FREE(tmp_ctx);
+                        return NT_STATUS_WRONG_PASSWORD;
+                }
+
+                if (user_info->password_state != AUTH_PASSWORD_RESPONSE) {
+                        /*
+                         * The authentication was OK against the previous password,
+                         * but it's not a NTLM network authentication.
+                         *
+                         * We just return the original wrong password.
+                         * This skips the update of the bad pwd count,
+                         * because this is almost certainly user error
+                         * (or automatic login on a computer using a cached
+                         * password from before the password change),
+                         * not an attack.
+                         */
+                        TALLOC_FREE(tmp_ctx);
+                        return NT_STATUS_WRONG_PASSWORD;
+                }
+
+                /*
+                 * If the password was OK, it's a NTLM network authentication
+                 * and it was the previous password.
+                 *
+                 * Now we see if it is within the grace period,
+                 * so that we don't break cached sessions on other computers
+                 * before the user can lock and unlock their other screens
+                 * (resetting their cached password).
+                 *
+                 * See http://support.microsoft.com/kb/906305
+                 * OldPasswordAllowedPeriod ("old password allowed period")
+                 * is specified in minutes. The default is 60.
+                 */
+                allowed_period_mins = lpcfg_old_password_allowed_period(auth_context->lp_ctx);
+                /*
+                 * NTTIME uses 100ns units
+                 */
+                allowed_period = allowed_period_mins * 60 * 1000*1000*10;
+                pwdLastSet = samdb_result_nttime(msg, "pwdLastSet", 0);
+                tv_now = timeval_current();
+                now = timeval_to_nttime(&tv_now);
+
+                if (now < pwdLastSet) {
+                        /*
+                         * time jump?
+                         *
+                         * We just return the original wrong password.
+                         * This skips the update of the bad pwd count,
+                         * because this is almost certainly user error
+                         * (or automatic login on a computer using a cached
+                         * password from before the password change),
+                         * not an attack.
+                         */
+                        TALLOC_FREE(tmp_ctx);
+                        return NT_STATUS_WRONG_PASSWORD;
+                }
+
+                if ((now - pwdLastSet) >= allowed_period) {
+                        /*
+                         * The allowed period is over.
+                         *
+                         * We just return the original wrong password.
+                         * This skips the update of the bad pwd count,
+                         * because this is almost certainly user error
+                         * (or automatic login on a computer using a cached
+                         * password from before the password change),
+                         * not an attack.
+                         */
+                        TALLOC_FREE(tmp_ctx);
+                        return NT_STATUS_WRONG_PASSWORD;
+                }
+
+                /*
+                 * We finally allow the authentication with the
+                 * previous password within the allowed period.
+                 */
+                if (user_sess_key->data) {
+                        talloc_steal(mem_ctx, user_sess_key->data);
+                }
+                if (lm_sess_key->data) {
+                        talloc_steal(mem_ctx, lm_sess_key->data);
+                }
+
+                TALLOC_FREE(tmp_ctx);
+                return auth_status;
+        }
+
+        /*
+         * If we are not in the allowed period or match an old password,
+         * we didn't return early. Now update the badPwdCount et al.
+         */
+        nt_status = authsam_update_bad_pwd_count(auth_context->sam_ctx,
+                                                 msg, domain_dn);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                /*
+                 * We need to return the original
+                 * NT_STATUS_WRONG_PASSWORD error, so there isn't
+                 * anything more we can do than write something into
+                 * the log
+                 */
+                DEBUG(0, ("Failed to note bad password for user [%s]: %s\n",
+                          user_info->mapped.account_name,
+                          nt_errstr(nt_status)));
+        }
+
+        TALLOC_FREE(tmp_ctx);
+        return NT_STATUS_WRONG_PASSWORD;
+}
+
+static NTSTATUS authsam_authenticate(struct auth4_context *auth_context,
+                                     TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
+                                     struct ldb_dn *domain_dn,
+                                     struct ldb_message *msg,
+                                     const struct auth_usersupplied_info *user_info,
+                                     DATA_BLOB *user_sess_key, DATA_BLOB *lm_sess_key)
+{
+        NTSTATUS nt_status;
+        bool interactive = (user_info->password_state == AUTH_PASSWORD_HASH);
+        uint16_t acct_flags = samdb_result_acct_flags(msg, NULL);
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /* You can only do an interactive login to normal accounts */
+        if (user_info->flags & USER_INFO_INTERACTIVE_LOGON) {
+                if (!(acct_flags & ACB_NORMAL)) {
+                        TALLOC_FREE(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                }
+        }
+
+        nt_status = authsam_password_check_and_record(auth_context, tmp_ctx,
+                                                      domain_dn, msg, acct_flags,
+                                                      user_info,
+                                                      user_sess_key, lm_sess_key);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                TALLOC_FREE(tmp_ctx);
+                return nt_status;
+        }
+
+        nt_status = authsam_account_ok(tmp_ctx, auth_context->sam_ctx,
                                        user_info->logon_parameters,
                                        domain_dn,
@@ -229 +526 @@
                                        user_info->mapped.account_name,
                                        false, false);
-
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                TALLOC_FREE(tmp_ctx);
+                return nt_status;
+        }
+
+        nt_status = authsam_logon_success_accounting(auth_context->sam_ctx,
+                                                     msg, domain_dn,
+                                                     interactive);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                TALLOC_FREE(tmp_ctx);
+                return nt_status;
+        }
+
+        if (user_sess_key && user_sess_key->data) {
+                talloc_steal(mem_ctx, user_sess_key->data);
+        }
+        if (lm_sess_key && lm_sess_key->data) {
+                talloc_steal(mem_ctx, lm_sess_key->data);
+        }
+
+        TALLOC_FREE(tmp_ctx);
         return nt_status;
 }
@@ -340 +657 @@
                         return NT_STATUS_OK;
 
-                case ROLE_DOMAIN_CONTROLLER:
+                case ROLE_ACTIVE_DIRECTORY_DC:
                         if (!is_local_name && !is_my_domain) {
                                 DEBUG(6,("authsam_check_password: %s is not one of my local names or domain name (DC)\n",
@@ -356 +673 @@
 /* Wrapper for the auth subsystem pointer */
 static NTSTATUS authsam_get_user_info_dc_principal_wrapper(TALLOC_CTX *mem_ctx,
-                                                          struct auth_context *auth_context,
+                                                          struct auth4_context *auth_context,
                                                           const char *principal,
                                                           struct ldb_dn *user_dn,
@@ -366 +683 @@
 static const struct auth_operations sam_ignoredomain_ops = {
         .name                      = "sam_ignoredomain",
-        .get_challenge             = auth_get_challenge_not_implemented,
         .want_check                = authsam_ignoredomain_want_check,
         .check_password            = authsam_check_password_internals,
-        .get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper
+        .get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper,
+        .flags                     = AUTH_METHOD_LOCAL_SAM
 };
 
 static const struct auth_operations sam_ops = {
         .name                      = "sam",
-        .get_challenge             = auth_get_challenge_not_implemented,
         .want_check                = authsam_want_check,
         .check_password            = authsam_check_password_internals,
-        .get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper
+        .get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper,
+        .flags                     = AUTH_METHOD_LOCAL_SAM
 };
 
-_PUBLIC_ NTSTATUS auth_sam_init(void)
+_PUBLIC_ NTSTATUS auth4_sam_init(void);
+_PUBLIC_ NTSTATUS auth4_sam_init(void)
 {
         NTSTATUS ret;

vendor/current/source4/auth/ntlm/auth_simple.c

@@ -31 +31 @@
 _PUBLIC_ NTSTATUS authenticate_username_pw(TALLOC_CTX *mem_ctx,
                                            struct tevent_context *ev,
-                                           struct messaging_context *msg,
+                                           struct imessaging_context *msg,
                                            struct loadparm_context *lp_ctx,
                                            const char *nt4_domain,
@@ -39 +39 @@
                                            struct auth_session_info **session_info) 
 {
-        struct auth_context *auth_context;
+        struct auth4_context *auth_context;
         struct auth_usersupplied_info *user_info;
         struct auth_user_info_dc *user_info_dc;
@@ -95 +95 @@
                         flags |= AUTH_SESSION_INFO_AUTHENTICATED;
                 }
-                nt_status = auth_context->generate_session_info(tmp_ctx, auth_context,
+                nt_status = auth_context->generate_session_info(auth_context,
+                                                                tmp_ctx, 
                                                                 user_info_dc,
+                                                                nt4_username,
                                                                 flags,
                                                                 session_info);

vendor/current/source4/auth/ntlm/auth_unix.c

@@ -29 +29 @@
 #include "param/param.h"
 
