[SCM] Samba Shared Repository - branch master updated
Stefan Metzmacher
metze at samba.org
Tue Apr 3 11:20:05 MDT 2012
The branch, master has been updated
via fba028a build: Remove checks for krb5_decode_ap_req, free_AP_REQ and KRB5_TICKET_HAS_KEYINFO
via bc3e52d build: Remove unused check for HAVE_KRB5_TKT_ENC_PART2
via e5684b3 s3-krb5 Remove unused get_kvno_from_ap_req()
via e01dc1c s3-krb5 Remove unused get_enctype_from_ap_req
via 0e2d659 s3-krb5: Remove unused smb_krb5_get_keyinfo_from_ap_req()
via c89f3bf s3-krb5: Remove unused get_key_from_keytab
via 8c40253 s3-krb5: remove unused unwrap_pac()
via 296f770 s3-krb5: remove unused get_auth_data_from_tkt
via fc8c533 s3-krb5: Remove unused get_authtime_from_tkt
via b1c4f1d s3-krb5: Remove unused krb5_rd_req_return_keyblock_from_keytab
via cf30fee s3-krb5: Remove unused get_principal_from_tkt
via e715460 s3-libads: Remove ads_verify_ticket() as it is now unused
via 410ca73 s3-libads: Rework kerberos_return_pac() to use GENSEC for the server-side
via 4e3e323 s3-libsmb: Remove unused spnego_parse_krb5_wrap()
via c7d29e8 build: Reduce deps of ntlm_auth
via 1c7c432 s3-ntlm_auth: use manage_gensec_request for squid-2.5-ntlmssp
via f3b005e s3-auth: Order GENSEC mechs by priority, krb5 before NTLMSSP
via 893387d s3-ntlm_auth: add ntlm_auth_generate_session_info_pac()
via 4ccac90 s3-ntlm_auth Use GENSEC for gss-spnego server
via e425948 s4:ldap_server: fix typo in DEBUG() message
from 5d10b49 wafsamba: Avoid NameError when printing error about missing system deps.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit fba028afbd65764074fd7c6da47dfff6142ccd6e
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 19:52:33 2012 +1100
build: Remove checks for krb5_decode_ap_req, free_AP_REQ and KRB5_TICKET_HAS_KEYINFO
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Autobuild-User: Stefan Metzmacher <metze at samba.org>
Autobuild-Date: Tue Apr 3 19:19:33 CEST 2012 on sn-devel-104
commit bc3e52d9d01e6884b1d9473f6b13d07ecaad9c02
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 19:26:16 2012 +1100
build: Remove unused check for HAVE_KRB5_TKT_ENC_PART2
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit e5684b3c6f1b42e54582f0791c61abdf126cb876
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:44:52 2012 +1100
s3-krb5 Remove unused get_kvno_from_ap_req()
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit e01dc1c7bfc0ff0640d0223f7644b8123cc07f2e
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:41:57 2012 +1100
s3-krb5 Remove unused get_enctype_from_ap_req
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit 0e2d659c945c000c9c3e29bb23a9fa24b8f59dc3
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:40:06 2012 +1100
s3-krb5: Remove unused smb_krb5_get_keyinfo_from_ap_req()
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit c89f3bf5643cfec4025bfc7dd155088c693412be
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:38:35 2012 +1100
s3-krb5: Remove unused get_key_from_keytab
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit 8c40253cc1a7e953bfc972ad06863d31e5087907
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:37:06 2012 +1100
s3-krb5: remove unused unwrap_pac()
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit 296f7705f6c551b9240d9b3e2f30dea730978832
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:33:12 2012 +1100
s3-krb5: remove unused get_auth_data_from_tkt
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit fc8c533aba1eaacd4a0f1f34411452347510c488
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:31:42 2012 +1100
s3-krb5: Remove unused get_authtime_from_tkt
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit b1c4f1ddfc6711463b40b8d09bbda0d1ecc676db
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:29:57 2012 +1100
s3-krb5: Remove unused krb5_rd_req_return_keyblock_from_keytab
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit cf30feef165b8fae2e39fe7cb68ff545b81d7b1d
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:29:40 2012 +1100
s3-krb5: Remove unused get_principal_from_tkt
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit e71546089894b4555ad1e17db49daadd0b20ab44
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:24:25 2012 +1100
s3-libads: Remove ads_verify_ticket() as it is now unused
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit 410ca7311ada99112120a46f70e71f99c4b5e0e0
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Mar 12 18:21:10 2012 +1100
s3-libads: Rework kerberos_return_pac() to use GENSEC for the server-side
This removes the last user of ads_verify_ticket(), and means that we
only have one code path to verify an incoming krb5 (GSSAPI) ticket.
