[SCM] Samba Shared Repository - branch master updated

Stefan Metzmacher metze at samba.org
Tue Apr 3 11:20:05 MDT 2012


The branch, master has been updated
       via  fba028a build: Remove checks for krb5_decode_ap_req, free_AP_REQ and KRB5_TICKET_HAS_KEYINFO
       via  bc3e52d build: Remove unused check for HAVE_KRB5_TKT_ENC_PART2
       via  e5684b3 s3-krb5 Remove unused get_kvno_from_ap_req()
       via  e01dc1c s3-krb5 Remove unused get_enctype_from_ap_req
       via  0e2d659 s3-krb5: Remove unused smb_krb5_get_keyinfo_from_ap_req()
       via  c89f3bf s3-krb5: Remove unused get_key_from_keytab
       via  8c40253 s3-krb5: remove unused unwrap_pac()
       via  296f770 s3-krb5: remove unused get_auth_data_from_tkt
       via  fc8c533 s3-krb5: Remove unused get_authtime_from_tkt
       via  b1c4f1d s3-krb5: Remove unused krb5_rd_req_return_keyblock_from_keytab
       via  cf30fee s3-krb5: Remove unused get_principal_from_tkt
       via  e715460 s3-libads: Remove ads_verify_ticket() as it is now unused
       via  410ca73 s3-libads: Rework kerberos_return_pac() to use GENSEC for the server-side
       via  4e3e323 s3-libsmb: Remove unused spnego_parse_krb5_wrap()
       via  c7d29e8 build: Reduce deps of ntlm_auth
       via  1c7c432 s3-ntlm_auth: use manage_gensec_request for squid-2.5-ntlmssp
       via  f3b005e s3-auth: Order GENSEC mechs by priority, krb5 before NTLMSSP
       via  893387d s3-ntlm_auth: add ntlm_auth_generate_session_info_pac()
       via  4ccac90 s3-ntlm_auth Use GENSEC for gss-spnego server
       via  e425948 s4:ldap_server: fix typo in DEBUG() message
      from  5d10b49 wafsamba: Avoid NameError when printing error about missing system deps.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit fba028afbd65764074fd7c6da47dfff6142ccd6e
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 19:52:33 2012 +1100

    build: Remove checks for krb5_decode_ap_req, free_AP_REQ and KRB5_TICKET_HAS_KEYINFO
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    
    Autobuild-User: Stefan Metzmacher <metze at samba.org>
    Autobuild-Date: Tue Apr  3 19:19:33 CEST 2012 on sn-devel-104

commit bc3e52d9d01e6884b1d9473f6b13d07ecaad9c02
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 19:26:16 2012 +1100

    build: Remove unused check for HAVE_KRB5_TKT_ENC_PART2
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit e5684b3c6f1b42e54582f0791c61abdf126cb876
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:44:52 2012 +1100

    s3-krb5 Remove unused get_kvno_from_ap_req()
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit e01dc1c7bfc0ff0640d0223f7644b8123cc07f2e
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:41:57 2012 +1100

    s3-krb5 Remove unused get_enctype_from_ap_req
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit 0e2d659c945c000c9c3e29bb23a9fa24b8f59dc3
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:40:06 2012 +1100

    s3-krb5: Remove unused smb_krb5_get_keyinfo_from_ap_req()
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit c89f3bf5643cfec4025bfc7dd155088c693412be
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:38:35 2012 +1100

    s3-krb5: Remove unused get_key_from_keytab
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit 8c40253cc1a7e953bfc972ad06863d31e5087907
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:37:06 2012 +1100

    s3-krb5: remove unused unwrap_pac()
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit 296f7705f6c551b9240d9b3e2f30dea730978832
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:33:12 2012 +1100

    s3-krb5: remove unused get_auth_data_from_tkt
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit fc8c533aba1eaacd4a0f1f34411452347510c488
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:31:42 2012 +1100

    s3-krb5: Remove unused get_authtime_from_tkt
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit b1c4f1ddfc6711463b40b8d09bbda0d1ecc676db
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:29:57 2012 +1100