+_PUBLIC_ NTSTATUS auth4_unix_init(void);
+
 /* TODO: look at how to best fill in parms retrieveing a struct passwd info
  * except in case USER_INFO_DONT_CHECK_UNIX_ACCOUNT is set
@@ -262 +264 @@
                 pam_error = pam_end(*pamh, 0);
                 if (pam_error != PAM_SUCCESS) {
-                        /* no vaild pamh here, can we reliably call pam_strerror ? */
+                        /* no valid pamh here, can we reliably call pam_strerror ? */
                         DEBUG(4,("smb_pam_start: clean up failed, pam_end gave error %d.\n",
                                  pam_error));
@@ -282 +284 @@
                 pam_error = pam_end(*pamh, 0);
                 if (pam_error != PAM_SUCCESS) {
-                        /* no vaild pamh here, can we reliably call pam_strerror ? */
+                        /* no valid pamh here, can we reliably call pam_strerror ? */
                         DEBUG(4,("smb_pam_start: clean up failed, pam_end gave error %d.\n",
                                  pam_error));
@@ -302 +304 @@
                 pam_error = pam_end(pamh, 0);
                 if (pam_error != PAM_SUCCESS) {
-                        /* no vaild pamh here, can we reliably call pam_strerror ? */
+                        /* no valid pamh here, can we reliably call pam_strerror ? */
                         DEBUG(4,("smb_pam_end: clean up failed, pam_end gave error %d.\n",
                                  pam_error));
@@ -512 +514 @@
         bool ret;
 
-#ifdef WITH_AFS
-        if (afs_auth(username, password))
-                return NT_STATUS_OK;
-#endif /* WITH_AFS */
-
-#ifdef WITH_DFS
-        if (dfs_auth(username, password))
-                return NT_STATUS_OK;
-#endif /* WITH_DFS */
+
 
 #ifdef OSF1_ENH_SEC
@@ -549 +543 @@
 #endif /* ULTRIX_AUTH */
         
-#ifdef LINUX_BIGCRYPT
-        ret = (linux_bigcrypt(password, salt, crypted));
-        if (ret) {
-                return NT_STATUS_OK;
-        } else {
-                return NT_STATUS_WRONG_PASSWORD;
-        }
-#endif /* LINUX_BIGCRYPT */
-        
-#if defined(HAVE_BIGCRYPT) && defined(HAVE_CRYPT) && defined(USE_BOTH_CRYPT_CALLS)
-        
-        /*
-         * Some systems have bigcrypt in the C library but might not
-         * actually use it for the password hashes (HPUX 10.20) is
-         * a noteable example. So we try bigcrypt first, followed
-         * by crypt.
-         */
-
-        if (strcmp(bigcrypt(password, salt), crypted) == 0)
-                return NT_STATUS_OK;
-        else
-                ret = (strcmp((char *)crypt(password, salt), crypted) == 0);
-        if (ret) {
-                return NT_STATUS_OK;
-        } else {
-                return NT_STATUS_WRONG_PASSWORD;
-        }
-#else /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
+        
         
 #ifdef HAVE_BIGCRYPT
@@ -598 +565 @@
         }
 #endif /* HAVE_CRYPT */
-#endif /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
 }
 
@@ -606 +572 @@
         char *username;
         char *password;
-        char *pwcopy;
         char *salt;
         char *crypted;
         struct passwd *pws;
         NTSTATUS nt_status;
-        int level = lpcfg_passwordlevel(lp_ctx);
 
         *ret_passwd = NULL;
@@ -659 +623 @@
 #endif
 
-#ifdef HAVE_GETPRPWNAM
-        {
-                struct pr_passwd *pr_pw = getprpwnam(pws->pw_name);
-                if (pr_pw && pr_pw->ufld.fd_encrypt) {
-                        crypted = talloc_strdup(ctx, pr_pw->ufld.fd_encrypt);
-                        NT_STATUS_HAVE_NO_MEMORY(crypted);
-                }
-        }
-#endif
 
 #ifdef HAVE_GETPWANAM
@@ -707 +662 @@
 #endif
 
-#if defined(HAVE_TRUNCATED_SALT)
-        /* crypt on some platforms (HPUX in particular)
-           won't work with more than 2 salt characters. */
-        salt[2] = 0;
-#endif
 
         if (crypted[0] == '\0') {
@@ -736 +686 @@
         }
 
-        if ( user_info->flags | USER_INFO_CASE_INSENSITIVE_PASSWORD) {
-                return nt_status;
-        }
-
-        /* if the password was given to us with mixed case then we don't
-         * need to proceed as we know it hasn't been case modified by the
-         * client */
-        if (strhasupper(password) && strhaslower(password)) {
-                return nt_status;
-        }
-
-        /* make a copy of it */
-        pwcopy = talloc_strdup(ctx, password);
-        if (!pwcopy)
-                return NT_STATUS_NO_MEMORY;
-
-        /* try all lowercase if it's currently all uppercase */
-        if (strhasupper(pwcopy)) {
-                strlower(pwcopy);
-                nt_status = password_check(username, pwcopy, crypted, salt);
-                if NT_STATUS_IS_OK(nt_status) {
-                        *ret_passwd = pws;
-                        return nt_status;
-                }
-        }
-
-        /* give up? */
-        if (level < 1) {
-                return NT_STATUS_WRONG_PASSWORD;
-        }
-
-        /* last chance - all combinations of up to level chars upper! */
-        strlower(pwcopy);
-
-#if 0
-        if (NT_STATUS_IS_OK(nt_status = string_combinations(pwcopy, password_check, level))) {
-                *ret_passwd = pws;
-                return nt_status;
-        }
-#endif   
+        /* we no longer try different case combinations here. The use
+         * of this code is now web auth, where trying different case
+         * combinations makes no sense
+         */
+
         return NT_STATUS_WRONG_PASSWORD;
 }
@@ -833 +748 @@
 static const struct auth_operations unix_ops = {
         .name           = "unix",
-        .get_challenge  = auth_get_challenge_not_implemented,
         .want_check     = authunix_want_check,
         .check_password = authunix_check_password
 };
 
-_PUBLIC_ NTSTATUS auth_unix_init(void)
+_PUBLIC_ NTSTATUS auth4_unix_init(void)
 {
         NTSTATUS ret;

vendor/current/source4/auth/ntlm/auth_util.c

@@ -26 +26 @@
 #include "libcli/auth/libcli_auth.h"
 #include "param/param.h"
+#include "auth/ntlm/auth_proto.h"
+#include "librpc/gen_ndr/drsuapi.h"
+#include "dsdb/samdb/samdb.h"
 
