auth: Move auth_session_info into IDL

This changes auth_session_info_transport to just be a wrapper, rather
than a copy that has to be kept in sync.

As auth_session_info was already wrapped in python, this required
changes to the existing pyauth wrapper and it's users.

Andrew Bartlett

7 files changed, 103 insertions, 106 deletions

diff --git a/source4/auth/gensec/pygensec.c b/source4/auth/gensec/pygensec.c
index 5fe3703138..fd9726eb75 100644
--- a/source4/auth/gensec/pygensec.c
+++ b/source4/auth/gensec/pygensec.c
@@ -271,7 +271,7 @@ static PyObject *py_gensec_session_info(PyObject *self)
 		return NULL;
 	}
 
-	py_session_info = py_return_ndr_struct("samba.auth", "AuthSession",
+	py_session_info = py_return_ndr_struct("samba.dcerpc.auth", "session_info",
 						 info, info);
 	return py_session_info;
 }
diff --git a/source4/auth/pyauth.c b/source4/auth/pyauth.c
index 9cb770b798..a4ba88c581 100644
--- a/source4/auth/pyauth.c
+++ b/source4/auth/pyauth.c
@@ -46,72 +46,9 @@ typedef intargfunc ssizeargfunc;
 #define Py_RETURN_NONE return Py_INCREF(Py_None), Py_None
 #endif
 
-static PyObject *py_auth_session_get_security_token(PyObject *self, void *closure)
+static PyObject *PyAuthSession_FromSession(struct auth_session_info *session)
 {
-	struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-	PyObject *py_security_token;
-	py_security_token = py_return_ndr_struct("samba.dcerpc.security", "token",
-						 session->security_token, session->security_token);
-	return py_security_token;
-}
-
-static int py_auth_session_set_security_token(PyObject *self, PyObject *value, void *closure)
-{
-	struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-	session->security_token = talloc_reference(session, py_talloc_get_ptr(value));
-	return 0;
-}
-
-static PyObject *py_auth_session_get_session_key(PyObject *self, void *closure)
-{
-	struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-	return PyString_FromStringAndSize((char *)session->session_key.data, session->session_key.length);
-}
-
-static int py_auth_session_set_session_key(PyObject *self, PyObject *value, void *closure)
-{
-	DATA_BLOB val;
-	struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-	val.data = (uint8_t *)PyString_AsString(value);
-	val.length = PyString_Size(value);
-
-	session->session_key = data_blob_talloc(session, val.data, val.length);
-	return 0;
-}
-
-static PyObject *py_auth_session_get_credentials(PyObject *self, void *closure)
-{
-	struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-	PyObject *py_credentials;
-	/* This is evil, as the credentials are not IDL structures */
-	py_credentials = py_return_ndr_struct("samba.credentials", "Credentials", session->credentials, session->credentials);
-	return py_credentials;
-}
-
-static int py_auth_session_set_credentials(PyObject *self, PyObject *value, void *closure)
-{
-	struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
-	session->credentials = talloc_reference(session, PyCredentials_AsCliCredentials(value));
-	return 0;
-}
-
-static PyGetSetDef py_auth_session_getset[] = {
-	{ discard_const_p(char, "security_token"), (getter)py_auth_session_get_security_token, (setter)py_auth_session_set_security_token, NULL },
-	{ discard_const_p(char, "session_key"), (getter)py_auth_session_get_session_key, (setter)py_auth_session_set_session_key, NULL },
-	{ discard_const_p(char, "credentials"), (getter)py_auth_session_get_credentials, (setter)py_auth_session_set_credentials, NULL },
-	{ NULL }
-};
-
-static PyTypeObject PyAuthSession = {
-	.tp_name = "AuthSession",
-	.tp_basicsize = sizeof(py_talloc_Object),
-	.tp_flags = Py_TPFLAGS_DEFAULT,
-	.tp_getset = py_auth_session_getset,
-};
-
-PyObject *PyAuthSession_FromSession(struct auth_session_info *session)
-{
-	return py_talloc_reference(&PyAuthSession, session);
+	return py_return_ndr_struct("samba.dcerpc.auth", "session_info", session, session);
 }
 
 static PyObject *py_system_session(PyObject *module, PyObject *args)
@@ -378,13 +315,6 @@ void initauth(void)
 {
 	PyObject *m;
 
-	PyAuthSession.tp_base = PyTalloc_GetObjectType();
-	if (PyAuthSession.tp_base == NULL)
-		return;
-
-	if (PyType_Ready(&PyAuthSession) < 0)
-		return;
-
 	PyAuthContext.tp_base = PyTalloc_GetObjectType();
 	if (PyAuthContext.tp_base == NULL)
 		return;
@@ -397,8 +327,6 @@ void initauth(void)
 	if (m == NULL)
 		return;
 
