[SCM] Samba Shared Repository - branch master updated
Jeremy Allison
jra at samba.org
Sun Jun 19 01:32:03 UTC 2016
The branch, master has been updated
via 3de3f64 s4-kdc: Move KDC packet handling functions to kdc-server.c
via 3da8932 s4-kdc: Create a kdc-proxy.h header file
via 379ed08 s4-kdc: Rename proxy-heimdal.c to kdc-proxy.c
via dc350a3 s4-kdc: Move KDC socket structs to krb5-server.h
via f110662 s4-kdc: Move kdc_process_fn_t declaration to kdc-server.h
via 13661b6 s4-kdc: Move definitions to kdc-server.h
via cafd2d3 s4-kdc: Use better and simpler names for the kdc_process_ret enum
via 0314796 s4-kdc: Put the heimdal kdc config into a private data pointer
via 5ddfe5e s4-kdc: Use smb_krb5_mk_error() in kpasswd implementation
via c5a02e8 s4-kdc: Use smb_krb5_mk_error() in kdc implemenation
via 8a0b058 krb5_wrap: Add smb_krb5_mk_error()
via de88bfc s4-kdc: Rename heimdal KDC files
from a978113 ctdb-tests: Improve ctdb protocol tests
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 3de3f643a870239a7a410a13065a86053992f7fa
Author: Andreas Schneider <asn at samba.org>
Date: Fri Jun 10 11:29:20 2016 +0200
s4-kdc: Move KDC packet handling functions to kdc-server.c
Create an Kerberos implmentation independent KDC-SERVER subsystem so we
can use it to implement a kpasswd server with MIT Kerberos in future.
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
Autobuild-User(master): Jeremy Allison <jra at samba.org>
Autobuild-Date(master): Sun Jun 19 03:31:32 CEST 2016 on sn-devel-144
commit 3da8932e4ce4c289daf7bb102c0e5f54413b568c
Author: Andreas Schneider <asn at samba.org>
Date: Mon Jun 13 11:20:44 2016 +0200
s4-kdc: Create a kdc-proxy.h header file
This makes the it Kerberos implmentation independent.
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit 379ed087545c01c6d897e7daaf4861edec32c3bf
Author: Andreas Schneider <asn at samba.org>
Date: Mon Jun 13 11:19:51 2016 +0200
s4-kdc: Rename proxy-heimdal.c to kdc-proxy.c
The plan is to have a KDC-SERVER subsystem later.
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit dc350a349ac8ae484074e0900129d817a017c11f
Author: Andreas Schneider <asn at samba.org>
Date: Fri Jun 10 11:23:20 2016 +0200
s4-kdc: Move KDC socket structs to krb5-server.h
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit f11066231052190467df8c7d0019c80e61c281b5
Author: Andreas Schneider <asn at samba.org>
Date: Fri Jun 10 14:06:10 2016 +0200
s4-kdc: Move kdc_process_fn_t declaration to kdc-server.h
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit 13661b6fb0806c871d858716394a85c0d3936ca0
Author: Andreas Schneider <asn at samba.org>
Date: Fri Jun 10 11:10:50 2016 +0200
s4-kdc: Move definitions to kdc-server.h
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit cafd2d365abd42193caa2b666ae443fdc8a9d0a6
Author: Andreas Schneider <asn at samba.org>
Date: Fri Jun 10 09:50:45 2016 +0200
s4-kdc: Use better and simpler names for the kdc_process_ret enum
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit 0314796113db86cb9ee3342e06e8e9e117fdd162
Author: Andreas Schneider <asn at samba.org>
Date: Fri Jun 10 09:42:33 2016 +0200
s4-kdc: Put the heimdal kdc config into a private data pointer
This allows us to make the struct general useable.
