Changeset 988 for vendor/current/source4/auth/gensec

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source4/auth/gensec

Files:

• cyrus_sasl.c (deleted)
• gensec.c (deleted)
• gensec.h (deleted)
• gensec.pc.in (deleted)
• gensec_gssapi.c (modified) (44 diffs)
• gensec_gssapi.h (modified) (6 diffs)
• gensec_krb5.c (modified) (24 diffs)
• gensec_krb5_util.c (added)
• gensec_krb5_util.h (added)
• gensec_tstream.c (modified) (2 diffs)
• pygensec.c (modified) (21 diffs)
• schannel.c (deleted)
• socket.c (deleted)
• spnego.c (deleted)
• tests (deleted)
• wscript_build (modified) (2 diffs)

vendor/current/source4/auth/gensec/gensec_gssapi.c

@@ -25 +25 @@
 #include "lib/events/events.h"
 #include "system/kerberos.h"
+#include "system/gssapi.h"
 #include "auth/kerberos/kerberos.h"
 #include "librpc/gen_ndr/krb5pac.h"
@@ -30 +31 @@
 #include <ldb.h>
 #include "auth/auth_sam.h"
-#include "librpc/rpc/dcerpc.h"
+#include "librpc/gen_ndr/dcerpc.h"
 #include "auth/credentials/credentials.h"
 #include "auth/credentials/credentials_krb5.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h"
 #include "auth/gensec/gensec_proto.h"
+#include "auth/gensec/gensec_toplevel_proto.h"
 #include "param/param.h"
 #include "auth/session_proto.h"
-#include <gssapi/gssapi.h>
-#include <gssapi/gssapi_krb5.h>
-#include <gssapi/gssapi_spnego.h>
-#include "auth/gensec/gensec_gssapi.h"
+#include "gensec_gssapi.h"
 #include "lib/util/util_net.h"
+#include "auth/kerberos/pac_utils.h"
+#include "auth/kerberos/gssapi_helper.h"
+
+#ifndef gss_mech_spnego
+gss_OID_desc spnego_mech_oid_desc =
+                { 6, discard_const_p(void, "\x2b\x06\x01\x05\x05\x02") };
+#define gss_mech_spnego (&spnego_mech_oid_desc)
+#endif
+
+_PUBLIC_ NTSTATUS gensec_gssapi_init(void);
 
 static size_t gensec_gssapi_max_input_size(struct gensec_security *gensec_security);
 static size_t gensec_gssapi_max_wrapped_size(struct gensec_security *gensec_security);
-
-static char *gssapi_error_string(TALLOC_CTX *mem_ctx, 
-                                 OM_uint32 maj_stat, OM_uint32 min_stat, 
-                                 const gss_OID mech)
-{
-        OM_uint32 disp_min_stat, disp_maj_stat;
-        gss_buffer_desc maj_error_message;
-        gss_buffer_desc min_error_message;
-        char *maj_error_string, *min_error_string;
-        OM_uint32 msg_ctx = 0;
-
-        char *ret;
-
-        maj_error_message.value = NULL;
-        min_error_message.value = NULL;
-        maj_error_message.length = 0;
-        min_error_message.length = 0;
-        
-        disp_maj_stat = gss_display_status(&disp_min_stat, maj_stat, GSS_C_GSS_CODE,
-                           mech, &msg_ctx, &maj_error_message);
-        disp_maj_stat = gss_display_status(&disp_min_stat, min_stat, GSS_C_MECH_CODE,
-                           mech, &msg_ctx, &min_error_message);
-        
-        maj_error_string = talloc_strndup(mem_ctx, (char *)maj_error_message.value, maj_error_message.length);
-
-        min_error_string = talloc_strndup(mem_ctx, (char *)min_error_message.value, min_error_message.length);
-
-        ret = talloc_asprintf(mem_ctx, "%s: %s", maj_error_string, min_error_string);
-
-        talloc_free(maj_error_string);
-        talloc_free(min_error_string);
-
-        gss_release_buffer(&disp_min_stat, &maj_error_message);
-        gss_release_buffer(&disp_min_stat, &min_error_message);
-
-        return ret;
-}
-
+static size_t gensec_gssapi_sig_size(struct gensec_security *gensec_security, size_t data_size);
 
 static int gensec_gssapi_destructor(struct gensec_gssapi_state *gensec_gssapi_state)
 {
-        OM_uint32 maj_stat, min_stat;
-        
+        OM_uint32 min_stat;
+
         if (gensec_gssapi_state->delegated_cred_handle != GSS_C_NO_CREDENTIAL) {
-                maj_stat = gss_release_cred(&min_stat, 
-                                            &gensec_gssapi_state->delegated_cred_handle);
+                gss_release_cred(&min_stat,
+                                 &gensec_gssapi_state->delegated_cred_handle);
         }
 
         if (gensec_gssapi_state->gssapi_context != GSS_C_NO_CONTEXT) {
-                maj_stat = gss_delete_sec_context (&min_stat,
-                                                   &gensec_gssapi_state->gssapi_context,
-                                                   GSS_C_NO_BUFFER);
+                gss_delete_sec_context(&min_stat,
+                                       &gensec_gssapi_state->gssapi_context,
+                                       GSS_C_NO_BUFFER);
         }
 
         if (gensec_gssapi_state->server_name != GSS_C_NO_NAME) {
-                maj_stat = gss_release_name(&min_stat, &gensec_gssapi_state->server_name);
+                gss_release_name(&min_stat,
+                                 &gensec_gssapi_state->server_name);
         }
         if (gensec_gssapi_state->client_name != GSS_C_NO_NAME) {
-                maj_stat = gss_release_name(&min_stat, &gensec_gssapi_state->client_name);
-        }
-
-        if (gensec_gssapi_state->lucid) {
-                gss_krb5_free_lucid_sec_context(&min_stat, gensec_gssapi_state->lucid);
+                gss_release_name(&min_stat,
+                                 &gensec_gssapi_state->client_name);
         }
 
         return 0;
-}
-
-static NTSTATUS gensec_gssapi_init_lucid(struct gensec_gssapi_state *gensec_gssapi_state)
-{
-        OM_uint32 maj_stat, min_stat;
-
-        if (gensec_gssapi_state->lucid) {
-                return NT_STATUS_OK;
-        }
-
-        maj_stat = gss_krb5_export_lucid_sec_context(&min_stat,
-                                                     &gensec_gssapi_state->gssapi_context,
-                                                     1,
-                                                     (void **)&gensec_gssapi_state->lucid);
-        if (maj_stat != GSS_S_COMPLETE) {
-                DEBUG(0,("gensec_gssapi_init_lucid: %s\n",
-                        gssapi_error_string(gensec_gssapi_state,
-                                            maj_stat, min_stat,
-                                            gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        if (gensec_gssapi_state->lucid->version != 1) {
-                DEBUG(0,("gensec_gssapi_init_lucid: lucid version[%d] != 1\n",
-                        gensec_gssapi_state->lucid->version));
-                gss_krb5_free_lucid_sec_context(&min_stat, gensec_gssapi_state->lucid);
-                gensec_gssapi_state->lucid = NULL;
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        return NT_STATUS_OK;
 }
 
@@ -148 +88 @@
         struct gensec_gssapi_state *gensec_gssapi_state;
         krb5_error_code ret;
+#ifdef SAMBA4_USES_HEIMDAL
         const char *realm;
+#endif
 
         gensec_gssapi_state = talloc_zero(gensec_security, struct gensec_gssapi_state);
@@ -165 +107 @@
         gensec_gssapi_state->client_name = GSS_C_NO_NAME;
         
-        gensec_gssapi_state->want_flags = 0;
+        gensec_gssapi_state->gss_want_flags = 0;
+        gensec_gssapi_state->expire_time = GENSEC_EXPIRE_TIME_INFINITY;
 
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation_by_kdc_policy", true)) {
-                gensec_gssapi_state->want_flags |= GSS_C_DELEG_POLICY_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_DELEG_POLICY_FLAG;
         }
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "mutual", true)) {
-                gensec_gssapi_state->want_flags |= GSS_C_MUTUAL_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_MUTUAL_FLAG;
         }
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", true)) {
-                gensec_gssapi_state->want_flags |= GSS_C_DELEG_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_DELEG_FLAG;
         }
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "replay", true)) {
-                gensec_gssapi_state->want_flags |= GSS_C_REPLAY_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_REPLAY_FLAG;
         }
         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "sequence", true)) {
-                gensec_gssapi_state->want_flags |= GSS_C_SEQUENCE_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_SEQUENCE_FLAG;
         }
 
         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
-                gensec_gssapi_state->want_flags |= GSS_C_INTEG_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_INTEG_FLAG;
         }
         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
-                gensec_gssapi_state->want_flags |= GSS_C_CONF_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_INTEG_FLAG;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_CONF_FLAG;
         }
         if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
-                gensec_gssapi_state->want_flags |= GSS_C_DCE_STYLE;
-        }
-
-        gensec_gssapi_state->got_flags = 0;
+                gensec_gssapi_state->gss_want_flags |= GSS_C_DCE_STYLE;
+        }
+
+        gensec_gssapi_state->gss_got_flags = 0;
 
         switch (gensec_security->ops->auth_type) {
@@ -201 +145 @@
         case DCERPC_AUTH_TYPE_KRB5:
         default:
-                gensec_gssapi_state->gss_oid = gss_mech_krb5;
+                gensec_gssapi_state->gss_oid =
+                        discard_const_p(void, gss_mech_krb5);
                 break;
         }
 
-        gensec_gssapi_state->session_key = data_blob(NULL, 0);
-        gensec_gssapi_state->pac = data_blob(NULL, 0);
-
         ret = smb_krb5_init_context(gensec_gssapi_state,
-                                    NULL,
                                     gensec_security->settings->lp_ctx,
                                     &gensec_gssapi_state->smb_krb5_context);
         if (ret) {
-                DEBUG(1,("gensec_krb5_start: krb5_init_context failed (%s)\n",
+                DEBUG(1,("gensec_gssapi_start: smb_krb5_init_context failed (%s)\n",
                          error_message(ret)));
                 talloc_free(gensec_gssapi_state);
@@ -221 +162 @@
         gensec_gssapi_state->client_cred = NULL;
         gensec_gssapi_state->server_cred = NULL;
-
-        gensec_gssapi_state->lucid = NULL;
 
         gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
@@ -237 +176 @@
         talloc_set_destructor(gensec_gssapi_state, gensec_gssapi_destructor);
 
+#ifdef SAMBA4_USES_HEIMDAL
         realm = lpcfg_realm(gensec_security->settings->lp_ctx);
         if (realm != NULL) {
                 ret = gsskrb5_set_default_realm(realm);
                 if (ret) {
-                        DEBUG(1,("gensec_krb5_start: gsskrb5_set_default_realm failed\n"));
+                        DEBUG(1,("gensec_gssapi_start: gsskrb5_set_default_realm failed\n"));
                         talloc_free(gensec_gssapi_state);
                         return NT_STATUS_INTERNAL_ERROR;
@@ -250 +190 @@
         ret = gsskrb5_set_dns_canonicalize(gensec_setting_bool(gensec_security->settings, "krb5", "set_dns_canonicalize", false));
         if (ret) {
-                DEBUG(1,("gensec_krb5_start: gsskrb5_set_dns_canonicalize failed\n"));
+                DEBUG(1,("gensec_gssapi_start: gsskrb5_set_dns_canonicalize failed\n"));
                 talloc_free(gensec_gssapi_state);
                 return NT_STATUS_INTERNAL_ERROR;
         }
-
+#endif
         return NT_STATUS_OK;
 }
@@ -306 +246 @@
 }
 
