diff options
| -rw-r--r-- | source4/auth/kerberos/clikrb5.c | 103 | ||||
| -rw-r--r-- | source4/auth/kerberos/config.mk | 3 | ||||
| -rw-r--r-- | source4/auth/kerberos/kerberos.h | 15 | ||||
| -rw-r--r-- | source4/auth/kerberos/krb5_init_context.c | 126 | ||||
| -rw-r--r-- | source4/auth/kerberos/krb5_init_context.h | 29 | ||||
| -rw-r--r-- | source4/heimdal/lib/gssapi/init.c | 32 | ||||
| -rw-r--r-- | source4/rpc_server/drsuapi/dcesrv_drsuapi.c | 2 |
7 files changed, 189 insertions, 121 deletions
diff --git a/source4/auth/kerberos/clikrb5.c b/source4/auth/kerberos/clikrb5.c index e3f2057b44..85d60a1244 100644 --- a/source4/auth/kerberos/clikrb5.c +++ b/source4/auth/kerberos/clikrb5.c @@ -385,107 +385,4 @@ cleanup_princ: return ret; } - -static int smb_krb5_context_destory_1(void *ptr) -{ - struct smb_krb5_context *ctx = ptr; - krb5_free_context(ctx->krb5_context); - return 0; -} - -#ifdef HAVE_KRB5_LOG_CONTROL -static int smb_krb5_context_destory_2(void *ptr) -{ - struct smb_krb5_context *ctx = ptr; - - /* Otherwise krb5_free_context will try and close what we have already free()ed */ - krb5_set_warn_dest(ctx->krb5_context, NULL); - krb5_closelog(ctx->krb5_context, ctx->logf); - smb_krb5_context_destory_1(ptr); - return 0; -} - -/* We never close down the DEBUG system, and no need to unreference the use */ -static void smb_krb5_debug_close(void *private) { - return; -} - -static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private) -{ - DEBUG(3, ("Kerberos: %s\n", msg)); -} - -#endif - - krb5_error_code smb_krb5_init_context(TALLOC_CTX *parent_ctx, - struct smb_krb5_context **smb_krb5_context) -{ - krb5_error_code ret; - TALLOC_CTX *tmp_ctx; - - initialize_krb5_error_table(); - - tmp_ctx = talloc_new(parent_ctx); - *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context); - - if (!*smb_krb5_context || !tmp_ctx) { - talloc_free(*smb_krb5_context); - talloc_free(tmp_ctx); - return ENOMEM; - } - - ret = krb5_init_context(&(*smb_krb5_context)->krb5_context); - if (ret) { - DEBUG(1,("krb5_init_context failed (%s)\n", - error_message(ret))); - return ret; - } - - talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destory_1); - - if (lp_realm() && *lp_realm()) { - char *upper_realm = strupper_talloc(tmp_ctx, lp_realm()); - if (!upper_realm) { - DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm())); - talloc_free(tmp_ctx); - return ENOMEM; - } - ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, lp_realm()); - if (ret) { - DEBUG(1,("krb5_set_default_realm failed (%s)\n", - smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); - talloc_free(tmp_ctx); - return ret; - } - } - -#ifdef HAVE_KRB5_LOG_CONTROL - /* TODO: Should we have a different name here? */ - ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf); - - if (ret) { - DEBUG(1,("krb5_initlog failed (%s)\n", - smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); - talloc_free(tmp_ctx); - return ret; - } - - talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destory_2); - - ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */, - smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL); - if (ret) { - DEBUG(1,("krb5_addlog_func failed (%s)\n", - smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); - talloc_free(tmp_ctx); - return ret; - } - krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf); - -#endif - talloc_steal(parent_ctx, *smb_krb5_context); - talloc_free(tmp_ctx); - return 0; -} - #endif diff --git a/source4/auth/kerberos/config.mk b/source4/auth/kerberos/config.mk index 56ce64fdb1..cc31af44e7 100644 --- a/source4/auth/kerberos/config.mk +++ b/source4/auth/kerberos/config.mk @@ -7,7 +7,8 @@ ADD_OBJ_FILES = \ auth/kerberos/kerberos_verify.o \ auth/kerberos/kerberos_util.o \ auth/kerberos/kerberos_pac.o \ - auth/kerberos/gssapi_parse.o + auth/kerberos/gssapi_parse.o \ + auth/kerberos/krb5_init_context.o REQUIRED_SUBSYSTEMS = KERBEROS_LIB NDR_KRB5PAC # End SUBSYSTEM KERBEROS ################################# diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h index 9535094e2b..bc2a1babe9 100644 --- a/source4/auth/kerberos/kerberos.h +++ b/source4/auth/kerberos/kerberos.h @@ -21,19 +21,8 @@ #if defined(HAVE_KRB5) -#if defined(HAVE_KRB5_INITLOG) && defined(HAVE_KRB5_ADDLOG_FUNC) && defined (HAVE_KRB5_SET_WARN_DEST) && defined(HAVE_KRB5_LOG_FACILITY) -#define HAVE_KRB5_LOG_CONTROL -#else -#undef HAVE_KRB5_LOG_CONTROL -#endif +#include "auth/kerberos/krb5_init_context.h" -struct smb_krb5_context { - krb5_context krb5_context; -#ifdef HAVE_KRB5_LOG_CONTROL - krb5_log_facility *logf; -#endif -}; - struct ccache_container { struct smb_krb5_context *smb_krb5_context; krb5_ccache ccache; @@ -118,8 +107,6 @@ char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TAL struct cli_credentials *credentials, struct smb_krb5_context *smb_krb5_context, krb5_ccache ccache); -krb5_error_code smb_krb5_init_context(TALLOC_CTX *parent_ctx, - struct smb_krb5_context **smb_krb5_context); krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, struct cli_credentials *machine_account, struct smb_krb5_context *smb_krb5_context, diff --git a/source4/auth/kerberos/krb5_init_context.c b/source4/auth/kerberos/krb5_init_context.c new file mode 100644 index 0000000000..2a8f0624da --- /dev/null +++ b/source4/auth/kerberos/krb5_init_context.c @@ -0,0 +1,126 @@ +/* + Unix SMB/CIFS implementation. + Wrapper for krb5_init_context + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "system/kerberos.h" +#include "auth/kerberos/kerberos.h" + +static int smb_krb5_context_destroy_1(void *ptr) +{ + struct smb_krb5_context *ctx = ptr; + krb5_free_context(ctx->krb5_context); + return 0; +} + +static int smb_krb5_context_destroy_2(void *ptr) +{ + struct smb_krb5_context *ctx = ptr; + + /* Otherwise krb5_free_context will try and close what we have already free()ed */ + krb5_set_warn_dest(ctx->krb5_context, NULL); + krb5_closelog(ctx->krb5_context, ctx->logf); + smb_krb5_context_destroy_1(ptr); + return 0; +} + +/* We never close down the DEBUG system, and no need to unreference the use */ +static void smb_krb5_debug_close(void *private) { + return; +} + +static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private) +{ + DEBUG(3, ("Kerberos: %s\n", msg)); +} + + krb5_error_code smb_krb5_init_context(void *parent_ctx, + struct smb_krb5_context **smb_krb5_context) +{ + krb5_error_code ret; + TALLOC_CTX *tmp_ctx; + + initialize_krb5_error_table(); + + tmp_ctx = talloc_new(parent_ctx); + *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context); + + if (!*smb_krb5_context || !tmp_ctx) { + talloc_free(*smb_krb5_context); + talloc_free(tmp_ctx); + return ENOMEM; + } + + ret = krb5_init_context(&(*smb_krb5_context)->krb5_context); + if (ret) { + DEBUG(1,("krb5_init_context failed (%s)\n", + error_message(ret))); + return ret; + } + + talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_1); + + if (lp_realm() && *lp_realm()) { + char *upper_realm = strupper_talloc(tmp_ctx, lp_realm()); + if (!upper_realm) { + DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm())); + talloc_free(tmp_ctx); + return ENOMEM; + } + ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, lp_realm()); + if (ret) { + DEBUG(1,("krb5_set_default_realm failed (%s)\n", + smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); + talloc_free(tmp_ctx); + return ret; + } + } + + /* TODO: Should we have a different name