Changeset 988 for vendor/current/source4/auth/kerberos

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source4/auth/kerberos

Files:

• clikrb5.c (deleted)
• gssapi_parse.c (deleted)
• kerberos-notes.txt (modified) (3 diffs)
• kerberos.c (deleted)
• kerberos.h (modified) (6 diffs)
• kerberos_credentials.h (modified) (1 diff)
• kerberos_heimdal.c (deleted)
• kerberos_pac.c (modified) (10 diffs)
• kerberos_util.c (modified) (16 diffs)
• keytab_copy.c (deleted)
• krb5_init_context.c (modified) (20 diffs)
• krb5_init_context.h (modified) (3 diffs)
• srv_keytab.c (added)
• wscript_build (modified) (2 diffs)

vendor/current/source4/auth/kerberos/kerberos-notes.txt

@@ -7 +7 @@
 ------------------------------------
 
-This document should be read in conjuction with the Samba4 source code.  
+This document should be read in conjunction with the Samba4 source code.  
 DAL and KDC requirements are expressed (as an implementation against Heimdal's 
 HDB abstraction layer) in Samba4's source4/kdc/hdb-samba4.c in particular.
@@ -160 +160 @@
 correctly implement the GSSAPI specification, particularly on top of the 
 (inflexible) MIT Kerberos API.  It did not seem possible to write a correct, 
-seperate GSSAPI implementation on top of MIT Kerberos's public krb5lib API, 
+separate GSSAPI implementation on top of MIT Kerberos's public krb5lib API,
 and at the time, the effort did not need to extend beyond what Windows would 
 require.  
@@ -528 +528 @@
 
 Traditional 'MIT' behaviour is to use a keytab, containing salted key
-data, extracted from the KDC.  (In this modal, there is no 'service
+data, extracted from the KDC.  (In this model, there is no 'service
 password', instead the keys are often simply application of random
 bytes).  Heimdal also implements this behaviour.
 
-The windows modal is very different - instead of sharing a keytab with
+The windows model is very different - instead of sharing a keytab with
 each member server, a random utf-16 pseudo-textual password is stored 
 for the whole machine.  

vendor/current/source4/auth/kerberos/kerberos.h

@@ -19 +19 @@
 */
 
+#ifndef _AUTH_KERBEROS_H_
+#define _AUTH_KERBEROS_H_
+
 #if defined(HAVE_KRB5)
 
+#include "system/kerberos.h"
 #include "auth/kerberos/krb5_init_context.h"
 #include "librpc/gen_ndr/krb5pac.h"
+#include "lib/krb5_wrap/krb5_samba.h"
+#include "lib/krb5_wrap/gss_samba.h"
 
 struct auth_user_info_dc;
@@ -35 +41 @@
         struct smb_krb5_context *smb_krb5_context;
         krb5_keytab keytab;
+        bool password_based;
 };
 
@@ -44 +51 @@
 #define TOK_ID_GSS_WRAP         ((const uint8_t *)"\x02\x01")
 
-#ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE
-#define KRB5_KEY_TYPE(k)        ((k)->keytype)
-#define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
-#define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
-#else
-#define KRB5_KEY_TYPE(k)        ((k)->enctype)
-#define KRB5_KEY_LENGTH(k)      ((k)->length)
-#define KRB5_KEY_DATA(k)        ((k)->contents)
-#endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
-
 #define ENC_ALL_TYPES (ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5 |     \
                        ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256)
-
-#ifndef HAVE_KRB5_SET_REAL_TIME
-krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds);
-#endif
 
 #ifndef HAVE_KRB5_SET_DEFAULT_TGS_KTYPES
@@ -69 +62 @@
 #endif
 
-#ifndef HAVE_KRB5_FREE_UNPARSED_NAME
-void krb5_free_unparsed_name(krb5_context ctx, char *val);
-#endif
-
 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
@@ -78 +67 @@
 
 /* Samba wrapper function for krb5 functionality. */
-void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr);
-int create_kerberos_key_from_string(krb5_context context, krb5_principal host_princ, krb5_data *password, krb5_keyblock *key, krb5_enctype enctype);
-int create_kerberos_key_from_string_direct(krb5_context context, krb5_principal host_princ, krb5_data *password, krb5_keyblock *key, krb5_enctype enctype);
-krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt);
-krb5_error_code get_kerberos_allowed_etypes(krb5_context context, krb5_enctype **enctypes);
-void free_kerberos_etypes(krb5_context context, krb5_enctype *enctypes);
-bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote);
-krb5_error_code ads_krb5_mk_req(krb5_context context, 
-                                krb5_auth_context *auth_context, 
-                                const krb5_flags ap_req_options,
-                                const char *principal,
-                                krb5_ccache ccache, 
-                                krb5_data *outbuf);
-bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
-krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
-                                           krb5_principal principal, const char *password,
-                                           krb5_principal impersonate_principal, const char *target_service,
-                                           krb5_get_init_creds_opt *krb_options,
-                                           time_t *expire_time, time_t *kdc_time);
-krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
-                                           krb5_principal principal, krb5_keyblock *keyblock,
-                                           const char *target_service,
-                                           krb5_get_init_creds_opt *krb_options,
-                                           time_t *expire_time, time_t *kdc_time);
-krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
-                                                        krb5_principal host_princ,
-                                                        int enctype);
-void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype);
-bool kerberos_compatible_enctypes(krb5_context context, krb5_enctype enctype1, krb5_enctype enctype2);
-void kerberos_free_data_contents(krb5_context context, krb5_data *pdata);
-krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry);
-char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx);
-NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
-                             struct PAC_DATA **pac_data_out,
-                             DATA_BLOB blob,
-                             krb5_context context,
-                             const krb5_keyblock *krbtgt_keyblock,
-                             const krb5_keyblock *service_keyblock,
-                             krb5_const_principal client_principal,
-                             time_t tgs_authtime,
-                             krb5_error_code *k5ret);
- NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
-                                  struct PAC_LOGON_INFO **logon_info,
-                                  DATA_BLOB blob,
-                                  krb5_context context,
-                                  const krb5_keyblock *krbtgt_keyblock,
-                                  const krb5_keyblock *service_keyblock,
-                                  krb5_const_principal client_principal,
-                                  time_t tgs_authtime, 
-                                  krb5_error_code *k5ret);
  krb5_error_code kerberos_encode_pac(TALLOC_CTX *mem_ctx,
                                     struct PAC_DATA *pac_data,
@@ -142 +81 @@
                                      time_t tgs_authtime,
                                      DATA_BLOB *pac);
-struct loadparm_context;
-struct ldb_message;
-struct ldb_context;
-uint32_t kerberos_enctype_to_bitmap(krb5_enctype enc_type_enum);
-/* Translate between the Microsoft msDS-SupportedEncryptionTypes values and the IETF encryption type values */
-krb5_enctype kerberos_enctype_bitmap_to_enctype(uint32_t enctype_bitmap);
-krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
-                                       struct smb_krb5_context *smb_krb5_context,
-                                       struct ldb_context *ldb, 
-                                       struct ldb_message *msg,
-                                       bool delete_all_kvno,
-                                       const char **error_string);
 
 #include "auth/kerberos/proto.h"
 
 #endif /* HAVE_KRB5 */
+
+#endif /* _AUTH_KERBEROS_H_ */

vendor/current/source4/auth/kerberos/kerberos_credentials.h

@@ -28 +28 @@
                                 enum credentials_obtained *obtained,
                                 const char **error_string);
+
+/* Manually prototyped here to avoid needing krb5 headers in most callers */
+krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
+                                struct cli_credentials *credentials,
+                                struct smb_krb5_context *smb_krb5_context,
+                                krb5_principal *princ,
+                                enum credentials_obtained *obtained,
+                                const char **error_string);

