diff options
| -rw-r--r-- | lib/replace/system/kerberos.h | 110 | ||||
| -rw-r--r-- | libcli/auth/krb5_wrap.c (renamed from source4/auth/kerberos/clikrb5.c) | 68 | ||||
| -rw-r--r-- | libcli/auth/krb5_wrap.h | 32 | ||||
| -rw-r--r-- | libcli/auth/wscript_build | 6 | ||||
| -rw-r--r-- | source3/Makefile.in | 4 | ||||
| -rw-r--r-- | source3/include/smb_krb5.h | 8 | ||||
| -rw-r--r-- | source3/libsmb/clikrb5.c | 74 | ||||
| -rw-r--r-- | source3/wscript | 78 | ||||
| -rwxr-xr-x | source3/wscript_build | 2 | ||||
| -rw-r--r-- | source4/auth/kerberos/kerberos_util.c | 4 | ||||
| -rw-r--r-- | source4/auth/kerberos/wscript_build | 4 | ||||
| -rw-r--r-- | source4/heimdal_build/wscript_configure | 75 |
12 files changed, 166 insertions, 299 deletions
diff --git a/lib/replace/system/kerberos.h b/lib/replace/system/kerberos.h index a1685ad333..bb1f1b9a09 100644 --- a/lib/replace/system/kerberos.h +++ b/lib/replace/system/kerberos.h @@ -28,114 +28,14 @@ */ #ifdef HAVE_KRB5 -/* Whether the krb5_address struct has a addrtype property */ -/* #undef HAVE_ADDRTYPE_IN_KRB5_ADDRESS */ -/* Whether the krb5_address struct has a addr_type property */ -#define HAVE_ADDR_TYPE_IN_KRB5_ADDRESS 1 -/* Define to 1 if you have the `gsskrb5_extract_authz_data_from_sec_context' */ -#define HAVE_GSSKRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT 1 -/* Define to 1 if you have the `gsskrb5_get_initiator_subkey' function. */ -#define HAVE_GSSKRB5_GET_INITIATOR_SUBKEY 1 -/* Define to 1 if you have the `gsskrb5_register_acceptor_identity' function. */ -#define HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY 1 -/* Define to 1 if you have the `gss_krb5_ccache_name' function. */ -#define HAVE_GSS_KRB5_CCACHE_NAME 1 -/* Define to 1 if you have the `krb5_addlog_func' function. */ -#define HAVE_KRB5_ADDLOG_FUNC 1 -/* Define to 1 if you have the `krb5_auth_con_setkey' function. */ -#define HAVE_KRB5_AUTH_CON_SETKEY 1 -/* Define to 1 if you have the `krb5_auth_con_setuseruserkey' function. */ -/* #undef HAVE_KRB5_AUTH_CON_SETUSERUSERKEY */ -/* Define to 1 if you have the `krb5_c_enctype_compare' function. */ -#define HAVE_KRB5_C_ENCTYPE_COMPARE 1 -/* Define to 1 if you have the `krb5_c_verify_checksum' function. */ -#define HAVE_KRB5_C_VERIFY_CHECKSUM 1 -/* Whether the type krb5_encrypt_block exists */ -/* #undef HAVE_KRB5_ENCRYPT_BLOCK */ -/* Define to 1 if you have the `krb5_encrypt_data' function. */ -/* #undef HAVE_KRB5_ENCRYPT_DATA */ -/* Define to 1 if you have the `krb5_enctypes_compatible_keys' function. */ -#define HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS 1 -/* Define to 1 if you have the `krb5_free_data_contents' function. */ -#define HAVE_KRB5_FREE_DATA_CONTENTS 1 -/* Define to 1 if you have the `krb5_free_error_string' function. */ -/* #undef HAVE_KRB5_FREE_ERROR_STRING */ -/* Define to 1 if you have the `krb5_free_error_message' function. */ -#define HAVE_KRB5_FREE_ERROR_MESSAGE 1 -/* Define to 1 if you have the `krb5_free_keytab_entry_contents' function. */ -/* #undef HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS */ -/* Define to 1 if you have the `krb5_free_ktypes' function. */ -/* #undef HAVE_KRB5_FREE_KTYPES */ -/* Define to 1 if you have the `krb5_free_unparsed_name' function. */ -/* #undef HAVE_KRB5_FREE_UNPARSED_NAME */ -/* Define to 1 if you have the `krb5_get_default_in_tkt_etypes' function. */ -#define HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES 1 -/* Define to 1 if you have the `krb5_get_error_string' function. */ -#define HAVE_KRB5_GET_ERROR_STRING 1 -/* Define to 1 if you have the `krb5_get_error_message' function. */ -#define HAVE_KRB5_GET_ERROR_MESSAGE 1 -/* Define to 1 if you have the `krb5_get_permitted_enctypes' function. */ -/* #undef HAVE_KRB5_GET_PERMITTED_ENCTYPES */ -/* Define to 1 if you have the `krb5_get_pw_salt' function. */ -#define HAVE_KRB5_GET_PW_SALT 1 -/* Define to 1 if you have the <krb5.h> header file. */ -#define HAVE_KRB5_H 1 -/* Define to 1 if you have the `krb5_initlog' function. */ -#define HAVE_KRB5_INITLOG 1 -/* Define to 1 if you have the `krb5_kdc_default_config' function. */ -#define HAVE_KRB5_KDC_DEFAULT_CONFIG 1 -/* Whether the krb5_creds struct has a keyblock property */ -/* #undef HAVE_KRB5_KEYBLOCK_IN_CREDS */ -/* Whether the krb5_keyblock struct has a keyvalue property */ -#define HAVE_KRB5_KEYBLOCK_KEYVALUE 1 -/* Whether krb5_keytab_entry has key member */ -/* #undef HAVE_KRB5_KEYTAB_ENTRY_KEY */ -/* Whether krb5_keytab_entry has keyblock member */ -#define HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK 1 -/* Define to 1 if you have the `krb5_krbhst_get_addrinfo' function. */ -#define HAVE_KRB5_KRBHST_GET_ADDRINFO 1 -/* Define to 1 if you have the `krb5_kt_compare' function. */ -#define HAVE_KRB5_KT_COMPARE 1 -/* Define to 1 if you have the `krb5_kt_free_entry' function. */ -#define HAVE_KRB5_KT_FREE_ENTRY 1 -/* Whether the type krb5_log_facility exists */ -#define HAVE_KRB5_LOG_FACILITY 1 -/* Define to 1 if you have the `krb5_mk_req_extended' function. */ -#define HAVE_KRB5_MK_REQ_EXTENDED 1 -/* Define to 1 if you have the `krb5_principal2salt' function. */ -/* #undef HAVE_KRB5_PRINCIPAL2SALT */ -/* Define to 1 if you have the `krb5_principal_get_comp_string' function. */ -#define HAVE_KRB5_PRINCIPAL_GET_COMP_STRING 1 -/* Whether krb5_princ_component is available */ -/* #undef HAVE_KRB5_PRINC_COMPONENT */ -/* Whether the krb5_creds struct has a session property */ -#define HAVE_KRB5_SESSION_IN_CREDS 1 -/* Define to 1 if you have the `krb5_set_default_in_tkt_etypes' function. */ -#define HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES 1 -/* Define to 1 if you have the `krb5_set_default_tgs_ktypes' function. */ -/* #undef HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */ -/* Define to 1 if you have the `krb5_set_real_time' function. */ -#define HAVE_KRB5_SET_REAL_TIME 1 -/* Define to 1 if you have the `krb5_set_warn_dest' function. */ -#define HAVE_KRB5_SET_WARN_DEST 1 -/* Define to 1 if you have the `krb5_string_to_key' function. */ -#define HAVE_KRB5_STRING_TO_KEY 1 -/* Define to 1 if you have the `krb5_string_to_key_salt' function. */ -#define HAVE_KRB5_STRING_TO_KEY_SALT 1 -/* Define to 1 if you have the `krb5_ticket_get_authorization_data_type' */ -#define HAVE_KRB5_TICKET_GET_AUTHORIZATION_DATA_TYPE 1 -/* Whether the krb5_ticket struct has a enc_part2 property */ -/* #undef HAVE_KRB5_TKT_ENC_PART2 */ -/* Define to 1 if you have the `krb5_use_enctype' function. */ -/* #undef HAVE_KRB5_USE_ENCTYPE */ -/* Define to 1 if you have the `krb5_verify_checksum' function. */ -#define HAVE_KRB5_VERIFY_CHECKSUM 1 -/* Whether krb5_princ_realm