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit 5ddfe5ecd3e941f645619ec200d6e131763e4bb3
Author: Andreas Schneider <asn at samba.org>
Date: Tue Jun 14 16:31:32 2016 +0200
s4-kdc: Use smb_krb5_mk_error() in kpasswd implementation
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit c5a02e81ea423f02b402ae3d16c61054d8606158
Author: Andreas Schneider <asn at samba.org>
Date: Tue Jun 14 16:33:34 2016 +0200
s4-kdc: Use smb_krb5_mk_error() in kdc implemenation
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit 8a0b058ceedf4a568e3e5e272eef356abbe9bd08
Author: Andreas Schneider <asn at samba.org>
Date: Mon Jun 13 10:52:46 2016 +0200
krb5_wrap: Add smb_krb5_mk_error()
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit de88bfc770b5f281c0065a2e3e4b9c9106b03ea4
Author: Andreas Schneider <asn at samba.org>
Date: Fri Jun 10 09:12:39 2016 +0200
s4-kdc: Rename heimdal KDC files
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
-----------------------------------------------------------------------
Summary of changes:
lib/krb5_wrap/krb5_samba.c | 37 ++
lib/krb5_wrap/krb5_samba.h | 6 +
source4/kdc/kdc-glue.h | 52 +-
source4/kdc/kdc-heimdal.c | 460 ++++++++++++++
source4/kdc/{proxy.c => kdc-proxy.c} | 3 +-
source4/kdc/kdc-proxy.h | 45 ++
source4/kdc/{kdc.c => kdc-server.c} | 857 +++++++-------------------
source4/kdc/kdc-server.h | 82 +++
source4/kdc/{kpasswdd.c => kpasswd-heimdal.c} | 59 +-
source4/kdc/wscript_build | 16 +-
10 files changed, 893 insertions(+), 724 deletions(-)
create mode 100644 source4/kdc/kdc-heimdal.c
rename source4/kdc/{proxy.c => kdc-proxy.c} (99%)
create mode 100644 source4/kdc/kdc-proxy.h
rename source4/kdc/{kdc.c => kdc-server.c} (52%)
create mode 100644 source4/kdc/kdc-server.h
rename source4/kdc/{kpasswdd.c => kpasswd-heimdal.c} (95%)
Changeset truncated at 500 lines:
diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
index 3cb1cee..79e9450 100644
--- a/lib/krb5_wrap/krb5_samba.c
+++ b/lib/krb5_wrap/krb5_samba.c
@@ -138,6 +138,43 @@ bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
#error UNKNOWN_ADDRTYPE
#endif
+krb5_error_code smb_krb5_mk_error(krb5_context context,
+ krb5_error_code error_code,
+ const char *e_text,
+ krb5_data *e_data,
+ krb5_data *enc_err)
+{
+ krb5_error_code code = EINVAL;
+#ifdef SAMBA4_USES_HEIMDAL
+ code = krb5_mk_error(context,
+ error_code,
+ e_text,
+ e_data,
+ NULL, /* client */
+ NULL, /* server */
+ NULL, /* client_time */
+ NULL, /* client_usec */
+ enc_err);
+#else
+ krb5_error dec_err = {
+ .error = error_code,
+ };
+
+ if (e_text != NULL) {
+ dec_err.text.length = strlen(e_text);
+ dec_err.text.data = discard_const_p(e_text, char);
+ }
+ if (e_data != NULL) {
+ dec_err.e_data = *e_data;
+ }
+
+ code = krb5_mk_error(context,
+ &dec_err,
+ enc_err);
+#endif
+ return code;
