summaryrefslogtreecommitdiff
path: root/source4/auth/kerberos
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2005-09-17 01:11:50 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 13:38:13 -0500
commitf3bce652c8c33712ffbb6c0a731f61b05f9d4be0 (patch)
treeb57b78a83e15e65d15ecb0ffa37efa1bab079708 /source4/auth/kerberos
parent3a4da8c0dbe1d50ca4de013fdb7c860a5196f4ca (diff)
downloadsamba-f3bce652c8c33712ffbb6c0a731f61b05f9d4be0.tar.gz
samba-f3bce652c8c33712ffbb6c0a731f61b05f9d4be0.tar.bz2
samba-f3bce652c8c33712ffbb6c0a731f61b05f9d4be0.zip
r10286: This patch is ugly and disgusting, but for now it works better than the other
ideas I have had. When I get a full list of things I want to do to a krb5_context I'll either add gsskrb5_ wrappers, or a way of speicfying the krb5 context per gssapi context. (I want to ensure that the only krb5_context variables created while executing Samba4 are via our wrapper). Andrew Bartlett (This used to be commit 8a22d46e70e9f863831aba0c9913d195f833d625)
Diffstat (limited to 'source4/auth/kerberos')
-rw-r--r--source4/auth/kerberos/clikrb5.c103
-rw-r--r--source4/auth/kerberos/config.mk3
-rw-r--r--source4/auth/kerberos/kerberos.h15
-rw-r--r--source4/auth/kerberos/krb5_init_context.c126
-rw-r--r--source4/auth/kerberos/krb5_init_context.h29
5 files changed, 158 insertions, 118 deletions
diff --git a/source4/auth/kerberos/clikrb5.c b/source4/auth/kerberos/clikrb5.c
index e3f2057b44..85d60a1244 100644
--- a/source4/auth/kerberos/clikrb5.c
+++ b/source4/auth/kerberos/clikrb5.c
@@ -385,107 +385,4 @@ cleanup_princ:
return ret;
}
-
-static int smb_krb5_context_destory_1(void *ptr)
-{
- struct smb_krb5_context *ctx = ptr;
- krb5_free_context(ctx->krb5_context);
- return 0;
-}
-
-#ifdef HAVE_KRB5_LOG_CONTROL
-static int smb_krb5_context_destory_2(void *ptr)
-{
- struct smb_krb5_context *ctx = ptr;
-
- /* Otherwise krb5_free_context will try and close what we have already free()ed */
- krb5_set_warn_dest(ctx->krb5_context, NULL);
- krb5_closelog(ctx->krb5_context, ctx->logf);
- smb_krb5_context_destory_1(ptr);
- return 0;
-}
-
-/* We never close down the DEBUG system, and no need to unreference the use */
-static void smb_krb5_debug_close(void *private) {
- return;
-}
-
-static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private)
-{
- DEBUG(3, ("Kerberos: %s\n", msg));
-}
-
-#endif
-
- krb5_error_code smb_krb5_init_context(TALLOC_CTX *parent_ctx,
- struct smb_krb5_context **smb_krb5_context)
-{
- krb5_error_code ret;
- TALLOC_CTX *tmp_ctx;
-
- initialize_krb5_error_table();
-
- tmp_ctx = talloc_new(parent_ctx);
- *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context);
-
- if (!*smb_krb5_context || !tmp_ctx) {
- talloc_free(*smb_krb5_context);
- talloc_free(tmp_ctx);
- return ENOMEM;
- }
-
- ret = krb5_init_context(&(*smb_krb5_context)->krb5_context);
- if (ret) {
- DEBUG(1,("krb5_init_context failed (%s)\n",
- error_message(ret)));
- return ret;
- }
-
- talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destory_1);
-
- if (lp_realm() && *lp_realm()) {
- char *upper_realm = strupper_talloc(tmp_ctx, lp_realm());
- if (!upper_realm) {
- DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm()));
- talloc_free(tmp_ctx);
- return ENOMEM;
- }
- ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, lp_realm());
- if (ret) {
- DEBUG(1,("krb5_set_default_realm failed (%s)\n",
- smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
- talloc_free(tmp_ctx);
- return ret;
- }
- }
-
-#ifdef HAVE_KRB5_LOG_CONTROL
- /* TODO: Should we have a different name here? */
- ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf);
-
- if (ret) {
- DEBUG(1,("krb5_initlog failed (%s)\n",
- smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
- talloc_free(tmp_ctx);
- return ret;
- }
-
- talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destory_2);
-
- ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */,
- smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL);
- if (ret) {
- DEBUG(1,("krb5_addlog_func failed (%s)\n",
- smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
- talloc_free(tmp_ctx);
- return ret;
- }
- krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf);
-
-#endif
- talloc_steal(parent_ctx, *smb_krb5_context);
- talloc_free(tmp_ctx);
- return 0;
-}
-
#endif
diff --git a/source4/auth/kerberos/config.mk b/source4/auth/kerberos/config.mk
index 56ce64fdb1..cc31af44e7 100644
--- a/source4/auth/kerberos/config.mk
+++ b/source4/auth/kerberos/config.mk
@@ -7,7 +7,8 @@ ADD_OBJ_FILES = \
auth/kerberos/kerberos_verify.o \
auth/kerberos/kerberos_util.o \
auth/kerberos/kerberos_pac.o \
- auth/kerberos/gssapi_parse.o
+ auth/kerberos/gssapi_parse.o \
+ auth/kerberos/krb5_init_context.o
REQUIRED_SUBSYSTEMS = KERBEROS_LIB NDR_KRB5PAC
# End SUBSYSTEM KERBEROS
#################################
diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