returns krb5_realm or krb5_data */ -#define KRB5_PRINC_REALM_RETURNS_REALM 1 +#if HAVE_KRB5_H #include <krb5.h> -#include <com_err.h> +#endif +#if HAVE_COM_ERR_H +#include <com_err.h> #endif #endif +#endif diff --git a/source4/auth/kerberos/clikrb5.c b/libcli/auth/krb5_wrap.c index 3314cbc591..48f50ec02e 100644 --- a/source4/auth/kerberos/clikrb5.c +++ b/libcli/auth/krb5_wrap.c @@ -1,40 +1,38 @@ -/* +/* Unix SMB/CIFS implementation. simple kerberos5 routines for active directory Copyright (C) Andrew Tridgell 2001 Copyright (C) Luke Howard 2002-2003 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 - + Copyright (C) Guenther Deschner 2005-2009 + This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. - + This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. - + You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>. */ #include "includes.h" -#include "system/network.h" -#include "system/kerberos.h" -#include "system/time.h" -#include "auth/kerberos/kerberos.h" +#include "libcli/auth/krb5_wrap.h" #ifdef HAVE_KRB5 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK) - int create_kerberos_key_from_string(krb5_context context, - krb5_principal host_princ, - krb5_data *password, - krb5_keyblock *key, - krb5_enctype enctype) +int create_kerberos_key_from_string_direct(krb5_context context, + krb5_principal host_princ, + krb5_data *password, + krb5_keyblock *key, + krb5_enctype enctype) { - int ret; + int ret = 0; krb5_data salt; krb5_encrypt_block eblock; @@ -46,14 +44,15 @@ krb5_use_enctype(context, &eblock, enctype); ret = krb5_string_to_key(context, &eblock, key, password, &salt); SAFE_FREE(salt.data); + return ret; } #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT) - int create_kerberos_key_from_string(krb5_context context, - krb5_principal host_princ, - krb5_data *password, - krb5_keyblock *key, - krb5_enctype enctype) +int create_kerberos_key_from_string_direct(krb5_context context, + krb5_principal host_princ, + krb5_data *password, + krb5_keyblock *key, + krb5_enctype enctype) { int ret; krb5_salt salt; @@ -63,9 +62,10 @@ DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret))); return ret; } - ret = krb5_string_to_key_salt(context, enctype, password->data, - salt, key); + + ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key); krb5_free_salt(context, salt); + return ret; } #else @@ -74,27 +74,39 @@ void kerberos_free_data_contents(krb5_context context, krb5_data *pdata) { +#if defined(HAVE_KRB5_FREE_DATA_CONTENTS) if (pdata->data) { - krb5_data_free(pdata); + krb5_free_data_contents(context, pdata); } +#elif defined(HAVE_KRB5_DATA_FREE) + krb5_data_free(context, pdata); +#else + SAFE_FREE(pdata->data); +#endif } + krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry) { -#if defined(HAVE_KRB5_KT_FREE_ENTRY) - return krb5_kt_free_entry(context, kt_entry); -#elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS) +/* Try krb5_free_keytab_entry_contents first, since + * MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and + * krb5_kt_free_entry but only has a prototype for the first, while the + * second is considered private. + */ +#if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS) return krb5_free_keytab_entry_contents(context, kt_entry); +#elif defined(HAVE_KRB5_KT_FREE_ENTRY) + return