svn commit: samba r22795 - in branches/SAMBA_3_0_26/source: .
include libads libsmb nsswitch
gd at samba.org
gd at samba.org
Fri May 11 12:02:35 GMT 2007
Author: gd
Date: 2007-05-11 12:02:33 +0000 (Fri, 11 May 2007)
New Revision: 22795
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22795
Log:
Merge krb5_get_init_creds_opt_get_error() usage from 3_0.
Guenther
Modified:
branches/SAMBA_3_0_26/source/configure.in
branches/SAMBA_3_0_26/source/include/ads.h
branches/SAMBA_3_0_26/source/libads/kerberos.c
branches/SAMBA_3_0_26/source/libsmb/clikrb5.c
branches/SAMBA_3_0_26/source/nsswitch/winbindd_cred_cache.c
branches/SAMBA_3_0_26/source/nsswitch/winbindd_pam.c
Changeset:
Modified: branches/SAMBA_3_0_26/source/configure.in
===================================================================
--- branches/SAMBA_3_0_26/source/configure.in 2007-05-11 11:54:41 UTC (rev 22794)
+++ branches/SAMBA_3_0_26/source/configure.in 2007-05-11 12:02:33 UTC (rev 22795)
@@ -3538,6 +3538,7 @@
AC_CHECK_FUNC_EXT(initialize_krb5_error_table, $KRB5_LIBS)
AC_CHECK_FUNC_EXT(krb5_get_init_creds_opt_alloc, $KRB5_LIBS)
AC_CHECK_FUNC_EXT(krb5_get_init_creds_opt_free, $KRB5_LIBS)
+ AC_CHECK_FUNC_EXT(krb5_get_init_creds_opt_get_error, $KRB5_LIBS)
LIBS="$KRB5_LIBS $LIBS"
Modified: branches/SAMBA_3_0_26/source/include/ads.h
===================================================================
--- branches/SAMBA_3_0_26/source/include/ads.h 2007-05-11 11:54:41 UTC (rev 22794)
+++ branches/SAMBA_3_0_26/source/include/ads.h 2007-05-11 12:02:33 UTC (rev 22795)
@@ -298,6 +298,12 @@
#ifdef HAVE_KRB5
typedef struct {
+ NTSTATUS ntstatus;
+ uint32 unknown1;
+ uint32 unknown2; /* 0x00000001 */
+} KRB5_EDATA_NTSTATUS;
+
+typedef struct {
#if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
krb5_address **addrs;
#elif defined(HAVE_KRB5_ADDRESSES) /* Heimdal */
Modified: branches/SAMBA_3_0_26/source/libads/kerberos.c
===================================================================
--- branches/SAMBA_3_0_26/source/libads/kerberos.c 2007-05-11 11:54:41 UTC (rev 22794)
+++ branches/SAMBA_3_0_26/source/libads/kerberos.c 2007-05-11 12:02:33 UTC (rev 22795)
@@ -55,6 +55,127 @@
return 0;
}
+static BOOL smb_krb5_err_io_nstatus(TALLOC_CTX *mem_ctx,
+ DATA_BLOB *edata_blob,
+ KRB5_EDATA_NTSTATUS *edata)
+{
+ BOOL ret = False;
+ prs_struct ps;
+
+ if (!mem_ctx || !edata_blob || !edata)
+ return False;
+
+ if (!prs_init(&ps, edata_blob->length, mem_ctx, UNMARSHALL))
+ return False;
+
+ if (!prs_copy_data_in(&ps, (char *)edata_blob->data, edata_blob->length))
+ goto out;
+