vendor/current/source4/auth/kerberos/kerberos_pac.c

@@ -31 +31 @@
 #include <ldb.h>
 #include "auth/auth_sam_reply.h"
-
-krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
-                                   DATA_BLOB pac_data,
-                                   struct PAC_SIGNATURE_DATA *sig,
-                                   krb5_context context,
-                                   const krb5_keyblock *keyblock)
-{
-        krb5_error_code ret;
-        krb5_crypto crypto;
-        Checksum cksum;
-
-        cksum.cksumtype         = (CKSUMTYPE)sig->type;
-        cksum.checksum.length   = sig->signature.length;
-        cksum.checksum.data     = sig->signature.data;
-
-        ret = krb5_crypto_init(context,
-                               keyblock,
-                               0,
-                               &crypto);
-        if (ret) {
-                DEBUG(0,("krb5_crypto_init() failed: %s\n",
-                          smb_get_krb5_error_message(context, ret, mem_ctx)));
-                return ret;
-        }
-        ret = krb5_verify_checksum(context,
-                                   crypto,
-                                   KRB5_KU_OTHER_CKSUM,
-                                   pac_data.data,
-                                   pac_data.length,
-                                   &cksum);
-        krb5_crypto_destroy(context, crypto);
-
-        return ret;
-}
-
- NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
-                              struct PAC_DATA **pac_data_out,
-                              DATA_BLOB blob,
-                              krb5_context context,
-                              const krb5_keyblock *krbtgt_keyblock,
-                              const krb5_keyblock *service_keyblock,
-                              krb5_const_principal client_principal,
-                              time_t tgs_authtime,
-                              krb5_error_code *k5ret)
-{
-        krb5_error_code ret;
-        NTSTATUS status;
-        enum ndr_err_code ndr_err;
-        struct PAC_SIGNATURE_DATA *srv_sig_ptr = NULL;
-        struct PAC_SIGNATURE_DATA *kdc_sig_ptr = NULL;
-        struct PAC_SIGNATURE_DATA *srv_sig_wipe = NULL;
-        struct PAC_SIGNATURE_DATA *kdc_sig_wipe = NULL;
-        struct PAC_LOGON_INFO *logon_info = NULL;
-        struct PAC_LOGON_NAME *logon_name = NULL;
-        struct PAC_DATA *pac_data;
-        struct PAC_DATA_RAW *pac_data_raw;
-
-        DATA_BLOB *srv_sig_blob = NULL;
-        DATA_BLOB *kdc_sig_blob = NULL;
-
-        DATA_BLOB modified_pac_blob;
-        NTTIME tgs_authtime_nttime;
-        krb5_principal client_principal_pac;
-        uint32_t i;
-
-        krb5_clear_error_message(context);
-
-        if (k5ret) {
-                *k5ret = KRB5_PARSE_MALFORMED;
-        }
-
-        pac_data = talloc(mem_ctx, struct PAC_DATA);
-        pac_data_raw = talloc(mem_ctx, struct PAC_DATA_RAW);
-        kdc_sig_wipe = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
-        srv_sig_wipe = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
-        if (!pac_data_raw || !pac_data || !kdc_sig_wipe || !srv_sig_wipe) {
-                if (k5ret) {
-                        *k5ret = ENOMEM;
-                }
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        ndr_err = ndr_pull_struct_blob(&blob, pac_data,
-                        pac_data, (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't parse the PAC: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        if (pac_data->num_buffers < 4) {
-                /* we need logon_ingo, service_key and kdc_key */
-                DEBUG(0,("less than 4 PAC buffers\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        ndr_err = ndr_pull_struct_blob(&blob, pac_data_raw,
-                                       pac_data_raw,
-                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA_RAW);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't parse the PAC: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        if (pac_data_raw->num_buffers < 4) {
-                /* we need logon_ingo, service_key and kdc_key */
-                DEBUG(0,("less than 4 PAC buffers\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (pac_data->num_buffers != pac_data_raw->num_buffers) {
-                /* we need logon_ingo, service_key and kdc_key */
-                DEBUG(0,("misparse!  PAC_DATA has %d buffers while PAC_DATA_RAW has %d\n",
-                         pac_data->num_buffers, pac_data_raw->num_buffers));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        for (i=0; i < pac_data->num_buffers; i++) {
-                if (pac_data->buffers[i].type != pac_data_raw->buffers[i].type) {
-                        DEBUG(0,("misparse!  PAC_DATA buffer %d has type %d while PAC_DATA_RAW has %d\n",
-                                 i, pac_data->buffers[i].type, pac_data->buffers[i].type));
-                        return NT_STATUS_INVALID_PARAMETER;
-                }
-                switch (pac_data->buffers[i].type) {
-                        case PAC_TYPE_LOGON_INFO:
-                                if (!pac_data->buffers[i].info) {
-                                        break;
-                                }
-                                logon_info = pac_data->buffers[i].info->logon_info.info;
-                                break;
-                        case PAC_TYPE_SRV_CHECKSUM:
-                                if (!pac_data->buffers[i].info) {
-                                        break;
-                                }
-                                srv_sig_ptr = &pac_data->buffers[i].info->srv_cksum;
-                                srv_sig_blob = &pac_data_raw->buffers[i].info->remaining;
-                                break;
-                        case PAC_TYPE_KDC_CHECKSUM:
-                                if (!pac_data->buffers[i].info) {
-                                        break;
-                                }
-                                kdc_sig_ptr = &pac_data->buffers[i].info->kdc_cksum;
-                                kdc_sig_blob = &pac_data_raw->buffers[i].info->remaining;
-                                break;
-                        case PAC_TYPE_LOGON_NAME:
-                                logon_name = &pac_data->buffers[i].info->logon_name;
-                                break;
-                        default:
-                                break;
-                }
-        }
-
-        if (!logon_info) {
-                DEBUG(0,("PAC no logon_info\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!logon_name) {
-                DEBUG(0,("PAC no logon_name\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!srv_sig_ptr || !srv_sig_blob) {
-                DEBUG(0,("PAC no srv_key\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!kdc_sig_ptr || !kdc_sig_blob) {
-                DEBUG(0,("PAC no kdc_key\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* Find and zero out the signatures, as required by the signing algorithm */
-
-        /* We find the data blobs above, now we parse them to get at the exact portion we should zero */
-        ndr_err = ndr_pull_struct_blob(kdc_sig_blob, kdc_sig_wipe,
-                                       kdc_sig_wipe,
-                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't parse the KDC signature: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        ndr_err = ndr_pull_struct_blob(srv_sig_blob, srv_sig_wipe,
-                                       srv_sig_wipe,
-                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't parse the SRV signature: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        /* Now zero the decoded structure */
-        memset(kdc_sig_wipe->signature.data, '\0', kdc_sig_wipe->signature.length);
-        memset(srv_sig_wipe->signature.data, '\0', srv_sig_wipe->signature.length);
-
-        /* and reencode, back into the same place it came from */
-        ndr_err = ndr_push_struct_blob(kdc_sig_blob, pac_data_raw,
-                                       kdc_sig_wipe,
-                                       (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't repack the KDC signature: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-        ndr_err = ndr_push_struct_blob(srv_sig_blob, pac_data_raw,
-                                       srv_sig_wipe,
-                                       (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't repack the SRV signature: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        /* push out the whole structure, but now with zero'ed signatures */
-        ndr_err = ndr_push_struct_blob(&modified_pac_blob, pac_data_raw,
-                                       pac_data_raw,
-                                       (ndr_push_flags_fn_t)ndr_push_PAC_DATA_RAW);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                DEBUG(0,("can't repack the RAW PAC: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        /* verify by service_key */
-        ret = check_pac_checksum(mem_ctx,
-                                 modified_pac_blob, srv_sig_ptr,
-                                 context,
-                                 service_keyblock);
-        if (ret) {
-                DEBUG(1, ("PAC Decode: Failed to verify the service signature: %s\n",
-                          smb_get_krb5_error_message(context, ret, mem_ctx)));
-                if (k5ret) {
-                        *k5ret = ret;
-                }
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        if (krbtgt_keyblock) {
-                ret = check_pac_checksum(mem_ctx,
-                                            srv_sig_ptr->signature, kdc_sig_ptr,
-                                            context, krbtgt_keyblock);
-                if (ret) {
-                        DEBUG(1, ("PAC Decode: Failed to verify the KDC signature: %s\n",
-                                  smb_get_krb5_error_message(context, ret, mem_ctx)));
-                        if (k5ret) {
-                                *k5ret = ret;
-                        }
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        /* Convert to NT time, so as not to loose accuracy in comparison */
-        unix_to_nt_time(&tgs_authtime_nttime, tgs_authtime);
-
-        if (tgs_authtime_nttime != logon_name->logon_time) {
-                DEBUG(2, ("PAC Decode: Logon time mismatch between ticket and PAC!\n"));
-                DEBUG(2, ("PAC Decode: PAC: %s\n", nt_time_string(mem_ctx, logon_name->logon_time)));
-                DEBUG(2, ("PAC Decode: Ticket: %s\n", nt_time_string(mem_ctx, tgs_authtime_nttime)));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        ret = krb5_parse_name_flags(context, logon_name->account_name, KRB5_PRINCIPAL_PARSE_NO_REALM,
-                                    &client_principal_pac);
-        if (ret) {
-                DEBUG(2, ("Could not parse name from incoming PAC: [%s]: %s\n",
-                          logon_name->account_name,
-                          smb_get_krb5_error_message(context, ret, mem_ctx)));
-                if (k5ret) {
-                        *k5ret = ret;
-                }
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!krb5_principal_compare_any_realm(context, client_principal, client_principal_pac)) {
-                DEBUG(2, ("Name in PAC [%s] does not match principal name in ticket\n",
-                          logon_name->account_name));
-                krb5_free_principal(context, client_principal_pac);
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        krb5_free_principal(context, client_principal_pac);
-
-#if 0
-        if (strcasecmp(logon_info->info3.base.account_name.string,
-                       "Administrator")== 0) {
-                file_save("tmp_pac_data-admin.dat",blob.data,blob.length);
-        }
-#endif
-
-        DEBUG(3,("Found account name from PAC: %s [%s]\n",
-                 logon_info->info3.base.account_name.string,
-                 logon_info->info3.base.full_name.string));
-        *pac_data_out = pac_data;
-
-        return NT_STATUS_OK;
-}
-
-_PUBLIC_  NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
-                                  struct PAC_LOGON_INFO **logon_info,
-                                  DATA_BLOB blob,
-                                  krb5_context context,
-                                  const krb5_keyblock *krbtgt_keyblock,
-                                  const krb5_keyblock *service_keyblock,
-                                  krb5_const_principal client_principal,
-                                  time_t tgs_authtime,
-                                  krb5_error_code *k5ret)
-{
-        NTSTATUS nt_status;
-        struct PAC_DATA *pac_data;
-        int i;
-        nt_status = kerberos_decode_pac(mem_ctx,
-                                        &pac_data,
-                                        blob,
-                                        context,
-                                        krbtgt_keyblock,
-                                        service_keyblock,
-                                        client_principal,
-                                        tgs_authtime,
-                                        k5ret);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                return nt_status;
-        }
-
-        *logon_info = NULL;
-        for (i=0; i < pac_data->num_buffers; i++) {
-                if (pac_data->buffers[i].type != PAC_TYPE_LOGON_INFO) {
-                        continue;
-                }
-                *logon_info = pac_data->buffers[i].info->logon_info.info;
-        }
-        if (!*logon_info) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-        return NT_STATUS_OK;
-}
-
-static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
-                                         DATA_BLOB *pac_data,
-                                         struct PAC_SIGNATURE_DATA *sig,
-                                         krb5_context context,
-                                         const krb5_keyblock *keyblock)
-{
-        krb5_error_code ret;
-        krb5_crypto crypto;
-        Checksum cksum;
-
-
-        ret = krb5_crypto_init(context,
-                               keyblock,
-                               0,
-                               &crypto);
-        if (ret) {
-                DEBUG(0,("krb5_crypto_init() failed: %s\n",
-                          smb_get_krb5_error_message(context, ret, mem_ctx)));
-                return ret;
-        }
-        ret = krb5_create_checksum(context,
-                                   crypto,
-                                   KRB5_KU_OTHER_CKSUM,
-                                   0,
-                                   pac_data->data,
-                                   pac_data->length,
-                                   &cksum);
-        if (ret) {
-                DEBUG(2, ("PAC Verification failed: %s\n",
-                          smb_get_krb5_error_message(context, ret, mem_ctx)));
-        }
-
-        krb5_crypto_destroy(context, crypto);
-
-        if (ret) {
-                return ret;
-        }
-
-        sig->type = cksum.cksumtype;
-        sig->signature = data_blob_talloc(mem_ctx, cksum.checksum.data, cksum.checksum.length);
-        free_Checksum(&cksum);
-
-        return 0;
-}
+#include "auth/credentials/credentials.h"
+#include "auth/kerberos/kerberos_util.h"
+#include "auth/kerberos/pac_utils.h"
 