 /* this default function can be used by mostly all backends
@@ -39 +42 @@
  Create an auth_usersupplied_data structure after appropriate mapping.
 ****************************************************************************/
-
-NTSTATUS map_user_info(TALLOC_CTX *mem_ctx,
+static NTSTATUS map_user_info_cracknames(struct ldb_context *sam_ctx,
+                                         TALLOC_CTX *mem_ctx,
+                                         const char *default_domain,
+                                         const struct auth_usersupplied_info *user_info,
+                                         struct auth_usersupplied_info **user_info_mapped)
+{
+        char *domain;
+        char *account_name;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        WERROR werr;
+        struct drsuapi_DsNameInfo1 info1;
+
+        DEBUG(5,("map_user_info_cracknames: Mapping user [%s]\\[%s] from workstation [%s]\n",
+                 user_info->client.domain_name, user_info->client.account_name, user_info->workstation_name));
+
+        account_name = talloc_strdup(tmp_ctx, user_info->client.account_name);
+        if (!account_name) {
+                talloc_free(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /* use cracknames to work out what domain is being
+           asked for */
+        if (strchr_m(user_info->client.account_name, '@') != NULL) {
+                werr = DsCrackNameOneName(sam_ctx, tmp_ctx, 0,
+                                          DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL,
+                                          DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT,
+                                          user_info->client.account_name,
+                                          &info1);
+                if (!W_ERROR_IS_OK(werr)) {
+                        DEBUG(2,("map_user_info: Failed cracknames of account '%s'\n",
+                                 user_info->client.account_name));
+                        talloc_free(tmp_ctx);
+                        return werror_to_ntstatus(werr);
+                }
+                switch (info1.status) {
+                case DRSUAPI_DS_NAME_STATUS_OK:
+                        break;
+                case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
+                        DEBUG(2,("map_user_info: Cracknames of account '%s' -> NOT_FOUND\n",
+                                 user_info->client.account_name));
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
+                        DEBUG(2,("map_user_info: Cracknames of account '%s' -> DOMAIN_ONLY\n",
+                                 user_info->client.account_name));
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
+                        DEBUG(2,("map_user_info: Cracknames of account '%s' -> NOT_UNIQUE\n",
+                                 user_info->client.account_name));
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
+                        DEBUG(2,("map_user_info: Cracknames of account '%s' -> RESOLVE_ERROR\n",
+                                 user_info->client.account_name));
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                default:
+                        DEBUG(2,("map_user_info: Cracknames of account '%s' -> unknown error %u\n",
+                                 user_info->client.account_name, info1.status));
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                }
+                /* info1.result_name is in DOMAIN\username
+                 * form, which we need to split up into the
+                 * user_info_mapped structure
+                 */
+                domain = talloc_strdup(tmp_ctx, info1.result_name);
+                if (domain == NULL) {
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
+                account_name = strchr_m(domain, '\\');
+                if (account_name == NULL) {
+                        DEBUG(2,("map_user_info: Cracknames of account '%s' gave invalid result '%s'\n",
+                                 user_info->client.account_name, info1.result_name));
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                }
+                *account_name = 0;
+                account_name = talloc_strdup(tmp_ctx, account_name+1);
+                if (account_name == NULL) {
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
+        } else {
+                char *domain_name;
+                if (user_info->client.domain_name && *user_info->client.domain_name) {
+                        domain_name = talloc_asprintf(tmp_ctx, "%s\\", user_info->client.domain_name);
+                } else {
+                        domain_name = talloc_strdup(tmp_ctx, default_domain);
+                }
+                if (domain_name == NULL) {
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
+                werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
+                                          DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT,
+                                          DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT,
+                                          domain_name,
+                                          &info1);
+                if (!W_ERROR_IS_OK(werr)) {
+                        DEBUG(2,("map_user_info: Failed cracknames of domain '%s'\n",
+                                 domain_name));
+                        talloc_free(tmp_ctx);
+                        return werror_to_ntstatus(werr);
+                }
+
+                /* we use the account_name as-is, but get the
+                 * domain name from cracknames if possible */
+                account_name = talloc_strdup(mem_ctx, user_info->client.account_name);
+                if (account_name == NULL) {
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
+
+                switch (info1.status) {
+                case DRSUAPI_DS_NAME_STATUS_OK:
+                case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
+                        domain = talloc_strdup(tmp_ctx, info1.result_name);
+                        if (domain == NULL) {
+                                talloc_free(tmp_ctx);
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                        if (domain[strlen_m(domain)-1] == '\\') {
+                                domain[strlen_m(domain)-1] = 0;
+                        }
+                        break;
+                case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
+                        /* the domain is unknown - use the
+                           default domain */
+                        domain = talloc_strdup(tmp_ctx, default_domain);
+                        break;
+                case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
+                        DEBUG(2,("map_user_info: Cracknames of domain '%s' -> NOT_UNIQUE\n",
+                                 domain_name));
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
+                        DEBUG(2,("map_user_info: Cracknames of domain '%s' -> RESOLVE_ERROR\n",
+                                 domain_name));
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                default:
+                        DEBUG(2,("map_user_info: Cracknames of account '%s' -> unknown error %u\n",
+                                 domain_name, info1.status));
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                }
+                /* domain and account_name are filled in above */
+        }
+
+        *user_info_mapped = talloc_zero(mem_ctx, struct auth_usersupplied_info);
+        if (!*user_info_mapped) {
+                talloc_free(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+        if (!talloc_reference(*user_info_mapped, user_info)) {
+                talloc_free(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+        **user_info_mapped = *user_info;
+        (*user_info_mapped)->mapped_state = true;
+        (*user_info_mapped)->mapped.domain_name = talloc_strdup(*user_info_mapped, domain);
+        (*user_info_mapped)->mapped.account_name = talloc_strdup(*user_info_mapped, account_name);
+        talloc_free(tmp_ctx);
+        if (!(*user_info_mapped)->mapped.domain_name
+            || !(*user_info_mapped)->mapped.account_name) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        return NT_STATUS_OK;
+}
+
+
+/****************************************************************************
+ Create an auth_usersupplied_data structure after appropriate mapping.
+****************************************************************************/
+NTSTATUS map_user_info(struct ldb_context *sam_ctx,
+                       TALLOC_CTX *mem_ctx,
                        const char *default_domain,
                        const struct auth_usersupplied_info *user_info,
                        struct auth_usersupplied_info **user_info_mapped)
 {
-        const char *domain;
+        char *domain;
         char *account_name;
         char *d;
-        DEBUG(5,("map_user_info: Mapping user [%s]\\[%s] from workstation [%s]\n",
-                user_info->client.domain_name, user_info->client.account_name, user_info->workstation_name));
-
-        account_name = talloc_strdup(mem_ctx, user_info->client.account_name);
+        TALLOC_CTX *tmp_ctx;
+
+        if (sam_ctx != NULL) {
+                /* if possible, use cracknames to parse the
+                   domain/account */
+                return map_user_info_cracknames(sam_ctx, mem_ctx, default_domain, user_info, user_info_mapped);
+        }
+
+        DEBUG(0,("map_user_info: Mapping user [%s]\\[%s] from workstation [%s] default_domain=%s\n",
+                 user_info->client.domain_name, user_info->client.account_name, user_info->workstation_name,
+                 default_domain));
+
+        tmp_ctx = talloc_new(mem_ctx);
+
+        account_name = talloc_strdup(tmp_ctx, user_info->client.account_name);
         if (!account_name) {
+                talloc_free(tmp_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
         
-        /* don't allow "" as a domain, fixes a Win9X bug 
-           where it doesn't supply a domain for logon script
-           'net use' commands.                                 */
-
-        /* Split user@realm names into user and realm components.  This is TODO to fix with proper userprincipalname support */
+        /* don't allow "" as a domain, fixes a Win9X bug where it
+           doesn't supply a domain for logon script 'net use'
+           commands.  */
+
+        /* Split user@realm names into user and realm components.
+         * This is TODO to fix with proper userprincipalname
+         * support */
         if (user_info->client.domain_name && *user_info->client.domain_name) {
-                domain = user_info->client.domain_name;
+                domain = talloc_strdup(tmp_ctx, user_info->client.domain_name);
         } else if (strchr_m(user_info->client.account_name, '@')) {
                 d = strchr_m(account_name, '@');
                 if (!d) {
+                        talloc_free(tmp_ctx);
                         return NT_STATUS_INTERNAL_ERROR;
                 }
@@ -72 +269 @@
                 domain = d;
         } else {
-                domain = default_domain;
-        }
-
+                domain = talloc_strdup(tmp_ctx, default_domain);
+        }
+
+        if (domain == NULL) {
+                talloc_free(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
         *user_info_mapped = talloc_zero(mem_ctx, struct auth_usersupplied_info);
         if (!*user_info_mapped) {
+                talloc_free(tmp_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
         if (!talloc_reference(*user_info_mapped, user_info)) {
+                talloc_free(tmp_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
@@ -86 +289 @@
         (*user_info_mapped)->mapped.domain_name = talloc_strdup(*user_info_mapped, domain);
         (*user_info_mapped)->mapped.account_name = talloc_strdup(*user_info_mapped, account_name);
-        talloc_free(account_name);
+        talloc_free(tmp_ctx);
         if (!(*user_info_mapped)->mapped.domain_name 
             || !(*user_info_mapped)->mapped.account_name) {
@@ -99 +302 @@
 ****************************************************************************/
 
-NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth_context *auth_context, 
+NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth4_context *auth_context, 
                            enum auth_password_state to_state,
                            const struct auth_usersupplied_info *user_info_in,
@@ -148 +351 @@
                                                            user_info_in->client.account_name, 
                                                            user_info_in->client.domain_name, 
-                                                           user_info_in->password.hash.nt->hash, &chall_blob,
+                                                           user_info_in->password.hash.nt->hash,
+                                                           &chall_blob,
+                                                           NULL, /* server_timestamp */
                                                            &names_blob,
                                                            &lmv2_response, &ntlmv2_response, 

vendor/current/source4/auth/ntlm/auth_winbind.c

@@ -25 +25 @@
 #include "auth/auth.h"
 #include "auth/ntlm/auth_proto.h"
-#include "auth/auth_sam_reply.h"
 #include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "lib/messaging/irpc.h"
 #include "param/param.h"
 #include "nsswitch/libwbclient/wbclient.h"
+#include "auth/auth_sam_reply.h"
 #include "libcli/security/security.h"
 