Andrew Bartlett
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit 4e3e323080b4b934870ff05630444f4e5ed26d98
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Mar 11 12:30:22 2012 +1100
s3-libsmb: Remove unused spnego_parse_krb5_wrap()
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit c7d29e8cda3f048f286c51939c0b3c8defa02c99
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Mar 11 08:11:36 2012 +1100
build: Reduce deps of ntlm_auth
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit 1c7c432874e9dbd18016b2d6cf3ad9b8402b7fbb
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Mar 11 08:10:16 2012 +1100
s3-ntlm_auth: use manage_gensec_request for squid-2.5-ntlmssp
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit f3b005e7595288096a4fac220709b7af26aa7b62
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Mar 11 07:04:38 2012 +1100
s3-auth: Order GENSEC mechs by priority, krb5 before NTLMSSP
Otherwise, really simple clients (such as the current ntlm_auth gss-spnego client)
will not select krb5.
Andrew Bartlett
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit 893387d25fcc24e906b3b97a49259930f298132d
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Mar 11 07:04:38 2012 +1100
s3-ntlm_auth: add ntlm_auth_generate_session_info_pac()
Andrew Bartlett
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit 4ccac9079302a725d80ab379c5e375a084d17497
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Mar 11 06:45:39 2012 +1100
s3-ntlm_auth Use GENSEC for gss-spnego server
This imports the gensec handling code from the source4 ntlm_auth, which
will eventually be used for all the NTLMSSP and SPNEGO clients and servers
but which is only used for gss-spnego for now.
Andrew Bartlett
Signed-off-by: Stefan Metzmacher <metze at samba.org>
commit e425948323ba433b3ff8c41379b5277228265e75
Author: Stefan Metzmacher <metze at samba.org>
Date: Tue Apr 3 13:55:08 2012 +0200
s4:ldap_server: fix typo in DEBUG() message
metze
-----------------------------------------------------------------------
Summary of changes:
source3/Makefile.in | 5 +-
source3/auth/auth_generic.c | 5 +-
source3/configure.in | 56 --
source3/include/krb5_protos.h | 16 -
source3/include/proto.h | 1 -
source3/libads/authdata.c | 189 +++++-
source3/libads/kerberos_proto.h | 12 -
source3/libads/kerberos_verify.c | 776 ---------------------
source3/libsmb/auth_generic.c | 6 +-
source3/libsmb/clikrb5.c | 295 --------
source3/libsmb/clispnego.c | 44 --
source3/utils/ntlm_auth.c | 1112 +++++++++++++++----------------
source3/wscript | 23 +-
source3/wscript_build | 5 +-
source4/heimdal_build/wscript_configure | 2 -
source4/ldap_server/ldap_server.c | 2 +-
16 files changed, 717 insertions(+), 1832 deletions(-)
delete mode 100644 source3/libads/kerberos_verify.c
Changeset truncated at 500 lines:
diff --git a/source3/Makefile.in b/source3/Makefile.in
index 003b000..e1d8770 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -517,7 +517,7 @@ LIBADS_OBJ = libads/ldap.o \
libads/disp_sec.o libads/ldap_utils.o \
libads/ldap_schema.o libads/util.o libads/ndr.o