    s3-krb5: Remove unused krb5_rd_req_return_keyblock_from_keytab
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit cf30feef165b8fae2e39fe7cb68ff545b81d7b1d
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:29:40 2012 +1100

    s3-krb5: Remove unused get_principal_from_tkt
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit e71546089894b4555ad1e17db49daadd0b20ab44
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:24:25 2012 +1100

    s3-libads: Remove ads_verify_ticket() as it is now unused
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit 410ca7311ada99112120a46f70e71f99c4b5e0e0
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Mar 12 18:21:10 2012 +1100

    s3-libads: Rework kerberos_return_pac() to use GENSEC for the server-side
    
    This removes the last user of ads_verify_ticket(), and means that we
    only have one code path to verify an incoming krb5 (GSSAPI) ticket.
    
    Andrew Bartlett
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit 4e3e323080b4b934870ff05630444f4e5ed26d98
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Sun Mar 11 12:30:22 2012 +1100

    s3-libsmb: Remove unused spnego_parse_krb5_wrap()
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit c7d29e8cda3f048f286c51939c0b3c8defa02c99
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Sun Mar 11 08:11:36 2012 +1100

    build: Reduce deps of ntlm_auth
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit 1c7c432874e9dbd18016b2d6cf3ad9b8402b7fbb
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Sun Mar 11 08:10:16 2012 +1100

    s3-ntlm_auth: use manage_gensec_request for squid-2.5-ntlmssp
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit f3b005e7595288096a4fac220709b7af26aa7b62
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Sun Mar 11 07:04:38 2012 +1100

    s3-auth: Order GENSEC mechs by priority, krb5 before NTLMSSP
    
    Otherwise, really simple clients (such as the current ntlm_auth gss-spnego client)
    will not select krb5.
    
    Andrew Bartlett
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit 893387d25fcc24e906b3b97a49259930f298132d
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Sun Mar 11 07:04:38 2012 +1100

    s3-ntlm_auth: add ntlm_auth_generate_session_info_pac()
    
    Andrew Bartlett
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit 4ccac9079302a725d80ab379c5e375a084d17497
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Sun Mar 11 06:45:39 2012 +1100

    s3-ntlm_auth Use GENSEC for gss-spnego server
    
    This imports the gensec handling code from the source4 ntlm_auth, which
    will eventually be used for all the NTLMSSP and SPNEGO clients and servers
    but which is only used for gss-spnego for now.
    
    Andrew Bartlett
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit e425948323ba433b3ff8c41379b5277228265e75
Author: Stefan Metzmacher <metze at samba.org>
Date:   Tue Apr 3 13:55:08 2012 +0200

    s4:ldap_server: fix typo in DEBUG() message
    
    metze

-----------------------------------------------------------------------

Summary of changes:
 source3/Makefile.in                     |    5 +-
 source3/auth/auth_generic.c             |    5 +-
 source3/configure.in                    |   56 --
 source3/include/krb5_protos.h           |   16 -
 source3/include/proto.h                 |    1 -
 source3/libads/authdata.c               |  189 +++++-
 source3/libads/kerberos_proto.h         |   12 -
 source3/libads/kerberos_verify.c        |  776 ---------------------
 source3/libsmb/auth_generic.c           |    6 +-
 source3/libsmb/clikrb5.c                |  295 --------
 source3/libsmb/clispnego.c              |   44 --
 source3/utils/ntlm_auth.c               | 1112 +++++++++++++++----------------
 source3/wscript                         |   23 +-
 source3/wscript_build                   |    5 +-
 source4/heimdal_build/wscript_configure |    2 -
 source4/ldap_server/ldap_server.c       |    2 +-
 16 files changed, 717 insertions(+), 1832 deletions(-)
 delete mode 100644 source3/libads/kerberos_verify.c


Changeset truncated at 500 lines:

diff --git a/source3/Makefile.in b/source3/Makefile.in
index 003b000..e1d8770 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -517,7 +517,7 @@ LIBADS_OBJ = libads/ldap.o \
              libads/disp_sec.o libads/ldap_utils.o \
 	     libads/ldap_schema.o libads/util.o libads/ndr.o
 