krb5_kt_free_entry(context, kt_entry); #else #error UNKNOWN_KT_FREE_FUNCTION #endif } - char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx) + char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx) { char *ret; - -#if defined(HAVE_KRB5_GET_ERROR_MESSAGE) && defined(HAVE_KRB5_FREE_ERROR_MESSAGE) + +#if defined(HAVE_KRB5_GET_ERROR_MESSAGE) && defined(HAVE_KRB5_FREE_ERROR_MESSAGE) const char *context_error = krb5_get_error_message(context, code); if (context_error) { ret = talloc_asprintf(mem_ctx, "%s: %s", error_message(code), context_error); diff --git a/libcli/auth/krb5_wrap.h b/libcli/auth/krb5_wrap.h new file mode 100644 index 0000000000..e608efe58c --- /dev/null +++ b/libcli/auth/krb5_wrap.h @@ -0,0 +1,32 @@ +/* + Unix SMB/CIFS implementation. + simple kerberos5 routines for active directory + Copyright (C) Andrew Tridgell 2001 + Copyright (C) Luke Howard 2002-2003 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + Copyright (C) Guenther Deschner 2005-2009 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "system/kerberos.h" + +int create_kerberos_key_from_string_direct(krb5_context context, + krb5_principal host_princ, + krb5_data *password, + krb5_keyblock *key, + krb5_enctype enctype); +void kerberos_free_data_contents(krb5_context context, krb5_data *pdata); +krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry); +char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx); diff --git a/libcli/auth/wscript_build b/libcli/auth/wscript_build index 436ca61b7f..6f5483f48b 100644 --- a/libcli/auth/wscript_build +++ b/libcli/auth/wscript_build @@ -2,7 +2,7 @@ bld.SAMBA_LIBRARY('cliauth', source='', - deps='NTLMSSP_COMMON MSRPC_PARSE LIBCLI_AUTH COMMON_SCHANNEL PAM_ERRORS SPNEGO_PARSE', + deps='NTLMSSP_COMMON MSRPC_PARSE LIBCLI_AUTH COMMON_SCHANNEL PAM_ERRORS SPNEGO_PARSE KRB5_WRAP', private_library=True, grouping_library=True) @@ -38,3 +38,7 @@ bld.SAMBA_SUBSYSTEM('PAM_ERRORS', bld.SAMBA_SUBSYSTEM('SPNEGO_PARSE', source='spnego_parse.c', deps='asn1util') + +bld.SAMBA_SUBSYSTEM('KRB5_WRAP', + source='krb5_wrap.c', + deps='krb5') diff --git a/source3/Makefile.in b/source3/Makefile.in index 0e74805417..e754a43270 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -576,7 +576,7 @@ SCHANNEL_OBJ = ../libcli/auth/credentials.o \ $(LIBNDR_SCHANNEL_OBJ) LIBSMB_OBJ = libsmb/clientgen.o libsmb/cliconnect.o libsmb/clifile.o \ - libsmb/clikrb5.o libsmb/clispnego.o \ + libsmb/clikrb5.o ../libcli/auth/krb5_wrap.o libsmb/clispnego.o \ ../libcli/auth/spnego_parse.o \ ../lib/util/asn1.o \ libsmb/clirap.o libsmb/clierror.o libsmb/climessage.o \ @@ -1476,7 +1476,7 @@ TDBTORTURE_OBJ = @tdbdir@/tools/tdbtorture.o $(LIBREPLACE_OBJ) \ NTLM_AUTH_OBJ1 = utils/ntlm_auth.o utils/ntlm_auth_diagnostics.o NTLM_AUTH_OBJ = ${NTLM_AUTH_OBJ1} $(LIBSAMBA_OBJ) $(POPT_LIB_OBJ) \ - ../lib/util/asn1.o ../libcli/auth/spnego_parse.o libsmb/clikrb5.o libads/kerberos.o \ + ../lib/util/asn1.o ../libcli/auth/spnego_parse.o libsmb/clikrb5.o ../libcli/auth/krb5_wrap.o libads/kerberos.o \ libsmb/samlogon_cache.o \ $(LIBADS_SERVER_OBJ) \ $(PASSDB_OBJ) $(LIBTSOCKET_OBJ) $(GROUPDB_OBJ) \ diff --git a/source3/include/smb_krb5.h b/source3/include/smb_krb5.h index adbb0debc3..042b7ebe40 100644 --- a/source3/include/smb_krb5.h +++ b/source3/include/smb_krb5.h @@ -10,9 +10,7 @@ #define KRB5_DEPRECATED #endif -#if HAVE_KRB5_H -#include <krb5.h> -#endif +#include "libcli/auth/krb5_wrap.h" #if HAVE_GSSAPI_GSSAPI_H #include <gssapi/gssapi.h> @@ -22,10 +20,6 @@ #include <gssapi.h> #endif -#if HAVE_COM_ERR_H -#include <com_err.h> -#endif - #ifndef KRB5_ADDR_NETBIOS #define KRB5_ADDR_NETBIOS 0x14 #endif diff --git a/source3/libsmb/clikrb5.c b/source3/libsmb/clikrb5.c index 5e1f704921..b341ff4be6 100644 --- a/source3/libsmb/clikrb5.c +++ b/source3/libsmb/clikrb5.c @@ -223,53 +223,6 @@ krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx, #error UNKNOWN_ADDRTYPE #endif -#if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK) -static int create_kerberos_key_from_string_direct(krb5_context context, - krb5_principal host_princ, - krb5_data *password, - krb5_keyblock *key, - krb5_enctype enctype) -{ - int ret = 0; - krb5_data salt; - krb5_encrypt_block eblock; - - ret = krb5_principal2salt(context, host_princ, &salt); - if (ret) { - DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret))); - return ret; - } - krb5_use_enctype(context, &eblock, enctype); - ret = krb5_string_to_key(context, &eblock, key, password, &salt); - SAFE_FREE(salt.data); - - return ret; -} -#elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT) -static int create_kerberos_key_from_string_direct(krb5_context context, - krb5_principal host_princ, - krb5_data *password, - krb5_keyblock *key, - krb5_enctype enctype) -{ - int ret; - krb5_salt salt; - - ret = krb5_get_pw_salt(context, host_princ, &salt); - if (ret) { - DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret))); - return ret; - } - - ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key); - krb5_free_salt(context, salt); - - return ret; -} -#else -#error UNKNOWN_CREATE_KEY_FUNCTIONS -#endif - int create_kerberos_key_from_string(krb5_context context, krb5_principal host_princ, krb5_data *password, @@ -584,17 +537,6 @@ bool unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_ } #endif - void kerberos_free_data_contents(krb5_context context, krb5_data *pdata) -{ -#if defined(HAVE_KRB5_FREE_DATA_CONTENTS) - if (pdata->data) { - krb5_free_data_contents(context, pdata); - } -#else - SAFE_FREE(pdata->data); -#endif -} - void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype) { #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS) @@ -1068,22 +1010,6 @@ done: } #endif - krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry) -{ -/* Try krb5_free_keytab_entry_contents first, since - * MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and - * krb5_kt_free_entry but only has a prototype for the first, while the - * second is considered private. - */ -#if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS) - return krb5_free_keytab_entry_contents(context, kt_entry); -#elif defined(HAVE_KRB5_KT_FREE_ENTRY) - return krb5_kt_free_entry(context, kt_entry); -#else -#error UNKNOWN_KT_FREE_FUNCTION -#endif -} - void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum, struct PAC_SIGNATURE_DATA *sig) { diff --git a/source3/wscript b/source3/wscript index cf96b39107..ffcecca195 100644 --- a/source3/wscript +++ b/source3/wscript @@ -799,83 +799,7 @@ return krb5_kt_resolve(context, "WRFILE:api", &keytab); 'HAVE_KRB5_DEPRECATED_WITH_IDENTIFIER', addmain=False, link=False, msg="Checking for KRB5_DEPRECATED define taking an