+ prs_set_offset(&ps, 0);
+
+ if (!prs_ntstatus("ntstatus", &ps, 1, &edata->ntstatus))
+ goto out;
+
+ if (!prs_uint32("unknown1", &ps, 1, &edata->unknown1))
+ goto out;
+
+ if (!prs_uint32("unknown2", &ps, 1, &edata->unknown2)) /* only seen 00000001 here */
+ goto out;
+
+ ret = True;
+ out:
+ prs_mem_free(&ps);
+
+ return ret;
+}
+
+ static BOOL smb_krb5_get_ntstatus_from_krb5_error(krb5_error *error,
+ NTSTATUS *nt_status)
+{
+ DATA_BLOB edata;
+ DATA_BLOB unwrapped_edata;
+ TALLOC_CTX *mem_ctx;
+ KRB5_EDATA_NTSTATUS parsed_edata;
+
+#ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR
+ edata = data_blob(error->e_data->data, error->e_data->length);
+#else
+ edata = data_blob(error->e_data.data, error->e_data.length);
+#endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
+
+#ifdef DEVELOPER
+ dump_data(10, edata.data, edata.length);
+#endif /* DEVELOPER */
+
+ mem_ctx = talloc_init("smb_krb5_get_ntstatus_from_krb5_error");
+ if (mem_ctx == NULL) {
+ data_blob_free(&edata);
+ return False;
+ }
+
+ if (!unwrap_edata_ntstatus(mem_ctx, &edata, &unwrapped_edata)) {
+ data_blob_free(&edata);
+ TALLOC_FREE(mem_ctx);
+ return False;
+ }
+
+ data_blob_free(&edata);
+
+ if (!smb_krb5_err_io_nstatus(mem_ctx, &unwrapped_edata, &parsed_edata)) {
+ data_blob_free(&unwrapped_edata);
+ TALLOC_FREE(mem_ctx);
+ return False;
+ }
+
+ data_blob_free(&unwrapped_edata);
+
+ if (nt_status) {
+ *nt_status = parsed_edata.ntstatus;
+ }
+
+ TALLOC_FREE(mem_ctx);
+
+ return True;
+}
+
+ static BOOL smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(krb5_context ctx,
+ krb5_get_init_creds_opt *opt,
+ NTSTATUS *nt_status)
+{
+ BOOL ret = False;
+ krb5_error *error = NULL;
+
+#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR
+ ret = krb5_get_init_creds_opt_get_error(ctx, opt, &error);
+ if (ret) {
+ DEBUG(1,("krb5_get_init_creds_opt_get_error gave: %s\n",
+ error_message(ret)));
+ return False;
+ }
+#endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR */
+
+ if (!error) {
+ DEBUG(1,("no krb5_error\n"));
+ return False;
+ }
+
+#ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR
+ if (!error->e_data) {
+#else
+ if (error->e_data.data == NULL) {
+#endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
+ DEBUG(1,("no edata in krb5_error\n"));
+ krb5_free_error(ctx, error);
+ return False;
+ }
+
+ ret = smb_krb5_get_ntstatus_from_krb5_error(error, nt_status);
+
+ krb5_free_error(ctx, error);
+
+ return ret;
+}
+
/*
simulate a kinit, putting the tgt in the given cache location. If cache_name == NULL
place in default cache location.