-LIBADS_SERVER_OBJ = libads/kerberos_verify.o libads/authdata.o ../auth/kerberos/kerberos_pac.o \
+LIBADS_SERVER_OBJ = libads/authdata.o ../auth/kerberos/kerberos_pac.o \
../librpc/ndr/ndr_krb5pac.o \
librpc/gen_ndr/ndr_krb5pac.o
@@ -1537,8 +1537,7 @@ TDBTORTURE_OBJ = @tdbdir@/tools/tdbtorture.o $(LIBREPLACE_OBJ) \
NTLM_AUTH_OBJ1 = utils/ntlm_auth.o utils/ntlm_auth_diagnostics.o
NTLM_AUTH_OBJ = ${NTLM_AUTH_OBJ1} \
- libsmb/samlogon_cache.o \
- $(LIBADS_SERVER_OBJ) \
+ ${LIBADS_SERVER_OBJ} \
$(PASSDB_OBJ) $(GROUPDB_OBJ) \
$(WBCOMMON_OBJ) \
$(LIBSMB_OBJ) $(KRBCLIENT_OBJ) \
diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c
index f99d390..c376726 100644
--- a/source3/auth/auth_generic.c
+++ b/source3/auth/auth_generic.c
@@ -292,12 +292,13 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
gensec_init();
- gensec_settings->backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
-
+ /* These need to be in priority order, krb5 before NTLMSSP */
#if defined(HAVE_KRB5)
gensec_settings->backends[idx++] = &gensec_gse_krb5_security_ops;
#endif
+ gensec_settings->backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
+
gensec_settings->backends[idx++] = gensec_security_by_oid(NULL,
GENSEC_OID_SPNEGO);
diff --git a/source3/configure.in b/source3/configure.in
index 11bd744..6828a2e 100644
--- a/source3/configure.in
+++ b/source3/configure.in
@@ -3879,8 +3879,6 @@ if test x"$with_ads_support" != x"no"; then
AC_CHECK_FUNC_EXT(krb5_krbhst_get_addrinfo, $KRB5_LIBS)
AC_CHECK_FUNC_EXT(krb5_crypto_init, $KRB5_LIBS)
AC_CHECK_FUNC_EXT(krb5_crypto_destroy, $KRB5_LIBS)
- AC_CHECK_FUNC_EXT(krb5_decode_ap_req, $KRB5_LIBS)
- AC_CHECK_FUNC_EXT(free_AP_REQ, $KRB5_LIBS)
AC_CHECK_FUNC_EXT(krb5_c_verify_checksum, $KRB5_LIBS)
AC_CHECK_FUNC_EXT(krb5_principal_compare_any_realm, $KRB5_LIBS)
AC_CHECK_FUNC_EXT(krb5_parse_name_norealm, $KRB5_LIBS)
@@ -3923,30 +3921,6 @@ if test x"$with_ads_support" != x"no"; then
LIBS="$KRB5_LIBS $LIBS"
- AC_CACHE_CHECK(whether krb5_ticket contains kvno and enctype,
- smb_krb5_cv_ticket_has_keyinfo,
- [
- AC_TRY_COMPILE(
- [
- #include <krb5.h>
- ],
- [
- krb5_ticket ticket;
- krb5_kvno kvno;
- krb5_enctype enctype;
-
- enctype = ticket.enc_part.enctype;
- kvno = ticket.enc_part.kvno;
- ],
- [ smb_krb5_cv_ticket_has_keyinfo=yes ],
- [ smb_krb5_cv_ticket_has_keyinfo=no ])
- ])
-
- if test x"$smb_krb5_cv_ticket_has_keyinfo" = x"yes" ; then
- AC_DEFINE(KRB5_TICKET_HAS_KEYINFO, 1,
- [Whether the krb5_ticket structure contains the kvno and enctype])
- fi
-
AC_CACHE_CHECK(whether krb5_get_init_creds_opt_free takes a context argument,
smb_krb5_cv_creds_opt_free_context,
[
@@ -4063,17 +4037,6 @@ if test x"$with_ads_support" != x"no"; then
[Whether the krb5_address struct has a addr_type property])
fi
- AC_CACHE_CHECK([for enc_part2 in krb5_ticket],
- samba_cv_HAVE_KRB5_TKT_ENC_PART2,
- [AC_TRY_COMPILE([#include <krb5.h>],
- [krb5_ticket tkt; tkt.enc_part2->authorization_data[0]->contents = NULL;],
- samba_cv_HAVE_KRB5_TKT_ENC_PART2=yes,samba_cv_HAVE_KRB5_TKT_ENC_PART2=no)])
-