identifier") - elif conf.env.toplevel_build: - # setup the right defines for a in-tree heimdal build - Logs.info("Using in-tree heimdal kerberos defines") - conf.define('HAVE_GSSAPI', 1) - conf.define('HAVE_GSSAPI_GSSAPI_H', 1) - conf.define('HAVE_AP_OPTS_USE_SUBKEY', 1) - conf.define('HAVE_KRB5_ADDRESSES', 1) - conf.define('HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK', 1) - conf.define('HAVE_KRB5_SET_REAL_TIME', 1) - conf.define('HAVE_COM_ERR_H', 1) - conf.define('HAVE_ADDR_TYPE_IN_KRB5_ADDRESS', 1) - conf.define('HAVE_GSS_DISPLAY_STATUS', 1) - conf.define('HAVE_LIBGSSAPI', 1) - conf.define('HAVE_ADDR_TYPE_IN_KRB5_ADDRESS', 1) - conf.define('HAVE_CHECKSUM_IN_KRB5_CHECKSUM', 1) - conf.define('HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE', 0) - conf.define('HAVE_DECL_KRB5_GET_CREDENTIALS_FOR_USER', 0) - conf.define('HAVE_E_DATA_POINTER_IN_KRB5_ERROR', 1) - conf.define('HAVE_INITIALIZE_KRB5_ERROR_TABLE', 1) - conf.define('HAVE_KRB5_ADDRESSES', 1) - conf.define('HAVE_KRB5_AUTH_CON_SETKEY', 1) - conf.define('HAVE_KRB5_CRYPTO', 1) - conf.define('HAVE_KRB5_CRYPTO_DESTROY', 1) - conf.define('HAVE_KRB5_CRYPTO_INIT', 1) - conf.define('HAVE_KRB5_C_ENCTYPE_COMPARE', 1) - conf.define('HAVE_KRB5_C_VERIFY_CHECKSUM', 1) - conf.define('HAVE_FREE_AP_REQ', 1) - conf.define('HAVE_KRB5_DECODE_AP_REQ', 1) - conf.define('HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS', 1) - conf.define('HAVE_KRB5_ENCTYPE_TO_STRING', 1) - conf.define('HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG', 1) - conf.define('HAVE_KRB5_FREE_ERROR_CONTENTS', 1) - conf.define('HAVE_KRB5_FREE_HOST_REALM', 1) - conf.define('HAVE_KRB5_FWD_TGT_CREDS', 1) - conf.define('HAVE_KRB5_GET_CREDS', 1) - conf.define('HAVE_KRB5_GET_CREDS_OPT_ALLOC', 1) - conf.define('HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE', 1) - conf.define('HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES', 1) - conf.define('HAVE_KRB5_GET_HOST_REALM', 1) - conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC', 1) - conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_FREE', 1) - conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR', 1) - conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST', 1) - conf.define('HAVE_KRB5_GET_KDC_CRED', 1) - conf.define('HAVE_KRB5_GET_PW_SALT', 1) - conf.define('HAVE_KRB5_GET_RENEWED_CREDS', 1) - conf.define('HAVE_KRB5_KEYBLOCK_KEYVALUE', 1) - conf.define('HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK', 1) - conf.define('HAVE_KRB5_KRBHST_GET_ADDRINFO', 1) - conf.define('HAVE_KRB5_KRBHST_INIT', 1) - conf.define('HAVE_KRB5_KT_COMPARE', 1) - conf.define('HAVE_KRB5_KT_FREE_ENTRY', 1) - conf.define('HAVE_KRB5_KU_OTHER_CKSUM', 1) - conf.define('HAVE_KRB5_LOCATE_PLUGIN_H', 1) - conf.define('HAVE_KRB5_MK_REQ_EXTENDED', 1) - conf.define('HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM', 1) - conf.define('HAVE_KRB5_PRINCIPAL_GET_COMP_STRING', 1) - conf.define('HAVE_KRB5_PRINCIPAL_GET_REALM', 1) - conf.define('HAVE_KRB5_REALM_TYPE', 1) - conf.define('HAVE_KRB5_SESSION_IN_CREDS', 1) - conf.define('HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES', 1) - conf.define('HAVE_KRB5_SET_REAL_TIME', 1) - conf.define('HAVE_KRB5_STRING_TO_KEY', 1) - conf.define('HAVE_KRB5_STRING_TO_KEY_SALT', 1) - conf.define('HAVE_KRB5_VERIFY_CHECKSUM', 