From bab977dad76e9204278c7afe0bb905cda064f488 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Thu, 16 Jun 2005 05:39:40 +0000
Subject: r7626: a new ldap client library. Main features are:

 - hooked into events system, so requests can be truly async and won't
   interfere with other processing happening at the same time

 - uses NTSTATUS codes for errors (previously errors were mostly
   ignored). In a similar fashion to the DOS error handling, I have
   reserved a range of the NTSTATUS code 32 bit space for LDAP error
   codes, so a function can return a LDAP error code in a NTSTATUS

 - much cleaner packet handling
(This used to be commit 2e3c660b2fc20e046d82bf1cc296422b6e7dfad0)
---
 source4/libcli/ldap/ldap_bind.c | 250 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 250 insertions(+)
 create mode 100644 source4/libcli/ldap/ldap_bind.c

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
new file mode 100644
index 0000000000..11a6997fb2
--- /dev/null
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -0,0 +1,250 @@
+/* 
+   Unix SMB/CIFS mplementation.
+
+   LDAP bind calls
+   
+   Copyright (C) Andrew Tridgell  2005
+   Copyright (C) Volker Lendecke  2004
+    
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   
+*/
+
+#include "includes.h"
+#include "libcli/ldap/ldap.h"
+#include "libcli/ldap/ldap_client.h"
+#include "auth/auth.h"
+
+static struct ldap_message *new_ldap_simple_bind_msg(struct ldap_connection *conn, 
+						     const char *dn, const char *pw)
+{
+	struct ldap_message *res;
+
+	res = new_ldap_message(conn);
+	if (!res) {
+		return NULL;
+	}
+
+	res->type = LDAP_TAG_BindRequest;
+	res->r.BindRequest.version = 3;
+	res->r.BindRequest.dn = talloc_strdup(res, dn);
+	res->r.BindRequest.mechanism = LDAP_AUTH_MECH_SIMPLE;
+	res->r.BindRequest.creds.password = talloc_strdup(res, pw);
+
+	return res;
+}
+
+
+/*
+  perform a simple username/password bind
+*/
+NTSTATUS ldap_bind_simple(struct ldap_connection *conn, 
+			  const char *userdn, const char *password)
+{
+	struct ldap_request *req;
+	struct ldap_message *msg;
+	const char *dn, *pw;
+	NTSTATUS status;
+
+	if (conn == NULL) {
+		return NT_STATUS_INVALID_CONNECTION;
+	}
+
+	if (userdn) {
+		dn = userdn;
+	} else {
+		if (conn->auth_dn) {
+			dn = conn->auth_dn;
+		} else {
+			dn = "";
+		}
+	}
+
+	if (password) {
+		pw = password;
+	} else {
+		if (conn->simple_pw) {
+			pw = conn->simple_pw;
+		} else {
+			pw = "";
+		}
+	}
+
+	msg = new_ldap_simple_bind_msg(conn, dn, pw);
+	NT_STATUS_HAVE_NO_MEMORY(msg);
+
+	/* send the request */
+	req = ldap_request_send(conn, msg);
+	talloc_free(msg);
+	NT_STATUS_HAVE_NO_MEMORY(req);
+
+	/* wait for replies */
+	status = ldap_request_wait(req);
+	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(req);
+		return status;
+	}
+
+	/* check its a valid reply */
+	msg = req->replies[0];
+	if (msg->type != LDAP_TAG_BindResponse) {
+		talloc_free(req);
+		return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
+	}
+
+	status = ldap_check_response(conn, &msg->r.BindResponse.response);
+
+	talloc_free(req);
+
+	return status;
+}
+
+
+static struct ldap_message *new_ldap_sasl_bind_msg(struct ldap_connection *conn, 
+						   const char *sasl_mechanism, 
+						   DATA_BLOB *secblob)
+{
+	struct ldap_message *res;
+
+	res = new_ldap_message(conn);