-static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_security)
+static NTSTATUS gensec_gssapi_client_creds(struct gensec_security *gensec_security,
+                                           struct tevent_context *ev)
 {
         struct gensec_gssapi_state *gensec_gssapi_state;
+        struct gssapi_creds_container *gcc;
         struct cli_credentials *creds = gensec_get_credentials(gensec_security);
-        krb5_error_code ret;
-        NTSTATUS nt_status;
-        gss_buffer_desc name_token;
-        gss_OID name_type;
-        OM_uint32 maj_stat, min_stat;
-        const char *hostname = gensec_get_target_hostname(gensec_security);
-        struct gssapi_creds_container *gcc;
         const char *error_string;
-
-        if (!hostname) {
-                DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-        if (is_ipaddress(hostname)) {
-                DEBUG(2, ("Cannot do GSSAPI to an IP address\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-        if (strcmp(hostname, "localhost") == 0) {
-                DEBUG(2, ("GSSAPI to 'localhost' does not make sense\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        nt_status = gensec_gssapi_start(gensec_security);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                return nt_status;
-        }
+        int ret;
 
         gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 
-        gensec_gssapi_state->target_principal = gensec_get_target_principal(gensec_security);
-        if (gensec_gssapi_state->target_principal) {
-                name_type = GSS_C_NULL_OID;
-        } else {
-                gensec_gssapi_state->target_principal = talloc_asprintf(gensec_gssapi_state, "%s/%s@%s",
-                                            gensec_get_target_service(gensec_security), 
-                                            hostname, lpcfg_realm(gensec_security->settings->lp_ctx));
-
-                name_type = GSS_C_NT_USER_NAME;
-        }
-        name_token.value  = discard_const_p(uint8_t, gensec_gssapi_state->target_principal);
-        name_token.length = strlen(gensec_gssapi_state->target_principal);
-
-
-        maj_stat = gss_import_name (&min_stat,
-                                    &name_token,
-                                    name_type,
-                                    &gensec_gssapi_state->server_name);
-        if (maj_stat) {
-                DEBUG(2, ("GSS Import name of %s failed: %s\n",
-                          (char *)name_token.value,
-                          gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        ret = cli_credentials_get_client_gss_creds(creds, 
-                                                   gensec_security->event_ctx, 
+        /* Only run this the first time the update() call is made */
+        if (gensec_gssapi_state->client_cred) {
+                return NT_STATUS_OK;
+        }
+
+        ret = cli_credentials_get_client_gss_creds(creds,
+                                                   ev,
                                                    gensec_security->settings->lp_ctx, &gcc, &error_string);
         switch (ret) {
         case 0:
                 break;
+        case EINVAL:
+                DEBUG(3, ("Cannot obtain client GSS credentials we need to contact %s : %s\n", gensec_gssapi_state->target_principal, error_string));
+                return NT_STATUS_INVALID_PARAMETER;
         case KRB5KDC_ERR_PREAUTH_FAILED:
         case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
+        case KRB5KRB_AP_ERR_BAD_INTEGRITY:
                 DEBUG(1, ("Wrong username or password: %s\n", error_string));
                 return NT_STATUS_LOGON_FAILURE;
+        case KRB5KDC_ERR_CLIENT_REVOKED:
+                DEBUG(1, ("Account locked out: %s\n", error_string));
+                return NT_STATUS_ACCOUNT_LOCKED_OUT;
+        case KRB5_REALM_UNKNOWN:
         case KRB5_KDC_UNREACH:
                 DEBUG(3, ("Cannot reach a KDC we require to contact %s : %s\n", gensec_gssapi_state->target_principal, error_string));
@@ -390 +296 @@
                 return NT_STATUS_NO_MEMORY;
         }
-        
+
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_security)
+{
+        struct gensec_gssapi_state *gensec_gssapi_state;
+        struct cli_credentials *creds = gensec_get_credentials(gensec_security);
+        NTSTATUS nt_status;
+        gss_buffer_desc name_token;
+        gss_OID name_type;
+        OM_uint32 maj_stat, min_stat;
+        const char *hostname = gensec_get_target_hostname(gensec_security);
+
+        if (!hostname) {
+                DEBUG(3, ("No hostname for target computer passed in, cannot use kerberos for this connection\n"));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        if (is_ipaddress(hostname)) {
+                DEBUG(2, ("Cannot do GSSAPI to an IP address\n"));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        if (strcmp(hostname, "localhost") == 0) {
+                DEBUG(2, ("GSSAPI to 'localhost' does not make sense\n"));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        nt_status = gensec_gssapi_start(gensec_security);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
+
+        if (cli_credentials_get_impersonate_principal(creds)) {
+                gensec_gssapi_state->gss_want_flags &= ~(GSS_C_DELEG_FLAG|GSS_C_DELEG_POLICY_FLAG);
+        }
+
+        gensec_gssapi_state->target_principal = gensec_get_target_principal(gensec_security);
+        if (gensec_gssapi_state->target_principal) {
+                name_type = GSS_C_NULL_OID;
+        } else {
+                gensec_gssapi_state->target_principal = talloc_asprintf(gensec_gssapi_state, "%s/%s@%s",
+                                            gensec_get_target_service(gensec_security), 
+                                            hostname, lpcfg_realm(gensec_security->settings->lp_ctx));
+
+                name_type = GSS_C_NT_USER_NAME;
+        }
+        name_token.value  = discard_const_p(uint8_t, gensec_gssapi_state->target_principal);
+        name_token.length = strlen(gensec_gssapi_state->target_principal);
+
+
+        maj_stat = gss_import_name (&min_stat,
+                                    &name_token,
+                                    name_type,
+                                    &gensec_gssapi_state->server_name);
+        if (maj_stat) {
+                DEBUG(2, ("GSS Import name of %s failed: %s\n",
+                          (char *)name_token.value,
+                          gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
         return NT_STATUS_OK;
 }
@@ -405 +373 @@
         }
         return nt_status;
-}
-
-
-/**
- * Check if the packet is one for this mechansim
- * 
- * @param gensec_security GENSEC state
- * @param in The request, as a DATA_BLOB
- * @return Error, INVALID_PARAMETER if it's not a packet for us
- *                or NT_STATUS_OK if the packet is ok. 
- */
-
-static NTSTATUS gensec_gssapi_magic(struct gensec_security *gensec_security, 
-                                    const DATA_BLOB *in) 
-{
-        if (gensec_gssapi_check_oid(in, GENSEC_OID_KERBEROS5)) {
-                return NT_STATUS_OK;
-        } else {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
 }
 
@@ -440 +388 @@
 
 static NTSTATUS gensec_gssapi_update(struct gensec_security *gensec_security, 
-                                   TALLOC_CTX *out_mem_ctx, 
-                                   const DATA_BLOB in, DATA_BLOB *out) 
+                                     TALLOC_CTX *out_mem_ctx,
+                                     struct tevent_context *ev,
+                                     const DATA_BLOB in, DATA_BLOB *out)
 {
         struct gensec_gssapi_state *gensec_gssapi_state
@@ -448 +397 @@
         OM_uint32 maj_stat, min_stat;
         OM_uint32 min_stat2;
-        gss_buffer_desc input_token, output_token;
+        gss_buffer_desc input_token = { 0, NULL };
+        gss_buffer_desc output_token = { 0, NULL };
+
         gss_OID gss_oid_p = NULL;
+        OM_uint32 time_req = 0;
+        OM_uint32 time_rec = 0;
+        struct timeval tv;
+
+        time_req = gensec_setting_int(gensec_security->settings,
+                                      "gensec_gssapi", "requested_life_time",
+                                      time_req);
+
         input_token.length = in.length;
         input_token.value = in.data;
@@ -459 +418 @@
                 case GENSEC_CLIENT:
                 {
+#ifdef SAMBA4_USES_HEIMDAL
                         struct gsskrb5_send_to_kdc send_to_kdc;
                         krb5_error_code ret;
+#endif
+
+                        nt_status = gensec_gssapi_client_creds(gensec_security, ev);
+                        if (!NT_STATUS_IS_OK(nt_status)) {
+                                return nt_status;
+                        }
+
+#ifdef SAMBA4_USES_HEIMDAL
                         send_to_kdc.func = smb_krb5_send_and_recv_func;
-                        send_to_kdc.ptr = gensec_security->event_ctx;
+                        send_to_kdc.ptr = ev;
 
                         min_stat = gsskrb5_set_send_to_kdc(&send_to_kdc);
                         if (min_stat) {
-                                DEBUG(1,("gensec_krb5_start: gsskrb5_set_send_to_kdc failed\n"));
+                                DEBUG(1,("gensec_gssapi_update: gsskrb5_set_send_to_kdc failed\n"));
                                 return NT_STATUS_INTERNAL_ERROR;
                         }
-
+#endif
                         maj_stat = gss_init_sec_context(&min_stat, 
                                                         gensec_gssapi_state->client_cred->creds,
@@ -475 +443 @@
                                                         gensec_gssapi_state->server_name, 
                                                         gensec_gssapi_state->gss_oid,
-                                                        gensec_gssapi_state->want_flags, 
-                                                        0, 
+                                                        gensec_gssapi_state->gss_want_flags, 
+                                                        time_req,
                                                         gensec_gssapi_state->input_chan_bindings,
                                                         &input_token, 
                                                         &gss_oid_p,
                                                         &output_token, 
-                                                        &gensec_gssapi_state->got_flags, /* ret flags */
-                                                        NULL);
+                                                        &gensec_gssapi_state->gss_got_flags, /* ret flags */
+                                                        &time_rec);
                         if (gss_oid_p) {
                                 gensec_gssapi_state->gss_oid = gss_oid_p;
                         }
 
+#ifdef SAMBA4_USES_HEIMDAL
                         send_to_kdc.func = smb_krb5_send_and_recv_func;
                         send_to_kdc.ptr = NULL;
@@ -492 +461 @@
                         ret = gsskrb5_set_send_to_kdc(&send_to_kdc);
                         if (ret) {
-                                DEBUG(1,("gensec_krb5_start: gsskrb5_set_send_to_kdc failed\n"));
+                                DEBUG(1,("gensec_gssapi_update: gsskrb5_set_send_to_kdc failed\n"));
                                 return NT_STATUS_INTERNAL_ERROR;
                         }
-
+#endif
                         break;
                 }
@@ -508 +477 @@
                                                           &gss_oid_p,
                                                           &output_token, 
-                                                          &gensec_gssapi_state->got_flags, 
-                                                          NULL, 
+                                                          &gensec_gssapi_state->gss_got_flags, 
+                                                          &time_rec,
                                                           &gensec_gssapi_state->delegated_cred_handle);
                         if (gss_oid_p) {
@@ -527 +496 @@
                         gss_release_buffer(&min_stat2, &output_token);
                         
-                        if (gensec_gssapi_state->got_flags & GSS_C_DELEG_FLAG) {
+                        if (gensec_gssapi_state->gss_got_flags & GSS_C_DELEG_FLAG &&
+                            gensec_gssapi_state->delegated_cred_handle != GSS_C_NO_CREDENTIAL) {
                                 DEBUG(5, ("gensec_gssapi: credentials were delegated\n"));
                         } else {
                                 DEBUG(5, ("gensec_gssapi: NO credentials were delegated\n"));
                         }
+
+                        tv = timeval_current_ofs(time_rec, 0);
+                        gensec_gssapi_state->expire_time = timeval_to_nttime(&tv);
 