-LIBADS_SERVER_OBJ = libads/kerberos_verify.o libads/authdata.o ../auth/kerberos/kerberos_pac.o \
+LIBADS_SERVER_OBJ = libads/authdata.o ../auth/kerberos/kerberos_pac.o \
 		    ../librpc/ndr/ndr_krb5pac.o \
 		    librpc/gen_ndr/ndr_krb5pac.o
 
@@ -1537,8 +1537,7 @@ TDBTORTURE_OBJ = @tdbdir@/tools/tdbtorture.o $(LIBREPLACE_OBJ) \
 NTLM_AUTH_OBJ1 = utils/ntlm_auth.o utils/ntlm_auth_diagnostics.o
 
 NTLM_AUTH_OBJ = ${NTLM_AUTH_OBJ1} \
-		libsmb/samlogon_cache.o \
-		$(LIBADS_SERVER_OBJ) \
+	        ${LIBADS_SERVER_OBJ} \
 		$(PASSDB_OBJ) $(GROUPDB_OBJ) \
 		$(WBCOMMON_OBJ) \
 		$(LIBSMB_OBJ) $(KRBCLIENT_OBJ) \
diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c
index f99d390..c376726 100644
--- a/source3/auth/auth_generic.c
+++ b/source3/auth/auth_generic.c
@@ -292,12 +292,13 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
 
 		gensec_init();
 
-		gensec_settings->backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
-
+		/* These need to be in priority order, krb5 before NTLMSSP */
 #if defined(HAVE_KRB5)
 		gensec_settings->backends[idx++] = &gensec_gse_krb5_security_ops;
 #endif
 
+		gensec_settings->backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
+
 		gensec_settings->backends[idx++] = gensec_security_by_oid(NULL,
 							GENSEC_OID_SPNEGO);
 
diff --git a/source3/configure.in b/source3/configure.in
index 11bd744..6828a2e 100644
--- a/source3/configure.in
+++ b/source3/configure.in
@@ -3879,8 +3879,6 @@ if test x"$with_ads_support" != x"no"; then
   AC_CHECK_FUNC_EXT(krb5_krbhst_get_addrinfo, $KRB5_LIBS)
   AC_CHECK_FUNC_EXT(krb5_crypto_init, $KRB5_LIBS)
   AC_CHECK_FUNC_EXT(krb5_crypto_destroy, $KRB5_LIBS)
-  AC_CHECK_FUNC_EXT(krb5_decode_ap_req, $KRB5_LIBS)
-  AC_CHECK_FUNC_EXT(free_AP_REQ, $KRB5_LIBS)
   AC_CHECK_FUNC_EXT(krb5_c_verify_checksum, $KRB5_LIBS)
   AC_CHECK_FUNC_EXT(krb5_principal_compare_any_realm, $KRB5_LIBS)
   AC_CHECK_FUNC_EXT(krb5_parse_name_norealm, $KRB5_LIBS)
@@ -3923,30 +3921,6 @@ if test x"$with_ads_support" != x"no"; then
 
   LIBS="$KRB5_LIBS $LIBS"
 
-  AC_CACHE_CHECK(whether krb5_ticket contains kvno and enctype,
-	smb_krb5_cv_ticket_has_keyinfo,
-	[
-	    AC_TRY_COMPILE(
-	    [
-		#include <krb5.h>
-	    ],
-	    [
-		krb5_ticket ticket;
-		krb5_kvno kvno;
-		krb5_enctype enctype;
-
-		enctype = ticket.enc_part.enctype;
-		kvno = ticket.enc_part.kvno;
-	    ],
-	    [ smb_krb5_cv_ticket_has_keyinfo=yes ],
-	    [ smb_krb5_cv_ticket_has_keyinfo=no ])
-	])
-
-  if test x"$smb_krb5_cv_ticket_has_keyinfo" = x"yes" ; then
-	AC_DEFINE(KRB5_TICKET_HAS_KEYINFO, 1,
-	    [Whether the krb5_ticket structure contains the kvno and enctype])
-  fi
-
   AC_CACHE_CHECK(whether krb5_get_init_creds_opt_free takes a context argument,
 	  smb_krb5_cv_creds_opt_free_context,
 	  [
@@ -4063,17 +4037,6 @@ if test x"$with_ads_support" != x"no"; then
               [Whether the krb5_address struct has a addr_type property])
   fi
 