@@ -68,19 +189,22 @@
const char *cache_name,
BOOL request_pac,
BOOL add_netbios_addr,
- time_t renewable_time)
+ time_t renewable_time,
+ NTSTATUS *ntstatus)
{
krb5_context ctx = NULL;
krb5_error_code code = 0;
krb5_ccache cc = NULL;
- krb5_principal me;
+ krb5_principal me = NULL;
krb5_creds my_creds;
krb5_get_init_creds_opt *opt = NULL;
smb_krb5_addresses *addr = NULL;
+ ZERO_STRUCT(my_creds);
+
initialize_krb5_error_table();
if ((code = krb5_init_context(&ctx)))
- return code;
+ goto out;
if (time_offset != 0) {
krb5_set_real_time(ctx, time(NULL) + time_offset, 0);
@@ -91,21 +215,15 @@
getenv("KRB5_CONFIG")));
if ((code = krb5_cc_resolve(ctx, cache_name ? cache_name : krb5_cc_default_name(ctx), &cc))) {
- krb5_free_context(ctx);
- return code;
+ goto out;
}
if ((code = smb_krb5_parse_name(ctx, principal, &me))) {
- krb5_cc_close(ctx, cc);
- krb5_free_context(ctx);
- return code;
+ goto out;
}
- code = smb_krb5_get_init_creds_opt_alloc(ctx, &opt);
- if (code) {
- krb5_cc_close(ctx, cc);
- krb5_free_context(ctx);
- return code;
+ if ((code = smb_krb5_get_init_creds_opt_alloc(ctx, &opt))) {
+ goto out;
}
krb5_get_init_creds_opt_set_renew_life(opt, renewable_time);
@@ -117,55 +235,29 @@
#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST
if (request_pac) {
- code = krb5_get_init_creds_opt_set_pac_request(ctx, opt, (krb5_boolean)request_pac);
- if (code) {
- krb5_cc_close(ctx, cc);
- krb5_free_principal(ctx, me);
- krb5_free_context(ctx);
- return code;
+ if ((code = krb5_get_init_creds_opt_set_pac_request(ctx, opt, (krb5_boolean)request_pac))) {
+ goto out;
}
}
#endif
if (add_netbios_addr) {
- code = smb_krb5_gen_netbios_krb5_address(&addr);
- if (code) {
- krb5_cc_close(ctx, cc);
- krb5_free_principal(ctx, me);
- krb5_free_context(ctx);
- return code;
+ if ((code = smb_krb5_gen_netbios_krb5_address(&addr))) {
+ goto out;
}
krb5_get_init_creds_opt_set_address_list(opt, addr->addrs);
}
if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password),
- kerb_prompter, NULL, 0, NULL, opt)))
- {
- smb_krb5_get_init_creds_opt_free(ctx, opt);
- smb_krb5_free_addresses(ctx, addr);
- krb5_cc_close(ctx, cc);
- krb5_free_principal(ctx, me);
- krb5_free_context(ctx);
- return code;
+ kerb_prompter, NULL, 0, NULL, opt))) {
+ goto out;
}
- smb_krb5_get_init_creds_opt_free(ctx, opt);
-
if ((code = krb5_cc_initialize(ctx, cc, me))) {
- smb_krb5_free_addresses(ctx, addr);
- krb5_free_cred_contents(ctx, &my_creds);
- krb5_cc_close(ctx, cc);
- krb5_free_principal(ctx, me);
- krb5_free_context(ctx);
- return code;
+ goto out;
}
if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
- krb5_cc_close(ctx, cc);
- smb_krb5_free_addresses(ctx, addr);
- krb5_free_cred_contents(ctx, &my_creds);
- krb5_free_principal(ctx, me);
- krb5_free_context(ctx);
- return code;
+ goto out;
}
if (expire_time) {
@@ -175,14 +267,47 @@
if (renew_till_time) {
*renew_till_time = (time_t) my_creds.times.renew_till;
}
+ out:
+ if (ntstatus) {
- krb5_cc_close(ctx, cc);
- smb_krb5_free_addresses(ctx, addr);
+ NTSTATUS status;
+
+ /* fast path */
+ if (code == 0) {
+ *ntstatus = NT_STATUS_OK;
+ goto cleanup;
+ }
+
+ /* try to get ntstatus code out of krb5_error when we have it
+ * inside the krb5_get_init_creds_opt - gd */
+
+ if (opt && smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(ctx, opt, &status)) {
+ *ntstatus = status;
+ goto cleanup;
+ }
+
+ /* fall back to self-made-mapping */
+ *ntstatus = krb5_to_nt_status(code);
+ }
+
+ cleanup:
krb5_free_cred_contents(ctx, &my_creds);
- krb5_free_principal(ctx, me);