                         /* We may have been invoked as SASL, so there
@@ -556 +529 @@
                         
                         return NT_STATUS_MORE_PROCESSING_REQUIRED;
-                } else if (gss_oid_equal(gensec_gssapi_state->gss_oid, gss_mech_krb5)) {
+                } else if (maj_stat == GSS_S_CONTEXT_EXPIRED) {
+                        gss_cred_id_t creds = NULL;
+                        gss_name_t name;
+                        gss_buffer_desc buffer;
+                        OM_uint32 lifetime = 0;
+                        gss_cred_usage_t usage;
+                        const char *role = NULL;
+                        DEBUG(0, ("GSS %s Update(krb5)(%d) Update failed, credentials expired during GSSAPI handshake!\n",
+                                  role,
+                                  gensec_gssapi_state->gss_exchange_count));
+
+                        
+                        switch (gensec_security->gensec_role) {
+                        case GENSEC_CLIENT:
+                                creds = gensec_gssapi_state->client_cred->creds;
+                                role = "client";
+                                break;
+                        case GENSEC_SERVER:
+                                creds = gensec_gssapi_state->server_cred->creds;
+                                role = "server";
+                                break;
+                        }
+
+                        maj_stat = gss_inquire_cred(&min_stat, 
+                                                    creds,
+                                                    &name, &lifetime, &usage, NULL);
+
+                        if (maj_stat == GSS_S_COMPLETE) {
+                                const char *usage_string = NULL;
+                                switch (usage) {
+                                case GSS_C_BOTH:
+                                        usage_string = "GSS_C_BOTH";
+                                        break;
+                                case GSS_C_ACCEPT:
+                                        usage_string = "GSS_C_ACCEPT";
+                                        break;
+                                case GSS_C_INITIATE:
+                                        usage_string = "GSS_C_INITIATE";
+                                        break;
+                                }
+                                maj_stat = gss_display_name(&min_stat, name, &buffer, NULL);
+                                if (maj_stat) {
+                                        buffer.value = NULL;
+                                        buffer.length = 0;
+                                }
+                                if (lifetime > 0) {
+                                        DEBUG(0, ("GSSAPI gss_inquire_cred indicates expiry of %*.*s in %u sec for %s\n", 
+                                                  (int)buffer.length, (int)buffer.length, (char *)buffer.value, 
+                                                  lifetime, usage_string));
+                                } else {
+                                        DEBUG(0, ("GSSAPI gss_inquire_cred indicates %*.*s has already expired for %s\n", 
+                                                  (int)buffer.length, (int)buffer.length, (char *)buffer.value, 
+                                                  usage_string));
+                                }
+                                gss_release_buffer(&min_stat, &buffer);
+                                gss_release_name(&min_stat, &name);
+                        } else if (maj_stat != GSS_S_COMPLETE) {
+                                DEBUG(0, ("inquiry of credential lifefime via GSSAPI gss_inquire_cred failed: %s\n",
+                                          gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                        }
+                        return NT_STATUS_INVALID_PARAMETER;
+                } else if (smb_gss_oid_equal(gensec_gssapi_state->gss_oid,
+                                             gss_mech_krb5)) {
                         switch (min_stat) {
                         case KRB5KRB_AP_ERR_TKT_NYV:
@@ -569 +604 @@
                                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
                         case KRB5_KDC_UNREACH:
-                                DEBUG(3, ("Cannot reach a KDC we require in order to obtain a ticetk to %s: %s\n",
+                                DEBUG(3, ("Cannot reach a KDC we require in order to obtain a ticket to %s: %s\n",
                                           gensec_gssapi_state->target_principal,
                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
@@ -586 +621 @@
                                           gensec_gssapi_state->gss_exchange_count,
                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                                return nt_status;
+                                return NT_STATUS_LOGON_FAILURE;
                         }
                 } else {
@@ -593 +628 @@
                                   gensec_gssapi_state->gss_exchange_count,
                                   gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                        return nt_status;
+                        return NT_STATUS_LOGON_FAILURE;
                 }
                 break;
@@ -942 +977 @@
         if (GSS_ERROR(maj_stat)) {
                 TALLOC_CTX *mem_ctx = talloc_new(NULL); 
-                DEBUG(1, ("gensec_gssapi_max_input_size: determinaing signature size with gss_wrap_size_limit failed: %s\n", 
+                DEBUG(1, ("gensec_gssapi_max_input_size: determining signature size with gss_wrap_size_limit failed: %s\n",
                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
                 talloc_free(mem_ctx);
@@ -966 +1001 @@
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        OM_uint32 maj_stat, min_stat;
-        gss_buffer_desc input_token, output_token;
-        int conf_state;
-        ssize_t sig_length;
-
-        input_token.length = length;
-        input_token.value = data;
-        
-        maj_stat = gss_wrap(&min_stat, 
-                            gensec_gssapi_state->gssapi_context,
-                            gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
-                            GSS_C_QOP_DEFAULT,
-                            &input_token,
-                            &conf_state,
-                            &output_token);
-        if (GSS_ERROR(maj_stat)) {
-                DEBUG(1, ("gensec_gssapi_seal_packet: GSS Wrap failed: %s\n", 
-                          gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        if (output_token.length < input_token.length) {
-                DEBUG(1, ("gensec_gssapi_seal_packet: GSS Wrap length [%ld] *less* than caller length [%ld]\n", 
-                          (long)output_token.length, (long)length));
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-        sig_length = output_token.length - input_token.length;
-
-        memcpy(data, ((uint8_t *)output_token.value) + sig_length, length);
-        *sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, sig_length);
-
-        dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
-        dump_data_pw("gensec_gssapi_seal_packet: clear\n", data, length);
-        dump_data_pw("gensec_gssapi_seal_packet: sealed\n", ((uint8_t *)output_token.value) + sig_length, output_token.length - sig_length);
-
-        gss_release_buffer(&min_stat, &output_token);
-
-        if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
-            && !conf_state) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
+        bool hdr_signing = false;
+        size_t sig_size = 0;
+        NTSTATUS status;
+
+        if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+                hdr_signing = true;
+        }
+
+        sig_size = gensec_gssapi_sig_size(gensec_security, length);
+
+        status = gssapi_seal_packet(gensec_gssapi_state->gssapi_context,
+                                    gensec_gssapi_state->gss_oid,
+                                    hdr_signing, sig_size,
+                                    data, length,
+                                    whole_pdu, pdu_length,
+                                    mem_ctx, sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("gssapi_seal_packet(hdr_signing=%u,sig_size=%zu,"
+                          "data=%zu,pdu=%zu) failed: %s\n",
+                          hdr_signing, sig_size, length, pdu_length,
+                          nt_errstr(status)));
+                return status;
+        }
+
         return NT_STATUS_OK;
 }
 
 static NTSTATUS gensec_gssapi_unseal_packet(struct gensec_security *gensec_security, 
-                                            TALLOC_CTX *mem_ctx, 
                                             uint8_t *data, size_t length, 
                                             const uint8_t *whole_pdu, size_t pdu_length,
@@ -1018 +1035 @@
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        OM_uint32 maj_stat, min_stat;
-        gss_buffer_desc input_token, output_token;
-        int conf_state;
-        gss_qop_t qop_state;
-        DATA_BLOB in;
-
-        dump_data_pw("gensec_gssapi_unseal_packet: sig\n", sig->data, sig->length);
-
-        in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
-
-        memcpy(in.data, sig->data, sig->length);
-        memcpy(in.data + sig->length, data, length);
-
-        input_token.length = in.length;
-        input_token.value = in.data;
-        
-        maj_stat = gss_unwrap(&min_stat, 
-                              gensec_gssapi_state->gssapi_context, 
-                              &input_token,
-                              &output_token, 
-                              &conf_state,
-                              &qop_state);
-        if (GSS_ERROR(maj_stat)) {
-                DEBUG(1, ("gensec_gssapi_unseal_packet: GSS UnWrap failed: %s\n", 
-                          gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        if (output_token.length != length) {
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        memcpy(data, output_token.value, length);
-
-        gss_release_buffer(&min_stat, &output_token);
-        
-        if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
-            && !conf_state) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
+        bool hdr_signing = false;
+        NTSTATUS status;
+
+        if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+                hdr_signing = true;
+        }
+
+        status = gssapi_unseal_packet(gensec_gssapi_state->gssapi_context,
+                                      gensec_gssapi_state->gss_oid,
+                                      hdr_signing,
+                                      data, length,
+                                      whole_pdu, pdu_length,
+                                      sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("gssapi_unseal_packet(hdr_signing=%u,sig_size=%zu,"
+                          "data=%zu,pdu=%zu) failed: %s\n",
+                          hdr_signing, sig->length, length, pdu_length,
+                          nt_errstr(status)));
+                return status;
+        }
+
         return NT_STATUS_OK;
 }
@@ -1069 +1067 @@
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        OM_uint32 maj_stat, min_stat;
-        gss_buffer_desc input_token, output_token;
+        bool hdr_signing = false;
+        NTSTATUS status;
 
         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
-                input_token.length = pdu_length;
-                input_token.value = discard_const_p(uint8_t *, whole_pdu);
-        } else {
-                input_token.length = length;
-                input_token.value = discard_const_p(uint8_t *, data);
-        }
-
-        maj_stat = gss_get_mic(&min_stat,
-                            gensec_gssapi_state->gssapi_context,
-                            GSS_C_QOP_DEFAULT,
-                            &input_token,
-                            &output_token);
-        if (GSS_ERROR(maj_stat)) {
-                DEBUG(1, ("GSS GetMic failed: %s\n",
-                          gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        *sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, output_token.length);
-
-        dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
-
-        gss_release_buffer(&min_stat, &output_token);
+                hdr_signing = true;
+        }
+
+        status = gssapi_sign_packet(gensec_gssapi_state->gssapi_context,
+                                    gensec_gssapi_state->gss_oid,
+                                    hdr_signing,
+                                    data, length,
+                                    whole_pdu, pdu_length,
+                                    mem_ctx, sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("gssapi_sign_packet(hdr_signing=%u,"
+                          "data=%zu,pdu=%zu) failed: %s\n",
+                          hdr_signing, length, pdu_length,
+                          nt_errstr(status)));
+                return status;
+        }
 
         return NT_STATUS_OK;
@@ -1101 +1092 @@
 
 static NTSTATUS gensec_gssapi_check_packet(struct gensec_security *gensec_security, 
-                                           TALLOC_CTX *mem_ctx, 
                                            const uint8_t *data, size_t length, 
                                            const uint8_t *whole_pdu, size_t pdu_length, 
@@ -1108 +1098 @@
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        OM_uint32 maj_stat, min_stat;
-        gss_buffer_desc input_token;
-        gss_buffer_desc input_message;
-        gss_qop_t qop_state;
-
-        dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
+        bool hdr_signing = false;
+        NTSTATUS status;
 
         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
-                input_message.length = pdu_length;
-                input_message.value = discard_const(whole_pdu);
-        } else {
-                input_message.length = length;
-                input_message.value = discard_const(data);
-        }
-
-        input_token.length = sig->length;
-        input_token.value = sig->data;
-
-        maj_stat = gss_verify_mic(&min_stat,
-                              gensec_gssapi_state->gssapi_context, 
-                              &input_message,
-                              &input_token,
-                              &qop_state);
-        if (GSS_ERROR(maj_stat)) {
-                DEBUG(1, ("GSS VerifyMic failed: %s\n",
-                          gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                return NT_STATUS_ACCESS_DENIED;
+                hdr_signing = true;
+        }
+
+        status = gssapi_check_packet(gensec_gssapi_state->gssapi_context,
+                                     gensec_gssapi_state->gss_oid,
+                                     hdr_signing,
+                                     data, length,
+                                     whole_pdu, pdu_length,
+                                     sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("gssapi_check_packet(hdr_signing=%u,sig_size=%zu,"
+                          "data=%zu,pdu=%zu) failed: %s\n",
+                          hdr_signing, sig->length, length, pdu_length,
+                          nt_errstr(status)));
+                return status;
         }
 