1) - conf.define('HAVE_LIBKRB5', 1) - conf.define('KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT', 1) - conf.define('KRB5_VERIFY_CHECKSUM_ARGS', 6) - conf.define('HAVE_ETYPE_IN_ENCRYPTEDDATA', 1) - conf.define('KRB5_PRINC_REALM_RETURNS_REALM', 1) - conf.define('HAVE_KRB5_PRINCIPAL_GET_REALM', 1) - conf.define('HAVE_KRB5_H', 1) - conf.define('HAVE_ENCTYPE_ARCFOUR_HMAC_MD5', 1) - conf.define('HAVE_AP_OPTS_USE_SUBKEY', 1) - conf.define('HAVE_ENCTYPE_ARCFOUR_HMAC_MD5', 1) - conf.define('HAVE_ENCTYPE_ARCFOUR_HMAC', 1) - else: + elif not conf.env.toplevel_build: conf.SET_TARGET_TYPE('krb5', 'EMPTY') conf.SET_TARGET_TYPE('gssapi', 'EMPTY') conf.SET_TARGET_TYPE('gssapi_krb5', 'EMPTY') diff --git a/source3/wscript_build b/source3/wscript_build index 24939c4004..0b924cad4d 100755 --- a/source3/wscript_build +++ b/source3/wscript_build @@ -775,7 +775,7 @@ bld.SAMBA3_SUBSYSTEM('POPT_SAMBA3', bld.SAMBA3_SUBSYSTEM('KRBCLIENT', source=KRBCLIENT_SRC, - public_deps='krb5 k5crypto com_err gssapi gssapi_krb5', + public_deps='KRB5_WRAP krb5 k5crypto com_err gssapi gssapi_krb5', vars=locals()) bld.SAMBA3_LIBRARY('samba3core', diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c index c5079123ef..9ac226390a 100644 --- a/source4/auth/kerberos/kerberos_util.c +++ b/source4/auth/kerberos/kerberos_util.c @@ -542,8 +542,8 @@ static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx, ZERO_STRUCT(entry); - ret = create_kerberos_key_from_string(smb_krb5_context->krb5_context, - salt_princ, &password, &entry.keyblock, enctypes[i]); + ret = create_kerberos_key_from_string_direct(smb_krb5_context->krb5_context, + salt_princ, &password, &entry.keyblock, enctypes[i]); if (ret != 0) { return ret; } diff --git a/source4/auth/kerberos/wscript_build b/source4/auth/kerberos/wscript_build index 1b4804e7cc..586366d422 100644 --- a/source4/auth/kerberos/wscript_build +++ b/source4/auth/kerberos/wscript_build @@ -1,10 +1,10 @@ #!/usr/bin/env python bld.SAMBA_LIBRARY('authkrb5', - source='kerberos.c clikrb5.c kerberos_heimdal.c kerberos_pac.c gssapi_parse.c krb5_init_context.c keytab_copy.c', + source='kerberos.c kerberos_heimdal.c kerberos_pac.c gssapi_parse.c krb5_init_context.c keytab_copy.c', autoproto='proto.h', public_deps='krb5 ndr-krb5pac samba_socket LIBCLI_RESOLVE com_err asn1', - deps='asn1util auth_sam_reply tevent LIBPACKET ndr ldb', + deps='asn1util auth_sam_reply tevent LIBPACKET ndr ldb KRB5_WRAP', private_library=True ) diff --git a/source4/heimdal_build/wscript_configure b/source4/heimdal_build/wscript_configure index 29def8bcaa..2e8896cdb5 100644 --- a/source4/heimdal_build/wscript_configure +++ b/source4/heimdal_build/wscript_configure @@ -70,6 +70,81 @@ conf.CHECK_STRUCTURE_MEMBER('DIR', 'dd_fd', define='HAVE_DIR_DD_FD', headers='d conf.DEFINE('SAMBA4_INTERNAL_HEIMDAL', 1) +# setup the right defines for a in-tree heimdal build +Logs.info("Using in-tree heimdal kerberos defines") +conf.define('HAVE_GSSAPI_GSSAPI_H', 1) +conf.define('HAVE_AP_OPTS_USE_SUBKEY', 1) +conf.define('HAVE_KRB5_ADDRESSES', 1) +conf.define('HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK', 1) +conf.define('HAVE_KRB5_SET_REAL_TIME', 1) +conf.define('HAVE_COM_ERR_H', 1) +conf.define('HAVE_ADDR_TYPE_IN_KRB5_ADDRESS', 1) +conf.define('HAVE_GSS_DISPLAY_STATUS', 1) +conf.define('HAVE_LIBGSSAPI', 