  krb5_error_code kerberos_encode_pac(TALLOC_CTX *mem_ctx,
@@ -444 +57 @@
                 }
                 kdc_checksum = &pac_data->buffers[i].info->kdc_cksum,
-                ret = make_pac_checksum(mem_ctx, &zero_blob,
-                                        kdc_checksum,
-                                        context, krbtgt_keyblock);
+                ret = smb_krb5_make_pac_checksum(mem_ctx,
+                                                 &zero_blob,
+                                                 context,
+                                                 krbtgt_keyblock,
+                                                 &kdc_checksum->type,
+                                                 &kdc_checksum->signature);
                 if (ret) {
                         DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
@@ -460 +76 @@
                 }
                 srv_checksum = &pac_data->buffers[i].info->srv_cksum;
-                ret = make_pac_checksum(mem_ctx, &zero_blob,
-                                        srv_checksum,
-                                        context, service_keyblock);
+                ret = smb_krb5_make_pac_checksum(mem_ctx,
+                                                 &zero_blob,
+                                                 context,
+                                                 service_keyblock,
+                                                 &srv_checksum->type,
+                                                 &srv_checksum->signature);
                 if (ret) {
                         DEBUG(2, ("making service PAC checksum failed: %s\n",
@@ -495 +114 @@
 
         /* Then sign the result of the previous push, where the sig was zero'ed out */
-        ret = make_pac_checksum(mem_ctx, &tmp_blob, srv_checksum,
-                                context, service_keyblock);
+        ret = smb_krb5_make_pac_checksum(mem_ctx,
+                                         &tmp_blob,
+                                         context,
+                                         service_keyblock,
+                                         &srv_checksum->type,
+                                         &srv_checksum->signature);
 
         /* Then sign Server checksum */
-        ret = make_pac_checksum(mem_ctx, &srv_checksum->signature, kdc_checksum, context, krbtgt_keyblock);
+        ret = smb_krb5_make_pac_checksum(mem_ctx,
+                                         &srv_checksum->signature,
+                                         context,
+                                         krbtgt_keyblock,
+                                         &kdc_checksum->type,
+                                         &kdc_checksum->signature);
         if (ret) {
                 DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
@@ -624 +252 @@
 
         ret = krb5_unparse_name_flags(context, client_principal,
-                                      KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
+                                      KRB5_PRINCIPAL_UNPARSE_NO_REALM |
+                                      KRB5_PRINCIPAL_UNPARSE_DISPLAY,
+                                      &name);
         if (ret) {
                 return ret;
@@ -680 +310 @@
                                       PAC_TYPE_LOGON_INFO,
                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
-        krb5_data_free(&k5pac_logon_info_in);
+        kerberos_free_data_contents(context, &k5pac_logon_info_in);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err) || !info.logon_info.info) {
                 nt_status = ndr_map_error2ntstatus(ndr_err);
@@ -709 +339 @@
                                                pac_srv_sig,
                                                (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
-                krb5_data_free(&k5pac_srv_checksum_in);
+                kerberos_free_data_contents(context, &k5pac_srv_checksum_in);
                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                         nt_status = ndr_map_error2ntstatus(ndr_err);
@@ -730 +360 @@
                                                pac_kdc_sig,
                                                (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
-                krb5_data_free(&k5pac_kdc_checksum_in);
+                kerberos_free_data_contents(context, &k5pac_kdc_checksum_in);
                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                         nt_status = ndr_map_error2ntstatus(ndr_err);
@@ -757 +387 @@
                              &pac);
         if (ret) {
-                return map_nt_error_from_unix(ret);
+                return map_nt_error_from_unix_common(ret);
         }
 
@@ -764 +394 @@
         krb5_pac_free(context, pac);
         if (ret) {
-                return map_nt_error_from_unix(ret);
+                return map_nt_error_from_unix_common(ret);
         }
         return NT_STATUS_OK;

vendor/current/source4/auth/kerberos/kerberos_util.c

@@ -29 +29 @@
 #include "auth/kerberos/kerberos_credentials.h"
 #include "auth/kerberos/kerberos_util.h"
-#include <ldb.h>
-#include "param/secrets.h"
 
 struct principal_container {
@@ -64 +62 @@
 
         if (ret) {
-                (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
+                (*error_string) = smb_get_krb5_error_message(
+                                                smb_krb5_context->krb5_context,
+                                                ret, parent_ctx);
                 return ret;
         }
@@ -76 +76 @@
         /* This song-and-dance effectivly puts the principal
          * into talloc, so we can't loose it. */
-        mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+        mem_ctx->smb_krb5_context = talloc_reference(mem_ctx,
+                                                     smb_krb5_context);
         mem_ctx->principal = *princ;
         talloc_set_destructor(mem_ctx, free_principal);
         return 0;
-}
-
-static krb5_error_code principals_from_msg(TALLOC_CTX *parent_ctx,
-                                           struct ldb_message *msg,
-                                           struct smb_krb5_context *smb_krb5_context,
-                                           struct principal_container ***principals_out,
-                                           const char **error_string)
-{
-        unsigned int i;
-        krb5_error_code ret;
-        char *upper_realm;
-        const char *realm = ldb_msg_find_attr_as_string(msg, "realm", NULL);
-        const char *samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
-        struct ldb_message_element *spn_el = ldb_msg_find_element(msg, "servicePrincipalName");
-        TALLOC_CTX *tmp_ctx;
-        struct principal_container **principals;
-        tmp_ctx = talloc_new(parent_ctx);
-        if (!tmp_ctx) {
-                *error_string = "Cannot allocate tmp_ctx";
-                return ENOMEM;
-        }
-
-        if (!realm) {
-                *error_string = "Cannot have a kerberos secret in secrets.ldb without a realm";
-                return EINVAL;
-        }
-
-        upper_realm = strupper_talloc(tmp_ctx, realm);
-        if (!upper_realm) {
-                talloc_free(tmp_ctx);
-                *error_string = "Cannot allocate full upper case realm";
-                return ENOMEM;
-        }
-
-        principals = talloc_array(tmp_ctx, struct principal_container *, spn_el ? (spn_el->num_values + 2) : 2);
-
-        spn_el = ldb_msg_find_element(msg, "servicePrincipalName");
-        for (i=0; spn_el && i < spn_el->num_values; i++) {
-                principals[i] = talloc(principals, struct principal_container);
-                if (!principals[i]) {
-                        talloc_free(tmp_ctx);
-                        *error_string = "Cannot allocate mem_ctx";
-                        return ENOMEM;
-                }
-
-                principals[i]->smb_krb5_context = talloc_reference(principals[i], smb_krb5_context);
-                principals[i]->string_form = talloc_asprintf(principals[i], "%*.*s@%s",
-                                                             (int)spn_el->values[i].length,
-                                                             (int)spn_el->values[i].length,
-                                                             (const char *)spn_el->values[i].data, upper_realm);
-                if (!principals[i]->string_form) {
-                        talloc_free(tmp_ctx);
-                        *error_string = "Cannot allocate full samAccountName";
-                        return ENOMEM;
-                }
-
-                ret = krb5_parse_name(smb_krb5_context->krb5_context,
-                                      principals[i]->string_form, &principals[i]->principal);
-                
-                if (ret) {
-                        talloc_free(tmp_ctx);
-                        (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
-                        return ret;
-                }
-
-                /* This song-and-dance effectivly puts the principal
-                 * into talloc, so we can't loose it. */
-                talloc_set_destructor(principals[i], free_principal);
-        }
-
-        if (samAccountName) {
-                principals[i] = talloc(principals, struct principal_container);
-                if (!principals[i]) {
-                        talloc_free(tmp_ctx);
-                        *error_string = "Cannot allocate mem_ctx";
-                        return ENOMEM;
-                }
-
-                principals[i]->smb_krb5_context = talloc_reference(principals[i], smb_krb5_context);
-                principals[i]->string_form = talloc_asprintf(parent_ctx, "%s@%s", samAccountName, upper_realm);
-                if (!principals[i]->string_form) {
-                        talloc_free(tmp_ctx);
-                        *error_string = "Cannot allocate full samAccountName";
-                        return ENOMEM;
-                }
-                
-                ret = krb5_make_principal(smb_krb5_context->krb5_context, &principals[i]->principal, upper_realm, samAccountName,
-                                          NULL);
-                if (ret) {
-                        talloc_free(tmp_ctx);
-                        (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
-                        return ret;
-                }
-                
-                /* This song-and-dance effectivly puts the principal
-                 * into talloc, so we can't loose it. */
-                talloc_set_destructor(principals[i], free_principal);
-                i++;
-        }
-
-        principals[i] = NULL;
-        *principals_out = talloc_steal(parent_ctx, principals);
-
-        talloc_free(tmp_ctx);
-        return ret;
-}
-
-static krb5_error_code salt_principal_from_msg(TALLOC_CTX *parent_ctx, 
-                                               struct ldb_message *msg, 
-                                               struct smb_krb5_context *smb_krb5_context,
-                                               krb5_principal *salt_princ,
-                                               const char **error_string)
-{
-        const char *salt_principal = ldb_msg_find_attr_as_string(msg, "saltPrincipal", NULL);
-        const char *samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
-        const char *realm = ldb_msg_find_attr_as_string(msg, "realm", NULL);
-        if (salt_principal) {
-                return parse_principal(parent_ctx, salt_principal, smb_krb5_context, salt_princ, error_string);
-        } else if (samAccountName) {
-                krb5_error_code ret;
-                char *machine_username;
-                char *salt_body;
-                char *lower_realm;
-                char *upper_realm;
-
-                TALLOC_CTX *tmp_ctx;
-                struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
-                if (!mem_ctx) {
-                        *error_string = "Cannot allocate mem_ctx";
-                        return ENOMEM;
-                }
-
-                tmp_ctx = talloc_new(mem_ctx);
-                if (!tmp_ctx) {
-                        talloc_free(mem_ctx);
-                        *error_string = "Cannot allocate tmp_ctx";
-                        return ENOMEM;
-                }
-
-                if (!realm) {
-                        *error_string = "Cannot have a kerberos secret in secrets.ldb without a realm";
-                        return EINVAL;
-                }
-                
-                machine_username = talloc_strdup(tmp_ctx, samAccountName);
-                if (!machine_username) {
-                        talloc_free(mem_ctx);
-                        *error_string = "Cannot duplicate samAccountName";
-                        return ENOMEM;
-                }
-                
-                if (machine_username[strlen(machine_username)-1] == '$') {
-                        machine_username[strlen(machine_username)-1] = '\0';
-                }
-
-                lower_realm = strlower_talloc(tmp_ctx, realm);
-                if (!lower_realm) {
-                        talloc_free(mem_ctx);
-                        *error_string = "Cannot allocate to lower case realm";
-                        return ENOMEM;
-                }
-                
-                upper_realm = strupper_talloc(tmp_ctx, realm);
-                if (!upper_realm) {
-                        talloc_free(mem_ctx);
-                        *error_string = "Cannot allocate to upper case realm";
-                        return ENOMEM;
-                }
-                
-                salt_body = talloc_asprintf(tmp_ctx, "%s.%s", machine_username, 
-                                            lower_realm);
-                talloc_free(lower_realm);
-                talloc_free(machine_username);
-                if (!salt_body) {
-                        talloc_free(mem_ctx);
-                        *error_string = "Cannot form salt principal body";
-                        return ENOMEM;
-                }
-                
-                ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ, 
-                                          upper_realm,
-                                          "host", salt_body, NULL);
-                if (ret == 0) {
-                        /* This song-and-dance effectivly puts the principal
-                         * into talloc, so we can't loose it. */
-                        mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
-                        mem_ctx->principal = *salt_princ;
-                        talloc_set_destructor(mem_ctx, free_principal);
-                } else {
-                        (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
-                }
-                talloc_free(tmp_ctx);
-                return ret;
-        } else {
-                (*error_string) = "Cannot determine salt principal, no saltPrincipal or samAccountName specified";
-                return EINVAL;
-        }
 }
 
