diff options
Diffstat (limited to 'source4/auth/kerberos')
| -rw-r--r-- | source4/auth/kerberos/clikrb5.c | 103 | ||||
| -rw-r--r-- | source4/auth/kerberos/config.mk | 3 | ||||
| -rw-r--r-- | source4/auth/kerberos/kerberos.h | 15 | ||||
| -rw-r--r-- | source4/auth/kerberos/krb5_init_context.c | 126 | ||||
| -rw-r--r-- | source4/auth/kerberos/krb5_init_context.h | 29 |
5 files changed, 158 insertions, 118 deletions
diff --git a/source4/auth/kerberos/clikrb5.c b/source4/auth/kerberos/clikrb5.c index e3f2057b44..85d60a1244 100644 --- a/source4/auth/kerberos/clikrb5.c +++ b/source4/auth/kerberos/clikrb5.c @@ -385,107 +385,4 @@ cleanup_princ: return ret; } - -static int smb_krb5_context_destory_1(void *ptr) -{ - struct smb_krb5_context *ctx = ptr; - krb5_free_context(ctx->krb5_context); - return 0; -} - -#ifdef HAVE_KRB5_LOG_CONTROL -static int smb_krb5_context_destory_2(void *ptr) -{ - struct smb_krb5_context *ctx = ptr; - - /* Otherwise krb5_free_context will try and close what we have already free()ed */ - krb5_set_warn_dest(ctx->krb5_context, NULL); - krb5_closelog(ctx->krb5_context, ctx->logf); - smb_krb5_context_destory_1(ptr); - return 0; -} - -/* We never close down the DEBUG system, and no need to unreference the use */ -static void smb_krb5_debug_close(void *private) { - return; -} - -static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private) -{ - DEBUG(3, ("Kerberos: %s\n", msg)); -} - -#endif - - krb5_error_code smb_krb5_init_context(TALLOC_CTX *parent_ctx, - struct smb_krb5_context **smb_krb5_context) -{ - krb5_error_code ret; - TALLOC_CTX *tmp_ctx; - - initialize_krb5_error_table(); - - tmp_ctx = talloc_new(parent_ctx); - *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context); - - if (!*smb_krb5_context || !tmp_ctx) { - talloc_free(*smb_krb5_context); - talloc_free(tmp_ctx); - return ENOMEM; - } - - ret = krb5_init_context(&(*smb_krb5_context)->krb5_context); - if (ret) { - DEBUG(1,("krb5_init_context failed (%s)\n", - error_message(ret))); - return ret; - } - - talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destory_1); - - if (lp_realm() && *lp_realm()) { - char *upper_realm = strupper_talloc(tmp_ctx, lp_realm()); - if (!upper_realm) { - DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm())); - talloc_free(tmp_ctx); - return ENOMEM; - } - ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, lp_realm()); - if (ret) { - DEBUG(1,("krb5_set_default_realm failed (%s)\n", - smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); - talloc_free(tmp_ctx); - return ret; - } - } - -#ifdef HAVE_KRB5_LOG_CONTROL - /* TODO: Should we have a different name here? */ - ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf); - - if (ret) { - DEBUG(1,("krb5_initlog failed (%s)\n", - smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); - talloc_free(tmp_ctx); - return ret; - } - - talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destory_2); - - ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */, - smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL); - if (ret) { - DEBUG(1,("krb5_addlog_func failed (%s)\n", - smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); - talloc_free(tmp_ctx); - return ret; - } - krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf); - -#endif - talloc_steal(parent_ctx, *smb_krb5_context); - talloc_free(tmp_ctx); - return 0; -} - #endif diff --git a/source4/auth/kerberos/config.mk b/source4/auth/kerberos/config.mk index 56ce64fdb1..cc31af44e7 100644 --- a/source4/auth/kerberos/config.mk +++ b/source4/auth/kerberos/config.mk @@ -7,7 +7,8 @@ ADD_OBJ_FILES = \ auth/kerberos/kerberos_verify.o \ auth/kerberos/kerberos_util.o \ auth/kerberos/kerberos_pac.o \ - auth/kerberos/gssapi_parse.o + auth/kerberos/gssapi_parse.o \ + auth/kerberos/krb5_init_context.o REQUIRED_SUBSYSTEMS = KERBEROS_LIB NDR_KRB5PAC # End SUBSYSTEM KERBEROS ################################# diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h index 9535094e2b..bc2a1babe9 100644 --- a/source4/auth/kerberos/kerberos.h +++ b/source4/auth/kerberos/kerberos.h @@ -21,19 +21,8 @@ #if defined(HAVE_KRB5) -#if defined(HAVE_KRB5_INITLOG) && defined(HAVE_KRB5_ADDLOG_FUNC) && defined (HAVE_KRB5_SET_WARN_DEST) && defined(HAVE_KRB5_LOG_FACILITY) -#define HAVE_KRB5_LOG_CONTROL -#else -#undef HAVE_KRB5_LOG_CONTROL -#endif +#include "auth/kerberos/krb5_init_context.h" -struct smb_krb5_context { - krb5_context