+}
+
/**
* @brief Create a keyblock based on input parameters
*
diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h
index 15da9a1..41664f1 100644
--- a/lib/krb5_wrap/krb5_samba.h
+++ b/lib/krb5_wrap/krb5_samba.h
@@ -145,6 +145,12 @@ void krb5_free_unparsed_name(krb5_context ctx, char *val);
/* Samba wrapper functions for krb5 functionality. */
bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr);
+krb5_error_code smb_krb5_mk_error(krb5_context context,
+ krb5_error_code error_code,
+ const char *e_text,
+ krb5_data *e_data,
+ krb5_data *enc_err);
+
krb5_error_code get_kerberos_allowed_etypes(krb5_context context, krb5_enctype **enctypes);
bool get_krb5_smb_session_key(TALLOC_CTX *mem_ctx,
krb5_context context,
diff --git a/source4/kdc/kdc-glue.h b/source4/kdc/kdc-glue.h
index 591ddd1..c083b8c 100644
--- a/source4/kdc/kdc-glue.h
+++ b/source4/kdc/kdc-glue.h
@@ -29,58 +29,22 @@
#include <kdc.h>
#include <krb5/windc_plugin.h>
#include "kdc/samba_kdc.h"
+#include "kdc/kdc-server.h"
struct tsocket_address;
-/*
- top level context structure for the kdc server
-*/
-struct kdc_server {
- struct task_server *task;
- krb5_kdc_configuration *config;
- struct smb_krb5_context *smb_krb5_context;
- struct samba_kdc_base_context *base_ctx;
- struct ldb_context *samdb;
- bool am_rodc;
- uint32_t proxy_timeout;
-};
-
-enum kdc_process_ret {
- KDC_PROCESS_OK=0,
- KDC_PROCESS_FAILED,
- KDC_PROCESS_PROXY};
-
-enum kdc_process_ret kpasswdd_process(struct kdc_server *kdc,
- TALLOC_CTX *mem_ctx,
- DATA_BLOB *input,
- DATA_BLOB *reply,
- struct tsocket_address *peer_addr,
- struct tsocket_address *my_addr,
- int datagram_reply);
+kdc_code kpasswdd_process(struct kdc_server *kdc,
+ TALLOC_CTX *mem_ctx,
+ DATA_BLOB *input,
+ DATA_BLOB *reply,
+ struct tsocket_address *peer_addr,
+ struct tsocket_address *my_addr,
+ int datagram_reply);
/* from hdb-samba4.c */
NTSTATUS hdb_samba4_create_kdc(struct samba_kdc_base_context *base_ctx,
krb5_context context, struct HDB **db);
-/* from proxy.c */
-struct tevent_req *kdc_udp_proxy_send(TALLOC_CTX *mem_ctx,
- struct tevent_context *ev,
- struct kdc_server *kdc,
- uint16_t port,
- DATA_BLOB in);
-NTSTATUS kdc_udp_proxy_recv(struct tevent_req *req,
- TALLOC_CTX *mem_ctx,
- DATA_BLOB *out);
-
-struct tevent_req *kdc_tcp_proxy_send(TALLOC_CTX *mem_ctx,
- struct tevent_context *ev,
- struct kdc_server *kdc,
- uint16_t port,
- DATA_BLOB in);
-NTSTATUS kdc_tcp_proxy_recv(struct tevent_req *req,
- TALLOC_CTX *mem_ctx,
- DATA_BLOB *out);
-
/* from kdc-glue.c */
int kdc_check_pac(krb5_context krb5_context,
DATA_BLOB server_sig,
diff --git a/source4/kdc/kdc-heimdal.c b/source4/kdc/kdc-heimdal.c
new file mode 100644
index 0000000..be45073
--- /dev/null
+++ b/source4/kdc/kdc-heimdal.c
@@ -0,0 +1,460 @@
+/*
+ Unix SMB/CIFS implementation.