-  AC_CACHE_CHECK([for enc_part2 in krb5_ticket],
-		 samba_cv_HAVE_KRB5_TKT_ENC_PART2,
-                 [AC_TRY_COMPILE([#include <krb5.h>],
-    [krb5_ticket tkt; tkt.enc_part2->authorization_data[0]->contents = NULL;],
-    samba_cv_HAVE_KRB5_TKT_ENC_PART2=yes,samba_cv_HAVE_KRB5_TKT_ENC_PART2=no)])
-
-  if test x"$samba_cv_HAVE_KRB5_TKT_ENC_PART2" = x"yes"; then
-    AC_DEFINE(HAVE_KRB5_TKT_ENC_PART2,1,
-              [Whether the krb5_ticket struct has a enc_part2 property])
-  fi
-
   AC_CACHE_CHECK([for keyvalue in krb5_keyblock],
                  samba_cv_HAVE_KRB5_KEYBLOCK_KEYVALUE,[
     AC_TRY_COMPILE([#include <krb5.h>],
@@ -4459,25 +4422,6 @@ if test x"$with_ads_support" != x"no"; then
     use_ads=no
   fi
 
-  if test x"$smb_krb5_cv_ticket_has_keyinfo" != x"yes" ; then
-
-      # We only need the following functions if we can't get the enctype
-      # and kvno out of the ticket directly (ie. on Heimdal).
-
-      if test x"$ac_cv_func_ext_free_AP_REQ" != x"yes"
-      then
-	AC_MSG_WARN(no KRB5_AP_REQ_FREE_FUNCTION detected)
-	use_ads=no
-      fi
-
-      if test x"$ac_cv_func_ext_krb5_decode_ap_req" != x"yes"
-      then
-	AC_MSG_WARN(no KRB5_AP_REQ_DECODING_FUNCTION detected)
-	use_ads=no
-      fi
-
-  fi
-
   if test x"$ac_cv_func_ext_gss_get_name_attribute" != x"yes" ; then
     if test x"$ac_cv_func_ext_gsskrb5_extract_authz_data_from_sec_context" != x"yes" -o \
             x"$ac_cv_func_ext_gss_inquire_sec_context_by_oid" != x"yes"
diff --git a/source3/include/krb5_protos.h b/source3/include/krb5_protos.h
index 1ec077c..c2d4517 100644
--- a/source3/include/krb5_protos.h
+++ b/source3/include/krb5_protos.h
@@ -65,8 +65,6 @@ void krb5_free_unparsed_name(krb5_context ctx, char *val);
 /* Samba wrapper function for krb5 functionality. */
 bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr);
 int create_kerberos_key_from_string(krb5_context context, krb5_principal host_princ, krb5_data *password, krb5_keyblock *key, krb5_enctype enctype, bool no_salt);
-bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
-krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt);
 krb5_error_code get_kerberos_allowed_etypes(krb5_context context, krb5_enctype **enctypes);
 bool get_krb5_smb_session_key(TALLOC_CTX *mem_ctx,
 			      krb5_context context,
@@ -77,19 +75,6 @@ krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context, kr
 void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype);
 bool kerberos_compatible_enctypes(krb5_context context, krb5_enctype enctype1, krb5_enctype enctype2);
 void kerberos_free_data_contents(krb5_context context, krb5_data *pdata);
-time_t get_authtime_from_tkt(krb5_ticket *tkt);
-krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
-						 const krb5_data *inbuf,
-						 krb5_kvno *kvno,
-						 krb5_enctype *enctype);
-krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
-							krb5_auth_context *auth_context,
-							const krb5_data *inbuf,
-							krb5_const_principal server,
-							krb5_keytab keytab,
-							krb5_flags *ap_req_options,
-							krb5_ticket **ticket,
-							krb5_keyblock **keyblock);
 krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
 					    const char *name,
 					    krb5_principal *principal);
@@ -149,6 +134,5 @@ int cli_krb5_get_ticket(TALLOC_CTX *mem_ctx,
 bool unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
 			   DATA_BLOB *edata,
 			   DATA_BLOB *edata_out);
-bool unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data);
 