-static NTSTATUS get_info3_from_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
-                                               struct wbcAuthUserInfo *info,
-                                               struct netr_SamInfo3 *info3)
-{
-        int i, j;
-        struct samr_RidWithAttribute *rids = NULL;
-        struct dom_sid *user_sid;
-        struct dom_sid *group_sid;
-
-        user_sid = (struct dom_sid *)(void *)&info->sids[0].sid;
-        group_sid = (struct dom_sid *)(void *)&info->sids[1].sid;
-
-        info3->base.last_logon = info->logon_time;
-        info3->base.last_logoff = info->logoff_time;
-        info3->base.acct_expiry = info->kickoff_time;
-        info3->base.last_password_change = info->pass_last_set_time;
-        info3->base.allow_password_change = info->pass_can_change_time;
-        info3->base.force_password_change = info->pass_must_change_time;
-
-        info3->base.account_name.string = talloc_strdup(mem_ctx,
-                                                        info->account_name);
-        info3->base.full_name.string = talloc_strdup(mem_ctx,
-                                                     info->full_name);
-        info3->base.logon_script.string = talloc_strdup(mem_ctx,
-                                                        info->logon_script);
-        info3->base.profile_path.string = talloc_strdup(mem_ctx,
-                                                        info->profile_path);
-        info3->base.home_directory.string = talloc_strdup(mem_ctx,
-                                                          info->home_directory);
-        info3->base.home_drive.string = talloc_strdup(mem_ctx,
-                                                      info->home_drive);
-        info3->base.logon_server.string = talloc_strdup(mem_ctx,
-                                                        info->logon_server);
-        info3->base.domain.string = talloc_strdup(mem_ctx,
-                                                  info->domain_name);
-
-        info3->base.logon_count = info->logon_count;
-        info3->base.bad_password_count = info->bad_password_count;
-        info3->base.user_flags = info->user_flags;
-        memcpy(info3->base.key.key, info->user_session_key,
-               sizeof(info3->base.key.key));
-        memcpy(info3->base.LMSessKey.key, info->lm_session_key,
-               sizeof(info3->base.LMSessKey.key));
-        info3->base.acct_flags = info->acct_flags;
-        memset(info3->base.unknown, 0, sizeof(info3->base.unknown));
-
-        if (info->num_sids < 2) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        dom_sid_split_rid(mem_ctx, user_sid,
-                          &info3->base.domain_sid,
-                          &info3->base.rid);
-        dom_sid_split_rid(mem_ctx, group_sid, NULL,
-                          &info3->base.primary_gid);
-
-        /* We already handled the first two, now take care of the rest */
-        info3->base.groups.count = info->num_sids - 2;
-
-        rids = talloc_array(mem_ctx, struct samr_RidWithAttribute,
-                            info3->base.groups.count);
-        NT_STATUS_HAVE_NO_MEMORY(rids);
-
-        for (i = 2, j = 0; i < info->num_sids; ++i, ++j) {
-                struct dom_sid *tmp_sid;
-                tmp_sid = (struct dom_sid *)(void *)&info->sids[1].sid;
-
-                rids[j].attributes = info->sids[i].attributes;
-                dom_sid_split_rid(mem_ctx, tmp_sid,
-                                  NULL, &rids[j].rid);
-        }
-        info3->base.groups.rids = rids;
-
-        return NT_STATUS_OK;
-}
-
+_PUBLIC_ NTSTATUS auth4_winbind_init(void);
 
 static NTSTATUS winbind_want_check(struct auth_method_context *ctx,
@@ -212 +137 @@
         s->req.in.validation_level      = 3;
 
+        /* Note: this makes use of nested event loops... */
+        dcerpc_binding_handle_set_sync_ev(irpc_handle, ctx->auth_ctx->event_ctx);
         status = dcerpc_winbind_SamLogon_r(irpc_handle, s, &s->req);
         NT_STATUS_NOT_OK_RETURN(status);
@@ -219 +146 @@
                                                       s->req.in.validation_level,
                                                       &s->req.out.validation,
+                                                       true, /* This user was authenticated */
                                                       user_info_dc);
         NT_STATUS_NOT_OK_RETURN(status);
@@ -239 +167 @@
         wbcErr wbc_status;
         NTSTATUS nt_status;
-        struct netr_SamInfo3 info3;
+        struct netr_SamInfo3 *info3;
         union netr_Validation validation;
 
@@ -266 +194 @@
         params.workstation_name = user_info->workstation_name;
 
-        d_fprintf(stderr, "looking up %s@%s logging in from %s\n",
+        DEBUG(5,("looking up %s@%s logging in from %s\n",
                   params.account_name, params.domain_name,
-                  params.workstation_name);
+                  params.workstation_name));
 
         memcpy(params.password.response.challenge,
@@ -286 +214 @@
         wbc_status = wbcAuthenticateUserEx(&params, &info, &err);
         if (wbc_status == WBC_ERR_AUTH_ERROR) {
-                DEBUG(1, ("error was %s (0x%08x)\nerror message was '%s'\n",
-                      err->nt_string, err->nt_status, err->display_string));
-
+                if (err) {
+                        DEBUG(1, ("error was %s (0x%08x)\nerror message was '%s'\n",
+                              err->nt_string, err->nt_status, err->display_string));
+                }
                 nt_status = NT_STATUS(err->nt_status);
                 wbcFreeMemory(err);
@@ -295 +224 @@
                 DEBUG(1, ("wbcAuthenticateUserEx: failed with %u - %s\n",
                         wbc_status, wbcErrorString(wbc_status)));
+                if (err) {
+                        DEBUG(1, ("error was %s (0x%08x)\nerror message was '%s'\n",
+                              err->nt_string, err->nt_status, err->display_string));
+                }
                 return NT_STATUS_LOGON_FAILURE;
         }
-        nt_status = get_info3_from_wbcAuthUserInfo(mem_ctx, info, &info3);
+        info3 = wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx, info);
         wbcFreeMemory(info);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
-
-        validation.sam3 = &info3;
+        if (!info3) {
+                DEBUG(1, ("wbcAuthUserInfo_to_netr_SamInfo3 failed\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        validation.sam3 = info3;
         nt_status = make_user_info_dc_netlogon_validation(mem_ctx,
-                                        user_info->client.account_name,
-                                        3, &validation, user_info_dc);
+                                                          user_info->client.account_name,
+                                                          3, &validation,
+                                                          true, /* This user was authenticated */
+                                                          user_info_dc);
         return nt_status;
 
@@ -311 +249 @@
 static const struct auth_operations winbind_ops = {
         .name           = "winbind",
-        .get_challenge  = auth_get_challenge_not_implemented,
         .want_check     = winbind_want_check,
         .check_password = winbind_check_password
@@ -318 +255 @@
 static const struct auth_operations winbind_wbclient_ops = {
         .name           = "winbind_wbclient",
-        .get_challenge  = auth_get_challenge_not_implemented,
         .want_check     = winbind_want_check,
         .check_password = winbind_check_password_wbclient
 };
 
-_PUBLIC_ NTSTATUS auth_winbind_init(void)
+_PUBLIC_ NTSTATUS auth4_winbind_init(void)
 {
         NTSTATUS ret;

vendor/current/source4/auth/ntlm/wscript_build

@@ -4 +4 @@
         source='auth_sam.c',
         subsystem='auth4',
-        init_function='auth_sam_init',
-        deps='samdb auth4_sam NTLMSSP_COMMON samba-hostconfig'
+        init_function='auth4_sam_init',
+        deps='samdb auth4_sam NTLMSSP_COMMON samba-hostconfig RPC_NDR_IRPC MESSAGING'
         )
 
@@ -12 +12 @@
         source='auth_anonymous.c',
         subsystem='auth4',
-        init_function='auth_anonymous_init',
+        init_function='auth4_anonymous_init',
         deps='talloc'
-        )
-
-
-bld.SAMBA_MODULE('auth4_server',
-        source='auth_server.c',
-        subsystem='auth4',
-        init_function='auth_server_init',
-        deps='samba-util LIBCLI_SMB CREDENTIALS_NTLM'
         )
 
@@ -28 +20 @@
         source='auth_winbind.c',
         subsystem='auth4',
-        init_function='auth_winbind_init',
+        init_function='auth4_winbind_init',
         deps='RPC_NDR_WINBIND MESSAGING wbclient'
         )
@@ -36 +28 @@
         source='auth_developer.c',
         subsystem='auth4',
-        init_function='auth_developer_init',
+        init_function='auth4_developer_init',
         deps='talloc'
         )
@@ -44 +36 @@
         source='auth_unix.c',
         subsystem='auth4',
-        init_function='auth_unix_init',
+        init_function='auth4_unix_init',
         deps='pam PAM_ERRORS LIBTSOCKET'
         )
@@ -52 +44 @@
         source='auth.c auth_util.c auth_simple.c',
         autoproto='auth_proto.h',
-        deps='samba-util security samdb credentials UTIL_TEVENT',
+        deps='samba-util samba-security samdb samba-credentials tevent-util LIBWBCLIENT_OLD auth_unix_token samba-modules KERBEROS_UTIL',
         private_library=True
         )

vendor/current/source4/auth/pyauth.c

@@ -31 +31 @@
 #include <tevent.h>
 #include "librpc/rpc/pyrpc_util.h"
+#include "lib/events/events.h"
+
+void initauth(void);
 
 staticforward PyTypeObject PyAuthContext;
 