+
+ KDC Server startup
+
+ Copyright (C) Andrew Bartlett <abartlet at samba.org> 2005-2008
+ Copyright (C) Andrew Tridgell 2005
+ Copyright (C) Stefan Metzmacher 2005
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "smbd/process_model.h"
+#include "lib/tsocket/tsocket.h"
+#include "lib/messaging/irpc.h"
+#include "librpc/gen_ndr/ndr_irpc.h"
+#include "librpc/gen_ndr/ndr_krb5pac.h"
+#include "lib/socket/netif.h"
+#include "param/param.h"
+#include "kdc/kdc-server.h"
+#include "kdc/kdc-proxy.h"
+#include "kdc/kdc-glue.h"
+#include "kdc/pac-glue.h"
+#include "dsdb/samdb/samdb.h"
+#include "auth/session.h"
+#include "libds/common/roles.h"
+#include <kdc.h>
+#include <hdb.h>
+
+NTSTATUS server_service_kdc_init(void);
+
+extern struct krb5plugin_windc_ftable windc_plugin_table;
+
+/**
+ Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
+ calling conventions
+*/
+
+static kdc_code kdc_process(struct kdc_server *kdc,
+ TALLOC_CTX *mem_ctx,
+ DATA_BLOB *input,
+ DATA_BLOB *reply,
+ struct tsocket_address *peer_addr,
+ struct tsocket_address *my_addr,
+ int datagram_reply)
+{
+ int ret;
+ char *pa;
+ struct sockaddr_storage ss;
+ krb5_data k5_reply;
+ krb5_kdc_configuration *kdc_config =
+ (krb5_kdc_configuration *)kdc->private_data;
+
+ krb5_data_zero(&k5_reply);
+
+ krb5_kdc_update_time(NULL);
+
+ ret = tsocket_address_bsd_sockaddr(peer_addr, (struct sockaddr *) &ss,
+ sizeof(struct sockaddr_storage));
+ if (ret < 0) {
+ return KDC_ERROR;
+ }
+ pa = tsocket_address_string(peer_addr, mem_ctx);
+ if (pa == NULL) {
+ return KDC_ERROR;
+ }
+
+ DEBUG(10,("Received KDC packet of length %lu from %s\n",
+ (long)input->length - 4, pa));
+
+ ret = krb5_kdc_process_krb5_request(kdc->smb_krb5_context->krb5_context,
+ kdc_config,
+ input->data, input->length,
+ &k5_reply,
+ pa,
+ (struct sockaddr *) &ss,
+ datagram_reply);
+ if (ret == -1) {
+ *reply = data_blob(NULL, 0);
+ return KDC_ERROR;
+ }
+
+ if (ret == HDB_ERR_NOT_FOUND_HERE) {
+ *reply = data_blob(NULL, 0);
+ return KDC_PROXY_REQUEST;
+ }
+
+ if (k5_reply.length) {
+ *reply = data_blob_talloc(mem_ctx, k5_reply.data, k5_reply.length);
+ krb5_data_free(&k5_reply);
+ } else {
+ *reply = data_blob(NULL, 0);
+ }
+ return KDC_OK;
+}
+
+/*
+ setup our listening sockets on the configured network interfaces
+*/
+static NTSTATUS kdc_startup_interfaces(struct kdc_server *kdc, struct loadparm_context *lp_ctx,
+ struct interface *ifaces)
+{
+ const struct model_ops *model_ops;
+ int num_interfaces;
+ TALLOC_CTX *tmp_ctx = talloc_new(kdc);
+ NTSTATUS status;
+ int i;
+ uint16_t kdc_port = lpcfg_krb5_port(lp_ctx);
+ uint16_t kpasswd_port = lpcfg_kpasswd_port(lp_ctx);
+ bool done_wildcard = false;
+
+ /* within the kdc task we want to be a single process, so
+ ask for the single process model ops and pass these to the
+ stream_setup_socket() call. */
+ model_ops = process_model_startup("single");
+ if (!model_ops) {
+ DEBUG(0,("Can't find 'single' process model_ops\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ num_interfaces = iface_list_count(ifaces);
+
+ /* if we are allowing incoming packets from any address, then
+ we need to bind to the wildcard address */