1) +conf.define('HAVE_ADDR_TYPE_IN_KRB5_ADDRESS', 1) +conf.define('HAVE_CHECKSUM_IN_KRB5_CHECKSUM', 1) +conf.define('HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE', 0) +conf.define('HAVE_DECL_KRB5_GET_CREDENTIALS_FOR_USER', 0) +conf.define('HAVE_E_DATA_POINTER_IN_KRB5_ERROR', 1) +conf.define('HAVE_INITIALIZE_KRB5_ERROR_TABLE', 1) +conf.define('HAVE_KRB5_ADDRESSES', 1) +conf.define('HAVE_KRB5_AUTH_CON_SETKEY', 1) +conf.define('HAVE_KRB5_CRYPTO', 1) +conf.define('HAVE_KRB5_CRYPTO_DESTROY', 1) +conf.define('HAVE_KRB5_CRYPTO_INIT', 1) +conf.define('HAVE_KRB5_C_ENCTYPE_COMPARE', 1) +conf.define('HAVE_KRB5_C_VERIFY_CHECKSUM', 1) +conf.define('HAVE_FREE_AP_REQ', 1) +conf.define('HAVE_KRB5_DECODE_AP_REQ', 1) +conf.define('HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS', 1) +conf.define('HAVE_KRB5_ENCTYPE_TO_STRING', 1) +conf.define('HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG', 1) +conf.define('HAVE_KRB5_FREE_ERROR_CONTENTS', 1) +conf.define('HAVE_KRB5_FREE_HOST_REALM', 1) +conf.define('HAVE_KRB5_FWD_TGT_CREDS', 1) +conf.define('HAVE_KRB5_GET_CREDS', 1) +conf.define('HAVE_KRB5_GET_CREDS_OPT_ALLOC', 1) +conf.define('HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE', 1) +conf.define('HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES', 1) +conf.define('HAVE_KRB5_GET_HOST_REALM', 1) +conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC', 1) +conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_FREE', 1) +conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR', 1) +conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST', 1) +conf.define('HAVE_KRB5_GET_KDC_CRED', 1) +conf.define('HAVE_KRB5_GET_PW_SALT', 1) +conf.define('HAVE_KRB5_GET_RENEWED_CREDS', 1) +conf.define('HAVE_KRB5_KEYBLOCK_KEYVALUE', 1) +conf.define('HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK', 1) +conf.define('HAVE_KRB5_KRBHST_GET_ADDRINFO', 1) +conf.define('HAVE_KRB5_KRBHST_INIT', 1) +conf.define('HAVE_KRB5_KT_COMPARE', 1) +conf.define('HAVE_KRB5_KT_FREE_ENTRY', 1) +conf.define('HAVE_KRB5_KU_OTHER_CKSUM', 1) +conf.define('HAVE_KRB5_LOCATE_PLUGIN_H', 1) +conf.define('HAVE_KRB5_MK_REQ_EXTENDED', 1) +conf.define('HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM', 1) +conf.define('HAVE_KRB5_PRINCIPAL_GET_COMP_STRING', 1) +conf.define('HAVE_KRB5_PRINCIPAL_GET_REALM', 1) +conf.define('HAVE_KRB5_REALM_TYPE', 1) +conf.define('HAVE_KRB5_SESSION_IN_CREDS', 1) +conf.define('HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES', 1) +conf.define('HAVE_KRB5_SET_REAL_TIME', 1) +conf.define('HAVE_KRB5_STRING_TO_KEY', 1) +conf.define('HAVE_KRB5_STRING_TO_KEY_SALT', 1) +conf.define('HAVE_KRB5_VERIFY_CHECKSUM', 1) +conf.define('HAVE_LIBKRB5', 1) +conf.define('KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT', 1) +conf.define('KRB5_VERIFY_CHECKSUM_ARGS', 6) +conf.define('HAVE_ETYPE_IN_ENCRYPTEDDATA', 1) +conf.define('KRB5_PRINC_REALM_RETURNS_REALM', 1) +conf.define('HAVE_KRB5_PRINCIPAL_GET_REALM', 1) +conf.define('HAVE_KRB5_H', 1) +conf.define('HAVE_ENCTYPE_ARCFOUR_HMAC_MD5', 1) +conf.define('HAVE_AP_OPTS_USE_SUBKEY', 1) +conf.define('HAVE_ENCTYPE_ARCFOUR_HMAC_MD5', 1) +conf.define('HAVE_ENCTYPE_ARCFOUR_HMAC', 1) + if conf.CHECK_BUNDLED_SYSTEM('com_err', checkfunctions='com_right_r com_err', headers='com_err.h'): conf.define('USING_SYSTEM_COM_ERR', 1) |