+	if (!res) {
+		return NULL;
+	}
+
+	res->type = LDAP_TAG_BindRequest;
+	res->r.BindRequest.version = 3;
+	res->r.BindRequest.dn = "";
+	res->r.BindRequest.mechanism = LDAP_AUTH_MECH_SASL;
+	res->r.BindRequest.creds.SASL.mechanism = talloc_strdup(res, sasl_mechanism);
+	res->r.BindRequest.creds.SASL.secblob = *secblob;
+
+	return res;
+}
+
+
+/*
+  perform a sasl bind using the given credentials
+*/
+NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *creds)
+{
+	NTSTATUS status;
+	TALLOC_CTX *tmp_ctx = NULL;
+	DATA_BLOB input = data_blob(NULL, 0);
+	DATA_BLOB output = data_blob(NULL, 0);
+
+	status = gensec_client_start(conn, &conn->gensec);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0, ("Failed to start GENSEC engine (%s)\n", nt_errstr(status)));
+		goto failed;
+	}
+
+	gensec_want_feature(conn->gensec, 0 | GENSEC_FEATURE_SIGN | GENSEC_FEATURE_SEAL);
+
+	status = gensec_set_credentials(conn->gensec, creds);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to start set GENSEC creds: %s\n", 
+			  nt_errstr(status)));
+		goto failed;
+	}
+
+	status = gensec_set_target_hostname(conn->gensec, conn->host);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to start set GENSEC target hostname: %s\n", 
+			  nt_errstr(status)));
+		goto failed;
+	}
+
+	status = gensec_set_target_service(conn->gensec, "ldap");
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to start set GENSEC target service: %s\n", 
+			  nt_errstr(status)));
+		goto failed;
+	}
+
+	status = gensec_start_mech_by_sasl_name(conn->gensec, "NTLM");
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to start set GENSEC client SPNEGO mechanism: %s\n",
+			  nt_errstr(status)));
+		goto failed;
+	}
+
+	tmp_ctx = talloc_new(conn);
+	if (tmp_ctx == NULL) goto failed;
+
+	status = gensec_update(conn->gensec, tmp_ctx, input, &output);
+
+	while (1) {
+		struct ldap_message *response;
+		struct ldap_message *msg;
+		struct ldap_request *req;
+		int result = LDAP_OTHER;
+	
+		if (NT_STATUS_IS_OK(status) && output.length == 0) {
+			break;
+		}
+		if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) && 
+		    !NT_STATUS_IS_OK(status)) {
+			break;
+		}
+
+		msg = new_ldap_sasl_bind_msg(tmp_ctx, "GSS-SPNEGO", &output);
+		if (msg == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		req = ldap_request_send(conn, msg);
+		if (req == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+		talloc_steal(tmp_ctx, req);
+
+		status = ldap_result_n(req, 0, &response);
+		if (!NT_STATUS_IS_OK(status)) {
+			goto failed;
+		}
+		
+		if (response->type != LDAP_TAG_BindResponse) {
+			status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
+			goto failed;
+		}
+
+		result = response->r.BindResponse.response.resultcode;
+
+		if (result != LDAP_SUCCESS && result != LDAP_SASL_BIND_IN_PROGRESS) {
+			break;
+		}
+
+		status = gensec_update(conn->gensec, tmp_ctx,
+				       response->r.BindResponse.SASL.secblob,
+				       &output);
+	}
+
+	if (NT_STATUS_IS_OK(status) &&
+	    (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
+	     gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN))) {
+		conn->enable_wrap = True;
+	}
+
+	talloc_free(tmp_ctx);
+	return status;
+
+failed:
+	talloc_free(tmp_ctx);
+	talloc_free(conn->gensec);
+	conn->gensec = NULL;
+	return status;
+}
-- 
cgit 