+ if (!lpcfg_bind_interfaces_only(lp_ctx)) {
+ int num_binds = 0;
+ char **wcard = iface_list_wildcard(kdc);
+ NT_STATUS_HAVE_NO_MEMORY(wcard);
+ for (i=0; wcard[i]; i++) {
+ if (kdc_port) {
+ status = kdc_add_socket(kdc, model_ops,
+ "kdc", wcard[i], kdc_port,
+ kdc_process, false);
+ if (NT_STATUS_IS_OK(status)) {
+ num_binds++;
+ }
+ }
+
+ if (kpasswd_port) {
+ status = kdc_add_socket(kdc, model_ops,
+ "kpasswd", wcard[i], kpasswd_port,
+ kpasswdd_process, false);
+ if (NT_STATUS_IS_OK(status)) {
+ num_binds++;
+ }
+ }
+ }
+ talloc_free(wcard);
+ if (num_binds == 0) {
+ return NT_STATUS_INVALID_PARAMETER_MIX;
+ }
+ done_wildcard = true;
+ }
+
+ for (i=0; i<num_interfaces; i++) {
+ const char *address = talloc_strdup(tmp_ctx, iface_list_n_ip(ifaces, i));
+
+ if (kdc_port) {
+ status = kdc_add_socket(kdc, model_ops,
+ "kdc", address, kdc_port,
+ kdc_process, done_wildcard);
+ NT_STATUS_NOT_OK_RETURN(status);
+ }
+
+ if (kpasswd_port) {
+ status = kdc_add_socket(kdc, model_ops,
+ "kpasswd", address, kpasswd_port,
+ kpasswdd_process, done_wildcard);
+ NT_STATUS_NOT_OK_RETURN(status);
+ }
+ }
+
+ talloc_free(tmp_ctx);
+
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS kdc_check_generic_kerberos(struct irpc_message *msg,
+ struct kdc_check_generic_kerberos *r)
+{
+ struct PAC_Validate pac_validate;
+ DATA_BLOB srv_sig;
+ struct PAC_SIGNATURE_DATA kdc_sig;
+ struct kdc_server *kdc = talloc_get_type(msg->private_data, struct kdc_server);
+ krb5_kdc_configuration *kdc_config =
+ (krb5_kdc_configuration *)kdc->private_data;
+ enum ndr_err_code ndr_err;
+ int ret;
+ hdb_entry_ex ent;
+ krb5_principal principal;
+
+
+ /* There is no reply to this request */
+ r->out.generic_reply = data_blob(NULL, 0);
+
+ ndr_err = ndr_pull_struct_blob(&r->in.generic_request, msg, &pac_validate,
+ (ndr_pull_flags_fn_t)ndr_pull_PAC_Validate);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (pac_validate.MessageType != NETLOGON_GENERIC_KRB5_PAC_VALIDATE) {
+ /* We don't implement any other message types - such as certificate validation - yet */
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (pac_validate.ChecksumAndSignature.length != (pac_validate.ChecksumLength + pac_validate.SignatureLength)
+ || pac_validate.ChecksumAndSignature.length < pac_validate.ChecksumLength
+ || pac_validate.ChecksumAndSignature.length < pac_validate.SignatureLength ) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ srv_sig = data_blob_const(pac_validate.ChecksumAndSignature.data,
+ pac_validate.ChecksumLength);
+
+ ret = krb5_make_principal(kdc->smb_krb5_context->krb5_context, &principal,
+ lpcfg_realm(kdc->task->lp_ctx),
+ "krbtgt", lpcfg_realm(kdc->task->lp_ctx),
+ NULL);
+
+ if (ret != 0) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ ret = kdc_config->db[0]->hdb_fetch_kvno(kdc->smb_krb5_context->krb5_context,
+ kdc_config->db[0],
+ principal,
+ HDB_F_GET_KRBTGT | HDB_F_DECRYPT,
+ 0,
+ &ent);
+
+ if (ret != 0) {
+ hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
+ krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
+
+ return NT_STATUS_LOGON_FAILURE;
+ }
+
+ kdc_sig.type = pac_validate.SignatureType;