@@ -1151 +1133 @@
                     && gensec_gssapi_state->sasl_state == STAGE_DONE) {
                         return ((gensec_gssapi_state->sasl_protection & NEG_SIGN) 
-                                && (gensec_gssapi_state->got_flags & GSS_C_INTEG_FLAG));
-                }
-                return gensec_gssapi_state->got_flags & GSS_C_INTEG_FLAG;
+                                && (gensec_gssapi_state->gss_got_flags & GSS_C_INTEG_FLAG));
+                }
+                return gensec_gssapi_state->gss_got_flags & GSS_C_INTEG_FLAG;
         }
         if (feature & GENSEC_FEATURE_SEAL) {
@@ -1160 +1142 @@
                     && gensec_gssapi_state->sasl_state == STAGE_DONE) {
                         return ((gensec_gssapi_state->sasl_protection & NEG_SEAL) 
-                                 && (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG));
-                }
-                return gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG;
+                                 && (gensec_gssapi_state->gss_got_flags & GSS_C_CONF_FLAG));
+                }
+                return gensec_gssapi_state->gss_got_flags & GSS_C_CONF_FLAG;
         }
         if (feature & GENSEC_FEATURE_SESSION_KEY) {
                 /* Only for GSSAPI/Krb5 */
-                if (gss_oid_equal(gensec_gssapi_state->gss_oid, gss_mech_krb5)) {
+                if (smb_gss_oid_equal(gensec_gssapi_state->gss_oid,
+                                      gss_mech_krb5)) {
                         return true;
                 }
         }
         if (feature & GENSEC_FEATURE_DCE_STYLE) {
-                return gensec_gssapi_state->got_flags & GSS_C_DCE_STYLE;
+                return gensec_gssapi_state->gss_got_flags & GSS_C_DCE_STYLE;
         }
         if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
                 NTSTATUS status;
-
-                if (!(gensec_gssapi_state->got_flags & GSS_C_INTEG_FLAG)) {
+                uint32_t keytype;
+
+                if (!(gensec_gssapi_state->gss_got_flags & GSS_C_INTEG_FLAG)) {
                         return false;
                 }
@@ -1187 +1171 @@
                 }
 
-                status = gensec_gssapi_init_lucid(gensec_gssapi_state);
-                if (!NT_STATUS_IS_OK(status)) {
-                        return false;
-                }
-
-                if (gensec_gssapi_state->lucid->protocol == 1) {
-                        return true;
-                }
-
-                return false;
+                status = gssapi_get_session_key(gensec_gssapi_state,
+                                                gensec_gssapi_state->gssapi_context, NULL, &keytype);
+                /* 
+                 * We should do a proper sig on the mechListMic unless
+                 * we know we have to be backwards compatible with
+                 * earlier windows versions.  
+                 * 
+                 * Negotiating a non-krb5
+                 * mech for example should be regarded as having
+                 * NEW_SPNEGO
+                 */
+                if (NT_STATUS_IS_OK(status)) {
+                        switch (keytype) {
+                        case ENCTYPE_DES_CBC_CRC:
+                        case ENCTYPE_DES_CBC_MD5:
+                        case ENCTYPE_ARCFOUR_HMAC:
+                        case ENCTYPE_DES3_CBC_SHA1:
+                                return false;
+                        }
+                }
+                return true;
         }
         /* We can always do async (rather than strict request/reply) packets.  */
@@ -1202 +1197 @@
                 return true;
         }
+        if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+                if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
+                        return true;
+                }
+
+                if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
+                        return true;
+                }
+
+                return false;
+        }
         return false;
+}
+
+static NTTIME gensec_gssapi_expire_time(struct gensec_security *gensec_security)
+{
+        struct gensec_gssapi_state *gensec_gssapi_state =
+                talloc_get_type_abort(gensec_security->private_data,
+                struct gensec_gssapi_state);
+
+        return gensec_gssapi_state->expire_time;
 }
 
@@ -1212 +1227 @@
  */
 static NTSTATUS gensec_gssapi_session_key(struct gensec_security *gensec_security, 
+                                          TALLOC_CTX *mem_ctx,
                                           DATA_BLOB *session_key) 
 {
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        OM_uint32 maj_stat, min_stat;
-        krb5_keyblock *subkey;
-
-        if (gensec_gssapi_state->sasl_state != STAGE_DONE) {
-                return NT_STATUS_NO_USER_SESSION_KEY;
-        }
-
-        if (gensec_gssapi_state->session_key.data) {
-                *session_key = gensec_gssapi_state->session_key;
-                return NT_STATUS_OK;
-        }
-
-        maj_stat = gsskrb5_get_subkey(&min_stat,
-                                      gensec_gssapi_state->gssapi_context,
-                                      &subkey);
-        if (maj_stat != 0) {
-                DEBUG(1, ("NO session key for this mech\n"));
-                return NT_STATUS_NO_USER_SESSION_KEY;
-        }
-        
-        DEBUG(10, ("Got KRB5 session key of length %d%s\n",
-                   (int)KRB5_KEY_LENGTH(subkey),
-                   (gensec_gssapi_state->sasl_state == STAGE_DONE)?" (done)":""));
-        *session_key = data_blob_talloc(gensec_gssapi_state,
-                                        KRB5_KEY_DATA(subkey), KRB5_KEY_LENGTH(subkey));
-        krb5_free_keyblock(gensec_gssapi_state->smb_krb5_context->krb5_context, subkey);
-        gensec_gssapi_state->session_key = *session_key;
-        dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
-
-        return NT_STATUS_OK;
+        return gssapi_get_session_key(mem_ctx, gensec_gssapi_state->gssapi_context, session_key, NULL);
 }
 
@@ -1252 +1239 @@
  * database lookup */
 static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_security,
+                                           TALLOC_CTX *mem_ctx,
                                            struct auth_session_info **_session_info) 
 {
         NTSTATUS nt_status;
-        TALLOC_CTX *mem_ctx;
+        TALLOC_CTX *tmp_ctx;
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        struct auth_user_info_dc *user_info_dc = NULL;
         struct auth_session_info *session_info = NULL;
         OM_uint32 maj_stat, min_stat;
-        gss_buffer_desc pac;
-        DATA_BLOB pac_blob;
-        struct PAC_SIGNATURE_DATA *pac_srv_sig = NULL;
-        struct PAC_SIGNATURE_DATA *pac_kdc_sig = NULL;
+        DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
+
+        gss_buffer_desc name_token;
+        char *principal_string;
         
-        if ((gensec_gssapi_state->gss_oid->length != gss_mech_krb5->length)
-            || (memcmp(gensec_gssapi_state->gss_oid->elements, gss_mech_krb5->elements, 
-                       gensec_gssapi_state->gss_oid->length) != 0)) {
-                DEBUG(1, ("NO session info available for this mech\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-                
-        mem_ctx = talloc_named(gensec_gssapi_state, 0, "gensec_gssapi_session_info context"); 
-        NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
-
-        maj_stat = gsskrb5_extract_authz_data_from_sec_context(&min_stat, 
-                                                               gensec_gssapi_state->gssapi_context, 
-                                                               KRB5_AUTHDATA_WIN2K_PAC,
-                                                               &pac);
-        
-        
-        if (maj_stat == 0) {
-                pac_blob = data_blob_talloc(mem_ctx, pac.value, pac.length);
-                gss_release_buffer(&min_stat, &pac);
-
-        } else {
-                pac_blob = data_blob(NULL, 0);
-        }
+        tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gssapi_session_info context");
+        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
+
+        maj_stat = gss_display_name (&min_stat,
+                                     gensec_gssapi_state->client_name,
+                                     &name_token,
+                                     NULL);
+        if (GSS_ERROR(maj_stat)) {
+                DEBUG(1, ("GSS display_name failed: %s\n",
+                          gssapi_error_string(tmp_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                talloc_free(tmp_ctx);
+                return NT_STATUS_FOOBAR;
+        }
+
+        principal_string = talloc_strndup(tmp_ctx,
+                                          (const char *)name_token.value,
+                                          name_token.length);
+
+        gss_release_buffer(&min_stat, &name_token);
+
+        if (!principal_string) {
+                talloc_free(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        nt_status = gssapi_obtain_pac_blob(tmp_ctx,  gensec_gssapi_state->gssapi_context,
+                                           gensec_gssapi_state->client_name,
+                                           &pac_blob);
         
         /* IF we have the PAC - otherwise we need to get this
@@ -1294 +1286 @@
          * kind... 
          */
-        if (pac_blob.length) {
-                pac_srv_sig = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
-                if (!pac_srv_sig) {
-                        talloc_free(mem_ctx);
-                        return NT_STATUS_NO_MEMORY;
-                }
-                pac_kdc_sig = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
-                if (!pac_kdc_sig) {
-                        talloc_free(mem_ctx);
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                nt_status = kerberos_pac_blob_to_user_info_dc(mem_ctx,
-                                                              pac_blob,
-                                                              gensec_gssapi_state->smb_krb5_context->krb5_context,
-                                                              &user_info_dc,
-                                                              pac_srv_sig,
-                                                              pac_kdc_sig);
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        talloc_free(mem_ctx);
-                        return nt_status;
-                }
-        } else {
-                gss_buffer_desc name_token;
-                char *principal_string;
-
-                maj_stat = gss_display_name (&min_stat,
-                                             gensec_gssapi_state->client_name,
-                                             &name_token,
-                                             NULL);
-                if (GSS_ERROR(maj_stat)) {
-                        DEBUG(1, ("GSS display_name failed: %s\n", 
-                                  gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                        talloc_free(mem_ctx);
-                        return NT_STATUS_FOOBAR;
-                }
-                
-                principal_string = talloc_strndup(mem_ctx, 
-                                                  (const char *)name_token.value, 
-                                                  name_token.length);
-                
-                gss_release_buffer(&min_stat, &name_token);
-                
-                if (!principal_string) {
-                        talloc_free(mem_ctx);
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                if (gensec_security->auth_context && 
-                    !gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
-                        DEBUG(1, ("Unable to find PAC, resorting to local user lookup: %s\n",
-                                  gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                        nt_status = gensec_security->auth_context->get_user_info_dc_principal(mem_ctx,
-                                                                                             gensec_security->auth_context, 
-                                                                                             principal_string,
-                                                                                             NULL,
-                                                                                             &user_info_dc);
-                        
-                        if (!NT_STATUS_IS_OK(nt_status)) {
-                                talloc_free(mem_ctx);
-                                return nt_status;
-                        }
-                } else {
-                        DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access: %s\n",
-                                  principal_string,
-                                  gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        /* references the user_info_dc into the session_info */
-        nt_status = gensec_generate_session_info(mem_ctx, gensec_security,
-                                                 user_info_dc, &session_info);
+        if (NT_STATUS_IS_OK(nt_status)) {
+                pac_blob_ptr = &pac_blob;
+        }
+        nt_status = gensec_generate_session_info_pac(tmp_ctx,
+                                                     gensec_security,
+                                                     gensec_gssapi_state->smb_krb5_context,
+                                                     pac_blob_ptr, principal_string,
+                                                     gensec_get_remote_address(gensec_security),
+                                                     &session_info);
         if (!NT_STATUS_IS_OK(nt_status)) {
-                talloc_free(mem_ctx);
+                talloc_free(tmp_ctx);
                 return nt_status;
         }
 
-        nt_status = gensec_gssapi_session_key(gensec_security, &session_info->session_key);
+        nt_status = gensec_gssapi_session_key(gensec_security, session_info, &session_info->session_key);
         if (!NT_STATUS_IS_OK(nt_status)) {
-                talloc_free(mem_ctx);
+                talloc_free(tmp_ctx);
                 return nt_status;
         }
 
