libcli/auth Move krb5 wrapper functions from s3 into common

This requires a small rework of the build system to ensure that the
correct #define statements are made in both the s3 and top level
builds.  We now define the various HAVE_ macros in config.h at all
times, using heimdal_build/wscript_configure when that is in use.

Andrew Bartlett

5 files changed, 5 insertions, 161 deletions

diff --git a/source3/Makefile.in b/source3/Makefile.in
index 0e74805417..e754a43270 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -576,7 +576,7 @@ SCHANNEL_OBJ = ../libcli/auth/credentials.o \
 	       $(LIBNDR_SCHANNEL_OBJ)
 
 LIBSMB_OBJ = libsmb/clientgen.o libsmb/cliconnect.o libsmb/clifile.o \
-	     libsmb/clikrb5.o libsmb/clispnego.o \
+	     libsmb/clikrb5.o ../libcli/auth/krb5_wrap.o libsmb/clispnego.o \
 	     ../libcli/auth/spnego_parse.o \
 	     ../lib/util/asn1.o \
 	     libsmb/clirap.o libsmb/clierror.o libsmb/climessage.o \
@@ -1476,7 +1476,7 @@ TDBTORTURE_OBJ = @tdbdir@/tools/tdbtorture.o $(LIBREPLACE_OBJ) \
 NTLM_AUTH_OBJ1 = utils/ntlm_auth.o utils/ntlm_auth_diagnostics.o
 
 NTLM_AUTH_OBJ = ${NTLM_AUTH_OBJ1} $(LIBSAMBA_OBJ) $(POPT_LIB_OBJ) \
-		../lib/util/asn1.o ../libcli/auth/spnego_parse.o libsmb/clikrb5.o libads/kerberos.o \
+		../lib/util/asn1.o ../libcli/auth/spnego_parse.o libsmb/clikrb5.o ../libcli/auth/krb5_wrap.o libads/kerberos.o \
 		libsmb/samlogon_cache.o \
 		$(LIBADS_SERVER_OBJ) \
 		$(PASSDB_OBJ) $(LIBTSOCKET_OBJ) $(GROUPDB_OBJ) \
diff --git a/source3/include/smb_krb5.h b/source3/include/smb_krb5.h
index adbb0debc3..042b7ebe40 100644
--- a/source3/include/smb_krb5.h
+++ b/source3/include/smb_krb5.h
@@ -10,9 +10,7 @@
 #define KRB5_DEPRECATED
 #endif
 
-#if HAVE_KRB5_H
-#include <krb5.h>
-#endif
+#include "libcli/auth/krb5_wrap.h"
 
 #if HAVE_GSSAPI_GSSAPI_H
 #include <gssapi/gssapi.h>
@@ -22,10 +20,6 @@
 #include <gssapi.h>
 #endif
 
-#if HAVE_COM_ERR_H
-#include <com_err.h>
-#endif
-
 #ifndef KRB5_ADDR_NETBIOS
 #define KRB5_ADDR_NETBIOS 0x14
 #endif
diff --git a/source3/libsmb/clikrb5.c b/source3/libsmb/clikrb5.c
index 5e1f704921..b341ff4be6 100644
--- a/source3/libsmb/clikrb5.c
+++ b/source3/libsmb/clikrb5.c
@@ -223,53 +223,6 @@ krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx,
 #error UNKNOWN_ADDRTYPE
 #endif
 
-#if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
-static int create_kerberos_key_from_string_direct(krb5_context context,
-						  krb5_principal host_princ,
-						  krb5_data *password,
-						  krb5_keyblock *key,
-						  krb5_enctype enctype)
-{
-	int ret = 0;
-	krb5_data salt;
-	krb5_encrypt_block eblock;
-
-	ret = krb5_principal2salt(context, host_princ, &salt);
-	if (ret) {
-		DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
-		return ret;
-	}
-	krb5_use_enctype(context, &eblock, enctype);
-	ret = krb5_string_to_key(context, &eblock, key, password, &salt);
-	SAFE_FREE(salt.data);
-
-	return ret;
-}
-#elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
-static int create_kerberos_key_from_string_direct(krb5_context context,
-						  krb5_principal host_princ,
-						  krb5_data *password,
-						  krb5_keyblock *key,
-						  krb5_enctype enctype)
-{
-	int ret;
-	krb5_salt salt;
-
-	ret = krb5_get_pw_salt(context, host_princ, &salt);
-	if (ret) {
-		DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
-		return ret;
-	}
-
-	ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
-	krb5_free_salt(context, salt);
-
-	return ret;
-}
-#else
-#error UNKNOWN_CREATE_KEY_FUNCTIONS
-#endif
-
  int create_kerberos_key_from_string(krb5_context context,
 					krb5_principal host_princ,
 					krb5_data *password,
@@ -584,17 +537,6 @@ bool unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_
 }
 #endif
 