index 9535094e2b..bc2a1babe9 100644
--- a/source4/auth/kerberos/kerberos.h
+++ b/source4/auth/kerberos/kerberos.h
@@ -21,19 +21,8 @@
#if defined(HAVE_KRB5)
-#if defined(HAVE_KRB5_INITLOG) && defined(HAVE_KRB5_ADDLOG_FUNC) && defined (HAVE_KRB5_SET_WARN_DEST) && defined(HAVE_KRB5_LOG_FACILITY)
-#define HAVE_KRB5_LOG_CONTROL
-#else
-#undef HAVE_KRB5_LOG_CONTROL
-#endif
+#include "auth/kerberos/krb5_init_context.h"
-struct smb_krb5_context {
- krb5_context krb5_context;
-#ifdef HAVE_KRB5_LOG_CONTROL
- krb5_log_facility *logf;
-#endif
-};
-
struct ccache_container {
struct smb_krb5_context *smb_krb5_context;
krb5_ccache ccache;
@@ -118,8 +107,6 @@ char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TAL
struct cli_credentials *credentials,
struct smb_krb5_context *smb_krb5_context,
krb5_ccache ccache);
-krb5_error_code smb_krb5_init_context(TALLOC_CTX *parent_ctx,
- struct smb_krb5_context **smb_krb5_context);
krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
struct cli_credentials *machine_account,
struct smb_krb5_context *smb_krb5_context,
diff --git a/source4/auth/kerberos/krb5_init_context.c b/source4/auth/kerberos/krb5_init_context.c
new file mode 100644
index 0000000000..2a8f0624da
--- /dev/null
+++ b/source4/auth/kerberos/krb5_init_context.c
@@ -0,0 +1,126 @@
+/*
+ Unix SMB/CIFS implementation.
+ Wrapper for krb5_init_context
+
+ Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "system/kerberos.h"
+#include "auth/kerberos/kerberos.h"
+
+static int smb_krb5_context_destroy_1(void *ptr)
+{
+ struct smb_krb5_context *ctx = ptr;
+ krb5_free_context(ctx->krb5_context);
+ return 0;
+}
+
+static int smb_krb5_context_destroy_2(void *ptr)
+{
+ struct smb_krb5_context *ctx = ptr;
+
+ /* Otherwise krb5_free_context will try and close what we have already free()ed */
+ krb5_set_warn_dest(ctx->krb5_context, NULL);
+ krb5_closelog(ctx->krb5_context, ctx->logf);
+ smb_krb5_context_destroy_1(ptr);
+ return 0;
+}
+
+/* We never close down the DEBUG system, and no need to unreference the use */
+static void smb_krb5_debug_close(void *private) {
+ return;
+}
+
+static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private)
+{
+ DEBUG(3, ("Kerberos: %s\n", msg));
+}
+
+ krb5_error_code smb_krb5_init_context(void *parent_ctx,
+ struct smb_krb5_context **smb_krb5_context)
+{
+ krb5_error_code ret;
+ TALLOC_CTX *tmp_ctx;
+
+ initialize_krb5_error_table();
+
+ tmp_ctx = talloc_new(parent_ctx);
+ *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context);
+
+ if (!*smb_krb5_context || !tmp_ctx) {
+ talloc_free(*smb_krb5_context);
+ talloc_free(tmp_ctx);
+ return ENOMEM;
+ }
+
+ ret = krb5_init_context(&(*smb_krb5_context)->krb5_context);
+ if (ret) {
+ DEBUG(1,("krb5_init_context failed (%s)\n",
+ error_message(ret)));
+ return ret;
+ }
+
+ talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_1);
+
+ if (lp_realm() && *lp_realm()) {
+ char *upper_realm = strupper_talloc(tmp_ctx, lp_realm());
+ if (!upper_realm) {
+ DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm()));
+ talloc_free(tmp_ctx);
+ return ENOMEM;
+ }
+ ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, lp_realm());
+ if (ret) {
+ DEBUG(1,("krb5_set_default_realm failed (%s)\n",
+ smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
+ talloc_free(tmp_ctx);
+ return ret;
+ }
+ }
+
+ /* TODO: Should we have a different name here? */
+ ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf);
+
+ if (ret) {
+ DEBUG(1,("krb5_initlog failed (%s)\n",
+ smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
+ talloc_free(tmp_ctx);
+ return ret;
+ }
+
+ talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_2);
+
+ ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */,
+ smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL);
+ if (ret) {
+ DEBUG(1,("krb5_addlog_func failed (%s)\n",
+ smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
+ talloc_free(tmp_ctx);
+ return ret;
+ }
+ krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf);
+
+ talloc_steal(parent_ctx, *smb_krb5_context);
+ talloc_free(tmp_ctx);
+ return 0;
+}
+
+ void smb_krb5_free_context(struct smb_krb5_context *smb_krb5_context)
+{
+ talloc_free(smb_krb5_context);
+}
diff --git a/source4/auth/kerberos/krb5_init_context.h b/source4/auth/kerberos/krb5_init_context.h
new file mode 100644
index 0000000000..8120b8c96d
--- /dev/null
+++ b/source4/auth/kerberos/krb5_init_context.h
@@ -0,0 +1,29 @@
+/*
+ Unix SMB/CIFS implementation.
+ simple kerberos5 routines for active directory
+ Copyright (C) Andrew Bartlett 2005
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+struct smb_krb5_context {
+ krb5_context krb5_context;
+ krb5_log_facility *logf;
+};
+
+krb5_error_code smb_krb5_init_context(void *parent_ctx,
+ struct smb_krb5_context **smb_krb5_context);
+void smb_krb5_free_context(struct smb_krb5_context *smb_krb5_context);
+