-        /* Allow torture tests to check the PAC signatures */
-        if (session_info->torture) {
-                session_info->torture->pac_srv_sig = talloc_steal(session_info->torture, pac_srv_sig);
-                session_info->torture->pac_kdc_sig = talloc_steal(session_info->torture, pac_kdc_sig);
-        }
-
-        if (!(gensec_gssapi_state->got_flags & GSS_C_DELEG_FLAG)) {
-                DEBUG(10, ("gensec_gssapi: NO delegated credentials supplied by client\n"));
-        } else {
+        if (gensec_gssapi_state->gss_got_flags & GSS_C_DELEG_FLAG &&
+            gensec_gssapi_state->delegated_cred_handle != GSS_C_NO_CREDENTIAL) {
                 krb5_error_code ret;
                 const char *error_string;
@@ -1393 +1314 @@
                 session_info->credentials = cli_credentials_init(session_info);
                 if (!session_info->credentials) {
-                        talloc_free(mem_ctx);
+                        talloc_free(tmp_ctx);
                         return NT_STATUS_NO_MEMORY;
                 }
@@ -1406 +1327 @@
                                                            CRED_SPECIFIED, &error_string);
                 if (ret) {
-                        talloc_free(mem_ctx);
+                        talloc_free(tmp_ctx);
                         DEBUG(2,("Failed to get gss creds: %s\n", error_string));
                         return NT_STATUS_NO_MEMORY;
@@ -1416 +1337 @@
                 /* It has been taken from this place... */
                 gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
-        }
-        talloc_steal(gensec_gssapi_state, session_info);
-        talloc_free(mem_ctx);
-        *_session_info = session_info;
+        } else {
+                DEBUG(10, ("gensec_gssapi: NO delegated credentials supplied by client\n"));
+        }
+
+        *_session_info = talloc_steal(mem_ctx, session_info);
+        talloc_free(tmp_ctx);
 
         return NT_STATUS_OK;
@@ -1428 +1351 @@
         struct gensec_gssapi_state *gensec_gssapi_state
                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
-        NTSTATUS status;
-
-        if (gensec_gssapi_state->sig_size) {
+        size_t sig_size;
+
+        if (gensec_gssapi_state->sig_size > 0) {
                 return gensec_gssapi_state->sig_size;
         }
 
-        if (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG) {
-                gensec_gssapi_state->sig_size = 45;
-        } else {
-                gensec_gssapi_state->sig_size = 37;
-        }
-
-        status = gensec_gssapi_init_lucid(gensec_gssapi_state);
-        if (!NT_STATUS_IS_OK(status)) {
-                return gensec_gssapi_state->sig_size;
-        }
-
-        if (gensec_gssapi_state->lucid->protocol == 1) {
-                if (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG) {
-                        /*
-                         * TODO: windows uses 76 here, but we don't know
-                         *       gss_wrap works with aes keys yet
-                         */
-                        gensec_gssapi_state->sig_size = 76;
-                } else {
-                        gensec_gssapi_state->sig_size = 28;
-                }
-        } else if (gensec_gssapi_state->lucid->protocol == 0) {
-                switch (gensec_gssapi_state->lucid->rfc1964_kd.ctx_key.type) {
-                case KEYTYPE_DES:
-                case KEYTYPE_ARCFOUR:
-                case KEYTYPE_ARCFOUR_56:
-                        if (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG) {
-                                gensec_gssapi_state->sig_size = 45;
-                        } else {
-                                gensec_gssapi_state->sig_size = 37;
-                        }
-                        break;
-                case KEYTYPE_DES3:
-                        if (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG) {
-                                gensec_gssapi_state->sig_size = 57;
-                        } else {
-                                gensec_gssapi_state->sig_size = 49;
-                        }
-                        break;
-                }
-        }
-
+        sig_size = gssapi_get_sig_size(gensec_gssapi_state->gssapi_context,
+                                       gensec_gssapi_state->gss_oid,
+                                       gensec_gssapi_state->gss_want_flags,
+                                       data_size);
+
+        gensec_gssapi_state->sig_size = sig_size;
         return gensec_gssapi_state->sig_size;
 }
@@ -1498 +1385 @@
         .client_start   = gensec_gssapi_client_start,
         .server_start   = gensec_gssapi_server_start,
-        .magic          = gensec_gssapi_magic,
+        .magic          = gensec_magic_check_krb5_oid,
         .update         = gensec_gssapi_update,
         .session_key    = gensec_gssapi_session_key,
@@ -1506 +1393 @@
         .seal_packet    = gensec_gssapi_seal_packet,
         .unseal_packet  = gensec_gssapi_unseal_packet,
+        .max_input_size   = gensec_gssapi_max_input_size,
+        .max_wrapped_size = gensec_gssapi_max_wrapped_size,
         .wrap           = gensec_gssapi_wrap,
         .unwrap         = gensec_gssapi_unwrap,
         .have_feature   = gensec_gssapi_have_feature,
+        .expire_time    = gensec_gssapi_expire_time,
         .enabled        = false,
         .kerberos       = true,
@@ -1521 +1411 @@
         .client_start   = gensec_gssapi_client_start,
         .server_start   = gensec_gssapi_server_start,
-        .magic          = gensec_gssapi_magic,
+        .magic          = gensec_magic_check_krb5_oid,
         .update         = gensec_gssapi_update,
         .session_key    = gensec_gssapi_session_key,
@@ -1530 +1420 @@
         .seal_packet    = gensec_gssapi_seal_packet,
         .unseal_packet  = gensec_gssapi_unseal_packet,
+        .max_input_size   = gensec_gssapi_max_input_size,
+        .max_wrapped_size = gensec_gssapi_max_wrapped_size,
         .wrap           = gensec_gssapi_wrap,
         .unwrap         = gensec_gssapi_unwrap,
         .have_feature   = gensec_gssapi_have_feature,
+        .expire_time    = gensec_gssapi_expire_time,
         .enabled        = true,
         .kerberos       = true,
@@ -1552 +1445 @@
         .unwrap           = gensec_gssapi_unwrap,
         .have_feature     = gensec_gssapi_have_feature,
+        .expire_time      = gensec_gssapi_expire_time,
         .enabled          = true,
         .kerberos         = true,

vendor/current/source4/auth/gensec/gensec_gssapi.h

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
    Kerberos backend for GENSEC
-   
+
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
    Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
@@ -11 +11 @@
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -17 +17 @@
    GNU General Public License for more details.
 
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -24 +24 @@
 /* This structure described here, so the RPC-PAC test can get at the PAC provided */
 
-enum gensec_gssapi_sasl_state 
+enum gensec_gssapi_sasl_state
 {
         STAGE_GSS_NEG,
@@ -38 +38 @@
 struct gensec_gssapi_state {
         gss_ctx_id_t gssapi_context;
-        struct gss_channel_bindings_struct *input_chan_bindings;
         gss_name_t server_name;
         gss_name_t client_name;
-        OM_uint32 want_flags, got_flags;
+        OM_uint32 gss_want_flags, gss_got_flags;
+
+        gss_cred_id_t delegated_cred_handle;
+
+        NTTIME expire_time;
+
+        /* gensec_gssapi only */
         gss_OID gss_oid;
 
-        DATA_BLOB session_key;
-        DATA_BLOB pac;
-
+        struct gss_channel_bindings_struct *input_chan_bindings;
         struct smb_krb5_context *smb_krb5_context;
         struct gssapi_creds_container *client_cred;
         struct gssapi_creds_container *server_cred;
-        gss_krb5_lucid_context_v1_t *lucid;
-
-        gss_cred_id_t delegated_cred_handle;
 
         bool sasl; /* We have two different mechs in this file: One
@@ -68 +68 @@
         const char *target_principal;
 };
-

vendor/current/source4/auth/gensec/gensec_krb5.c

@@ -28 +28 @@
 #include "auth/kerberos/kerberos.h"
 #include "auth/auth.h"
-#include "lib/socket/socket.h"
 #include "lib/tsocket/tsocket.h"
-#include "librpc/rpc/dcerpc.h"
+#include "librpc/gen_ndr/dcerpc.h"
 #include "auth/credentials/credentials.h"
 #include "auth/credentials/credentials_krb5.h"
 #include "auth/kerberos/kerberos_credentials.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h"
 #include "auth/gensec/gensec_proto.h"
+#include "auth/gensec/gensec_toplevel_proto.h"
 #include "param/param.h"
 #include "auth/auth_sam_reply.h"
 #include "lib/util/util_net.h"
+#include "../lib/util/asn1.h"
+#include "auth/kerberos/pac_utils.h"
+#include "gensec_krb5_util.h"
+
+_PUBLIC_ NTSTATUS gensec_krb5_init(void);
 
 enum GENSEC_KRB5_STATE {
@@ -48 +54 @@
 
 struct gensec_krb5_state {
-        DATA_BLOB session_key;
-        DATA_BLOB pac;
         enum GENSEC_KRB5_STATE state_position;
         struct smb_krb5_context *smb_krb5_context;
@@ -113 +117 @@
         ZERO_STRUCT(gensec_krb5_state->enc_ticket);
         gensec_krb5_state->keyblock = NULL;
-        gensec_krb5_state->session_key = data_blob(NULL, 0);
-        gensec_krb5_state->pac = data_blob(NULL, 0);
         gensec_krb5_state->gssapi = gssapi;
 
@@ -234 +236 @@
 static NTSTATUS gensec_krb5_common_client_start(struct gensec_security *gensec_security, bool gssapi)
 {
+        const char *hostname;
         struct gensec_krb5_state *gensec_krb5_state;
-        krb5_error_code ret;
         NTSTATUS nt_status;
-        struct ccache_container *ccache_container;
-        const char *hostname;
-        const char *error_string;
-        const char *principal;
-        krb5_data in_data;
-        struct tevent_context *previous_ev;
-
         hostname = gensec_get_target_hostname(gensec_security);
         if (!hostname) {
-                DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
+                DEBUG(3, ("No hostname for target computer passed in, cannot use kerberos for this connection\n"));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -268 +263 @@
 
         if (gensec_krb5_state->gssapi) {
-                /* The Fake GSSAPI modal emulates Samba3, which does not do mutual authentication */
+                /* The Fake GSSAPI model emulates Samba3, which does not do mutual authentication */
                 if (gensec_setting_bool(gensec_security->settings, "gensec_fake_gssapi_krb5", "mutual", false)) {
                         gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
@@ -278 +273 @@
                 }
         }
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_krb5_common_client_creds(struct gensec_security *gensec_security,
+                                                struct tevent_context *ev,
+                                                bool gssapi)
+{
+        struct gensec_krb5_state *gensec_krb5_state;
+        krb5_error_code ret;
+        struct ccache_container *ccache_container;
+        const char *error_string;
+        const char *principal;
+        const char *hostname;
+        krb5_data in_data = { .length = 0 };
+        krb5_data *in_data_p = NULL;
+        struct tevent_context *previous_ev;
+
+        if (lpcfg_parm_bool(gensec_security->settings->lp_ctx,
+                            NULL, "gensec_krb5", "send_authenticator_checksum", true)) {
+                in_data_p = &in_data;
+        }
+        
+        gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 
         principal = gensec_get_target_principal(gensec_security);
+        hostname = gensec_get_target_hostname(gensec_security);
 
         ret = cli_credentials_get_ccache(gensec_get_credentials(gensec_security), 
-                                         gensec_security->event_ctx, 
+                                         ev,
                                          gensec_security->settings->lp_ctx, &ccache_container, &error_string);
         switch (ret) {
@@ -301 +320 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        in_data.length = 0;
         