 #endif /* _INCLUDE_KRB5_PROTOS_H_ */
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 779745a..e08c175 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -858,7 +858,6 @@ bool spnego_parse_negTokenInit(TALLOC_CTX *ctx,
 			       char **principal,
 			       DATA_BLOB *secblob);
 DATA_BLOB spnego_gen_krb5_wrap(TALLOC_CTX *ctx, const DATA_BLOB ticket, const uint8 tok_id[2]);
-bool spnego_parse_krb5_wrap(TALLOC_CTX *ctx, DATA_BLOB blob, DATA_BLOB *ticket, uint8 tok_id[2]);
 int spnego_gen_krb5_negTokenInit(TALLOC_CTX *ctx,
 			    const char *principal, int time_offset,
 			    DATA_BLOB *targ,
diff --git a/source3/libads/authdata.c b/source3/libads/authdata.c
index 44279a2..5a8ca28 100644
--- a/source3/libads/authdata.c
+++ b/source3/libads/authdata.c
@@ -26,15 +26,90 @@
 #include "librpc/gen_ndr/ndr_krb5pac.h"
 #include "smb_krb5.h"
 #include "libads/kerberos_proto.h"
+#include "auth/common_auth.h"
+#include "lib/param/param.h"
+#include "librpc/crypto/gse.h"
+#include "auth/gensec/gensec.h"
+#include "../libcli/auth/spnego.h"
 
 #ifdef HAVE_KRB5
 
+struct smb_krb5_context;
+
 /****************************************************************
-Given a username, password and other details, return the
-PAC_LOGON_INFO (the structure containing the important user
-information such as groups).
+Callback to get the PAC_LOGON_INFO from the blob
 ****************************************************************/
+static NTSTATUS kerberos_fetch_pac(struct auth4_context *auth_ctx,
+				   TALLOC_CTX *mem_ctx,
+				   struct smb_krb5_context *smb_krb5_context,
+				   DATA_BLOB *pac_blob,
+				   const char *princ_name,
+				   const struct tsocket_address *remote_address,
+				   uint32_t session_info_flags,
+				   struct auth_session_info **session_info)
+{
+	TALLOC_CTX *tmp_ctx;
+	struct PAC_DATA *pac_data = NULL;
+	struct PAC_LOGON_INFO *logon_info = NULL;
+	unsigned int i;
+	NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
+
+	tmp_ctx = talloc_new(mem_ctx);
+	if (!tmp_ctx) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	if (pac_blob) {
+		status = kerberos_decode_pac(tmp_ctx,
+				     *pac_blob,
+				     NULL, NULL, NULL, NULL, 0, &pac_data);
+		if (!NT_STATUS_IS_OK(status)) {
+			goto done;
+		}
+
+		/* get logon name and logon info */
+		for (i = 0; i < pac_data->num_buffers; i++) {
+			struct PAC_BUFFER *data_buf = &pac_data->buffers[i];
+
+			switch (data_buf->type) {
+			case PAC_TYPE_LOGON_INFO:
+				if (!data_buf->info) {
+					break;
+				}
+				logon_info = data_buf->info->logon_info.info;
+				break;
+			default:
+				break;
+			}
+		}
+		if (!logon_info) {
+			DEBUG(1, ("Invalid PAC data, missing logon info!\n"));
+			status = NT_STATUS_NOT_FOUND;
+			goto done;
+		}
+	}
+	talloc_set_name_const(logon_info, "struct PAC_LOGON_INFO");
+
+	auth_ctx->private_data = talloc_steal(auth_ctx, logon_info);
+	*session_info = talloc_zero(mem_ctx, struct auth_session_info);
+	if (!*session_info) {
+		status = NT_STATUS_NO_MEMORY;
+		goto done;
+	}
+	status = NT_STATUS_OK;
+
+done:
+	TALLOC_FREE(tmp_ctx);
 