From af237084ecd4f9928c6c282b9c5c73598d5c73d6 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Thu, 16 Jun 2005 11:36:09 +0000
Subject: r7633: this patch started as an attempt to make the dcerpc code use a
 given event_context for the socket_connect() call, so that when things that
 use dcerpc are running alongside anything else it doesn't block the whole
 process during a connect.

Then of course I needed to change any code that created a dcerpc
connection (such as the auth code) to also take an event context, and
anything that called that and so on .... thus the size of the patch.

There were 3 places where I punted:

  - abartlet wanted me to add a gensec_set_event_context() call
    instead of adding it to the gensec init calls. Andrew, my
    apologies for not doing this. I didn't do it as adding a new
    parameter allowed me to catch all the callers with the
    compiler. Now that its done, we could go back and use
    gensec_set_event_context()

  - the ejs code calls auth initialisation, which means it should pass
    in the event context from the web server. I punted on that. Needs fixing.

  - I used a NULL event context in dcom_get_pipe(). This is equivalent
    to what we did already, but should be fixed to use a callers event
    context. Jelmer, can you think of a clean way to do that?

I also cleaned up a couple of things:

 - libnet_context_destroy() makes no sense. I removed it.

 - removed some unused vars in various places
(This used to be commit 3a3025485bdb8f600ab528c0b4b4eef0c65e3fc9)
---
 source4/libcli/ldap/ldap_bind.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 11a6997fb2..ea97798261 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -144,7 +144,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	DATA_BLOB input = data_blob(NULL, 0);
 	DATA_BLOB output = data_blob(NULL, 0);
 
-	status = gensec_client_start(conn, &conn->gensec);
+	status = gensec_client_start(conn, &conn->gensec, NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(0, ("Failed to start GENSEC engine (%s)\n", nt_errstr(status)));
 		goto failed;
-- 
cgit 


From ca91a8a6919b9bc1b6016310c6b30447723b08d6 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Sat, 18 Jun 2005 09:09:27 +0000
Subject: r7717: fixed some typos (This used to be commit
 fc8feee56034fe165359c804d111f80e5b3ebb65)

---
 source4/libcli/ldap/ldap_bind.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index ea97798261..7e4fa10fe4 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -154,28 +154,28 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 
 	status = gensec_set_credentials(conn->gensec, creds);
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(1, ("Failed to start set GENSEC creds: %s\n", 
+		DEBUG(1, ("Failed to set GENSEC creds: %s\n", 
 			  nt_errstr(status)));
 		goto failed;
 	}
 
 	status = gensec_set_target_hostname(conn->gensec, conn->host);
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(1, ("Failed to start set GENSEC target hostname: %s\n", 
+		DEBUG(1, ("Failed to set GENSEC target hostname: %s\n", 
 			  nt_errstr(status)));
 		goto failed;
 	}
 
 	status = gensec_set_target_service(conn->gensec, "ldap");
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(1, ("Failed to start set GENSEC target service: %s\n", 
+		DEBUG(1, ("Failed to set GENSEC target service: %s\n", 
 			  nt_errstr(status)));
 		goto failed;
 	}
 
 	status = gensec_start_mech_by_sasl_name(conn->gensec, "NTLM");
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(1, ("Failed to start set GENSEC client SPNEGO mechanism: %s\n",
+		DEBUG(1, ("Failed to set GENSEC client SPNEGO mechanism: %s\n",
 			  nt_errstr(status)));
 		goto failed;
 	}
-- 
cgit 


From acd04c9281252f4fe47c7127da13ea25be703c7c Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Fri, 24 Jun 2005 00:03:47 +0000
Subject: r7855: fixed a typo (This used to be commit
 a1155651e722e28496be02b729c950afae5db9a9)

---
 source4/libcli/ldap/ldap_bind.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 7e4fa10fe4..e70a56779b 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -234,7 +234,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	}
 
 	if (NT_STATUS_IS_OK(status) &&
-	    (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
+	    (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL) ||
 	     gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN))) {
 		conn->enable_wrap = True;
 	}
-- 
cgit 


From ba90b652d918fb34f1e43083f8283f669c73c340 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 23 Aug 2005 05:29:37 +0000
Subject: r9505: Work on GENSEC and the code that calls it, for tighter
 interface requirements, and for better error reporting.

In particular, the composite session setup (extended security/SPNEGO)
code now returns errors, rather than NT_STATUS_NO_MEMORY.  This is
seen particularly when GENSEC fails to start.

The tighter interface rules apply to NTLMSSP, which must be called
exactly the right number of times.  This is to match some of our other
less-tested modules, where adding flexablity is harder.  (and this is
security code, so let's just get it right).  As such, the DCE/RPC and
LDAP clients have been updated.

Andrew Bartlett
(This used to be commit 134550cf752b9edad66c3368750bfb4bbd9d55d1)
---
 source4/libcli/ldap/ldap_bind.c | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index e70a56779b..738222da86 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -141,6 +141,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 {
 	NTSTATUS status;
 	TALLOC_CTX *tmp_ctx = NULL;
+
 	DATA_BLOB input = data_blob(NULL, 0);
 	DATA_BLOB output = data_blob(NULL, 0);
 
@@ -183,21 +184,35 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	tmp_ctx = talloc_new(conn);
 	if (tmp_ctx == NULL) goto failed;
 
-	status = gensec_update(conn->gensec, tmp_ctx, input, &output);
-
 	while (1) {
+		NTSTATUS gensec_status;
 		struct ldap_message *response;
 		struct ldap_message *msg;
 		struct ldap_request *req;
 		int result = LDAP_OTHER;
 	
-		if (NT_STATUS_IS_OK(status) && output.length == 0) {
-			break;
-		}
+		status = gensec_update(conn->gensec, tmp_ctx,
+				       input,
+				       &output);
+		/* The status value here, from GENSEC is vital to the security
+		 * of the system.  Even if the other end accepts, if GENSEC
+		 * claims 'MORE_PROCESSING_REQUIRED' then you must keep
+		 * feeding it blobs, or else the remote host/attacker might
+		 * avoid mutal authentication requirements.
+		 *
+		 * Likewise, you must not feed GENSEC too much (after the OK),
+		 * it doesn't like that either
+		 */
+
+		gensec_status = status;
+
 		if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) && 
 		    !NT_STATUS_IS_OK(status)) {
 			break;
 		}
+		if (output.length == 0) {
+			break;
+		}
 
 		msg = new_ldap_sasl_bind_msg(tmp_ctx, "GSS-SPNEGO", &output);
 		if (msg == NULL) {
@@ -225,12 +240,15 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		result = response->r.BindResponse.response.resultcode;
 
 		if (result != LDAP_SUCCESS && result != LDAP_SASL_BIND_IN_PROGRESS) {
+			status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 			break;
 		}
 