         /* Do this every time, in case we have weird recursive issues here */
-        ret = smb_krb5_context_set_event_ctx(gensec_krb5_state->smb_krb5_context, gensec_security->event_ctx, &previous_ev);
+        ret = smb_krb5_context_set_event_ctx(gensec_krb5_state->smb_krb5_context, ev, &previous_ev);
         if (ret != 0) {
                 DEBUG(1, ("gensec_krb5_start: Setting event context failed\n"));
@@ -318 +336 @@
                                                 gensec_krb5_state->ap_req_options, 
                                                 target_principal,
-                                                &in_data, ccache_container->ccache, 
+                                                in_data_p, ccache_container->ccache, 
                                                 &gensec_krb5_state->enc_ticket);
                         krb5_free_principal(gensec_krb5_state->smb_krb5_context->krb5_context, 
@@ -329 +347 @@
                                   gensec_get_target_service(gensec_security),
                                   hostname,
-                                  &in_data, ccache_container->ccache, 
+                                  in_data_p, ccache_container->ccache, 
                                   &gensec_krb5_state->enc_ticket);
         }
 
-        smb_krb5_context_remove_event_ctx(gensec_krb5_state->smb_krb5_context, previous_ev, gensec_security->event_ctx);
+        smb_krb5_context_remove_event_ctx(gensec_krb5_state->smb_krb5_context, previous_ev, ev);
 
         switch (ret) {
@@ -383 +401 @@
 }
 
-/**
- * Check if the packet is one for this mechansim
- * 
- * @param gensec_security GENSEC state
- * @param in The request, as a DATA_BLOB
- * @return Error, INVALID_PARAMETER if it's not a packet for us
- *                or NT_STATUS_OK if the packet is ok. 
- */
-
-static NTSTATUS gensec_fake_gssapi_krb5_magic(struct gensec_security *gensec_security, 
-                                  const DATA_BLOB *in) 
-{
-        if (gensec_gssapi_check_oid(in, GENSEC_OID_KERBEROS5)) {
-                return NT_STATUS_OK;
+
+/*
+  generate a krb5 GSS-API wrapper packet given a ticket
+*/
+static DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *ticket, const uint8_t tok_id[2])
+{
+        struct asn1_data *data;
+        DATA_BLOB ret = data_blob_null;
+
+        data = asn1_init(mem_ctx);
+        if (!data || !ticket->data) {
+                return ret;
+        }
+
+        if (!asn1_push_tag(data, ASN1_APPLICATION(0))) goto err;
+        if (!asn1_write_OID(data, GENSEC_OID_KERBEROS5)) goto err;
+
+        if (!asn1_write(data, tok_id, 2)) goto err;
+        if (!asn1_write(data, ticket->data, ticket->length)) goto err;
+        if (!asn1_pop_tag(data)) goto err;
+
+
+        if (!asn1_extract_blob(data, mem_ctx, &ret)) {
+                goto err;
+        }
+        asn1_free(data);
+
+        return ret;
+
+  err:
+
+        DEBUG(1, ("Failed to build krb5 wrapper at offset %d\n",
+                  (int)asn1_current_ofs(data)));
+        asn1_free(data);
+        return ret;
+}
+
+/*
+  parse a krb5 GSS-API wrapper packet giving a ticket
+*/
+static bool gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, DATA_BLOB *ticket, uint8_t tok_id[2])
+{
+        bool ret = false;
+        struct asn1_data *data = asn1_init(mem_ctx);
+        int data_remaining;
+
+        if (!data) {
+                return false;
+        }
+
+        if (!asn1_load(data, *blob)) goto err;
+        if (!asn1_start_tag(data, ASN1_APPLICATION(0))) goto err;
+        if (!asn1_check_OID(data, GENSEC_OID_KERBEROS5)) goto err;
+
+        data_remaining = asn1_tag_remaining(data);
+
+        if (data_remaining < 3) {
+                asn1_set_error(data);
         } else {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-}
-
+                if (!asn1_read(data, tok_id, 2)) goto err;
+                data_remaining -= 2;
+                *ticket = data_blob_talloc(mem_ctx, NULL, data_remaining);
+                if (!asn1_read(data, ticket->data, ticket->length)) goto err;
+        }
+
+        if (!asn1_end_tag(data)) goto err;
+
+        ret = !asn1_has_error(data);
+
+  err:
+
+        asn1_free(data);
+
+        return ret;
+}
 
 /**
@@ -416 +490 @@
 static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security, 
                                    TALLOC_CTX *out_mem_ctx, 
+                                   struct tevent_context *ev,
                                    const DATA_BLOB in, DATA_BLOB *out) 
 {
@@ -427 +502 @@
                 DATA_BLOB unwrapped_out;
                 
+                nt_status = gensec_krb5_common_client_creds(gensec_security, ev, gensec_krb5_state->gssapi);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+
                 if (gensec_krb5_state->gssapi) {
                         unwrapped_out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
@@ -506 +586 @@
                 }
                 
-                /* This ensures we lookup the correct entry in that keytab */
+                /* This ensures we lookup the correct entry in that
+                 * keytab.  A NULL principal is acceptable, and means
+                 * that the krb5 libs should search the keytab at
+                 * accept time for any matching key */
                 ret = principal_from_credentials(out_mem_ctx, gensec_get_credentials(gensec_security), 
                                                  gensec_krb5_state->smb_krb5_context, 
@@ -514 +597 @@
                         DEBUG(2,("Failed to make credentials from principal: %s\n", error_string));
                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+                }
+
+                if (keytab->password_based || obtained < CRED_SPECIFIED) {
+                        /* 
+                         * Use match-by-key in this case (matches
+                         * cli_credentials_get_server_gss_creds()
+                         * behaviour).  No need to free the memory,
+                         * this is handled with a talloc destructor.
+                         */
+                        server_in_keytab = NULL;
                 }
 
@@ -557 +650 @@
 
 static NTSTATUS gensec_krb5_session_key(struct gensec_security *gensec_security, 
+                                        TALLOC_CTX *mem_ctx,
                                         DATA_BLOB *session_key) 
 {
@@ -567 +661 @@
         if (gensec_krb5_state->state_position != GENSEC_KRB5_DONE) {
                 return NT_STATUS_NO_USER_SESSION_KEY;
-        }
-
-        if (gensec_krb5_state->session_key.data) {
-                *session_key = gensec_krb5_state->session_key;
-                return NT_STATUS_OK;
         }
 
@@ -585 +674 @@
                 DEBUG(10, ("Got KRB5 session key of length %d\n",  
                            (int)KRB5_KEY_LENGTH(skey)));
-                gensec_krb5_state->session_key = data_blob_talloc(gensec_krb5_state, 
-                                                KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
-                *session_key = gensec_krb5_state->session_key;
+                *session_key = data_blob_talloc(mem_ctx,
+                                               KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 
@@ -599 +687 @@
 
 static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security,
+                                         TALLOC_CTX *mem_ctx,
                                          struct auth_session_info **_session_info) 
 {
@@ -604 +693 @@
         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
-        struct auth_user_info_dc *user_info_dc = NULL;
         struct auth_session_info *session_info = NULL;
-        struct PAC_LOGON_INFO *logon_info;
 
         krb5_principal client_principal;
         char *principal_string;
         
-        DATA_BLOB pac;
+        DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
         krb5_data pac_data;
 
         krb5_error_code ret;
 
-        TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
-        if (!mem_ctx) {
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
                 return NT_STATUS_NO_MEMORY;
         }
@@ -625 +712 @@
                 DEBUG(5, ("krb5_ticket_get_client failed to get cleint principal: %s\n", 
                           smb_get_krb5_error_message(context, 
-                                                     ret, mem_ctx)));
-                talloc_free(mem_ctx);
+                                                     ret, tmp_ctx)));
+                talloc_free(tmp_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
@@ -635 +722 @@
                 DEBUG(1, ("Unable to parse client principal: %s\n",
                           smb_get_krb5_error_message(context, 
-                                                     ret, mem_ctx)));
+                                                     ret, tmp_ctx)));
                 krb5_free_principal(context, client_principal);
-                talloc_free(mem_ctx);
+                talloc_free(tmp_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
@@ -645 +732 @@
                                                       &pac_data);
         
-        if (ret && gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
-                DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access: %s \n",
-                          principal_string,
-                          smb_get_krb5_error_message(context, 
-                                                     ret, mem_ctx)));
-                free(principal_string);
-                krb5_free_principal(context, client_principal);
-                talloc_free(mem_ctx);
-                return NT_STATUS_ACCESS_DENIED;
-        } else if (ret) {
+        if (ret) {
                 /* NO pac */
                 DEBUG(5, ("krb5_ticket_get_authorization_data_type failed to find PAC: %s\n", 
                           smb_get_krb5_error_message(context, 
-                                                     ret, mem_ctx)));
-                if (gensec_security->auth_context && 
-                    !gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
-                        DEBUG(1, ("Unable to find PAC for %s, resorting to local user lookup: %s",
-                                  principal_string, smb_get_krb5_error_message(context, 
-                                                     ret, mem_ctx)));
-                        nt_status = gensec_security->auth_context->get_user_info_dc_principal(mem_ctx,
-                                                                                             gensec_security->auth_context, 
-                                                                                             principal_string,
-                                                                                             NULL, &user_info_dc);
-                        if (!NT_STATUS_IS_OK(nt_status)) {
-                                free(principal_string);
-                                krb5_free_principal(context, client_principal);
-                                talloc_free(mem_ctx);
-                                return nt_status;
-                        }
-                } else {
-                        DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access\n",
-                                  principal_string));
+                                                     ret, tmp_ctx)));
+        } else {
+                /* Found pac */
+                pac_blob = data_blob_talloc(tmp_ctx, pac_data.data, pac_data.length);
+                kerberos_free_data_contents(context, &pac_data);
+                if (!pac_blob.data) {
                         free(principal_string);
                         krb5_free_principal(context, client_principal);
-                        talloc_free(mem_ctx);
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        } else {
-                /* Found pac */
-                union netr_Validation validation;
-
-                pac = data_blob_talloc(mem_ctx, pac_data.data, pac_data.length);
-                if (!pac.data) {
-                        free(principal_string);
-                        krb5_free_principal(context, client_principal);
-                        talloc_free(mem_ctx);
+                        talloc_free(tmp_ctx);
                         return NT_STATUS_NO_MEMORY;
                 }
 
                 /* decode and verify the pac */
-                nt_status = kerberos_pac_logon_info(gensec_krb5_state, 
-                                                    &logon_info, pac,
-                                                    gensec_krb5_state->smb_krb5_context->krb5_context,
-                                                    NULL, gensec_krb5_state->keyblock,
-                                                    client_principal,
-                                                    gensec_krb5_state->ticket->ticket.authtime, NULL);
+                nt_status = kerberos_decode_pac(gensec_krb5_state,
+                                                pac_blob,
+                                                gensec_krb5_state->smb_krb5_context->krb5_context,
+                                                NULL, gensec_krb5_state->keyblock,
+                                                client_principal,
+                                                gensec_krb5_state->ticket->ticket.authtime, NULL);
 
                 if (!NT_STATUS_IS_OK(nt_status)) {
                         free(principal_string);
                         krb5_free_principal(context, client_principal);
-                        talloc_free(mem_ctx);
+                        talloc_free(tmp_ctx);
                         return nt_status;
                 }
 
-                validation.sam3 = &logon_info->info3;
-                nt_status = make_user_info_dc_netlogon_validation(mem_ctx,
-                                                                 NULL,
-                                                                 3, &validation,
-                                                                 &user_info_dc);
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        free(principal_string);
-                        krb5_free_principal(context, client_principal);
-                        talloc_free(mem_ctx);
-                        return nt_status;
-                }
-        }
+                pac_blob_ptr = &pac_blob;
+        }
+
+        nt_status = gensec_generate_session_info_pac(tmp_ctx,
+                                                     gensec_security,
+                                                     gensec_krb5_state->smb_krb5_context,
+                                                     pac_blob_ptr, principal_string,
+                                                     gensec_get_remote_address(gensec_security),
+                                                     &session_info);
 
         free(principal_string);
         krb5_free_principal(context, client_principal);
 