+	return status;
+}
+
+/*
+ * Given the username/password, do a kinit, store the ticket in
+ * cache_name if specified, and return the PAC_LOGON_INFO (the
+ * structure containing the important user information such as
+ * groups).
+ */
 NTSTATUS kerberos_return_pac(TALLOC_CTX *mem_ctx,
 			     const char *name,
 			     const char *pass,
@@ -46,20 +121,29 @@ NTSTATUS kerberos_return_pac(TALLOC_CTX *mem_ctx,
 			     bool add_netbios_addr,
 			     time_t renewable_time,
 			     const char *impersonate_princ_s,
-			     struct PAC_LOGON_INFO **logon_info)
+			     struct PAC_LOGON_INFO **_logon_info)
 {
 	krb5_error_code ret;
 	NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
-	DATA_BLOB tkt, ap_rep, sesskey1, sesskey2;
-	char *client_princ_out = NULL;
+	DATA_BLOB tkt, tkt_wrapped, ap_rep, sesskey1;
 	const char *auth_princ = NULL;
 	const char *local_service = NULL;
 	const char *cc = "MEMORY:kerberos_return_pac";
+	struct auth_session_info *session_info;
+	struct gensec_security *gensec_server_context;
+
+	struct gensec_settings *gensec_settings;
+	size_t idx = 0;
+	struct auth4_context *auth_context;
+	struct loadparm_context *lp_ctx;
+	struct PAC_LOGON_INFO *logon_info = NULL;
+
+	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+	NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 
 	ZERO_STRUCT(tkt);
 	ZERO_STRUCT(ap_rep);
 	ZERO_STRUCT(sesskey1);
-	ZERO_STRUCT(sesskey2);
 
 	if (!name || !pass) {
 		return NT_STATUS_INVALID_PARAMETER;
@@ -137,28 +221,92 @@ NTSTATUS kerberos_return_pac(TALLOC_CTX *mem_ctx,
 		status = krb5_to_nt_status(ret);
 		goto out;
 	}
-	status = ads_verify_ticket(mem_ctx,
-				   lp_realm(),
-				   time_offset,
-				   &tkt,
-				   &client_princ_out,
-				   logon_info,
-				   &ap_rep,
-				   &sesskey2,
-				   False);
+
+	/* wrap that up in a nice GSS-API wrapping */
+	tkt_wrapped = spnego_gen_krb5_wrap(tmp_ctx, tkt, TOK_ID_KRB_AP_REQ);
+	if (tkt_wrapped.data == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto out;
+	}
+
+	auth_context = talloc_zero(tmp_ctx, struct auth4_context);
+	if (auth_context == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto out;
+	}
+	auth_context->generate_session_info_pac = kerberos_fetch_pac;
+
+	lp_ctx = loadparm_init_s3(tmp_ctx, loadparm_s3_context());
+	if (lp_ctx == NULL) {
+		status = NT_STATUS_INVALID_SERVER_STATE;
+		DEBUG(10, ("loadparm_init_s3 failed\n"));
+		goto out;
+	}
+
+	gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
+	if (lp_ctx == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		DEBUG(10, ("lpcfg_gensec_settings failed\n"));
+		goto out;
+	}
+
+	gensec_settings->backends = talloc_zero_array(gensec_settings,
+						      struct gensec_security_ops *, 2);
+	if (gensec_settings->backends == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto out;
+	}
+
+	gensec_init();
+
+	gensec_settings->backends[idx++] = &gensec_gse_krb5_security_ops;
+
+	status = gensec_server_start(tmp_ctx, gensec_settings,
+					auth_context, &gensec_server_context);
+
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(1,("ads_verify_ticket failed: %s\n",
-			nt_errstr(status)));
+		DEBUG(1, (__location__ "Failed to start server-side GENSEC to validate a Kerberos ticket: %s\n", nt_errstr(status)));
 		goto out;
 	}
 