@@ -284 +88 @@
  * system by means of a destructor (do *not* free). */
 
-krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx, 
-                                            struct cli_credentials *credentials, 
-                                            struct smb_krb5_context *smb_krb5_context,
-                                            krb5_principal *princ,
-                                            enum credentials_obtained *obtained,
-                                            const char **error_string)
+krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
+                                struct cli_credentials *credentials,
+                                struct smb_krb5_context *smb_krb5_context,
+                                krb5_principal *princ,
+                                enum credentials_obtained *obtained,
+                                const char **error_string)
 {
         krb5_error_code ret;
         const char *princ_string;
         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
+        *obtained = CRED_UNINITIALISED;
+
         if (!mem_ctx) {
                 (*error_string) = error_message(ENOMEM);
                 return ENOMEM;
         }
-        princ_string = cli_credentials_get_principal_and_obtained(credentials, mem_ctx, obtained);
+        princ_string = cli_credentials_get_principal_and_obtained(credentials,
+                                                                  mem_ctx,
+                                                                  obtained);
         if (!princ_string) {
-                (*error_string) = error_message(ENOMEM);
-                return ENOMEM;
+                *princ = NULL;
+                return 0;
         }
 
@@ -315 +123 @@
  * system by means of a destructor (do *not* free). */
 
- krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
-                                                        struct cli_credentials *credentials,
-                                                        struct smb_krb5_context *smb_krb5_context,
-                                                        krb5_principal *princ,
-                                                        const char **error_string)
-{
-        return parse_principal(parent_ctx, cli_credentials_get_impersonate_principal(credentials),
-                               smb_krb5_context, princ, error_string);
+static krb5_error_code impersonate_principal_from_credentials(
+                                TALLOC_CTX *parent_ctx,
+                                struct cli_credentials *credentials,
+                                struct smb_krb5_context *smb_krb5_context,
+                                krb5_principal *princ,
+                                const char **error_string)
+{
+        return parse_principal(parent_ctx,
+                        cli_credentials_get_impersonate_principal(credentials),
+                        smb_krb5_context, princ, error_string);
+}
+
+krb5_error_code smb_krb5_create_principals_array(TALLOC_CTX *mem_ctx,
+                                                 krb5_context context,
+                                                 const char *account_name,
+                                                 const char *realm,
+                                                 uint32_t num_spns,
+                                                 const char *spns[],
+                                                 uint32_t *pnum_principals,
+                                                 krb5_principal **pprincipals,
+                                                 const char **error_string)
+{
+        krb5_error_code code;
+        TALLOC_CTX *tmp_ctx;
+        uint32_t num_principals = 0;
+        krb5_principal *principals;
+        uint32_t i;
+
+        tmp_ctx = talloc_new(mem_ctx);
+        if (tmp_ctx == NULL) {
+                *error_string = "Cannot allocate tmp_ctx";
+                return ENOMEM;
+        }
+
+        if (realm == NULL) {
+                *error_string = "Cannot create principal without a realm";
+                code = EINVAL;
+                goto done;
+        }
+
+        if (account_name == NULL && (num_spns == 0 || spns == NULL)) {
+                *error_string = "Cannot create principal without an account or SPN";
+                code = EINVAL;
+                goto done;
+        }
+
+        if (account_name != NULL && account_name[0] != '\0') {
+                num_principals++;
+        }
+        num_principals += num_spns;
+
+        principals = talloc_zero_array(tmp_ctx,
+                                       krb5_principal,
+                                       num_principals);
+        if (principals == NULL) {
+                *error_string = "Cannot allocate principals";
+                code = ENOMEM;
+                goto done;
+        }
+
+        for (i = 0; i < num_spns; i++) {
+                code = krb5_parse_name(context, spns[i], &(principals[i]));
+                if (code != 0) {
+                        *error_string = smb_get_krb5_error_message(context,
+                                                                   code,
+                                                                   mem_ctx);
+                        goto done;
+                }
+        }
+
+        if (account_name != NULL && account_name[0] != '\0') {
+                code = smb_krb5_make_principal(context,
+                                               &(principals[i]),
+                                               realm,
+                                               account_name,
+                                               NULL);
+                if (code != 0) {
+                        *error_string = smb_get_krb5_error_message(context,
+                                                                   code,
+                                                                   mem_ctx);
+                        goto done;
+                }
+        }
+
+        if (pnum_principals != NULL) {
+                *pnum_principals = num_principals;
+
+                if (pprincipals != NULL) {
+                        *pprincipals = talloc_steal(mem_ctx, principals);
+                }
+        }
+
+        code = 0;
+done:
+        talloc_free(tmp_ctx);
+        return code;
 }
 
@@ -339 +235 @@
 {
         krb5_error_code ret;
-        const char *password, *target_service;
+        const char *password;
+#ifdef SAMBA4_USES_HEIMDAL
+        const char *self_service;
+#endif
+        const char *target_service;
         time_t kdc_time = 0;
         krb5_principal princ;
@@ -358 +258 @@
         }
 
+        if (princ == NULL) {
+                (*error_string) = talloc_asprintf(credentials, "principal, username or realm was not specified in the credentials");
+                talloc_free(mem_ctx);
+                return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
+        }
+
         ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string);
         if (ret) {
@@ -364 +270 @@
         }
 
+#ifdef SAMBA4_USES_HEIMDAL
+        self_service = cli_credentials_get_self_service(credentials);
+#endif
         target_service = cli_credentials_get_target_service(credentials);
 
@@ -377 +286 @@
         }
 
+#ifdef SAMBA4_USES_HEIMDAL /* Disable for now MIT reads defaults when needed */
         /* get the defaults */
         krb5_get_init_creds_opt_set_default_flags(smb_krb5_context->krb5_context, NULL, NULL, krb_options);
-
+#endif
         /* set if we want a forwardable ticket */
         switch (cli_credentials_get_krb_forwardable(credentials)) {
@@ -392 +302 @@
         }
 
+#ifdef SAMBA4_USES_HEIMDAL /* FIXME: MIT does not have this yet */
+        /*
+         * In order to work against windows KDCs even if we use
+         * the netbios domain name as realm, we need to add the following
+         * flags:
+         * KRB5_INIT_CREDS_NO_C_CANON_CHECK;
+         * KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK;
+         *
+         * On MIT: Set pkinit_eku_checking to none
+         */
+        krb5_get_init_creds_opt_set_win2k(smb_krb5_context->krb5_context,
+                                          krb_options, true);
+#else /* MIT */
+        krb5_get_init_creds_opt_set_canonicalize(krb_options, true);
+#endif
+
         tries = 2;
         while (tries--) {
+#ifdef SAMBA4_USES_HEIMDAL
                 struct tevent_context *previous_ev;
                 /* Do this every time, in case we have weird recursive issues here */
@@ -401 +328 @@
                         return ret;
                 }
+#endif
                 if (password) {
-                        ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, ccache, 
-                                                         princ, password,
-                                                         impersonate_principal, target_service,
-                                                         krb_options,
-                                                         NULL, &kdc_time);
+                        if (impersonate_principal) {
+#ifdef SAMBA4_USES_HEIMDAL
+                                ret = kerberos_kinit_s4u2_cc(
+                                                smb_krb5_context->krb5_context,
+                                                ccache, princ, password,
+                                                impersonate_principal,
+                                                self_service, target_service,
+                                                krb_options, NULL, &kdc_time);
+#else
+                                talloc_free(mem_ctx);
+                                (*error_string) = "INTERNAL error: s4u2 ops "
+                                        "are not supported with MIT build yet";
+                                return EINVAL;
+#endif
+                        } else {
+                                ret = kerberos_kinit_password_cc(
+                                                smb_krb5_context->krb5_context,
+                                                ccache, princ, password,
+                                                target_service,
+                                                krb_options, NULL, &kdc_time);
+                        }
                 } else if (impersonate_principal) {
                         talloc_free(mem_ctx);
@@ -421 +365 @@
                                 (*error_string) = "kinit_to_ccache: No password available for kinit\n";
                                 krb5_get_init_creds_opt_free(smb_krb5_context->krb5_context, krb_options);
+#ifdef SAMBA4_USES_HEIMDAL
                                 smb_krb5_context_remove_event_ctx(smb_krb5_context, previous_ev, event_ctx);
+#endif
                                 return EINVAL;
                         }
-                        ret = krb5_keyblock_init(smb_krb5_context->krb5_context,
+                        ret = smb_krb5_keyblock_init_contents(smb_krb5_context->krb5_context,
                                                  ENCTYPE_ARCFOUR_HMAC,
                                                  mach_pwd->hash, sizeof(mach_pwd->hash), 
@@ -438 +384 @@
                 }
 