- void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
-{
-#if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
-	if (pdata->data) {
-		krb5_free_data_contents(context, pdata);
-	}
-#else
-	SAFE_FREE(pdata->data);
-#endif
-}
-
  void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
 {
 #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
@@ -1068,22 +1010,6 @@ done:
 }
 #endif
 
- krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
-{
-/* Try krb5_free_keytab_entry_contents first, since 
- * MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and 
- * krb5_kt_free_entry but only has a prototype for the first, while the 
- * second is considered private. 
- */
-#if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
-	return krb5_free_keytab_entry_contents(context, kt_entry);
-#elif defined(HAVE_KRB5_KT_FREE_ENTRY)
-	return krb5_kt_free_entry(context, kt_entry);
-#else
-#error UNKNOWN_KT_FREE_FUNCTION
-#endif
-}
-
  void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
 				     struct PAC_SIGNATURE_DATA *sig)
 {
diff --git a/source3/wscript b/source3/wscript
index cf96b39107..ffcecca195 100644
--- a/source3/wscript
+++ b/source3/wscript
@@ -799,83 +799,7 @@ return krb5_kt_resolve(context, "WRFILE:api", &keytab);
         'HAVE_KRB5_DEPRECATED_WITH_IDENTIFIER', addmain=False,
         link=False,
         msg="Checking for KRB5_DEPRECATED define taking an identifier")
-    elif conf.env.toplevel_build:
-        # setup the right defines for a in-tree heimdal build
-        Logs.info("Using in-tree heimdal kerberos defines")
-        conf.define('HAVE_GSSAPI', 1)
-        conf.define('HAVE_GSSAPI_GSSAPI_H', 1)
-        conf.define('HAVE_AP_OPTS_USE_SUBKEY', 1)
-        conf.define('HAVE_KRB5_ADDRESSES', 1)
-        conf.define('HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK', 1)
-        conf.define('HAVE_KRB5_SET_REAL_TIME', 1)
-        conf.define('HAVE_COM_ERR_H', 1)
-        conf.define('HAVE_ADDR_TYPE_IN_KRB5_ADDRESS', 1)
-        conf.define('HAVE_GSS_DISPLAY_STATUS', 1)
-        conf.define('HAVE_LIBGSSAPI', 1)
-        conf.define('HAVE_ADDR_TYPE_IN_KRB5_ADDRESS', 1)
-        conf.define('HAVE_CHECKSUM_IN_KRB5_CHECKSUM', 1)
-        conf.define('HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE', 0)
-        conf.define('HAVE_DECL_KRB5_GET_CREDENTIALS_FOR_USER', 0)
-        conf.define('HAVE_E_DATA_POINTER_IN_KRB5_ERROR', 1)
-        conf.define('HAVE_INITIALIZE_KRB5_ERROR_TABLE', 1)
-        conf.define('HAVE_KRB5_ADDRESSES', 1)
-        conf.define('HAVE_KRB5_AUTH_CON_SETKEY', 1)
-        conf.define('HAVE_KRB5_CRYPTO', 1)
-        conf.define('HAVE_KRB5_CRYPTO_DESTROY', 1)
-        conf.define('HAVE_KRB5_CRYPTO_INIT', 1)
-        conf.define('HAVE_KRB5_C_ENCTYPE_COMPARE', 1)
-        conf.define('HAVE_KRB5_C_VERIFY_CHECKSUM', 1)
-        conf.define('HAVE_FREE_AP_REQ', 1)
-        conf.define('HAVE_KRB5_DECODE_AP_REQ', 1)
-        conf.define('HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS', 1)
-        conf.define('HAVE_KRB5_ENCTYPE_TO_STRING', 1)
-        conf.define('HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG', 1)
-        conf.define('HAVE_KRB5_FREE_ERROR_CONTENTS', 1)
-        conf.define('HAVE_KRB5_FREE_HOST_REALM', 1)