-        /* references the user_info_dc into the session_info */
-        nt_status = gensec_generate_session_info(mem_ctx, gensec_security, user_info_dc, &session_info);
-
         if (!NT_STATUS_IS_OK(nt_status)) {
-                talloc_free(mem_ctx);
+                talloc_free(tmp_ctx);
                 return nt_status;
         }
 
-        nt_status = gensec_krb5_session_key(gensec_security, &session_info->session_key);
+        nt_status = gensec_krb5_session_key(gensec_security, session_info, &session_info->session_key);
 
         if (!NT_STATUS_IS_OK(nt_status)) {
-                talloc_free(mem_ctx);
+                talloc_free(tmp_ctx);
                 return nt_status;
         }
 
-        *_session_info = session_info;
-
-        talloc_steal(gensec_krb5_state, session_info);
-        talloc_free(mem_ctx);
+        *_session_info = talloc_steal(mem_ctx, session_info);
+
+        talloc_free(tmp_ctx);
         return NT_STATUS_OK;
 }
@@ -836 +883 @@
         .server_start   = gensec_fake_gssapi_krb5_server_start,
         .update         = gensec_krb5_update,
-        .magic          = gensec_fake_gssapi_krb5_magic,
+        .magic          = gensec_magic_check_krb5_oid,
         .session_key    = gensec_krb5_session_key,
         .session_info   = gensec_krb5_session_info,
@@ -874 +921 @@
         if (!NT_STATUS_IS_OK(ret)) {
                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
-                        gensec_krb5_security_ops.name));
+                        gensec_fake_gssapi_krb5_security_ops.name));
                 return ret;
         }

vendor/current/source4/auth/gensec/gensec_tstream.c

@@ -28 +28 @@
 #include "lib/tsocket/tsocket.h"
 #include "lib/tsocket/tsocket_internal.h"
-
+#include "auth/gensec/gensec_toplevel_proto.h"
 
 static const struct tstream_context_ops tstream_gensec_ops;
@@ -248 +248 @@
                 vector[0].iov_len = sizeof(state->wrapped.hdr);
         } else if (!state->wrapped.asked_for_blob) {
+                uint32_t msg_len;
+
                 state->wrapped.asked_for_blob = true;
-                uint32_t msg_len;
 
                 msg_len = RIVAL(state->wrapped.hdr, 0);
 
-                if (msg_len > 0x00FFFFFF) {
+                /*
+                 * I got a Windows 2012R2 server responding with
+                 * a message of 0x1b28a33.
+                 */
+                if (msg_len > 0x0FFFFFFF) {
                         errno = EMSGSIZE;
                         return -1;

vendor/current/source4/auth/gensec/pygensec.c

@@ -21 +21 @@
 #include "param/pyparam.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h" /* TODO: remove this */
 #include "auth/credentials/pycredentials.h"
 #include "libcli/util/pyerrors.h"
-#include "scripting/python/modules.h"
-#include "lib/talloc/pytalloc.h"
+#include "python/modules.h"
+#include <pytalloc.h>
 #include <tevent.h>
 #include "librpc/rpc/pyrpc_util.h"
@@ -37 +38 @@
                 return NULL;
 
-        security = py_talloc_get_type(self, struct gensec_security);
+        security = pytalloc_get_type(self, struct gensec_security);
 
         name = gensec_get_name_by_authtype(security, type);
@@ -79 +80 @@
 {
         NTSTATUS status;
-        py_talloc_Object *self;
+        PyObject *self;
         struct gensec_settings *settings;
         const char *kwnames[] = { "settings", NULL };
-        PyObject *py_settings;
-        struct tevent_context *ev;
+        PyObject *py_settings = Py_None;
         struct gensec_security *gensec;
+        TALLOC_CTX *frame;
 
         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|O", discard_const_p(char *, kwnames), &py_settings))
                 return NULL;
 
-        self = (py_talloc_Object*)type->tp_alloc(type, 0);
-        if (self == NULL) {
-                PyErr_NoMemory();
-                return NULL;
-        }
-        self->talloc_ctx = talloc_new(NULL);
-        if (self->talloc_ctx == NULL) {
-                PyErr_NoMemory();
-                return NULL;
-        }
+        frame = talloc_stackframe();
 
         if (py_settings != Py_None) {
-                settings = settings_from_object(self->talloc_ctx, py_settings);
+                settings = settings_from_object(frame, py_settings);
                 if (settings == NULL) {
-                        PyObject_DEL(self);
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
                         return NULL;
                 }
         } else {
-                settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
+                settings = talloc_zero(frame, struct gensec_settings);
                 if (settings == NULL) {
-                        PyObject_DEL(self);
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
                         return NULL;
                 }
 
                 settings->lp_ctx = loadparm_init_global(true);
-        }
-
-        ev = tevent_context_init(self->talloc_ctx);
-        if (ev == NULL) {
-                PyErr_NoMemory();
-                PyObject_Del(self);
-                return NULL;
-        }
-
-        status = gensec_init(settings->lp_ctx);
-        if (!NT_STATUS_IS_OK(status)) {
-                PyErr_SetNTSTATUS(status);
-                PyObject_DEL(self);
-                return NULL;
-        }
-
-        status = gensec_client_start(self->talloc_ctx, &gensec, ev, settings);
-        if (!NT_STATUS_IS_OK(status)) {
-                PyErr_SetNTSTATUS(status);
-                PyObject_DEL(self);
-                return NULL;
-        }
-
-        self->ptr = gensec;
+                if (settings->lp_ctx == NULL) {
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
+                        return NULL;
+                }
+        }
+
+        status = gensec_init();
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                TALLOC_FREE(frame);
+                return NULL;
+        }
+
+        status = gensec_client_start(frame, &gensec, settings);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                TALLOC_FREE(frame);
+                return NULL;
+        }
+
+        self = pytalloc_steal(type, gensec);
+        TALLOC_FREE(frame);
 
         return (PyObject *)self;
@@ -145 +138 @@
 {
         NTSTATUS status;
-        py_talloc_Object *self;
+        PyObject *self;
         struct gensec_settings *settings = NULL;
         const char *kwnames[] = { "settings", "auth_context", NULL };
         PyObject *py_settings = Py_None;
         PyObject *py_auth_context = Py_None;
-        struct tevent_context *ev;
         struct gensec_security *gensec;
-        struct auth_context *auth_context = NULL;
+        struct auth4_context *auth_context = NULL;
+        TALLOC_CTX *frame;
 
         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OO", discard_const_p(char *, kwnames), &py_settings, &py_auth_context))
                 return NULL;
 
-        self = (py_talloc_Object*)type->tp_alloc(type, 0);
-        if (self == NULL) {
-                PyErr_NoMemory();
-                return NULL;
-        }
-        self->talloc_ctx = talloc_new(NULL);
-        if (self->talloc_ctx == NULL) {
-                PyErr_NoMemory();
-                return NULL;
-        }
+        frame = talloc_stackframe();
 
         if (py_settings != Py_None) {
-                settings = settings_from_object(self->talloc_ctx, py_settings);
+                settings = settings_from_object(frame, py_settings);
                 if (settings == NULL) {
-                        PyObject_DEL(self);
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
                         return NULL;
                 }
         } else {
-                settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
+                settings = talloc_zero(frame, struct gensec_settings);
                 if (settings == NULL) {
-                        PyObject_DEL(self);
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
                         return NULL;
                 }
 
                 settings->lp_ctx = loadparm_init_global(true);
-        }
-
-        ev = tevent_context_init(self->talloc_ctx);
-        if (ev == NULL) {
-                PyErr_NoMemory();
-                PyObject_Del(self);
-                return NULL;
+                if (settings->lp_ctx == NULL) {
+                        PyErr_NoMemory();
+                        TALLOC_FREE(frame);
+                        return NULL;
+                }
         }
 
         if (py_auth_context != Py_None) {
-                auth_context = py_talloc_get_type(py_auth_context, struct auth_context);
+                auth_context = pytalloc_get_type(py_auth_context, struct auth4_context);
                 if (!auth_context) {
                         PyErr_Format(PyExc_TypeError,
                                      "Expected auth.AuthContext for auth_context argument, got %s",
-                                     talloc_get_name(py_talloc_get_ptr(py_auth_context)));
+                                     talloc_get_name(pytalloc_get_ptr(py_auth_context)));
                         return NULL;
                 }
         }
 
-        status = gensec_init(settings->lp_ctx);
-        if (!NT_STATUS_IS_OK(status)) {
-                PyErr_SetNTSTATUS(status);
-                PyObject_DEL(self);
-                return NULL;
-        }
-
-        status = gensec_server_start(self->talloc_ctx, ev, settings, auth_context, &gensec);
-        if (!NT_STATUS_IS_OK(status)) {
-                PyErr_SetNTSTATUS(status);
-                PyObject_DEL(self);
-                return NULL;
-        }
-
-        self->ptr = gensec;
-
-        return (PyObject *)self;
+        status = gensec_init();
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                TALLOC_FREE(frame);
+                return NULL;
+        }
+
+        status = gensec_server_start(frame, settings, auth_context, &gensec);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                TALLOC_FREE(frame);
+                return NULL;
+        }
+
+        self = pytalloc_steal(type, gensec);
+        TALLOC_FREE(frame);
+
+        return self;
+}
+
+static PyObject *py_gensec_set_target_hostname(PyObject *self, PyObject *args)
+{
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        char *target_hostname;
+        NTSTATUS status;
+
+        if (!PyArg_ParseTuple(args, "s", &target_hostname))
+                return NULL;
+
+        status = gensec_set_target_hostname(security, target_hostname);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+        
+        Py_RETURN_NONE;
+}
+
+static PyObject *py_gensec_set_target_service(PyObject *self, PyObject *args)
+{
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        char *target_service;
+        NTSTATUS status;
+
+        if (!PyArg_ParseTuple(args, "s", &target_service))
+                return NULL;
+
+        status = gensec_set_target_service(security, target_service);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+        
+        Py_RETURN_NONE;
 }
 
@@ -224 +245 @@
         PyObject *py_creds = Py_None;
         struct cli_credentials *creds;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         NTSTATUS status;
 
@@ -234 +255 @@
                 PyErr_Format(PyExc_TypeError,
                              "Expected samba.credentaials for credentials argument got  %s",
-                             talloc_get_name(py_talloc_get_ptr(py_creds)));
+                             talloc_get_name(pytalloc_get_ptr(py_creds)));
         }
 
@@ -248 +269 @@
 static PyObject *py_gensec_session_info(PyObject *self)
 {
+        TALLOC_CTX *mem_ctx;
         NTSTATUS status;
         PyObject *py_session_info;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         struct auth_session_info *info;
         if (security->ops == NULL) {
@@ -256 +278 @@
                 return NULL;
         }
-        status = gensec_session_info(security, &info);
+        mem_ctx = talloc_new(NULL);
+
+        status = gensec_session_info(security, mem_ctx, &info);
         if (NT_STATUS_IS_ERR(status)) {
                 PyErr_SetNTSTATUS(status);
@@ -262 +286 @@
         }
 
-        py_session_info = py_return_ndr_struct("samba.auth", "AuthSession",
+        py_session_info = py_return_ndr_struct("samba.dcerpc.auth", "session_info",
                                                  info, info);
+        talloc_free(mem_ctx);
         return py_session_info;
 }
 