+#ifdef SAMBA4_USES_HEIMDAL
                 smb_krb5_context_remove_event_ctx(smb_krb5_context, previous_ev, event_ctx);
+#endif
 
                 if (ret == KRB5KRB_AP_ERR_SKEW || ret == KRB5_KDCREP_SKEW) {
@@ -485 +433 @@
                 talloc_free(mem_ctx);
                 return ret;
-        } 
+        }
+
+        DEBUG(10,("kinit for %s succeeded\n",
+                cli_credentials_get_principal(credentials, mem_ctx)));
+
+
         talloc_free(mem_ctx);
         return 0;
 }
 
-static krb5_error_code free_keytab(struct keytab_container *ktc)
+static krb5_error_code free_keytab_container(struct keytab_container *ktc)
 {
         return krb5_kt_close(ktc->smb_krb5_context->krb5_context, ktc->keytab);
 }
 
-krb5_error_code smb_krb5_open_keytab(TALLOC_CTX *mem_ctx,
-                         struct smb_krb5_context *smb_krb5_context, 
-                         const char *keytab_name, struct keytab_container **ktc) 
+krb5_error_code smb_krb5_get_keytab_container(TALLOC_CTX *mem_ctx,
+                                struct smb_krb5_context *smb_krb5_context,
+                                krb5_keytab opt_keytab,
+                                const char *keytab_name,
+                                struct keytab_container **ktc)
 {
         krb5_keytab keytab;
         krb5_error_code ret;
-        ret = krb5_kt_resolve(smb_krb5_context->krb5_context, keytab_name, &keytab);
-        if (ret) {
-                DEBUG(1,("failed to open krb5 keytab: %s\n", 
-                         smb_get_krb5_error_message(smb_krb5_context->krb5_context, 
-                                                    ret, mem_ctx)));
-                return ret;
+
+        if (opt_keytab) {
+                keytab = opt_keytab;
+        } else {
+                ret = krb5_kt_resolve(smb_krb5_context->krb5_context,
+                                                keytab_name, &keytab);
+                if (ret) {
+                        DEBUG(1,("failed to open krb5 keytab: %s\n",
+                                 smb_get_krb5_error_message(
+                                        smb_krb5_context->krb5_context,
+                                        ret, mem_ctx)));
+                        return ret;
+                }
         }
 
@@ -516 +478 @@
         (*ktc)->smb_krb5_context = talloc_reference(*ktc, smb_krb5_context);
         (*ktc)->keytab = keytab;
-        talloc_set_destructor(*ktc, free_keytab);
+        (*ktc)->password_based = false;
+        talloc_set_destructor(*ktc, free_keytab_container);
 
         return 0;
 }
 
-static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
-                                       struct principal_container **principals,
-                                       krb5_principal salt_princ,
-                                       int kvno,
-                                       const char *password_s,
-                                       struct smb_krb5_context *smb_krb5_context,
-                                       krb5_enctype *enctypes,
-                                       krb5_keytab keytab,
-                                       const char **error_string)
-{
-        unsigned int i, p;
-        krb5_error_code ret;
-        krb5_data password;
-
-        password.data = discard_const_p(char *, password_s);
-        password.length = strlen(password_s);
-
-        for (i=0; enctypes[i]; i++) {
-                krb5_keytab_entry entry;
-
-                ZERO_STRUCT(entry);
-
-                ret = create_kerberos_key_from_string(smb_krb5_context->krb5_context, 
-                                                      salt_princ, &password, &entry.keyblock, enctypes[i]);
-                if (ret != 0) {
-                        return ret;
-                }
-
-                entry.vno = kvno;
-
-                for (p=0; principals[p]; p++) {
-                        entry.principal = principals[p]->principal;
-                        ret = krb5_kt_add_entry(smb_krb5_context->krb5_context, keytab, &entry);
-                        if (ret != 0) {
-                                char *k5_error_string = smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                                                   ret, NULL);
-                                *error_string = talloc_asprintf(parent_ctx, "Failed to add enctype %d entry for %s(kvno %d) to keytab: %s\n",
-                                                                (int)enctypes[i],
-                                                                principals[p]->string_form,
-                                                                kvno,
-                                                                k5_error_string);
-                                talloc_free(k5_error_string);
-                                krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
-                                return ret;
-                        }
-
-                        DEBUG(5, ("Added %s(kvno %d) to keytab (enctype %d)\n", 
-                                  principals[p]->string_form, kvno,
-                                  (int)enctypes[i]));
-                }
-                krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
-        }
-        return 0;
-}
-
-static krb5_error_code create_keytab(TALLOC_CTX *parent_ctx,
-                                     struct ldb_message *msg,
-                                     struct principal_container **principals,
-                                     struct smb_krb5_context *smb_krb5_context,
-                                     krb5_keytab keytab,
-                                     bool add_old,
-                                     const char **error_string)
-{
-        krb5_error_code ret;
-        const char *password_s;
-        const char *old_secret;
-        int kvno;
-        uint32_t enctype_bitmap;
-        krb5_principal salt_princ;
-        krb5_enctype *enctypes;
-        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
-        if (!mem_ctx) {
-                *error_string = "unable to allocate tmp_ctx for create_keytab";
-                return ENOMEM;
-        }
-
-        /* The salt used to generate these entries may be different however, fetch that */
-        ret = salt_principal_from_msg(mem_ctx, msg,
-                                      smb_krb5_context, 
-                                      &salt_princ, error_string);
-        if (ret) {
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        kvno = ldb_msg_find_attr_as_int(msg, "msDS-KeyVersionNumber", 0);
-
-        /* Finally, do the dance to get the password to put in the entry */
-        password_s =  ldb_msg_find_attr_as_string(msg, "secret", NULL);
-
-        if (!password_s) {
-                /* There is no password here, so nothing to do */
-                talloc_free(mem_ctx);
-                return 0;
-        }
-
-        if (add_old && kvno != 0) {
-                old_secret = ldb_msg_find_attr_as_string(msg, "priorSecret", NULL);
-        } else {
-                old_secret = NULL;
-        }
-
-        enctype_bitmap = (uint32_t)ldb_msg_find_attr_as_int(msg, "msDS-SupportedEncryptionTypes", ENC_ALL_TYPES);
-        
-        ret = kerberos_enctype_bitmap_to_enctypes(mem_ctx, enctype_bitmap, &enctypes);
-        if (ret) {
-                *error_string = talloc_asprintf(parent_ctx, "create_keytab: generating list of encryption types failed (%s)\n",
-                                                smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                                           ret, mem_ctx));
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        ret = keytab_add_keys(mem_ctx, principals,
-                              salt_princ,
-                              kvno, password_s, smb_krb5_context,
-                              enctypes, keytab, error_string);
-        if (ret) {
-                talloc_free(mem_ctx);
-                return ret;
-        }
-        
-        if (old_secret) {
-                ret = keytab_add_keys(mem_ctx, principals,
-                                      salt_princ,
-                                      kvno - 1, old_secret, smb_krb5_context,
-                                      enctypes, keytab, error_string);
-                if (ret) {
-                        talloc_free(mem_ctx);
-                        return ret;
-                }
-        }
-
-        talloc_free(mem_ctx);
-        return ret;
-}
-
 /*
- * Walk the keytab, looking for entries of this principal name, with KVNO other than current kvno -1.
+ * Walk the keytab, looking for entries of this principal name,
+ * with KVNO other than current kvno -1.
  *
- * These entries are now stale, we only keep the current, and previous entries around.
+ * These entries are now stale,
+ * we only keep the current and previous entries around.
  *
  * Inspired by the code in Samba3 for 'use kerberos keytab'.
- *
  */
-
-static krb5_error_code remove_old_entries(TALLOC_CTX *parent_ctx,
-                                          struct ldb_message *msg,
-                                          struct principal_container **principals,
-                                          bool delete_all_kvno,
-                                          struct smb_krb5_context *smb_krb5_context,
-                                          krb5_keytab keytab, bool *found_previous,
-                                          const char **error_string)
-{
-        krb5_error_code ret, ret2;
+krb5_error_code smb_krb5_remove_obsolete_keytab_entries(TALLOC_CTX *mem_ctx,
+                                                        krb5_context context,
+                                                        krb5_keytab keytab,
+                                                        uint32_t num_principals,
+                                                        krb5_principal *principals,
+                                                        krb5_kvno kvno,
+                                                        bool *found_previous,
+                                                        const char **error_string)
+{
+        TALLOC_CTX *tmp_ctx;
+        krb5_error_code code;
         krb5_kt_cursor cursor;
-        int kvno;
-        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
-
-        if (!mem_ctx) {
+
+        tmp_ctx = talloc_new(mem_ctx);
+        if (tmp_ctx == NULL) {
+                *error_string = "Cannot allocate tmp_ctx";
                 return ENOMEM;
         }
 