-/* There's no Py_ssize_t in 2.4, apparently */
-#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5
-typedef int Py_ssize_t;
-typedef inquiry lenfunc;
-typedef intargfunc ssizeargfunc;
-#endif
-
-#ifndef Py_RETURN_NONE
-#define Py_RETURN_NONE return Py_INCREF(Py_None), Py_None
-#endif
-
-static PyObject *py_auth_session_get_security_token(PyObject *self, void *closure)
-{
-        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-        PyObject *py_security_token;
-        py_security_token = py_return_ndr_struct("samba.dcerpc.security", "token",
-                                                 session->security_token, session->security_token);
-        return py_security_token;
-}
-
-static int py_auth_session_set_security_token(PyObject *self, PyObject *value, void *closure)
-{
-        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-        session->security_token = talloc_reference(session, py_talloc_get_ptr(value));
-        return 0;
-}
-
-static PyObject *py_auth_session_get_session_key(PyObject *self, void *closure)
-{
-        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-        return PyString_FromStringAndSize((char *)session->session_key.data, session->session_key.length);
-}
-
-static int py_auth_session_set_session_key(PyObject *self, PyObject *value, void *closure)
-{
-        DATA_BLOB val;
-        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-        val.data = (uint8_t *)PyString_AsString(value);
-        val.length = PyString_Size(value);
-
-        session->session_key = data_blob_talloc(session, val.data, val.length);
-        return 0;
-}
-
-static PyObject *py_auth_session_get_credentials(PyObject *self, void *closure)
-{
-        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-        PyObject *py_credentials;
-        /* This is evil, as the credentials are not IDL structures */
-        py_credentials = py_return_ndr_struct("samba.credentials", "Credentials", session->credentials, session->credentials);
-        return py_credentials;
-}
-
-static int py_auth_session_set_credentials(PyObject *self, PyObject *value, void *closure)
-{
-        struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-        session->credentials = talloc_reference(session, PyCredentials_AsCliCredentials(value));
-        return 0;
-}
-
-static PyGetSetDef py_auth_session_getset[] = {
-        { discard_const_p(char, "security_token"), (getter)py_auth_session_get_security_token, (setter)py_auth_session_set_security_token, NULL },
-        { discard_const_p(char, "session_key"), (getter)py_auth_session_get_session_key, (setter)py_auth_session_set_session_key, NULL },
-        { discard_const_p(char, "credentials"), (getter)py_auth_session_get_credentials, (setter)py_auth_session_set_credentials, NULL },
-        { NULL }
-};
-
-static PyTypeObject PyAuthSession = {
-        .tp_name = "AuthSession",
-        .tp_basicsize = sizeof(py_talloc_Object),
-        .tp_flags = Py_TPFLAGS_DEFAULT,
-        .tp_getset = py_auth_session_getset,
-};
-
-PyObject *PyAuthSession_FromSession(struct auth_session_info *session)
-{
-        return py_talloc_reference(&PyAuthSession, session);
+static PyObject *PyAuthSession_FromSession(struct auth_session_info *session)
+{
+        return py_return_ndr_struct("samba.dcerpc.auth", "session_info", session, session);
 }
 
@@ -208 +137 @@
         }
 
-        ldb_ctx = PyLdb_AsLdbContext(py_ldb);
+        ldb_ctx = pyldb_Ldb_AsLdbContext(py_ldb);
 
         if (py_dn == Py_None) {
                 user_dn = NULL;
         } else {
-                if (!PyObject_AsDn(ldb_ctx, py_dn, ldb_ctx, &user_dn)) {
+                if (!pyldb_Object_AsDn(ldb_ctx, py_dn, ldb_ctx, &user_dn)) {
                         talloc_free(mem_ctx);
                         return NULL;
@@ -267 +196 @@
 }
 
-static PyObject *PyAuthContext_FromContext(struct auth_context *auth_context)
-{
-        return py_talloc_reference(&PyAuthContext, auth_context);
+static PyObject *PyAuthContext_FromContext(struct auth4_context *auth_context)
+{
+        return pytalloc_reference(&PyAuthContext, auth_context);
 }
 
@@ -276 +205 @@
         PyObject *py_lp_ctx = Py_None;
         PyObject *py_ldb = Py_None;
-        PyObject *py_messaging_ctx = Py_None;
+        PyObject *py_imessaging_ctx = Py_None;
         PyObject *py_auth_context = Py_None;
         PyObject *py_methods = Py_None;
         TALLOC_CTX *mem_ctx;
-        struct auth_context *auth_context;
-        struct messaging_context *messaging_context = NULL;
+        struct auth4_context *auth_context;
+        struct imessaging_context *imessaging_context = NULL;
         struct loadparm_context *lp_ctx;
         struct tevent_context *ev;
-        struct ldb_context *ldb;
+        struct ldb_context *ldb = NULL;
         NTSTATUS nt_status;
         const char **methods;
@@ -292 +221 @@
         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OOOO",
                                          discard_const_p(char *, kwnames),
-                                         &py_lp_ctx, &py_messaging_ctx, &py_ldb, &py_methods))
+                                         &py_lp_ctx, &py_imessaging_ctx, &py_ldb, &py_methods))
                 return NULL;
 
@@ -302 +231 @@
 
         if (py_ldb != Py_None) {
-                ldb = PyLdb_AsLdbContext(py_ldb);
+                ldb = pyldb_Ldb_AsLdbContext(py_ldb);
         }
 
         lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
-
-        ev = tevent_context_init(mem_ctx);
+        if (lp_ctx == NULL) {
+                PyErr_NoMemory();
+                return NULL;
+        }
+
+        ev = s4_event_context_init(mem_ctx);
         if (ev == NULL) {
                 PyErr_NoMemory();
@@ -313 +246 @@
         }
 
-        if (py_messaging_ctx != Py_None) {
-                messaging_context = py_talloc_get_type(py_messaging_ctx, struct messaging_context);
+        if (py_imessaging_ctx != Py_None) {
+                imessaging_context = pytalloc_get_type(py_imessaging_ctx, struct imessaging_context);
         }
 
         if (py_methods == Py_None && py_ldb == Py_None) {
-                nt_status = auth_context_create(mem_ctx, ev, messaging_context, lp_ctx, &auth_context);
+                nt_status = auth_context_create(mem_ctx, ev, imessaging_context, lp_ctx, &auth_context);
         } else {
                 if (py_methods != Py_None) {
@@ -330 +263 @@
                 }
                 nt_status = auth_context_create_methods(mem_ctx, methods, ev, 
-                                                        messaging_context, lp_ctx, 
+                                                        imessaging_context, lp_ctx,
                                                         ldb, &auth_context);
         }
@@ -360 +293 @@
 static PyTypeObject PyAuthContext = {
         .tp_name = "AuthContext",
-        .tp_basicsize = sizeof(py_talloc_Object),
         .tp_flags = Py_TPFLAGS_DEFAULT,
         .tp_new = py_auth_context_new,
-        .tp_basicsize = sizeof(py_talloc_Object),
 };
 
@@ -377 +308 @@
         PyObject *m;
 
-        PyAuthSession.tp_base = PyTalloc_GetObjectType();
-        if (PyAuthSession.tp_base == NULL)
-                return;
-
-        if (PyType_Ready(&PyAuthSession) < 0)
-                return;
-
-        PyAuthContext.tp_base = PyTalloc_GetObjectType();
-        if (PyAuthContext.tp_base == NULL)
-                return;
-
-        if (PyType_Ready(&PyAuthContext) < 0)
+        if (pytalloc_BaseObject_PyType_Ready(&PyAuthContext) < 0)
                 return;
 
@@ -396 +316 @@
                 return;
 
-        Py_INCREF(&PyAuthSession);
-        PyModule_AddObject(m, "AuthSession", (PyObject *)&PyAuthSession);
         Py_INCREF(&PyAuthContext);
         PyModule_AddObject(m, "AuthContext", (PyObject *)&PyAuthContext);

vendor/current/source4/auth/pyauth.h

@@ -24 +24 @@
 #include "auth/session.h"
 
-#define PyAuthSession_AsSession(obj) py_talloc_get_type(obj, struct auth_session_info)
-#define PyAuthSession_Check(obj) PyObject_TypeCheck(obj, &PyAuthSession)
+#define PyAuthSession_AsSession(obj) pytalloc_get_type(obj, struct auth_session_info)
 struct auth_session_info *PyObject_AsSession(PyObject *obj);
-PyObject *PyAuthSession_FromSession(struct auth_session_info *session);
 
 #endif /* _PYAUTH_H */

vendor/current/source4/auth/sam.c

@@ -42 +42 @@
         "msDS-SupportedEncryptionTypes",        \
         "supplementalCredentials",              \
+        "msDS-AllowedToDelegateTo",             \
                                                 \
         /* passwords */                         \
@@ -47 +48 @@
         "unicodePwd",                           \
                                                 \
-        "userAccountControl",                   \
+        "userAccountControl",                   \
+        "msDS-User-Account-Control-Computed",   \
         "objectSid",                            \
                                                 \
@@ -65 +67 @@
 
         "logonHours",
+
+        /*
+         * To allow us to zero the badPwdCount and lockoutTime on
+         * successful logon, without database churn
+         */
+        "lockoutTime",
 
         /* check 'allowed workstations' */
@@ -76 +84 @@
         "homeDrive",
         "lastLogon",
+        "lastLogonTimestamp",
         "lastLogoff",
         "accountExpires",
@@ -82 +91 @@
         "primaryGroupID",
         "memberOf",
+        "badPasswordTime",
+        "lmPwdHistory",
+        "ntPwdHistory",
         NULL,
 };
@@ -165 +177 @@
         NTTIME acct_expiry;
         NTTIME must_change_time;
-
-        NTTIME now;
+        struct timeval tv_now = timeval_current();
+        NTTIME now = timeval_to_nttime(&tv_now);
+
         DEBUG(4,("authsam_account_ok: Checking SMB password for user %s\n", name_for_logs));
 