+static PyObject *py_gensec_session_key(PyObject *self)
+{
+        TALLOC_CTX *mem_ctx;
+        NTSTATUS status;
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        DATA_BLOB session_key = data_blob_null;
+        static PyObject *session_key_obj = NULL;
+
+        if (security->ops == NULL) {
+                PyErr_SetString(PyExc_RuntimeError, "no mechanism selected");
+                return NULL;
+        }
+        mem_ctx = talloc_new(NULL);
+
+        status = gensec_session_key(security, mem_ctx, &session_key);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(mem_ctx);
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+
+        session_key_obj = PyString_FromStringAndSize((const char *)session_key.data,
+                                                     session_key.length);
+        talloc_free(mem_ctx);
+        return session_key_obj;
+}
+
 static PyObject *py_gensec_start_mech_by_name(PyObject *self, PyObject *args)
 {
         char *name;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         NTSTATUS status;
 
@@ -288 +340 @@
 {
         char *sasl_name;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         NTSTATUS status;
 
@@ -306 +358 @@
 {
         int authtype, level;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         NTSTATUS status;
         if (!PyArg_ParseTuple(args, "ii", &authtype, &level))
@@ -323 +375 @@
 {
         int feature;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
         if (!PyArg_ParseTuple(args, "i", &feature))
@@ -336 +388 @@
 {
         int feature;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
         if (!PyArg_ParseTuple(args, "i", &feature))
@@ -347 +399 @@
 }
 
+static PyObject *py_gensec_set_max_update_size(PyObject *self, PyObject *args)
+{
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        unsigned int max_update_size = 0;
+
+        if (!PyArg_ParseTuple(args, "I", &max_update_size))
+                return NULL;
+
+        gensec_set_max_update_size(security, max_update_size);
+
+        Py_RETURN_NONE;
+}
+
+static PyObject *py_gensec_max_update_size(PyObject *self)
+{
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        unsigned int max_update_size = gensec_max_update_size(security);
+
+        return PyInt_FromLong(max_update_size);
+}
+
 static PyObject *py_gensec_update(PyObject *self, PyObject *args)
 {
@@ -353 +426 @@
         DATA_BLOB in, out;
         PyObject *ret, *py_in;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
         PyObject *finished_processing;
 
@@ -396 +469 @@
         DATA_BLOB in, out;
         PyObject *ret, *py_in;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 
         if (!PyArg_ParseTuple(args, "O", &py_in))
@@ -430 +503 @@
         DATA_BLOB in, out;
         PyObject *ret, *py_in;
-        struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 
         if (!PyArg_ParseTuple(args, "O", &py_in))
@@ -456 +529 @@
         talloc_free(mem_ctx);
         return ret;
+}
+
+static PyObject *py_gensec_sig_size(PyObject *self, PyObject *args)
+{
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+        Py_ssize_t data_size = 0;
+        size_t sig_size = 0;
+
+        if (!PyArg_ParseTuple(args, "n", &data_size)) {
+                return NULL;
+        }
+
+        sig_size = gensec_sig_size(security, data_size);
+
+        return PyLong_FromSize_t(sig_size);
+}
+
+static PyObject *py_gensec_sign_packet(PyObject *self, PyObject *args)
+{
+        NTSTATUS status;
+        TALLOC_CTX *mem_ctx = NULL;
+        Py_ssize_t data_length = 0;
+        Py_ssize_t pdu_length = 0;
+        DATA_BLOB data, pdu, sig;
+        PyObject *py_sig;
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+
+        if (!PyArg_ParseTuple(args, "z#z#", &data.data, &data_length, &pdu.data, &pdu_length)) {
+                return NULL;
+        }
+        data.length = data_length;
+        pdu.length = pdu_length;
+
+        mem_ctx = talloc_new(NULL);
+
+        status = gensec_sign_packet(security, mem_ctx,
+                                    data.data, data.length,
+                                    pdu.data, pdu.length, &sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                talloc_free(mem_ctx);
+                return NULL;
+        }
+
+        py_sig = PyBytes_FromStringAndSize((const char *)sig.data, sig.length);
+        talloc_free(mem_ctx);
+        return py_sig;
+}
+
+static PyObject *py_gensec_check_packet(PyObject *self, PyObject *args)
+{
+        NTSTATUS status;
+        Py_ssize_t data_length = 0;
+        Py_ssize_t pdu_length = 0;
+        Py_ssize_t sig_length = 0;
+        DATA_BLOB data, pdu, sig;
+        struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
+
+        if (!PyArg_ParseTuple(args, "z#z#z#",
+                              &data.data, &data_length,
+                              &pdu.data, &pdu_length,
+                              &sig.data, &sig_length)) {
+                return NULL;
+        }
+        data.length = data_length;
+        pdu.length = pdu_length;
+        sig.length = sig_length;
+
+        status = gensec_check_packet(security,
+                                     data.data, data.length,
+                                     pdu.data, pdu.length, &sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                PyErr_SetNTSTATUS(status);
+                return NULL;
+        }
+
+        Py_RETURN_NONE;
 }
 
@@ -465 +615 @@
         { "set_credentials", (PyCFunction)py_gensec_set_credentials, METH_VARARGS, 
                 "S.start_client(credentials)" },
+        { "set_target_hostname", (PyCFunction)py_gensec_set_target_hostname, METH_VARARGS, 
+                "S.start_target_hostname(target_hostname)" },
+        { "set_target_service", (PyCFunction)py_gensec_set_target_service, METH_VARARGS, 
+                "S.start_target_service(target_service)" },
         { "session_info", (PyCFunction)py_gensec_session_info, METH_NOARGS,
-                "S.session_info() -> info" },
+                "S.session_info() -> info" },
+        { "session_key", (PyCFunction)py_gensec_session_key, METH_NOARGS,
+                "S.session_key() -> key" },
         { "start_mech_by_name", (PyCFunction)py_gensec_start_mech_by_name, METH_VARARGS,
-        "S.start_mech_by_name(name)" },
+                "S.start_mech_by_name(name)" },
         { "start_mech_by_sasl_name", (PyCFunction)py_gensec_start_mech_by_sasl_name, METH_VARARGS,
-        "S.start_mech_by_sasl_name(name)" },
-        { "start_mech_by_authtype", (PyCFunction)py_gensec_start_mech_by_authtype, METH_VARARGS, "S.start_mech_by_authtype(authtype, level)" },
+                "S.start_mech_by_sasl_name(name)" },
+        { "start_mech_by_authtype", (PyCFunction)py_gensec_start_mech_by_authtype, METH_VARARGS,
+                "S.start_mech_by_authtype(authtype, level)" },
         { "get_name_by_authtype", (PyCFunction)py_get_name_by_authtype, METH_VARARGS,
                 "S.get_name_by_authtype(authtype) -> name\nLookup an auth type." },
         { "want_feature", (PyCFunction)py_gensec_want_feature, METH_VARARGS,
-          "S.want_feature(feature)\n Request that GENSEC negotiate a particular feature." },
+                "S.want_feature(feature)\n Request that GENSEC negotiate a particular feature." },
         { "have_feature", (PyCFunction)py_gensec_have_feature, METH_VARARGS,
-          "S.have_feature()\n Return True if GENSEC negotiated a particular feature." },
+                "S.have_feature()\n Return True if GENSEC negotiated a particular feature." },
+        { "set_max_update_size",  (PyCFunction)py_gensec_set_max_update_size, METH_VARARGS,
+                "S.set_max_update_size(max_size) \n Some mechs can fragment update packets, needs to be use before the mech is started." },
+        { "max_update_size",  (PyCFunction)py_gensec_max_update_size, 0,
+                "S.max_update_size() \n Return the current max_update_size." },
         { "update",  (PyCFunction)py_gensec_update, METH_VARARGS,
                 "S.update(blob_in) -> (finished, blob_out)\nPerform one step in a GENSEC dance.  Repeat with new packets until finished is true or exception." },
@@ -484 +645 @@
         { "unwrap",  (PyCFunction)py_gensec_unwrap, METH_VARARGS,
                 "S.unwrap(blob_in) -> blob_out\nPerform one wrapped GENSEC packet into a clear packet." },
-
+        { "sig_size",  (PyCFunction)py_gensec_sig_size, METH_VARARGS,
+                "S.sig_size(data_size) -> sig_size\nSize of the DCERPC packet signature" },
+        { "sign_packet",  (PyCFunction)py_gensec_sign_packet, METH_VARARGS,
+                "S.sign_packet(data, whole_pdu) -> sig\nSign a DCERPC packet." },
+        { "check_packet",  (PyCFunction)py_gensec_check_packet, METH_VARARGS,
+                "S.check_packet(data, whole_pdu, sig)\nCheck a DCERPC packet." },
         { NULL }
 };
 
 static PyTypeObject Py_Security = {
-        .tp_name = "Security",
+        .tp_name = "gensec.Security",
         .tp_flags = Py_TPFLAGS_DEFAULT,
         .tp_methods = py_gensec_security_methods,
-        .tp_basicsize = sizeof(py_talloc_Object),
 };
 
@@ -500 +665 @@
         PyObject *m;
 
-        Py_Security.tp_base = PyTalloc_GetObjectType();
-        if (Py_Security.tp_base == NULL)
-                return;
-
-        if (PyType_Ready(&Py_Security) < 0)
+        if (pytalloc_BaseObject_PyType_Ready(&Py_Security) < 0)
                 return;
 

vendor/current/source4/auth/gensec/wscript_build

@@ -1 +1 @@
 #!/usr/bin/env python
 
-bld.SAMBA_LIBRARY('gensec',
-        source='gensec.c socket.c gensec_tstream.c',
-        pc_files='gensec.pc',
-        autoproto='gensec_proto.h',
-        public_deps='UTIL_TEVENT samba-util errors LIBPACKET auth_system_session',
-        public_headers='gensec.h',
-        deps='com_err',
-        vnum='0.0.1'
-        )
+bld.SAMBA_SUBSYSTEM('gensec_util',
+                    source='gensec_tstream.c',
+                    deps='tevent-util tevent samba-util LIBTSOCKET',
+                    autoproto='gensec_proto.h')
 
 bld.SAMBA_MODULE('gensec_krb5',
-        source='gensec_krb5.c',
+        source='gensec_krb5.c gensec_krb5_util.c',
         subsystem='gensec',
         init_function='gensec_krb5_init',
-        deps='credentials authkrb5 auth_session com_err',
+        deps='samba-credentials authkrb5 com_err gensec_util',
         internal_module=False,
+        enabled=bld.AD_DC_BUILD_IS_ENABLED() and bld.CONFIG_SET('SAMBA4_USES_HEIMDAL')
         )
 
@@ -24 +20 @@
         subsystem='gensec',
         init_function='gensec_gssapi_init',
-        deps='gssapi credentials authkrb5 com_err'
+        deps='gssapi samba-credentials authkrb5 com_err gensec_util'
         )
-
-
-bld.SAMBA_MODULE('cyrus_sasl',
-        source='cyrus_sasl.c',
-        subsystem='gensec',
-        init_function='gensec_sasl_init',
-        deps='credentials sasl2',
-        enabled=bld.CONFIG_SET('HAVE_SASL')
-        )
-
-
-bld.SAMBA_MODULE('gensec_spnego',
-        source='spnego.c',
-        autoproto='spnego_proto.h',
-        subsystem='gensec',
-        init_function='gensec_spnego_init',
-        deps='ASN1_UTIL credentials SPNEGO_PARSE'
-        )
-
-
-bld.SAMBA_MODULE('gensec_schannel',
-        source='schannel.c',
-        subsystem='gensec',
-        deps='COMMON_SCHANNEL NDR_SCHANNEL credentials ndr auth_session',
-        internal_module=True,
-        autoproto='schannel_proto.h',
-        init_function='gensec_schannel_init'
-        )
-
 
 bld.SAMBA_PYTHON('pygensec',