here? */ + ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf); + + if (ret) { + DEBUG(1,("krb5_initlog failed (%s)\n", + smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); + talloc_free(tmp_ctx); + return ret; + } + + talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_2); + + ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */, + smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL); + if (ret) { + DEBUG(1,("krb5_addlog_func failed (%s)\n", + smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); + talloc_free(tmp_ctx); + return ret; + } + krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf); + + talloc_steal(parent_ctx, *smb_krb5_context); + talloc_free(tmp_ctx); + return 0; +} + + void smb_krb5_free_context(struct smb_krb5_context *smb_krb5_context) +{ + talloc_free(smb_krb5_context); +} diff --git a/source4/auth/kerberos/krb5_init_context.h b/source4/auth/kerberos/krb5_init_context.h new file mode 100644 index 0000000000..8120b8c96d --- /dev/null +++ b/source4/auth/kerberos/krb5_init_context.h @@ -0,0 +1,29 @@ +/* + Unix SMB/CIFS implementation. + simple kerberos5 routines for active directory + Copyright (C) Andrew Bartlett 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +struct smb_krb5_context { + krb5_context krb5_context; + krb5_log_facility *logf; +}; + +krb5_error_code smb_krb5_init_context(void *parent_ctx, + struct smb_krb5_context **smb_krb5_context); +void smb_krb5_free_context(struct smb_krb5_context *smb_krb5_context); + diff --git a/source4/heimdal/lib/gssapi/init.c b/source4/heimdal/lib/gssapi/init.c index 37f46624ae..a642b629f4 100644 --- a/source4/heimdal/lib/gssapi/init.c +++ b/source4/heimdal/lib/gssapi/init.c @@ -35,6 +35,10 @@ RCSID("$Id: init.c,v 1.7 2003/07/22 19:50:11 lha Exp $"); +#ifdef _SAMBA_BUILD_ +#include "auth/kerberos/krb5_init_context.h" +#endif + static HEIMDAL_MUTEX gssapi_krb5_context_mutex = HEIMDAL_MUTEX_INITIALIZER; static int created_key; static HEIMDAL_thread_key gssapi_context_key; @@ -89,11 +93,35 @@ krb5_error_code gssapi_krb5_init (void) { krb5_error_code ret = 0; +#ifdef _SAMBA_BUILD_ + static struct smb_krb5_context *smb_krb5_context; HEIMDAL_MUTEX_lock(&gssapi_krb5_context_mutex); - if(gssapi_krb5_context == NULL) + if(smb_krb5_context == NULL) { + ret = smb_krb5_init_context(NULL, &smb_krb5_context); + } + if (ret == 0 && !created_key) { + HEIMDAL_key_create(&gssapi_context_key, + gssapi_destroy_thread_context, + ret); + if (ret) { + smb_krb5_free_context(smb_krb5_context); + smb_krb5_context = NULL; + } else + created_key = 1; + } + if (ret == 0) { + gssapi_krb5_context = smb_krb5_context->krb5_context; + } + + HEIMDAL_MUTEX_unlock(&gssapi_krb5_context_mutex); +#else + HEIMDAL_MUTEX_lock(&gssapi_krb5_context_mutex); + + if(gssapi_krb5_context == NULL) { ret = krb5_init_context (&gssapi_krb5_context); + } if (ret == 0 && !created_key) { HEIMDAL_key_create(&gssapi_context_key, gssapi_destroy_thread_context, @@ -106,6 +134,6 @@ gssapi_krb5_init (void) } HEIMDAL_MUTEX_unlock(&gssapi_krb5_context_mutex); - +#endif return ret; } diff --git a/source4/rpc_server/drsuapi/dcesrv_drsuapi.c b/source4/rpc_server/drsuapi/dcesrv_drsuapi.c index 13058296a5..94a16d0a09 100644 --- a/source4/rpc_server/drsuapi/dcesrv_drsuapi.c +++ b/source4/rpc_server/drsuapi/dcesrv_drsuapi.c @@ -239,7 +239,7 @@ static WERROR DRSUAPI_REMOVE_DS_DOMAIN(struct dcesrv_call_state *dce_call, TALLO drsuapi_DsGetDomainControllerInfo */ static WERROR drsuapi_DsGetDomainControllerInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, - struct drsuapi_DsGetDomainControllerInfo *r) + struct drsuapi_DsGetDomainControllerInfo *r) { DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); } |