-        acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, domain_dn);
+        acct_flags = samdb_result_acct_flags(msg, "msDS-User-Account-Control-Computed");
         
         acct_expiry = samdb_result_account_expires(msg);
@@ -193 +206 @@
 
         /* Test account expire time */
-        unix_to_nt_time(&now, time(NULL));
         if (now > acct_expiry) {
                 DEBUG(2,("authsam_account_ok: Account for user '%s' has expired.\n", name_for_logs));
@@ -221 +233 @@
                 bool invalid_ws = true;
                 int i;
-                const char **workstations = (const char **)str_list_make(mem_ctx, workstation_list, ",");
-                
+                char **workstations = str_list_make(mem_ctx, workstation_list, ",");
+
                 for (i = 0; workstations && workstations[i]; i++) {
                         DEBUG(10,("sam_account_ok: checking for workstation match '%s' and '%s'\n",
@@ -298 +310 @@
 
         tmp_ctx = talloc_new(user_info_dc);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc, user_info_dc);
+        if (user_info_dc == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         sids = talloc_array(user_info_dc, struct dom_sid, 2);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sids, user_info_dc);
+        if (sids == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         num_sids = 2;
 
         account_sid = samdb_result_dom_sid(user_info_dc, msg, "objectSid");
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(account_sid, user_info_dc);
+        if (account_sid == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         status = dom_sid_split_rid(tmp_ctx, account_sid, &domain_sid, NULL);
@@ -322 +343 @@
          * on SamLogon validation info */
         filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(!(groupType:1.2.840.113556.1.4.803:=%u))(groupType:1.2.840.113556.1.4.803:=%u))", GROUP_TYPE_BUILTIN_LOCAL_GROUP, GROUP_TYPE_SECURITY_ENABLED);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(filter, user_info_dc);
+        if (filter == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         primary_group_string = dom_sid_string(tmp_ctx, &sids[PRIMARY_GROUP_SID_INDEX]);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(primary_group_string, user_info_dc);
+        if (primary_group_string == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         primary_group_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", primary_group_string);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(primary_group_dn, user_info_dc);
+        if (primary_group_dn == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         primary_group_blob = data_blob_string_const(primary_group_dn);
@@ -372 +402 @@
 
         info->domain_name = talloc_strdup(info, domain_name);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->domain_name,
-                user_info_dc);
+        if (info->domain_name == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         str = ldb_msg_find_attr_as_string(msg, "displayName", "");
         info->full_name = talloc_strdup(info, str);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->full_name, user_info_dc);
+        if (info->full_name == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         str = ldb_msg_find_attr_as_string(msg, "scriptPath", "");
         info->logon_script = talloc_strdup(info, str);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->logon_script,
-                user_info_dc);
+        if (info->logon_script == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         str = ldb_msg_find_attr_as_string(msg, "profilePath", "");
         info->profile_path = talloc_strdup(info, str);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->profile_path,
-                user_info_dc);
+        if (info->profile_path == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         str = ldb_msg_find_attr_as_string(msg, "homeDirectory", "");
         info->home_directory = talloc_strdup(info, str);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->home_directory,
-                user_info_dc);
+        if (info->home_directory == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         str = ldb_msg_find_attr_as_string(msg, "homeDrive", "");
         info->home_drive = talloc_strdup(info, str);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->home_drive, user_info_dc);
+        if (info->home_drive == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         info->logon_server = talloc_strdup(info, netbios_name);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->logon_server,
-                user_info_dc);
+        if (info->logon_server == NULL) {
+                TALLOC_FREE(user_info_dc);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         info->last_logon = samdb_result_nttime(msg, "lastLogon", 0);
@@ -417 +463 @@
                 0);
 
-        info->acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx,
-                                                          msg, domain_dn);
+        info->acct_flags = samdb_result_acct_flags(msg, "msDS-User-Account-Control-Computed");
 
         user_info_dc->user_session_key = data_blob_talloc(user_info_dc,
@@ -424 +469 @@
                                                          user_sess_key.length);
         if (user_sess_key.data) {
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->user_session_key.data,
-                                                  user_info_dc);
+                if (user_info_dc->user_session_key.data == NULL) {
+                        TALLOC_FREE(user_info_dc);
+                        return NT_STATUS_NO_MEMORY;
+                }
         }
         user_info_dc->lm_session_key = data_blob_talloc(user_info_dc,
@@ -431 +478 @@
                                                        lm_sess_key.length);
         if (lm_sess_key.data) {
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->lm_session_key.data,
-                                                  user_info_dc);
+                if (user_info_dc->lm_session_key.data == NULL) {
+                        TALLOC_FREE(user_info_dc);
+                        return NT_STATUS_NO_MEMORY;
+                }
         }
 