-	Py_INCREF(&PyAuthSession);
-	PyModule_AddObject(m, "AuthSession", (PyObject *)&PyAuthSession);
 	Py_INCREF(&PyAuthContext);
 	PyModule_AddObject(m, "AuthContext", (PyObject *)&PyAuthContext);
 
diff --git a/source4/auth/pyauth.h b/source4/auth/pyauth.h
index 38fd2a56a8..60fd2e5d14 100644
--- a/source4/auth/pyauth.h
+++ b/source4/auth/pyauth.h
@@ -24,8 +24,6 @@
 #include "auth/session.h"
 
 #define PyAuthSession_AsSession(obj) py_talloc_get_type(obj, struct auth_session_info)
-#define PyAuthSession_Check(obj) PyObject_TypeCheck(obj, &PyAuthSession)
 struct auth_session_info *PyObject_AsSession(PyObject *obj);
-PyObject *PyAuthSession_FromSession(struct auth_session_info *session);
 
 #endif /* _PYAUTH_H */
diff --git a/source4/auth/session.c b/source4/auth/session.c
index 9475104569..7a4dc5426b 100644
--- a/source4/auth/session.c
+++ b/source4/auth/session.c
@@ -155,9 +155,8 @@ _PUBLIC_ NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx,
 	return NT_STATUS_OK;
 }
 
-/* Create a session_info structure from the
- * auth_session_info_transport we were forwarded over named pipe
- * forwarding.
+/* Fill out the auth_session_info with a cli_credentials based on the
+ * auth_session_info we were forwarded over named pipe forwarding.
  *
  * NOTE: The stucture members of session_info_transport are stolen
  * with talloc_move() into auth_session_info for long term use
@@ -168,16 +167,7 @@ struct auth_session_info *auth_session_info_from_transport(TALLOC_CTX *mem_ctx,
 							   const char **reason)
 {
 	struct auth_session_info *session_info;
-	session_info = talloc_zero(mem_ctx, struct auth_session_info);
-	if (!session_info) {
-		*reason = "failed to allocate session_info";
-		return NULL;
-	}
-
-	session_info->security_token = talloc_move(session_info, &session_info_transport->security_token);
-	session_info->info = talloc_move(session_info, &session_info_transport->info);
-	session_info->session_key = session_info_transport->session_key;
-	session_info->session_key.data = talloc_move(session_info, &session_info_transport->session_key.data);
+	session_info = talloc_steal(mem_ctx, session_info_transport->session_info);
 
 	if (session_info_transport->exported_gssapi_credentials.length) {
 		struct cli_credentials *creds;
@@ -236,9 +226,8 @@ struct auth_session_info *auth_session_info_from_transport(TALLOC_CTX *mem_ctx,
 
 /* Create a auth_session_info_transport from an auth_session_info.
  *
- * NOTE: Members of the auth_session_info_transport structure are not talloc_referenced, but simply assigned.  They are only valid for the lifetime of the struct auth_session_info
- *
- * This isn't normally an issue, as the auth_session_info has a very long typical life
+ * NOTE: Members of the auth_session_info_transport structure are
+ * talloc_referenced() into this structure, and should not be changed.
  */
 NTSTATUS auth_session_info_transport_from_session(TALLOC_CTX *mem_ctx,
 						  struct auth_session_info *session_info,
@@ -247,18 +236,15 @@ NTSTATUS auth_session_info_transport_from_session(TALLOC_CTX *mem_ctx,
 						  struct auth_session_info_transport **transport_out)
 {
 
-	struct auth_session_info_transport *session_info_transport = talloc_zero(mem_ctx, struct auth_session_info_transport);
-	session_info_transport->security_token = talloc_reference(session_info, session_info->security_token);
-	NT_STATUS_HAVE_NO_MEMORY(session_info_transport->security_token);
-
-	session_info_transport->info = talloc_reference(session_info, session_info->info);
-	NT_STATUS_HAVE_NO_MEMORY(session_info_transport->info);
-
-	session_info_transport->session_key = session_info->session_key;
-	session_info_transport->session_key.data = talloc_reference(session_info, session_info->session_key.data);
-	if (!session_info_transport->session_key.data && session_info->session_key.length) {
+	struct auth_session_info_transport *session_info_transport
+		= talloc_zero(mem_ctx, struct auth_session_info_transport);
+	if (!session_info_transport) {
 		return NT_STATUS_NO_MEMORY;
-	}
+	};
+	session_info_transport->session_info = talloc_reference(session_info_transport, session_info);
+	if (!session_info_transport->session_info) {
+		return NT_STATUS_NO_MEMORY;
+	};
 
 	if (session_info->credentials) {
 		struct gssapi_creds_container *gcc;
diff --git a/source4/lib/ldb-samba/pyldb.c b/source4/lib/ldb-samba/pyldb.c
index 472a4664ea..ff48a3bb04 100644
--- a/source4/lib/ldb-samba/pyldb.c
+++ b/source4/lib/ldb-samba/pyldb.c
@@ -174,11 +174,11 @@ static PyObject *py_ldb_set_session_info(PyObject *self, PyObject *args)
 	PyObject *PyAuthSession_Type;
 	bool ret;
 