- krb5_free_context(ctx);
-
- return 0;
+ if (me) {
+ krb5_free_principal(ctx, me);
+ }
+ if (addr) {
+ smb_krb5_free_addresses(ctx, addr);
+ }
+ if (opt) {
+ smb_krb5_get_init_creds_opt_free(ctx, opt);
+ }
+ if (cc) {
+ krb5_cc_close(ctx, cc);
+ }
+ if (ctx) {
+ krb5_free_context(ctx);
+ }
+ return code;
}
@@ -220,7 +345,8 @@
}
ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset,
- &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable);
+ &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable,
+ NULL);
if (ret) {
DEBUG(0,("kerberos_kinit_password %s failed: %s\n",
@@ -479,7 +605,8 @@
cache_name,
False,
False,
- 0);
+ 0,
+ NULL);
}
/************************************************************************
Modified: branches/SAMBA_3_0_26/source/libsmb/clikrb5.c
===================================================================
--- branches/SAMBA_3_0_26/source/libsmb/clikrb5.c 2007-05-11 11:54:41 UTC (rev 22794)
+++ branches/SAMBA_3_0_26/source/libsmb/clikrb5.c 2007-05-11 12:02:33 UTC (rev 22795)
@@ -272,6 +272,45 @@
}
#endif
+BOOL unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
+ DATA_BLOB *edata,
+ DATA_BLOB *edata_out)
+{
+ DATA_BLOB edata_contents;
+ ASN1_DATA data;
+ int edata_type;
+
+ if (!edata->length) {
+ return False;
+ }
+
+ asn1_load(&data, *edata);
+ asn1_start_tag(&data, ASN1_SEQUENCE(0));
+ asn1_start_tag(&data, ASN1_CONTEXT(1));
+ asn1_read_Integer(&data, &edata_type);
+
+ if (edata_type != KRB5_PADATA_PW_SALT) {
+ DEBUG(0,("edata is not of required type %d but of type %d\n",
+ KRB5_PADATA_PW_SALT, edata_type));
+ asn1_free(&data);
+ return False;
+ }
+
+ asn1_start_tag(&data, ASN1_CONTEXT(2));
+ asn1_read_OctetString(&data, &edata_contents);
+ asn1_end_tag(&data);
+ asn1_end_tag(&data);
+ asn1_end_tag(&data);
+ asn1_free(&data);
+
+ *edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length);
+
+ data_blob_free(&edata_contents);
+
+ return True;
+}
+
+
BOOL unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
{
DATA_BLOB pac_contents;
Modified: branches/SAMBA_3_0_26/source/nsswitch/winbindd_cred_cache.c
===================================================================
--- branches/SAMBA_3_0_26/source/nsswitch/winbindd_cred_cache.c 2007-05-11 11:54:41 UTC (rev 22794)
+++ branches/SAMBA_3_0_26/source/nsswitch/winbindd_cred_cache.c 2007-05-11 12:02:33 UTC (rev 22795)
@@ -111,7 +111,8 @@
entry->ccname,
False, /* no PAC required anymore */
True,
- WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
+ WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
+ NULL);
gain_root_privilege();
if (ret) {
@@ -224,7 +225,8 @@
entry->ccname,
False, /* no PAC required anymore */
True,
- WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
+ WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
+ NULL);
gain_root_privilege();
if (ret) {
Modified: branches/SAMBA_3_0_26/source/nsswitch/winbindd_pam.c
===================================================================
--- branches/SAMBA_3_0_26/source/nsswitch/winbindd_pam.c 2007-05-11 11:54:41 UTC (rev 22794)
+++ branches/SAMBA_3_0_26/source/nsswitch/winbindd_pam.c 2007-05-11 12:02:33 UTC (rev 22795)
@@ -579,12 +579,12 @@
cc,
True,
True,
- WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
+ WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
+ &result);
if (krb5_ret) {
DEBUG(1,("winbindd_raw_kerberos_login: kinit failed for '%s' with: %s (%d)\n",
principal_s, error_message(krb5_ret), krb5_ret));
- result = krb5_to_nt_status(krb5_ret);
goto failed;
}
More information about the samba-cvs
mailing list