+ kdc_sig.signature = data_blob_const(&pac_validate.ChecksumAndSignature.data[pac_validate.ChecksumLength],
+ pac_validate.SignatureLength);
+
+ ret = kdc_check_pac(kdc->smb_krb5_context->krb5_context, srv_sig, &kdc_sig, &ent);
+
+ hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
+ krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
+
+ if (ret != 0) {
+ return NT_STATUS_LOGON_FAILURE;
+ }
+
+ return NT_STATUS_OK;
+}
+
+
+/*
+ startup the kdc task
+*/
+static void kdc_task_init(struct task_server *task)
+{
+ struct kdc_server *kdc;
+ krb5_kdc_configuration *kdc_config = NULL;
+ NTSTATUS status;
+ krb5_error_code ret;
+ struct interface *ifaces;
+ int ldb_ret;
+
+ switch (lpcfg_server_role(task->lp_ctx)) {
+ case ROLE_STANDALONE:
+ task_server_terminate(task, "kdc: no KDC required in standalone configuration", false);
+ return;
+ case ROLE_DOMAIN_MEMBER:
+ task_server_terminate(task, "kdc: no KDC required in member server configuration", false);
+ return;
+ case ROLE_DOMAIN_PDC:
+ case ROLE_DOMAIN_BDC:
+ task_server_terminate(task, "Cannot start KDC as a 'classic Samba' DC", true);
+ return;
+ case ROLE_ACTIVE_DIRECTORY_DC:
+ /* Yes, we want a KDC */
+ break;
+ }
+
+ load_interface_list(task, task->lp_ctx, &ifaces);
+
+ if (iface_list_count(ifaces) == 0) {
+ task_server_terminate(task, "kdc: no network interfaces configured", false);
+ return;
+ }
+
+ task_server_set_title(task, "task[kdc]");
+
+ kdc = talloc_zero(task, struct kdc_server);
+ if (kdc == NULL) {
+ task_server_terminate(task, "kdc: out of memory", true);
+ return;
+ }
+
+ kdc->task = task;
+
+
+ /* get a samdb connection */
+ kdc->samdb = samdb_connect(kdc, kdc->task->event_ctx, kdc->task->lp_ctx,
+ system_session(kdc->task->lp_ctx), 0);
+ if (!kdc->samdb) {
+ DEBUG(1,("kdc_task_init: unable to connect to samdb\n"));
+ task_server_terminate(task, "kdc: krb5_init_context samdb connect failed", true);
+ return;
+ }
+
+ ldb_ret = samdb_rodc(kdc->samdb, &kdc->am_rodc);
+ if (ldb_ret != LDB_SUCCESS) {
+ DEBUG(1, ("kdc_task_init: Cannot determine if we are an RODC: %s\n",
+ ldb_errstring(kdc->samdb)));
+ task_server_terminate(task, "kdc: krb5_init_context samdb RODC connect failed", true);
+ return;
+ }
+
+ kdc->proxy_timeout = lpcfg_parm_int(kdc->task->lp_ctx, NULL, "kdc", "proxy timeout", 5);
+
+ initialize_krb5_error_table();
+
+ ret = smb_krb5_init_context(kdc, task->lp_ctx, &kdc->smb_krb5_context);
+ if (ret) {
+ DEBUG(1,("kdc_task_init: krb5_init_context failed (%s)\n",
+ error_message(ret)));
+ task_server_terminate(task, "kdc: krb5_init_context failed", true);
+ return;
+ }
+
+ krb5_add_et_list(kdc->smb_krb5_context->krb5_context, initialize_hdb_error_table_r);
+
+ ret = krb5_kdc_get_config(kdc->smb_krb5_context->krb5_context,
+ &kdc_config);
+ if(ret) {
+ task_server_terminate(task, "kdc: failed to get KDC configuration", true);
+ return;
+ }
+
+ kdc_config->logf = (krb5_log_facility *)kdc->smb_krb5_context->pvt_log_data;
+ kdc_config->db = talloc(kdc, struct HDB *);
+ if (!kdc_config->db) {
+ task_server_terminate(task, "kdc: out of memory", true);
+ return;
+ }
+ kdc_config->num_db = 1;
--
Samba Shared Repository
More information about the samba-cvs
mailing list