-	mod_samba_auth = PyImport_ImportModule("samba.auth");
+	mod_samba_auth = PyImport_ImportModule("samba.dcerpc.auth");
 	if (mod_samba_auth == NULL)
 		return NULL;
 
-	PyAuthSession_Type = PyObject_GetAttrString(mod_samba_auth, "AuthSession");
+	PyAuthSession_Type = PyObject_GetAttrString(mod_samba_auth, "session_info");
 	if (PyAuthSession_Type == NULL)
 		return NULL;
 
diff --git a/source4/librpc/ndr/py_auth.c b/source4/librpc/ndr/py_auth.c
new file mode 100644
index 0000000000..40164e0981
--- /dev/null
+++ b/source4/librpc/ndr/py_auth.c
@@ -0,0 +1,74 @@
+/* 
+   Unix SMB/CIFS implementation.
+   Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2011
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <Python.h>
+#include "includes.h"
+#include "libcli/util/pyerrors.h"
+#include "pyauth.h"
+#include "auth/auth.h"
+#include "auth/credentials/pycredentials.h"
+#include "librpc/rpc/pyrpc_util.h"
+
+#ifndef Py_RETURN_NONE
+#define Py_RETURN_NONE return Py_INCREF(Py_None), Py_None
+#endif
+
+static void PyType_AddGetSet(PyTypeObject *type, PyGetSetDef *getset)
+{
+	PyObject *dict;
+	int i;
+	if (type->tp_dict == NULL)
+		type->tp_dict = PyDict_New();
+	dict = type->tp_dict;
+	for (i = 0; getset[i].name; i++) {
+		PyObject *descr;
+		descr = PyDescr_NewGetSet(type, &getset[i]);
+		PyDict_SetItemString(dict, getset[i].name, 
+				     descr);
+	}
+}
+
+static PyObject *py_auth_session_get_credentials(PyObject *self, void *closure)
+{
+	struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
+	PyObject *py_credentials;
+	/* This is evil, as the credentials are not IDL structures */
+	py_credentials = py_return_ndr_struct("samba.credentials", "Credentials", session->credentials, session->credentials);
+	return py_credentials;
+}
+
+static int py_auth_session_set_credentials(PyObject *self, PyObject *value, void *closure)
+{
+	struct auth_session_info *session = py_talloc_get_type(self, struct auth_session_info);
+	session->credentials = talloc_reference(session, PyCredentials_AsCliCredentials(value));
+	return 0;
+}
+
+static PyGetSetDef py_auth_session_extra_getset[] = {
+	{ discard_const_p(char, "credentials"), (getter)py_auth_session_get_credentials, (setter)py_auth_session_set_credentials, NULL },
+	{ NULL }
+};
+
+static void py_auth_session_info_patch(PyTypeObject *type)
+{
+	PyType_AddGetSet(type, py_auth_session_extra_getset);
+}
+
+#define PY_SESSION_INFO_PATCH py_auth_session_info_patch
+
diff --git a/source4/librpc/wscript_build b/source4/librpc/wscript_build
index 8d1e9a8220..ce015ccaa5 100755
--- a/source4/librpc/wscript_build
+++ b/source4/librpc/wscript_build
@@ -199,6 +199,17 @@ bld.SAMBA_PYTHON('python_echo',
 	realname='samba/dcerpc/echo.so'
 	)
 
+bld.SAMBA_PYTHON('python_auth',
+	source='../../librpc/gen_ndr/py_auth.c',
+	deps='NDR_AUTH pytalloc-util pyrpc_util',
+	realname='samba/dcerpc/auth.so'
+	)
+
+bld.SAMBA_PYTHON('python_krb5pac',
+	source='../../librpc/gen_ndr/py_krb5pac.c',
+	deps='ndr-krb5pac pytalloc-util pyrpc_util',
+	realname='samba/dcerpc/krb5pac.so'
+	)
 
 bld.SAMBA_PYTHON('python_winreg',
 	source='../../librpc/gen_ndr/py_winreg.c',