-        *found_previous = false;
-
-        kvno = ldb_msg_find_attr_as_int(msg, "msDS-KeyVersionNumber", 0);
-
-        /* for each entry in the keytab */
-        ret = krb5_kt_start_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
-        switch (ret) {
+        *found_previous = true;
+
+        code = krb5_kt_start_seq_get(context, keytab, &cursor);
+        switch (code) {
         case 0:
                 break;
+#ifdef HEIM_ERR_OPNOTSUPP
         case HEIM_ERR_OPNOTSUPP:
+#endif
         case ENOENT:
         case KRB5_KT_END:
                 /* no point enumerating if there isn't anything here */
-                talloc_free(mem_ctx);
-                return 0;
+                code = 0;
+                goto done;
         default:
-                *error_string = talloc_asprintf(parent_ctx, "failed to open keytab for read of old entries: %s\n",
-                                                smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                                           ret, mem_ctx));
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        while (!ret) {
-                unsigned int i;
+                *error_string = talloc_asprintf(mem_ctx,
+                                                "failed to open keytab for read of old entries: %s\n",
+                                                smb_get_krb5_error_message(context, code, mem_ctx));
+                goto done;
+        }
+
+        do {
+                krb5_kvno old_kvno = kvno - 1;
+                krb5_keytab_entry entry;
                 bool matched = false;
-                krb5_keytab_entry entry;
-                ret = krb5_kt_next_entry(smb_krb5_context->krb5_context, keytab, &entry, &cursor);
-                if (ret) {
+                uint32_t i;
+
+                code = krb5_kt_next_entry(context, keytab, &entry, &cursor);
+                if (code) {
                         break;
                 }
-                for (i = 0; principals[i]; i++) {
-                        /* if it matches our principal */
-                        if (krb5_kt_compare(smb_krb5_context->krb5_context, &entry, principals[i]->principal, 0, 0)) {
+
+                for (i = 0; i < num_principals; i++) {
+                        krb5_boolean ok;
+
+                        ok = smb_krb5_kt_compare(context,
+                                                &entry,
+                                                principals[i],
+                                                0,
+                                                0);
+                        if (ok) {
                                 matched = true;
                                 break;
@@ -724 +559 @@
 
                 if (!matched) {
-                        /* Free the entry, it wasn't the one we were looking for anyway */
-                        krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
+                        /*
+                         * Free the entry, it wasn't the one we were looking
+                         * for anyway
+                         */
+                        krb5_kt_free_entry(context, &entry);
+                        /* Make sure we do not double free */
+                        ZERO_STRUCT(entry);
                         continue;
                 }
 
-                /* delete it, if it is not kvno -1 */
-                if (entry.vno != (kvno - 1 )) {
+                /*
+                 * Delete it, if it is not kvno - 1.
+                 *
+                 * Some keytab files store the kvno only in 8bits. Limit the
+                 * compare to 8bits, so that we don't miss old keys and delete
+                 * them.
+                 */
+                if ((entry.vno & 0xff) != (old_kvno & 0xff)) {
+                        krb5_error_code rc;
+
                         /* Release the enumeration.  We are going to
                          * have to start this from the top again,
                          * because deletes during enumeration may not
-                         * always be consistant.
+                         * always be consistent.
                          *
                          * Also, the enumeration locks a FILE: keytab
                          */
-                
-                        krb5_kt_end_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
-
-                        ret = krb5_kt_remove_entry(smb_krb5_context->krb5_context, keytab, &entry);
-                        krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
+                        krb5_kt_end_seq_get(context, keytab, &cursor);
+
+                        code = krb5_kt_remove_entry(context, keytab, &entry);
+                        krb5_kt_free_entry(context, &entry);
+
+                        /* Make sure we do not double free */
+                        ZERO_STRUCT(entry);
 
                         /* Deleted: Restart from the top */
-                        ret2 = krb5_kt_start_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
-                        if (ret2) {
-                                krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
-                                DEBUG(1,("failed to restart enumeration of keytab: %s\n",
-                                         smb_get_krb5_error_message(smb_krb5_context->krb5_context, 
-                                                                    ret, mem_ctx)));
-                                
-                                talloc_free(mem_ctx);
-                                return ret2;
+                        rc = krb5_kt_start_seq_get(context, keytab, &cursor);
+                        if (rc != 0) {
+                                krb5_kt_free_entry(context, &entry);
+
+                                /* Make sure we do not double free */
+                                ZERO_STRUCT(entry);
+
+                                DEBUG(1, ("failed to restart enumeration of keytab: %s\n",
+                                          smb_get_krb5_error_message(context,
+                                                                     code,
+                                                                     tmp_ctx)));
+
+                                talloc_free(tmp_ctx);
+                                return rc;
                         }
 
-                        if (ret) {
+                        if (code != 0) {
                                 break;
                         }
-                        
+
                 } else {
                         *found_previous = true;
                 }
-                
+
                 /* Free the entry, we don't need it any more */
-                krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
-                
-                
-        }
-        krb5_kt_end_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
-
-        switch (ret) {
+                krb5_kt_free_entry(context, &entry);
+                /* Make sure we do not double free */
+                ZERO_STRUCT(entry);
+        } while (code != 0);
+
+        krb5_kt_end_seq_get(context, keytab, &cursor);
+
+        switch (code) {
         case 0:
                 break;
         case ENOENT:
         case KRB5_KT_END:
-                ret = 0;
+                code = 0;
                 break;
         default:
-                *error_string = talloc_asprintf(parent_ctx, "failed in deleting old entries for principal: %s\n",
-                                                smb_get_krb5_error_message(smb_krb5_context->krb5_context,
-                                                                           ret, mem_ctx));
-        }
-        talloc_free(mem_ctx);
-        return ret;
-}
-
-krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
-                                       struct smb_krb5_context *smb_krb5_context,
-                                       struct ldb_context *ldb, 
-                                       struct ldb_message *msg,
-                                       bool delete_all_kvno,
-                                       const char **error_string)
-{
-        krb5_error_code ret;
-        bool found_previous;
-        TALLOC_CTX *mem_ctx = talloc_new(NULL);
-        struct keytab_container *keytab_container;
-        struct principal_container **principals;
-        const char *keytab_name;
-
-        if (!mem_ctx) {
-                return ENOMEM;
-        }
-
-        keytab_name = keytab_name_from_msg(mem_ctx, ldb, msg);
-        if (!keytab_name) {
-                return ENOENT;
-        }
-
-        ret = smb_krb5_open_keytab(mem_ctx, smb_krb5_context, keytab_name, &keytab_container);
-
-        if (ret != 0) {
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        DEBUG(5, ("Opened keytab %s\n", keytab_name));
-
-        /* Get the principal we will store the new keytab entries under */
-        ret = principals_from_msg(mem_ctx, msg, smb_krb5_context, &principals, error_string);
-
-        if (ret != 0) {
-                *error_string = talloc_asprintf(parent_ctx, "Failed to load principals from ldb message: %s\n", *error_string);
-                talloc_free(mem_ctx);
-                return ret;
-        }
-
-        ret = remove_old_entries(mem_ctx, msg, principals, delete_all_kvno,
-                                 smb_krb5_context, keytab_container->keytab, &found_previous, error_string);
-        if (ret != 0) {
-                *error_string = talloc_asprintf(parent_ctx, "Failed to remove old principals from keytab: %s\n", *error_string);
-                talloc_free(mem_ctx);
-                return ret;
-        }
-        
-        if (!delete_all_kvno) {
-                /* Create a new keytab.  If during the cleanout we found
-                 * entires for kvno -1, then don't try and duplicate them.
-                 * Otherwise, add kvno, and kvno -1 */
-                
-                ret = create_keytab(mem_ctx, msg, principals,
-                                    smb_krb5_context,
-                                    keytab_container->keytab, 
-                                    found_previous ? false : true, error_string);
-        }
-        talloc_free(mem_ctx);
-        return ret;
-}
-
-krb5_error_code smb_krb5_create_memory_keytab(TALLOC_CTX *parent_ctx,
-                                           struct cli_credentials *machine_account,
-                                           struct smb_krb5_context *smb_krb5_context,
-                                           struct keytab_container **keytab_container) 
-{
-        krb5_error_code ret;
-        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
-        const char *rand_string;
-        const char *keytab_name;
-        struct ldb_message *msg;
-        const char *error_string;
-        if (!mem_ctx) {
-                return ENOMEM;
-        }
-        
-        *keytab_container = talloc(mem_ctx, struct keytab_container);
-
-        rand_string = generate_random_str(mem_ctx, 16);
-        if (!rand_string) {
-                talloc_free(mem_ctx);
-                return ENOMEM;
-        }
-
-        keytab_name = talloc_asprintf(mem_ctx, "MEMORY:%s", 
-                                      rand_string);
-        if (!keytab_name) {
-                talloc_free(mem_ctx);
-                return ENOMEM;
-        }
-
-        ret = smb_krb5_open_keytab(mem_ctx, smb_krb5_context, keytab_name, keytab_container);
-        if (ret) {
-                return ret;
-        }
-
-        msg = ldb_msg_new(mem_ctx);
-        if (!msg) {
-                talloc_free(mem_ctx);
-                return ENOMEM;
-        }
-        ldb_msg_add_string(msg, "krb5Keytab", keytab_name);
-        ldb_msg_add_string(msg, "secret", cli_credentials_get_password(machine_account));
-        ldb_msg_add_string(msg, "samAccountName", cli_credentials_get_username(machine_account));
-        ldb_msg_add_string(msg, "realm", cli_credentials_get_realm(machine_account));
-        ldb_msg_add_fmt(msg, "msDS-KeyVersionNumber", "%d", (int)cli_credentials_get_kvno(machine_account));
-
-        ret = smb_krb5_update_keytab(mem_ctx, smb_krb5_context, NULL, msg, false, &error_string);
-        if (ret == 0) {
-                talloc_steal(parent_ctx, *keytab_container);
-        } else {
-                DEBUG(0, ("Failed to create in-memory keytab: %s\n", error_string));
-                *keytab_container = NULL;
-        }
-        talloc_free(mem_ctx);
-        return ret;
-}
-/* Translate between the IETF encryption type values and the Microsoft msDS-SupportedEncryptionTypes values */
-uint32_t kerberos_enctype_to_bitmap(krb5_enctype enc_type_enum)
-{
-        switch (enc_type_enum) {
-        case ENCTYPE_DES_CBC_CRC:
-                return ENC_CRC32;
-        case ENCTYPE_DES_CBC_MD5:
-                return ENC_RSA_MD5;
-        case ENCTYPE_ARCFOUR_HMAC_MD5:
-                return ENC_RC4_HMAC_MD5;
-        case ENCTYPE_AES128_CTS_HMAC_SHA1_96:
-                return ENC_HMAC_SHA1_96_AES128;
-        case ENCTYPE_AES256_CTS_HMAC_SHA1_96:
-                return ENC_HMAC_SHA1_96_AES256;
-        default:
-                return 0;
-        }
-}
-
-/* Translate between the Microsoft msDS-SupportedEncryptionTypes values and the IETF encryption type values */
-krb5_enctype kerberos_enctype_bitmap_to_enctype(uint32_t enctype_bitmap)
-{
-        switch (enctype_bitmap) {
-        case ENC_CRC32:
-                return ENCTYPE_DES_CBC_CRC;
-        case ENC_RSA_MD5:
-                return ENCTYPE_DES_CBC_MD5;
-        case ENC_RC4_HMAC_MD5:
-                return ENCTYPE_ARCFOUR_HMAC_MD5;
-        case ENC_HMAC_SHA1_96_AES128:
-                return ENCTYPE_AES128_CTS_HMAC_SHA1_96;
-        case ENC_HMAC_SHA1_96_AES256:
-                return ENCTYPE_AES256_CTS_HMAC_SHA1_96;
-        default:
-                return 0;
-        }
-}
-
-/* Return an array of krb5_enctype values */
-krb5_error_code kerberos_enctype_bitmap_to_enctypes(TALLOC_CTX *mem_ctx, uint32_t enctype_bitmap, krb5_enctype **enctypes)
-{
-        unsigned int i, j = 0;
-        *enctypes = talloc_zero_array(mem_ctx, krb5_enctype, (8*sizeof(enctype_bitmap))+1);
-        if (!*enctypes) {
-                return ENOMEM;
-        }
-        for (i=0; i<(8*sizeof(enctype_bitmap)); i++) {
-                uint32_t bit_value = (1 << i) & enctype_bitmap;
-                if (bit_value & enctype_bitmap) {
-                        (*enctypes)[j] = kerberos_enctype_bitmap_to_enctype(bit_value);
-                        if (!(*enctypes)[j]) {
-                                continue;
-                        }
-                        j++;
-                }
-        }
-        (*enctypes)[j] = 0;
-        return 0;
-}
+                *error_string = talloc_asprintf(mem_ctx,
+                                                "failed in deleting old entries for principal: %s\n",
+                                                smb_get_krb5_error_message(context,
+                                                                           code,
+                                                                           mem_ctx));
+        }
+
+        code = 0;
+done:
+        talloc_free(tmp_ctx);
+        return code;
+}