- if test x"$samba_cv_HAVE_KRB5_TKT_ENC_PART2" = x"yes"; then
- AC_DEFINE(HAVE_KRB5_TKT_ENC_PART2,1,
- [Whether the krb5_ticket struct has a enc_part2 property])
- fi
-
AC_CACHE_CHECK([for keyvalue in krb5_keyblock],
samba_cv_HAVE_KRB5_KEYBLOCK_KEYVALUE,[
AC_TRY_COMPILE([#include <krb5.h>],
@@ -4459,25 +4422,6 @@ if test x"$with_ads_support" != x"no"; then
use_ads=no
fi
- if test x"$smb_krb5_cv_ticket_has_keyinfo" != x"yes" ; then
-
- # We only need the following functions if we can't get the enctype
- # and kvno out of the ticket directly (ie. on Heimdal).
-
- if test x"$ac_cv_func_ext_free_AP_REQ" != x"yes"
- then
- AC_MSG_WARN(no KRB5_AP_REQ_FREE_FUNCTION detected)
- use_ads=no
- fi
-
- if test x"$ac_cv_func_ext_krb5_decode_ap_req" != x"yes"
- then
- AC_MSG_WARN(no KRB5_AP_REQ_DECODING_FUNCTION detected)
- use_ads=no
- fi
-
- fi
-
if test x"$ac_cv_func_ext_gss_get_name_attribute" != x"yes" ; then
if test x"$ac_cv_func_ext_gsskrb5_extract_authz_data_from_sec_context" != x"yes" -o \
x"$ac_cv_func_ext_gss_inquire_sec_context_by_oid" != x"yes"
diff --git a/source3/include/krb5_protos.h b/source3/include/krb5_protos.h
index 1ec077c..c2d4517 100644
--- a/source3/include/krb5_protos.h
+++ b/source3/include/krb5_protos.h
@@ -65,8 +65,6 @@ void krb5_free_unparsed_name(krb5_context ctx, char *val);
/* Samba wrapper function for krb5 functionality. */
bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr);
int create_kerberos_key_from_string(krb5_context context, krb5_principal host_princ, krb5_data *password, krb5_keyblock *key, krb5_enctype enctype, bool no_salt);
-bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
-krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt);
krb5_error_code get_kerberos_allowed_etypes(krb5_context context, krb5_enctype **enctypes);
bool get_krb5_smb_session_key(TALLOC_CTX *mem_ctx,
krb5_context context,
@@ -77,19 +75,6 @@ krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context, kr
void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype);
bool kerberos_compatible_enctypes(krb5_context context, krb5_enctype enctype1, krb5_enctype enctype2);
void kerberos_free_data_contents(krb5_context context, krb5_data *pdata);
-time_t get_authtime_from_tkt(krb5_ticket *tkt);
-krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
- const krb5_data *inbuf,
- krb5_kvno *kvno,
- krb5_enctype *enctype);
-krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
- krb5_auth_context *auth_context,
- const krb5_data *inbuf,
- krb5_const_principal server,
- krb5_keytab keytab,
- krb5_flags *ap_req_options,
- krb5_ticket **ticket,
- krb5_keyblock **keyblock);
krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
const char *name,
krb5_principal *principal);
@@ -149,6 +134,5 @@ int cli_krb5_get_ticket(TALLOC_CTX *mem_ctx,
bool unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
DATA_BLOB *edata,
DATA_BLOB *edata_out);
-bool unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data);
#endif /* _INCLUDE_KRB5_PROTOS_H_ */