-        conf.define('HAVE_KRB5_FWD_TGT_CREDS', 1)
-        conf.define('HAVE_KRB5_GET_CREDS', 1)
-        conf.define('HAVE_KRB5_GET_CREDS_OPT_ALLOC', 1)
-        conf.define('HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE', 1)
-        conf.define('HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES', 1)
-        conf.define('HAVE_KRB5_GET_HOST_REALM', 1)
-        conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC', 1)
-        conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_FREE', 1)
-        conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR', 1)
-        conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST', 1)
-        conf.define('HAVE_KRB5_GET_KDC_CRED', 1)
-        conf.define('HAVE_KRB5_GET_PW_SALT', 1)
-        conf.define('HAVE_KRB5_GET_RENEWED_CREDS', 1)
-        conf.define('HAVE_KRB5_KEYBLOCK_KEYVALUE', 1)
-        conf.define('HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK', 1)
-        conf.define('HAVE_KRB5_KRBHST_GET_ADDRINFO', 1)
-        conf.define('HAVE_KRB5_KRBHST_INIT', 1)
-        conf.define('HAVE_KRB5_KT_COMPARE', 1)
-        conf.define('HAVE_KRB5_KT_FREE_ENTRY', 1)
-        conf.define('HAVE_KRB5_KU_OTHER_CKSUM', 1)
-        conf.define('HAVE_KRB5_LOCATE_PLUGIN_H', 1)
-        conf.define('HAVE_KRB5_MK_REQ_EXTENDED', 1)
-        conf.define('HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM', 1)
-        conf.define('HAVE_KRB5_PRINCIPAL_GET_COMP_STRING', 1)
-        conf.define('HAVE_KRB5_PRINCIPAL_GET_REALM', 1)
-        conf.define('HAVE_KRB5_REALM_TYPE', 1)
-        conf.define('HAVE_KRB5_SESSION_IN_CREDS', 1)
-        conf.define('HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES', 1)
-        conf.define('HAVE_KRB5_SET_REAL_TIME', 1)
-        conf.define('HAVE_KRB5_STRING_TO_KEY', 1)
-        conf.define('HAVE_KRB5_STRING_TO_KEY_SALT', 1)
-        conf.define('HAVE_KRB5_VERIFY_CHECKSUM', 1)
-        conf.define('HAVE_LIBKRB5', 1)
-        conf.define('KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT', 1)
-        conf.define('KRB5_VERIFY_CHECKSUM_ARGS', 6)
-        conf.define('HAVE_ETYPE_IN_ENCRYPTEDDATA', 1)
-        conf.define('KRB5_PRINC_REALM_RETURNS_REALM', 1)
-        conf.define('HAVE_KRB5_PRINCIPAL_GET_REALM', 1)
-        conf.define('HAVE_KRB5_H', 1)
-        conf.define('HAVE_ENCTYPE_ARCFOUR_HMAC_MD5', 1)
-        conf.define('HAVE_AP_OPTS_USE_SUBKEY', 1)
-        conf.define('HAVE_ENCTYPE_ARCFOUR_HMAC_MD5', 1)
-        conf.define('HAVE_ENCTYPE_ARCFOUR_HMAC', 1)
-    else:
+    elif not conf.env.toplevel_build:
         conf.SET_TARGET_TYPE('krb5', 'EMPTY')
         conf.SET_TARGET_TYPE('gssapi', 'EMPTY')
         conf.SET_TARGET_TYPE('gssapi_krb5', 'EMPTY')
diff --git a/source3/wscript_build b/source3/wscript_build
index 24939c4004..0b924cad4d 100755
--- a/source3/wscript_build
+++ b/source3/wscript_build
@@ -775,7 +775,7 @@ bld.SAMBA3_SUBSYSTEM('POPT_SAMBA3',
 
 bld.SAMBA3_SUBSYSTEM('KRBCLIENT',
                     source=KRBCLIENT_SRC,
-                    public_deps='krb5 k5crypto com_err gssapi gssapi_krb5',
+                    public_deps='KRB5_WRAP krb5 k5crypto com_err gssapi gssapi_krb5',
                     vars=locals())
 
 bld.SAMBA3_LIBRARY('samba3core',