vendor/current/source4/auth/kerberos/krb5_init_context.c

@@ -23 +23 @@
 #include "includes.h"
 #include "system/kerberos.h"
+#include "system/gssapi.h"
 #include <tevent.h>
 #include "auth/kerberos/kerberos.h"
@@ -31 +32 @@
 #include "libcli/resolve/resolve.h"
 #include "../lib/tsocket/tsocket.h"
-
+#include "krb5_init_context.h"
 /*
   context structure for operations on cldap packets
@@ -47 +48 @@
 
         size_t partial_read;
-
+#ifdef SAMBA4_USES_HEIMDAL
         krb5_krbhst_info *hi;
+#endif
 };
 
 static krb5_error_code smb_krb5_context_destroy(struct smb_krb5_context *ctx)
 {
-        /* Otherwise krb5_free_context will try and close what we have already free()ed */
-        krb5_set_warn_dest(ctx->krb5_context, NULL);
-        krb5_closelog(ctx->krb5_context, ctx->logf);
+#ifdef SAMBA4_USES_HEIMDAL
+        if (ctx->pvt_log_data) {
+                /* Otherwise krb5_free_context will try and close what we
+                 * have already free()ed */
+                krb5_set_warn_dest(ctx->krb5_context, NULL);
+                krb5_closelog(ctx->krb5_context,
+                                (krb5_log_facility *)ctx->pvt_log_data);
+        }
+#endif
         krb5_free_context(ctx->krb5_context);
         return 0;
 }
 
+#ifdef SAMBA4_USES_HEIMDAL
 /* We never close down the DEBUG system, and no need to unreference the use */
 static void smb_krb5_debug_close(void *private_data) {
         return;
 }
-
+#endif
+
+#ifdef SAMBA4_USES_HEIMDAL
 static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private_data)
 {
         DEBUG(3, ("Kerberos: %s\n", msg));
 }
-
+#endif
+
+#ifdef SAMBA4_USES_HEIMDAL
 /*
   handle recv events on a smb_krb5 socket
@@ -105 +118 @@
         }
 
-        DEBUG(2,("Received smb_krb5 packet of length %d\n",
+        DEBUG(4,("Received smb_krb5 packet of length %d\n",
                  (int)blob.length));
 
@@ -198 +211 @@
 }
 
-
-krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
-                                            void *data,
-                                            krb5_krbhst_info *hi,
-                                            time_t timeout,
-                                            const krb5_data *send_buf,
-                                            krb5_data *recv_buf)
+static krb5_error_code smb_krb5_send_and_recv_func_int(krb5_context context,
+                                                       struct tevent_context *ev,
+                                                       krb5_krbhst_info *hi,
+                                                       struct addrinfo *ai,
+                                                       krb5_send_to_kdc_func func,
+                                                       void *data,
+                                                       time_t timeout,
+                                                       const krb5_data *send_buf,
+                                                       krb5_data *recv_buf)
 {
         krb5_error_code ret;
         NTSTATUS status;
         const char *name;
-        struct addrinfo *ai, *a;
+        struct addrinfo *a;
         struct smb_krb5_socket *smb_krb5;
 
         DATA_BLOB send_blob;
 
-        struct tevent_context *ev;
-        TALLOC_CTX *tmp_ctx = talloc_new(NULL);
-        if (!tmp_ctx) {
+        TALLOC_CTX *frame = talloc_stackframe();
+        if (frame == NULL) {
                 return ENOMEM;
         }
 
-        if (!data) {
-                /* If no event context was available, then create one for this loop */
-                ev = tevent_context_init(tmp_ctx);
-                if (!ev) {
-                        talloc_free(tmp_ctx);
-                        return ENOMEM;
-                }
-        } else {
-                ev = talloc_get_type_abort(data, struct tevent_context);
-        }
-
         send_blob = data_blob_const(send_buf->data, send_buf->length);
-
-        ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
-        if (ret) {
-                talloc_free(tmp_ctx);
-                return ret;
-        }
 
         for (a = ai; a; a = a->ai_next) {
                 struct socket_address *remote_addr;
-                smb_krb5 = talloc(tmp_ctx, struct smb_krb5_socket);
+                smb_krb5 = talloc(frame, struct smb_krb5_socket);
                 if (!smb_krb5) {
-                        talloc_free(tmp_ctx);
+                        TALLOC_FREE(frame);
                         return ENOMEM;
                 }
@@ -258 +255 @@
 #endif
                 default:
-                        talloc_free(tmp_ctx);
+                        TALLOC_FREE(frame);
                         return EINVAL;
                 }
@@ -271 +268 @@
                         break;
                 case KRB5_KRBHST_HTTP:
-                        talloc_free(tmp_ctx);
+                        TALLOC_FREE(frame);
                         return EINVAL;
                 }
@@ -339 +336 @@
                         break;
                 case KRB5_KRBHST_HTTP:
-                        talloc_free(tmp_ctx);
+                        TALLOC_FREE(frame);
                         return EINVAL;
                 }
                 while ((NT_STATUS_IS_OK(smb_krb5->status)) && !smb_krb5->reply.length) {
                         if (tevent_loop_once(ev) != 0) {
-                                talloc_free(tmp_ctx);
+                                TALLOC_FREE(frame);
                                 return EINVAL;
                         }
 