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 779745a..e08c175 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -858,7 +858,6 @@ bool spnego_parse_negTokenInit(TALLOC_CTX *ctx,
char **principal,
DATA_BLOB *secblob);
DATA_BLOB spnego_gen_krb5_wrap(TALLOC_CTX *ctx, const DATA_BLOB ticket, const uint8 tok_id[2]);
-bool spnego_parse_krb5_wrap(TALLOC_CTX *ctx, DATA_BLOB blob, DATA_BLOB *ticket, uint8 tok_id[2]);
int spnego_gen_krb5_negTokenInit(TALLOC_CTX *ctx,
const char *principal, int time_offset,
DATA_BLOB *targ,
diff --git a/source3/libads/authdata.c b/source3/libads/authdata.c
index 44279a2..5a8ca28 100644
--- a/source3/libads/authdata.c
+++ b/source3/libads/authdata.c
@@ -26,15 +26,90 @@
#include "librpc/gen_ndr/ndr_krb5pac.h"
#include "smb_krb5.h"
#include "libads/kerberos_proto.h"
+#include "auth/common_auth.h"
+#include "lib/param/param.h"
+#include "librpc/crypto/gse.h"
+#include "auth/gensec/gensec.h"
+#include "../libcli/auth/spnego.h"
#ifdef HAVE_KRB5
+struct smb_krb5_context;
+
/****************************************************************
-Given a username, password and other details, return the
-PAC_LOGON_INFO (the structure containing the important user
-information such as groups).
+Callback to get the PAC_LOGON_INFO from the blob
****************************************************************/
+static NTSTATUS kerberos_fetch_pac(struct auth4_context *auth_ctx,
+ TALLOC_CTX *mem_ctx,
+ struct smb_krb5_context *smb_krb5_context,
+ DATA_BLOB *pac_blob,
+ const char *princ_name,
+ const struct tsocket_address *remote_address,
+ uint32_t session_info_flags,
+ struct auth_session_info **session_info)
+{
+ TALLOC_CTX *tmp_ctx;
+ struct PAC_DATA *pac_data = NULL;
+ struct PAC_LOGON_INFO *logon_info = NULL;
+ unsigned int i;
+ NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
+
+ tmp_ctx = talloc_new(mem_ctx);
+ if (!tmp_ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (pac_blob) {
+ status = kerberos_decode_pac(tmp_ctx,
+ *pac_blob,
+ NULL, NULL, NULL, NULL, 0, &pac_data);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto done;
+ }
+
+ /* get logon name and logon info */
+ for (i = 0; i < pac_data->num_buffers; i++) {
+ struct PAC_BUFFER *data_buf = &pac_data->buffers[i];
+
+ switch (data_buf->type) {
+ case PAC_TYPE_LOGON_INFO:
+ if (!data_buf->info) {
+ break;
+ }
+ logon_info = data_buf->info->logon_info.info;
+ break;
+ default:
+ break;
+ }
+ }
+ if (!logon_info) {
+ DEBUG(1, ("Invalid PAC data, missing logon info!\n"));
+ status = NT_STATUS_NOT_FOUND;
+ goto done;
+ }
+ }
+ talloc_set_name_const(logon_info, "struct PAC_LOGON_INFO");
+
+ auth_ctx->private_data = talloc_steal(auth_ctx, logon_info);
+ *session_info = talloc_zero(mem_ctx, struct auth_session_info);
+ if (!*session_info) {
+ status = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ status = NT_STATUS_OK;
+
+done:
+ TALLOC_FREE(tmp_ctx);
+ return status;
+}
+
+/*
+ * Given the username/password, do a kinit, store the ticket in
+ * cache_name if specified, and return the PAC_LOGON_INFO (the
+ * structure containing the important user information such as
+ * groups).