krb5_context; -#ifdef HAVE_KRB5_LOG_CONTROL - krb5_log_facility *logf; -#endif -}; - struct ccache_container { struct smb_krb5_context *smb_krb5_context; krb5_ccache ccache; @@ -118,8 +107,6 @@ char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TAL struct cli_credentials *credentials, struct smb_krb5_context *smb_krb5_context, krb5_ccache ccache); -krb5_error_code smb_krb5_init_context(TALLOC_CTX *parent_ctx, - struct smb_krb5_context **smb_krb5_context); krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, struct cli_credentials *machine_account, struct smb_krb5_context *smb_krb5_context, diff --git a/source4/auth/kerberos/krb5_init_context.c b/source4/auth/kerberos/krb5_init_context.c new file mode 100644 index 0000000000..2a8f0624da --- /dev/null +++ b/source4/auth/kerberos/krb5_init_context.c @@ -0,0 +1,126 @@ +/* + Unix SMB/CIFS implementation. + Wrapper for krb5_init_context + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "system/kerberos.h" +#include "auth/kerberos/kerberos.h" + +static int smb_krb5_context_destroy_1(void *ptr) +{ + struct smb_krb5_context *ctx = ptr; + krb5_free_context(ctx->krb5_context); + return 0; +} + +static int smb_krb5_context_destroy_2(void *ptr) +{ + struct smb_krb5_context *ctx = ptr; + + /* Otherwise krb5_free_context will try and close what we have already free()ed */ + krb5_set_warn_dest(ctx->krb5_context, NULL); + krb5_closelog(ctx->krb5_context, ctx->logf); + smb_krb5_context_destroy_1(ptr); + return 0; +} + +/* We never close down the DEBUG system, and no need to unreference the use */ +static void smb_krb5_debug_close(void *private) { + return; +} + +static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private) +{ + DEBUG(3, ("Kerberos: %s\n", msg)); +} + + krb5_error_code smb_krb5_init_context(void *parent_ctx, + struct smb_krb5_context **smb_krb5_context) +{ + krb5_error_code ret; + TALLOC_CTX *tmp_ctx; + + initialize_krb5_error_table(); + + tmp_ctx = talloc_new(parent_ctx); + *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context); + + if (!*smb_krb5_context || !tmp_ctx) { + talloc_free(*smb_krb5_context); + talloc_free(tmp_ctx); + return ENOMEM; + } + + ret = krb5_init_context(&(*smb_krb5_context)->krb5_context); + if (ret) { + DEBUG(1,("krb5_init_context failed (%s)\n", + error_message(ret))); + return ret; + } + + talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_1); + + if (lp_realm() && *lp_realm()) { + char *upper_realm = strupper_talloc(tmp_ctx, lp_realm()); + if (!upper_realm) { + DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm())); + talloc_free(tmp_ctx); + return ENOMEM; + } + ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, lp_realm()); + if (ret) { + DEBUG(1,("krb5_set_default_realm failed (%s)\n", + smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); + talloc_free(tmp_ctx); + return ret; + } + } + + /* TODO: Should we have a different name here? */ + ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf); + + if (ret) { + DEBUG(1,("krb5_initlog failed (%s)\n", + smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); + talloc_free(tmp_ctx); + return ret; + } + + talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_2); + + ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */, + smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL); + if (ret) { + DEBUG(1,("krb5_addlog_func failed (%s)\n", + smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx))); + talloc_free(tmp_ctx); + return ret; + } + krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf); + + talloc_steal(parent_ctx, *smb_krb5_context); + talloc_free(tmp_ctx); + return 0; +} + + void smb_krb5_free_context(struct smb_krb5_context *smb_krb5_context) +{ + talloc_free(smb_krb5_context); +} diff --git a/source4/auth/kerberos/krb5_init_context.h b/source4/auth/kerberos/krb5_init_context.h new file mode 100644 index 0000000000..8120b8c96d --- /dev/null +++ b/source4/auth/kerberos/krb5_init_context.h @@ -0,0 +1,29 @@ +/* + Unix SMB/CIFS implementation. + simple kerberos5 routines for active directory + Copyright (C) Andrew Bartlett 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +struct smb_krb5_context { + krb5_context krb5_context; + krb5_log_facility *logf; +}; + +krb5_error_code smb_krb5_init_context(void *parent_ctx, + struct smb_krb5_context **smb_krb5_context); +void smb_krb5_free_context(struct smb_krb5_context *smb_krb5_context); + |