@@ -442 +491 @@
                                                    struct dom_sid,
                                                    user_info_dc->num_sids+1);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->sids, user_info_dc);
+                if (user_info_dc->sids == NULL) {
+                        TALLOC_FREE(user_info_dc);
+                        return NT_STATUS_NO_MEMORY;
+                }
                 user_info_dc->sids[user_info_dc->num_sids] = global_sid_Enterprise_DCs;
                 user_info_dc->num_sids++;
@@ -454 +506 @@
                                                    struct dom_sid,
                                                    user_info_dc->num_sids+1);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->sids, user_info_dc);
+                if (user_info_dc->sids == NULL) {
+                        TALLOC_FREE(user_info_dc);
+                        return NT_STATUS_NO_MEMORY;
+                }
                 user_info_dc->sids[user_info_dc->num_sids] = *domain_sid;
                 sid_append_rid(&user_info_dc->sids[user_info_dc->num_sids],
@@ -493 +548 @@
         /* pull the user attributes */
         ret = dsdb_search_one(sam_ctx, tmp_ctx, msg, user_dn,
-                              LDB_SCOPE_BASE, attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
+                              LDB_SCOPE_BASE, attrs,
+                              DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                              "(objectClass=*)");
         if (ret != LDB_SUCCESS) {
                 talloc_free(tmp_ctx);
@@ -540 +597 @@
                 /* pull the user attributes */
                 ret = dsdb_search_one(sam_ctx, tmp_ctx, &msg, user_dn,
-                                      LDB_SCOPE_BASE, user_attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
+                                      LDB_SCOPE_BASE, user_attrs,
+                                      DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                                      "(objectClass=*)");
                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
                         talloc_free(tmp_ctx);
@@ -586 +645 @@
         return NT_STATUS_OK;
 }
+
+NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx,
+                                      struct ldb_message *msg,
+                                      struct ldb_dn *domain_dn)
+{
+        const char *attrs[] = { "lockoutThreshold",
+                                "lockOutObservationWindow",
+                                "lockoutDuration",
+                                "pwdProperties",
+                                NULL };
+        int ret;
+        NTSTATUS status;
+        struct ldb_result *domain_res;
+        struct ldb_message *msg_mod = NULL;
+        TALLOC_CTX *mem_ctx;
+
+        mem_ctx = talloc_new(msg);
+        if (mem_ctx == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ret = dsdb_search_dn(sam_ctx, mem_ctx, &domain_res, domain_dn, attrs, 0);
+        if (ret != LDB_SUCCESS) {
+                TALLOC_FREE(mem_ctx);
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+
+        status = dsdb_update_bad_pwd_count(mem_ctx, sam_ctx,
+                                           msg, domain_res->msgs[0], &msg_mod);
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(mem_ctx);
+                return status;
+        }
+
+        if (msg_mod != NULL) {
+                ret = dsdb_modify(sam_ctx, msg_mod, 0);
+                if (ret != LDB_SUCCESS) {
+                        DEBUG(0, ("Failed to update badPwdCount, badPasswordTime or set lockoutTime on %s: %s\n",
+                                  ldb_dn_get_linearized(msg_mod->dn), ldb_errstring(sam_ctx)));
+                        TALLOC_FREE(mem_ctx);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+        }
+
+        TALLOC_FREE(mem_ctx);
+        return NT_STATUS_OK;
+}
+
+
+static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx,
+                                            struct ldb_message *msg_mod,
+                                            struct ldb_dn *domain_dn,
+                                            NTTIME old_timestamp,
+                                            NTTIME now)
+{
+        /*
+         * We only set lastLogonTimestamp if the current value is older than
+         * now - msDS-LogonTimeSyncInterval days.
+         *
+         * msDS-LogonTimeSyncInterval is an int32_t number of days, while
+         * lastLogonTimestamp is in the 64 bit 100ns NTTIME format.
+         *
+         * The docs say: "the initial update, after the domain functional
+         * level is raised to DS_BEHAVIOR_WIN2003 or higher, is calculated as
+         * 14 days minus a random percentage of 5 days", but we aren't doing
+         * that. The blogosphere seems to think that this randomised update
+         * happens everytime, but [MS-ADA1] doesn't agree.
+         *
+         * Dochelp referred us to the following blog post:
+         * http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx
+         *
+         * en msDS-LogonTimeSyncInterval is zero, the lastLogonTimestamp is
+         * not changed.
+         */
+        static const char *attrs[] = { "msDS-LogonTimeSyncInterval",
+                                        NULL };
+        int ret;
+        struct ldb_result *domain_res = NULL;
+        TALLOC_CTX *mem_ctx = NULL;
+        int32_t sync_interval;
+        NTTIME sync_interval_nt;
+
+        mem_ctx = talloc_new(msg_mod);
+        if (mem_ctx == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ret = dsdb_search_dn(sam_ctx, mem_ctx, &domain_res, domain_dn, attrs,
+                             0);
+        if (ret != LDB_SUCCESS || domain_res->count != 1) {
+                TALLOC_FREE(mem_ctx);
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+
+        sync_interval = ldb_msg_find_attr_as_int(domain_res->msgs[0],
+                                                 "msDS-LogonTimeSyncInterval",
+                                                 14);
+        DEBUG(5, ("sync interval is %d\n", sync_interval));
+        if (sync_interval == 0){
+                /*
+                 * Setting msDS-LogonTimeSyncInterval to zero is how you ask
+                 * that nothing happens here.
+                 */
+                TALLOC_FREE(mem_ctx);
+                return NT_STATUS_OK;
+        }
+        else if (sync_interval >= 5){
+                /*
+                 * Subtract "a random percentage of 5" days. Presumably this
+                 * percentage is between 0 and 100, and modulus is accurate
+                 * enough.
+                 */
+                uint32_t r = generate_random() % 6;
+                sync_interval -= r;
+                DEBUG(5, ("randomised sync interval is %d (-%d)\n", sync_interval, r));
+        }
+        /* In the case where sync_interval < 5 there is no randomisation */
+
+        sync_interval_nt = sync_interval * 24LL * 3600LL * 10000000LL;
+
+        DEBUG(5, ("old timestamp is %lld, threshold %lld, diff %lld\n",
+                  (long long int)old_timestamp,
+                  (long long int)(now - sync_interval_nt),
+                  (long long int)(old_timestamp - now + sync_interval_nt)));
+
+        if (old_timestamp > now){
+                DEBUG(0, ("lastLogonTimestamp is in the future! (%lld > %lld)\n",
+                          (long long int)old_timestamp, (long long int)now));
+                /* then what? */
+
+        } else if (old_timestamp < now - sync_interval_nt){
+                DEBUG(5, ("updating lastLogonTimestamp to %lld\n",
+                          (long long int)now));
+
+                /* The time has come to update lastLogonTimestamp */
+                ret = samdb_msg_add_int64(sam_ctx, msg_mod, msg_mod,
+                                          "lastLogonTimestamp", now);
+
+                if (ret != LDB_SUCCESS) {
+                        TALLOC_FREE(mem_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+        TALLOC_FREE(mem_ctx);
+        return NT_STATUS_OK;
+}
+
+
+
+/* Reset the badPwdCount to zero and update the lastLogon time. */
+NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
+                                          const struct ldb_message *msg,
+                                          struct ldb_dn *domain_dn,
+                                          bool interactive_or_kerberos)
+{
+        int ret;
+        NTSTATUS status;
+        int badPwdCount;
+        int64_t lockoutTime;
+        struct ldb_message *msg_mod;
+        TALLOC_CTX *mem_ctx;
+        struct timeval tv_now;
+        NTTIME now;
+        NTTIME lastLogonTimestamp;
+        NTTIME lastLogon;
+
+        lockoutTime = ldb_msg_find_attr_as_int64(msg, "lockoutTime", 0);
+        badPwdCount = ldb_msg_find_attr_as_int(msg, "badPwdCount", 0);
+        lastLogonTimestamp = \
+                ldb_msg_find_attr_as_int64(msg, "lastLogonTimestamp", 0);
+        lastLogon = ldb_msg_find_attr_as_int64(msg, "lastLogon", 0);
+
+        DEBUG(5, ("lastLogonTimestamp is %lld\n",
+                  (long long int)lastLogonTimestamp));
+
+        mem_ctx = talloc_new(msg);
+        if (mem_ctx == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        msg_mod = ldb_msg_new(mem_ctx);
+        if (msg_mod == NULL) {
+                TALLOC_FREE(mem_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+        msg_mod->dn = msg->dn;
+
+        if (lockoutTime != 0) {
+                /*
+                 * This implies "badPwdCount" = 0, see samldb_lockout_time()
+                 */
+                ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod, "lockoutTime", 0);
+                if (ret != LDB_SUCCESS) {
+                        TALLOC_FREE(mem_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
+        } else if (badPwdCount != 0) {
+                ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod, "badPwdCount", 0);
+                if (ret != LDB_SUCCESS) {
+                        TALLOC_FREE(mem_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+
+        tv_now = timeval_current();
+        now = timeval_to_nttime(&tv_now);
+
+        if (interactive_or_kerberos || lastLogon == 0 ||
+            (badPwdCount != 0 && lockoutTime == 0)) {
+                ret = samdb_msg_add_int64(sam_ctx, msg_mod, msg_mod,
+                                          "lastLogon", now);
+                if (ret != LDB_SUCCESS) {
+                        TALLOC_FREE(mem_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+        status = authsam_update_lastlogon_timestamp(sam_ctx, msg_mod, domain_dn,
+                                                    lastLogonTimestamp, now);
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(mem_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (msg_mod->num_elements > 0) {
+                ret = dsdb_replace(sam_ctx, msg_mod, 0);
+                if (ret != LDB_SUCCESS) {
+                        DEBUG(0, ("Failed to set badPwdCount and lockoutTime "
+                                  "to 0 and/or  lastlogon to now (%lld) "
+                                  "%s: %s\n", (long long int)now,
+                                  ldb_dn_get_linearized(msg_mod->dn),
+                                  ldb_errstring(sam_ctx)));
+                        TALLOC_FREE(mem_ctx);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+        }
+        TALLOC_FREE(mem_ctx);
+        return NT_STATUS_OK;
+}

vendor/current/source4/auth/samba_server_gensec.c

@@ -30 +30 @@
 NTSTATUS samba_server_gensec_start(TALLOC_CTX *mem_ctx,
                                    struct tevent_context *event_ctx,
-                                   struct messaging_context *msg_ctx,
+                                   struct imessaging_context *msg_ctx,
                                    struct loadparm_context *lp_ctx,
                                    struct cli_credentials *server_credentials,
@@ -38 +38 @@
         NTSTATUS nt_status;
         struct gensec_security *gensec_ctx;
-        struct auth_context *auth_context;
+        struct auth4_context *auth_context;
 
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
@@ -58 +58 @@
 
         nt_status = gensec_server_start(tmp_ctx,
-                                        event_ctx,
                                         lpcfg_gensec_settings(mem_ctx, lp_ctx),
                                         auth_context,

vendor/current/source4/auth/session.c

@@ -33 +33 @@
 #include "system/kerberos.h"
 #include <gssapi/gssapi.h>
+#include "libcli/wbclient/wbclient.h"
 
 _PUBLIC_ struct auth_session_info *anonymous_session(TALLOC_CTX *mem_ctx, 
@@ -65 +66 @@
         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 
-        session_info = talloc(tmp_ctx, struct auth_session_info);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(session_info, tmp_ctx);
+        session_info = talloc_zero(tmp_ctx, struct auth_session_info);
+        if (session_info == NULL) {
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         session_info->info = talloc_reference(session_info, user_info_dc->info);
 
         session_info->torture = talloc_zero(session_info, struct auth_user_info_torture);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(session_info->torture, tmp_ctx);
+        if (session_info->torture == NULL) {
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
         session_info->torture->num_dc_sids = user_info_dc->num_sids;
         session_info->torture->dc_sids = talloc_reference(session_info, user_info_dc->sids);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(session_info->torture->dc_sids, tmp_ctx);
+        if (session_info->torture->dc_sids == NULL) {
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         /* unless set otherwise, the session key is the user session
@@ -80 +90 @@
         session_info->session_key = data_blob_talloc(session_info, user_info_dc->user_session_key.data, user_info_dc->user_session_key.length);
         if (!session_info->session_key.data && session_info->session_key.length) {
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(session_info->session_key.data, tmp_ctx);
+                if (session_info->session_key.data == NULL) {
+                        TALLOC_FREE(tmp_ctx);
+                        return NT_STATUS_NO_MEMORY;
+                }
         }
 
         anonymous_sid = dom_sid_parse_talloc(tmp_ctx, SID_NT_ANONYMOUS);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(anonymous_sid, tmp_ctx);
+        if (anonymous_sid == NULL) {
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         system_sid = dom_sid_parse_talloc(tmp_ctx, SID_NT_SYSTEM);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(system_sid, tmp_ctx);
+        if (system_sid == NULL) {
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         sids = talloc_array(tmp_ctx, struct dom_sid, user_info_dc->num_sids);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sids, tmp_ctx);
+        if (sids == NULL) {
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
         if (!sids) {
                 talloc_free(tmp_ctx);
@@ -102 +124 @@
         }
 