+ */
NTSTATUS kerberos_return_pac(TALLOC_CTX *mem_ctx,
const char *name,
const char *pass,
@@ -46,20 +121,29 @@ NTSTATUS kerberos_return_pac(TALLOC_CTX *mem_ctx,
bool add_netbios_addr,
time_t renewable_time,
const char *impersonate_princ_s,
- struct PAC_LOGON_INFO **logon_info)
+ struct PAC_LOGON_INFO **_logon_info)
{
krb5_error_code ret;
NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
- DATA_BLOB tkt, ap_rep, sesskey1, sesskey2;
- char *client_princ_out = NULL;
+ DATA_BLOB tkt, tkt_wrapped, ap_rep, sesskey1;
const char *auth_princ = NULL;
const char *local_service = NULL;
const char *cc = "MEMORY:kerberos_return_pac";
+ struct auth_session_info *session_info;
+ struct gensec_security *gensec_server_context;
+
+ struct gensec_settings *gensec_settings;
+ size_t idx = 0;
+ struct auth4_context *auth_context;
+ struct loadparm_context *lp_ctx;
+ struct PAC_LOGON_INFO *logon_info = NULL;
+
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+ NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
ZERO_STRUCT(tkt);
ZERO_STRUCT(ap_rep);
ZERO_STRUCT(sesskey1);
- ZERO_STRUCT(sesskey2);
if (!name || !pass) {
return NT_STATUS_INVALID_PARAMETER;
@@ -137,28 +221,92 @@ NTSTATUS kerberos_return_pac(TALLOC_CTX *mem_ctx,
status = krb5_to_nt_status(ret);
goto out;
}
- status = ads_verify_ticket(mem_ctx,
- lp_realm(),
- time_offset,
- &tkt,
- &client_princ_out,
- logon_info,
- &ap_rep,
- &sesskey2,
- False);
+
+ /* wrap that up in a nice GSS-API wrapping */
+ tkt_wrapped = spnego_gen_krb5_wrap(tmp_ctx, tkt, TOK_ID_KRB_AP_REQ);
+ if (tkt_wrapped.data == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+
+ auth_context = talloc_zero(tmp_ctx, struct auth4_context);
+ if (auth_context == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+ auth_context->generate_session_info_pac = kerberos_fetch_pac;
+
+ lp_ctx = loadparm_init_s3(tmp_ctx, loadparm_s3_context());
+ if (lp_ctx == NULL) {
+ status = NT_STATUS_INVALID_SERVER_STATE;
+ DEBUG(10, ("loadparm_init_s3 failed\n"));
+ goto out;
+ }
+
+ gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
+ if (lp_ctx == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ DEBUG(10, ("lpcfg_gensec_settings failed\n"));
+ goto out;
+ }
+
+ gensec_settings->backends = talloc_zero_array(gensec_settings,
+ struct gensec_security_ops *, 2);
+ if (gensec_settings->backends == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+
+ gensec_init();
+
+ gensec_settings->backends[idx++] = &gensec_gse_krb5_security_ops;
+
+ status = gensec_server_start(tmp_ctx, gensec_settings,
+ auth_context, &gensec_server_context);
+
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1,("ads_verify_ticket failed: %s\n",
- nt_errstr(status)));
+ DEBUG(1, (__location__ "Failed to start server-side GENSEC to validate a Kerberos ticket: %s\n", nt_errstr(status)));
goto out;
}
- if (!*logon_info) {
+ talloc_unlink(tmp_ctx, lp_ctx);
+ talloc_unlink(tmp_ctx, gensec_settings);
+ talloc_unlink(tmp_ctx, auth_context);
+
+ status = gensec_start_mech_by_oid(gensec_server_context, GENSEC_OID_KERBEROS5);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, (__location__ "Failed to start server-side GENSEC krb5 to validate a Kerberos ticket: %s\n", nt_errstr(status)));