-	if (!*logon_info) {
+	talloc_unlink(tmp_ctx, lp_ctx);
+	talloc_unlink(tmp_ctx, gensec_settings);
+	talloc_unlink(tmp_ctx, auth_context);
+
+	status = gensec_start_mech_by_oid(gensec_server_context, GENSEC_OID_KERBEROS5);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, (__location__ "Failed to start server-side GENSEC krb5 to validate a Kerberos ticket: %s\n", nt_errstr(status)));
+		goto out;
+	}
+
+	/* Do a client-server update dance */
+	status = gensec_update(gensec_server_context, tmp_ctx, NULL, tkt_wrapped, &ap_rep);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("gensec_update() failed: %s\n", nt_errstr(status)));
+		goto out;
+	}
+
+	/* Now return the PAC information to the callers.  We ingore
+	 * the session_info and instead pick out the PAC via the
+	 * private_data on the auth_context */
+	status = gensec_session_info(gensec_server_context, tmp_ctx, &session_info);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Unable to obtain PAC via gensec_session_info\n"));
+		goto out;
+	}
+
+	logon_info = talloc_get_type_abort(gensec_server_context->auth_context->private_data,
+					   struct PAC_LOGON_INFO);
+	if (logon_info == NULL) {
 		DEBUG(1,("no PAC\n"));
 		status = NT_STATUS_INVALID_PARAMETER;
 		goto out;
 	}
 
+	*_logon_info = talloc_move(mem_ctx, &logon_info);
+
 out:
+	talloc_free(tmp_ctx);
 	if (cc != cache_name) {
 		ads_kdestroy(cc);
 	}
@@ -166,9 +314,6 @@ out:
 	data_blob_free(&tkt);
 	data_blob_free(&ap_rep);
 	data_blob_free(&sesskey1);
-	data_blob_free(&sesskey2);
-
-	TALLOC_FREE(client_princ_out);
 
 	return status;
 }
diff --git a/source3/libads/kerberos_proto.h b/source3/libads/kerberos_proto.h
index 094f38d..6a7811d 100644
--- a/source3/libads/kerberos_proto.h
+++ b/source3/libads/kerberos_proto.h
@@ -34,18 +34,6 @@ struct PAC_LOGON_INFO;
 
 #include "libads/ads_status.h"
 
-/* The following definitions come from libads/kerberos_verify.c  */
-
-NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
-			   const char *realm,
-			   time_t time_offset,
-			   const DATA_BLOB *ticket,
-			   char **principal,
-			   struct PAC_LOGON_INFO **logon_info,
-			   DATA_BLOB *ap_rep,
-			   DATA_BLOB *session_key,
-			   bool use_replay_cache);
-
 /* The following definitions come from libads/kerberos.c  */
 
 int kerberos_kinit_password_ext(const char *principal,
diff --git a/source3/libads/kerberos_verify.c b/source3/libads/kerberos_verify.c
deleted file mode 100644
index 0c44db9..0000000
--- a/source3/libads/kerberos_verify.c
+++ /dev/null
@@ -1,776 +0,0 @@
-/*
-   Unix SMB/CIFS implementation.
-   kerberos utility library
-   Copyright (C) Andrew Tridgell 2001
-   Copyright (C) Remus Koos 2001
-   Copyright (C) Luke Howard 2003
-   Copyright (C) Guenther Deschner 2003, 2005
-   Copyright (C) Jim McDonough (jmcd at us.ibm.com) 2003
-   Copyright (C) Andrew Bartlett <abartlet at samba.org> 2004-2005
-   Copyright (C) Jeremy Allison 2007
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-#include "includes.h"
-#include "smb_krb5.h"
-#include "libads/kerberos_proto.h"
-#include "secrets.h"
-#include "../librpc/gen_ndr/krb5pac.h"
-
-#ifdef HAVE_KRB5
-
-#if !defined(HAVE_KRB5_PRINC_COMPONENT)
-const krb5_data *krb5_princ_component(krb5_context, krb5_principal, int );
-#endif
-
-static bool ads_dedicated_keytab_verify_ticket(krb5_context context,
-					  krb5_auth_context auth_context,
-					  const DATA_BLOB *ticket,
-					  krb5_ticket **pp_tkt,


-- 
Samba Shared Repository


More information about the samba-cvs mailing list