-        if (user_info_dc->num_sids > PRIMARY_USER_SID_INDEX && dom_sid_equal(anonymous_sid, &user_info_dc->sids[PRIMARY_USER_SID_INDEX])) {
+        /*
+         * Finally add the "standard" sids.
+         * The only difference between guest and "anonymous"
+         * is the addition of Authenticated_Users.
+         */
+
+        if (session_info_flags & AUTH_SESSION_INFO_DEFAULT_GROUPS) {
+                sids = talloc_realloc(tmp_ctx, sids, struct dom_sid, num_sids + 2);
+                NT_STATUS_HAVE_NO_MEMORY(sids);
+
+                if (!dom_sid_parse(SID_WORLD, &sids[num_sids])) {
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+                num_sids++;
+
+                if (!dom_sid_parse(SID_NT_NETWORK, &sids[num_sids])) {
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+                num_sids++;
+        }
+
+        if (session_info_flags & AUTH_SESSION_INFO_AUTHENTICATED) {
+                sids = talloc_realloc(tmp_ctx, sids, struct dom_sid, num_sids + 1);
+                NT_STATUS_HAVE_NO_MEMORY(sids);
+
+                if (!dom_sid_parse(SID_NT_AUTHENTICATED_USERS, &sids[num_sids])) {
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+                num_sids++;
+        }
+
+
+
+        if (num_sids > PRIMARY_USER_SID_INDEX && dom_sid_equal(anonymous_sid, &sids[PRIMARY_USER_SID_INDEX])) {
                 /* Don't expand nested groups of system, anonymous etc*/
-        } else if (user_info_dc->num_sids > PRIMARY_USER_SID_INDEX && dom_sid_equal(system_sid, &user_info_dc->sids[PRIMARY_USER_SID_INDEX])) {
+        } else if (num_sids > PRIMARY_USER_SID_INDEX && dom_sid_equal(system_sid, &sids[PRIMARY_USER_SID_INDEX])) {
                 /* Don't expand nested groups of system, anonymous etc*/
         } else if (sam_ctx) {
@@ -111 +166 @@
 
                 /* Search for each group in the token */
-                for (i = 0; i < user_info_dc->num_sids; i++) {
+                for (i = 0; i < num_sids; i++) {
                         char *sid_string;
                         const char *sid_dn;
                         DATA_BLOB sid_blob;
-                        
+
                         sid_string = dom_sid_string(tmp_ctx,
-                                                      &user_info_dc->sids[i]);
-                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sid_string, user_info_dc);
+                                                      &sids[i]);
+                        if (sid_string == NULL) {
+                                TALLOC_FREE(user_info_dc);
+                                return NT_STATUS_NO_MEMORY;
+                        }
                         
                         sid_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", sid_string);
                         talloc_free(sid_string);
-                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sid_dn, user_info_dc);
+                        if (sid_dn == NULL) {
+                                TALLOC_FREE(user_info_dc);
+                                return NT_STATUS_NO_MEMORY;
+                        }
                         sid_blob = data_blob_string_const(sid_dn);
                         
@@ -146 +207 @@
                                           session_info_flags,
                                           &session_info->security_token);
-        NT_STATUS_NOT_OK_RETURN_AND_FREE(nt_status, tmp_ctx);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                TALLOC_FREE(tmp_ctx);
+                return nt_status;
+        }
 
         session_info->credentials = NULL;
@@ -156 +220 @@
 }
 
-/* Create a session_info structure from the
- * auth_session_info_transport we were forwarded over named pipe
- * forwarding.
+
+/* Fill out the auth_session_info with a cli_credentials based on the
+ * auth_session_info we were forwarded over named pipe forwarding.
  *
  * NOTE: The stucture members of session_info_transport are stolen
@@ -169 +233 @@
 {
         struct auth_session_info *session_info;
-        session_info = talloc_zero(mem_ctx, struct auth_session_info);
-        if (!session_info) {
-                *reason = "failed to allocate session_info";
-                return NULL;
-        }
-
-        session_info->security_token = talloc_move(session_info, &session_info_transport->security_token);
-        session_info->info = talloc_move(session_info, &session_info_transport->info);
-        session_info->session_key = session_info_transport->session_key;
-        session_info->session_key.data = talloc_move(session_info, &session_info_transport->session_key.data);
-
+        session_info = talloc_steal(mem_ctx, session_info_transport->session_info);
+        /*
+         * This is to allow us to check the type of this pointer using
+         * talloc_get_type()
+         */
+        talloc_set_name(session_info, "struct auth_session_info");
+#ifdef HAVE_GSS_IMPORT_CRED
         if (session_info_transport->exported_gssapi_credentials.length) {
                 struct cli_credentials *creds;
@@ -230 +290 @@
 
         }
-
+#endif
         return session_info;
 }
@@ -237 +297 @@
 /* Create a auth_session_info_transport from an auth_session_info.
  *
- * NOTE: Members of the auth_session_info_transport structure are not talloc_referenced, but simply assigned.  They are only valid for the lifetime of the struct auth_session_info
- *
- * This isn't normally an issue, as the auth_session_info has a very long typical life
+ * NOTE: Members of the auth_session_info_transport structure are
+ * talloc_referenced() into this structure, and should not be changed.
  */
 NTSTATUS auth_session_info_transport_from_session(TALLOC_CTX *mem_ctx,
@@ -248 +307 @@
 {
 
-        struct auth_session_info_transport *session_info_transport = talloc_zero(mem_ctx, struct auth_session_info_transport);
-        session_info_transport->security_token = talloc_reference(session_info, session_info->security_token);
-        NT_STATUS_HAVE_NO_MEMORY(session_info_transport->security_token);
-
-        session_info_transport->info = talloc_reference(session_info, session_info->info);
-        NT_STATUS_HAVE_NO_MEMORY(session_info_transport->info);
-
-        session_info_transport->session_key = session_info->session_key;
-        session_info_transport->session_key.data = talloc_reference(session_info, session_info->session_key.data);
-        if (!session_info_transport->session_key.data && session_info->session_key.length) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
+        struct auth_session_info_transport *session_info_transport
+                = talloc_zero(mem_ctx, struct auth_session_info_transport);
+        if (!session_info_transport) {
+                return NT_STATUS_NO_MEMORY;
+        };
+        session_info_transport->session_info = talloc_reference(session_info_transport, session_info);
+        if (!session_info_transport->session_info) {
+                return NT_STATUS_NO_MEMORY;
+        };
+#ifdef HAVE_GSS_EXPORT_CRED
         if (session_info->credentials) {
                 struct gssapi_creds_container *gcc;
@@ -294 +350 @@
                 }
         }
+#endif
         *transport_out = session_info_transport;
         return NT_STATUS_OK;
@@ -350 +407 @@
         security_token_debug(0, dbg_lev, session_info->security_token);
 }
-

vendor/current/source4/auth/system_session.c

@@ -191 +191 @@
 
         user_info_dc->sids[PRIMARY_GROUP_SID_INDEX] = *domain_sid;
-        sid_append_rid(&user_info_dc->sids[PRIMARY_USER_SID_INDEX], DOMAIN_RID_USERS);
+        sid_append_rid(&user_info_dc->sids[PRIMARY_GROUP_SID_INDEX], DOMAIN_RID_USERS);
 
         user_info_dc->sids[2] = global_sid_Builtin_Administrators;
@@ -268 +268 @@
         struct auth_user_info_dc *user_info_dc = NULL;
         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
+
+        NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
 
         nt_status = auth_domain_admin_user_info_dc(mem_ctx, lpcfg_netbios_name(lp_ctx),

vendor/current/source4/auth/wscript_build

@@ -3 +3 @@
 bld.RECURSE('gensec')
 bld.RECURSE('kerberos')
-bld.RECURSE('ntlmssp')
 bld.RECURSE('ntlm')
-bld.RECURSE('credentials')
 
 bld.SAMBA_SUBSYSTEM('auth_session',
         source='session.c',
         autoproto='session_proto.h',
-        public_deps='credentials',
+        public_deps='samba-credentials',
         public_headers='session.h',
         header_path='samba',
@@ -16 +14 @@
         )
 
+bld.SAMBA_LIBRARY('auth_unix_token',
+                  source='unix_token.c',
+                  autoproto='unix_token_proto.h',
+                  public_deps='LIBWBCLIENT_OLD',
+                  private_library=True,
+                  )
+
 
 bld.SAMBA_SUBSYSTEM('samba_server_gensec',
         source='samba_server_gensec.c',
-        public_deps='credentials gensec auth4'
+        public_deps='samba-credentials gensec auth4'
         )
 
@@ -26 +31 @@
         source='system_session.c',
         autoproto='system_session_proto.h',
-        public_deps='credentials',
+        public_deps='samba-credentials',
         deps='auth_session',
         )
@@ -34 +39 @@
         source='sam.c',
         autoproto='auth_sam.h',
-        public_deps='samdb security ldb tevent',
+        public_deps='samdb samba-security ldb tevent',
         deps=''
         )

vendor/current/source4/auth/wscript_configure

@@ -3 +3 @@
 conf.CHECK_HEADERS('security/pam_appl.h')
 conf.CHECK_FUNCS_IN('pam_start', 'pam', checklibc=True)
-
-if (conf.CHECK_HEADERS('sasl/sasl.h') and
-    conf.CHECK_FUNCS_IN('sasl_client_init', 'sasl2')):
-    conf.DEFINE('HAVE_SASL', 1)