+ goto out;
+ }
+
+ /* Do a client-server update dance */
+ status = gensec_update(gensec_server_context, tmp_ctx, NULL, tkt_wrapped, &ap_rep);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("gensec_update() failed: %s\n", nt_errstr(status)));
+ goto out;
+ }
+
+ /* Now return the PAC information to the callers. We ingore
+ * the session_info and instead pick out the PAC via the
+ * private_data on the auth_context */
+ status = gensec_session_info(gensec_server_context, tmp_ctx, &session_info);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Unable to obtain PAC via gensec_session_info\n"));
+ goto out;
+ }
+
+ logon_info = talloc_get_type_abort(gensec_server_context->auth_context->private_data,
+ struct PAC_LOGON_INFO);
+ if (logon_info == NULL) {
DEBUG(1,("no PAC\n"));
status = NT_STATUS_INVALID_PARAMETER;
goto out;
}
+ *_logon_info = talloc_move(mem_ctx, &logon_info);
+
out:
+ talloc_free(tmp_ctx);
if (cc != cache_name) {
ads_kdestroy(cc);
}
@@ -166,9 +314,6 @@ out:
data_blob_free(&tkt);
data_blob_free(&ap_rep);
data_blob_free(&sesskey1);
- data_blob_free(&sesskey2);
-
- TALLOC_FREE(client_princ_out);
return status;
}
diff --git a/source3/libads/kerberos_proto.h b/source3/libads/kerberos_proto.h
index 094f38d..6a7811d 100644
--- a/source3/libads/kerberos_proto.h
+++ b/source3/libads/kerberos_proto.h
@@ -34,18 +34,6 @@ struct PAC_LOGON_INFO;
#include "libads/ads_status.h"
-/* The following definitions come from libads/kerberos_verify.c */
-
-NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
- const char *realm,
- time_t time_offset,
- const DATA_BLOB *ticket,
- char **principal,
- struct PAC_LOGON_INFO **logon_info,
- DATA_BLOB *ap_rep,
- DATA_BLOB *session_key,
- bool use_replay_cache);
-
/* The following definitions come from libads/kerberos.c */
int kerberos_kinit_password_ext(const char *principal,
diff --git a/source3/libads/kerberos_verify.c b/source3/libads/kerberos_verify.c
deleted file mode 100644
index 0c44db9..0000000
--- a/source3/libads/kerberos_verify.c
+++ /dev/null
@@ -1,776 +0,0 @@
-/*
- Unix SMB/CIFS implementation.
- kerberos utility library
- Copyright (C) Andrew Tridgell 2001
- Copyright (C) Remus Koos 2001
- Copyright (C) Luke Howard 2003
- Copyright (C) Guenther Deschner 2003, 2005
- Copyright (C) Jim McDonough (jmcd at us.ibm.com) 2003
- Copyright (C) Andrew Bartlett <abartlet at samba.org> 2004-2005
- Copyright (C) Jeremy Allison 2007
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 3 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program. If not, see <http://www.gnu.org/licenses/>.
-*/
-
-#include "includes.h"
-#include "smb_krb5.h"
-#include "libads/kerberos_proto.h"
-#include "secrets.h"
-#include "../librpc/gen_ndr/krb5pac.h"
-
-#ifdef HAVE_KRB5
-
-#if !defined(HAVE_KRB5_PRINC_COMPONENT)
-const krb5_data *krb5_princ_component(krb5_context, krb5_principal, int );
-#endif
-
-static bool ads_dedicated_keytab_verify_ticket(krb5_context context,
- krb5_auth_context auth_context,
- const DATA_BLOB *ticket,
- krb5_ticket **pp_tkt,
--
Samba Shared Repository
More information about the samba-cvs
mailing list