-                        /* After each and every event loop, reset the
-                         * send_to_kdc pointers to what they were when
-                         * we entered this loop.  That way, if a
-                         * nested event has invalidated them, we put
-                         * it back before we return to the heimdal
-                         * code */
-                        ret = krb5_set_send_to_kdc_func(context,
-                                                        smb_krb5_send_and_recv_func,
-                                                        data);
-                        if (ret != 0) {
-                                talloc_free(tmp_ctx);
-                                return ret;
+                        if (func) {
+                                /* After each and every event loop, reset the
+                                 * send_to_kdc pointers to what they were when
+                                 * we entered this loop.  That way, if a
+                                 * nested event has invalidated them, we put
+                                 * it back before we return to the heimdal
+                                 * code */
+                                ret = krb5_set_send_to_kdc_func(context,
+                                                                func,
+                                                                data);
+                                if (ret != 0) {
+                                        TALLOC_FREE(frame);
+                                        return ret;
+                                }
                         }
                 }
@@ -383 +382 @@
                 ret = krb5_data_copy(recv_buf, smb_krb5->reply.data, smb_krb5->reply.length);
                 if (ret) {
-                        talloc_free(tmp_ctx);
+                        TALLOC_FREE(frame);
                         return ret;
                 }
@@ -390 +389 @@
                 break;
         }
-        talloc_free(tmp_ctx);
+        TALLOC_FREE(frame);
         if (a) {
                 return 0;
@@ -396 +395 @@
         return KRB5_KDC_UNREACH;
 }
+
+krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
+                                            void *data,
+                                            krb5_krbhst_info *hi,
+                                            time_t timeout,
+                                            const krb5_data *send_buf,
+                                            krb5_data *recv_buf)
+{
+        krb5_error_code ret;
+        struct addrinfo *ai;
+
+        struct tevent_context *ev;
+        TALLOC_CTX *frame = talloc_stackframe();
+        if (frame == NULL) {
+                return ENOMEM;
+        }
+
+        if (data == NULL) {
+                /* If no event context was available, then create one for this loop */
+                ev = samba_tevent_context_init(frame);
+                if (ev == NULL) {
+                        TALLOC_FREE(frame);
+                        return ENOMEM;
+                }
+        } else {
+                ev = talloc_get_type_abort(data, struct tevent_context);
+        }
+
+        ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
+        if (ret) {
+                TALLOC_FREE(frame);
+                return ret;
+        }
+
+        ret = smb_krb5_send_and_recv_func_int(context, ev, hi, ai, smb_krb5_send_and_recv_func, data, timeout, send_buf, recv_buf);
+        TALLOC_FREE(frame);
+        return ret;
+}
+
+krb5_error_code smb_krb5_send_and_recv_func_forced(krb5_context context,
+                                                   void *data, /* struct addrinfo */
+                                                   krb5_krbhst_info *hi,
+                                                   time_t timeout,
+                                                   const krb5_data *send_buf,
+                                                   krb5_data *recv_buf)
+{
+        krb5_error_code k5ret;
+        struct addrinfo *ai = data;
+
+        struct tevent_context *ev;
+        TALLOC_CTX *frame = talloc_stackframe();
+        if (frame == NULL) {
+                return ENOMEM;
+        }
+
+        /* no event context is passed in, create one for this loop */
+        ev = samba_tevent_context_init(frame);
+        if (ev == NULL) {
+                TALLOC_FREE(frame);
+                return ENOMEM;
+        }
+
+        /* No need to pass in send_and_recv functions, we won't nest on this private event loop */
+        k5ret = smb_krb5_send_and_recv_func_int(context, ev, hi, ai, NULL, NULL,
+                                                timeout, send_buf, recv_buf);
+        TALLOC_FREE(frame);
+        return k5ret;
+}
+#endif
 
 krb5_error_code
@@ -403 +471 @@
 {
         krb5_error_code ret;
+#ifdef SAMBA4_USES_HEIMDAL
         char **config_files;
         const char *config_file, *realm;
+#endif
         krb5_context krb5_ctx;
 
@@ -416 +486 @@
         }
 
-        config_file = config_path(tmp_ctx, lp_ctx, "krb5.conf");
+        /* The MIT Kerberos build relies on using the system krb5.conf file.
+         * If you really want to use another file please set KRB5_CONFIG
+         * accordingly. */
+#ifdef SAMBA4_USES_HEIMDAL
+        config_file = lpcfg_config_path(tmp_ctx, lp_ctx, "krb5.conf");
         if (!config_file) {
                 krb5_free_context(krb5_ctx);
@@ -423 +497 @@
 
         /* Use our local krb5.conf file by default */
-        ret = krb5_prepend_config_files_default(config_file == NULL?"":config_file, &config_files);
+        ret = krb5_prepend_config_files_default(config_file, &config_files);
         if (ret) {
                 DEBUG(1,("krb5_prepend_config_files_default failed (%s)\n",
@@ -450 +524 @@
                 }
         }
-
+#endif
         *_krb5_context = krb5_ctx;
         return 0;
@@ -456 +530 @@
 
 krb5_error_code smb_krb5_init_context(void *parent_ctx,
-                                      struct tevent_context *ev,
                                       struct loadparm_context *lp_ctx,
                                       struct smb_krb5_context **smb_krb5_context)
@@ -462 +535 @@
         krb5_error_code ret;
         TALLOC_CTX *tmp_ctx;
+        krb5_context kctx;
+#ifdef SAMBA4_USES_HEIMDAL
+        krb5_log_facility *logf;
+#endif
 
         initialize_krb5_error_table();
@@ -473 +550 @@
         }
 
-        ret = smb_krb5_init_context_basic(tmp_ctx, lp_ctx,
-                                          &(*smb_krb5_context)->krb5_context);
+        ret = smb_krb5_init_context_basic(tmp_ctx, lp_ctx, &kctx);
         if (ret) {
                 DEBUG(1,("smb_krb5_context_init_basic failed (%s)\n",
@@ -481 +557 @@
                 return ret;
         }
-
+        (*smb_krb5_context)->krb5_context = kctx;
+
+        talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy);
+
+#ifdef SAMBA4_USES_HEIMDAL
         /* TODO: Should we have a different name here? */
-        ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf);
+        ret = krb5_initlog(kctx, "Samba", &logf);
 
         if (ret) {
                 DEBUG(1,("krb5_initlog failed (%s)\n",
-                         smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
-                krb5_free_context((*smb_krb5_context)->krb5_context);
-                talloc_free(tmp_ctx);
-                return ret;
-        }
-
-        talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy);
-
-        ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */,
-                               smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL);
+                         smb_get_krb5_error_message(kctx, ret, tmp_ctx)));
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        (*smb_krb5_context)->pvt_log_data = logf;
+
+        ret = krb5_addlog_func(kctx, logf, 0 /* min */, -1 /* max */,
+                               smb_krb5_debug_wrapper,
+                                smb_krb5_debug_close, NULL);
         if (ret) {
                 DEBUG(1,("krb5_addlog_func failed (%s)\n",
-                         smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
-                talloc_free(tmp_ctx);
-                return ret;
-        }
-        krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf);
-
-        /* Set use of our socket lib */
-        if (ev) {
-                struct tevent_context *previous_ev;
-                ret = smb_krb5_context_set_event_ctx(*smb_krb5_context,
-                                                     ev, &previous_ev);
-                if (ret) {
-                        talloc_free(tmp_ctx);
-                        return ret;
-                }
-        }
-
+                         smb_get_krb5_error_message(kctx, ret, tmp_ctx)));
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        krb5_set_warn_dest(kctx, logf);
+
+        /* Set options in kerberos */
+
+        krb5_set_dns_canonicalize_hostname(kctx,
+                        lpcfg_parm_bool(lp_ctx, NULL, "krb5",
+                                        "set_dns_canonicalize", false));
+#endif
         talloc_steal(parent_ctx, *smb_krb5_context);
         talloc_free(tmp_ctx);
 
-        /* Set options in kerberos */
-
-        krb5_set_dns_canonicalize_hostname((*smb_krb5_context)->krb5_context,
-                                           lpcfg_parm_bool(lp_ctx, NULL, "krb5", "set_dns_canonicalize", false));
-
         return 0;
 }
 
+#ifdef SAMBA4_USES_HEIMDAL
 krb5_error_code smb_krb5_context_set_event_ctx(struct smb_krb5_context *smb_krb5_context,
                                                struct tevent_context *ev,
@@ -580 +650 @@
         return 0;
 }
+#endif

vendor/current/source4/auth/kerberos/krb5_init_context.h

@@ -18 +18 @@
 */
 
+#ifndef _KRB5_INIT_CONTEXT_H_
+#define _KRB5_INIT_CONTEXT_H_
+
 struct smb_krb5_context {
         krb5_context krb5_context;
-        krb5_log_facility *logf;
+        void *pvt_log_data;
         struct tevent_context *current_ev;
 };
-        
+
 struct tevent_context;
 struct loadparm_context;
@@ -32 +35 @@
                             krb5_context *_krb5_context);
 
-krb5_error_code smb_krb5_init_context(void *parent_ctx, struct tevent_context *ev,
+krb5_error_code smb_krb5_init_context(void *parent_ctx,
                                       struct loadparm_context *lp_ctx,
                                       struct smb_krb5_context **smb_krb5_context); 
 
+#ifdef SAMBA4_USES_HEIMDAL
 krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
                                             void *data,
@@ -42 +46 @@
                                             const krb5_data *send_buf,
                                             krb5_data *recv_buf);
+krb5_error_code smb_krb5_send_and_recv_func_forced(krb5_context context,
+                                                   void *data, /* struct addrinfo */
+                                                   krb5_krbhst_info *hi,
+                                                   time_t timeout,
+                                                   const krb5_data *send_buf,
+                                                   krb5_data *recv_buf);
+krb5_error_code smb_krb5_context_set_event_ctx(struct smb_krb5_context *smb_krb5_context,
+                                               struct tevent_context *ev,
+                                               struct tevent_context **previous_ev);
+krb5_error_code smb_krb5_context_remove_event_ctx(struct smb_krb5_context *smb_krb5_context,
+                                                  struct tevent_context *previous_ev,
+                                                  struct tevent_context *ev);
+#endif
+
+#endif /* _KRB5_INIT_CONTEXT_H_ */

vendor/current/source4/auth/kerberos/wscript_build

@@ -1 +1 @@
 #!/usr/bin/env python
 
+bld.SAMBA_SUBSYSTEM('KRB_INIT_CTX',
+                    source='krb5_init_context.c',
+                    deps='gssapi krb5samba'
+                   )
+
 bld.SAMBA_LIBRARY('authkrb5',
-                  source='kerberos.c clikrb5.c kerberos_heimdal.c kerberos_pac.c gssapi_parse.c krb5_init_context.c keytab_copy.c',
+                  source='kerberos_pac.c',
                   autoproto='proto.h',
-                  public_deps='krb5 ndr-krb5pac samba_socket LIBCLI_RESOLVE com_err asn1',
-                  deps='ASN1_UTIL auth_sam_reply tevent LIBPACKET ndr ldb',
+                  public_deps='ndr-krb5pac krb5samba samba_socket LIBCLI_RESOLVE asn1',
+                  deps='auth_sam_reply tevent LIBPACKET ndr ldb krb5samba KRB_INIT_CTX KRB5_PAC samba-errors',
                   private_library=True
                   )
@@ -12 +17 @@
         autoproto='kerberos_util.h',
         source='kerberos_util.c',
-        deps='authkrb5 com_err ldb CREDENTIALS_KRB5 SECRETS',
+        deps='authkrb5 krb5samba com_err CREDENTIALS_KRB5',
         )
 
+bld.SAMBA_SUBSYSTEM('KERBEROS_SRV_KEYTAB',
+        autoproto='kerberos_srv_keytab.h',
+        source='srv_keytab.c',
+        deps='authkrb5',
+        )