-		status = gensec_update(conn->gensec, tmp_ctx,
-				       response->r.BindResponse.SASL.secblob,
-				       &output);
+		/* This is where we check if GENSEC wanted to be fed more data */
+		if (!NT_STATUS_EQUAL(gensec_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+			break;
+		}
+		input = response->r.BindResponse.SASL.secblob;
 	}
 
 	if (NT_STATUS_IS_OK(status) &&
-- 
cgit 


From d73bd8f01aefe97f007a59f49698a5c7c9e97c29 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Mon, 17 Oct 2005 11:50:34 +0000
Subject: r11114: - fixed error handling on bad bind in ildap client

- added nicer error display, giving a string version of the error code
(This used to be commit 5ec486bb81536b38a5f40cae7555cbcbbfa52263)
---
 source4/libcli/ldap/ldap_bind.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 738222da86..c08ffabc22 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -240,7 +240,8 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		result = response->r.BindResponse.response.resultcode;
 
 		if (result != LDAP_SUCCESS && result != LDAP_SASL_BIND_IN_PROGRESS) {
-			status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
+			status = ldap_check_response(conn, 
+						     &response->r.BindResponse.response);
 			break;
 		}
 
-- 
cgit 


From 72820aaf9281acc2acec869793a95f3353c1034c Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sat, 5 Nov 2005 11:02:37 +0000
Subject: r11521: Add in client support for checking supportedSASLmechanisms,
 and then determining a mechanism to use.

Currently it doesn't to fallbacks like SPNEGO does, but this could be
added (to GENSEC, not to here).

This also adds a new function to GENSEC, which returns a list of SASL
names in our preference order (currently determined by the build
system of all things...).

Also make the similar function used for OIDs in SPNEGO do the same.

This is all a very long-winded way of moving from a hard-coded NTLM to
GSS-SPNEGO in our SASL client...

Andrew Bartlett
(This used to be commit 130eb9bb9a37957614c87e0e6846a812abb51e00)
---
 source4/libcli/ldap/ldap_bind.c | 57 +++++++++++++++++++++++++++++++++++++++--
 1 file changed, 55 insertions(+), 2 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index c08ffabc22..81e0c8b4e6 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -145,6 +145,18 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	DATA_BLOB input = data_blob(NULL, 0);
 	DATA_BLOB output = data_blob(NULL, 0);
 
+	struct ldap_message **sasl_mechs_msgs;
+	struct ldap_SearchResEntry *search;
+	int count, i;
+
+	const char **sasl_names;
+	const struct gensec_security_ops **mechs;
+	
+	static const char *supported_sasl_mech_attrs[] = {
+		"supportedSASLMechanisms", 
+		NULL 
+	};
+
 	status = gensec_client_start(conn, &conn->gensec, NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(0, ("Failed to start GENSEC engine (%s)\n", nt_errstr(status)));
@@ -174,16 +186,57 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		goto failed;
 	}
 
-	status = gensec_start_mech_by_sasl_name(conn->gensec, "NTLM");
+	status = ildap_search(conn, "", LDAP_SEARCH_SCOPE_BASE, "", supported_sasl_mech_attrs, 
+			      False, &sasl_mechs_msgs);
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(1, ("Failed to set GENSEC client SPNEGO mechanism: %s\n",
+		DEBUG(1, ("Failed to inquire of target's available sasl mechs in rootdse search: %s\n", 
 			  nt_errstr(status)));
 		goto failed;
 	}
+	
+	count = ildap_count_entries(conn, sasl_mechs_msgs);
+	if (count != 1) {
+		DEBUG(1, ("Failed to inquire of target's available sasl mechs in rootdse search: wrong number of replies: %d\n",
+			  count));
+		goto failed;
+	}
 
 	tmp_ctx = talloc_new(conn);
 	if (tmp_ctx == NULL) goto failed;
 
+	search = &sasl_mechs_msgs[0]->r.SearchResultEntry;
+	if (search->num_attributes != 1) {
+		DEBUG(1, ("Failed to inquire of target's available sasl mechs in rootdse search: wrong number of attributes: %d\n",
+			  search->num_attributes));
+		goto failed;
+	}
+
+	sasl_names = talloc_array(tmp_ctx, const char *, search->attributes[0].num_values + 1);
+	if (!sasl_names) {
+		DEBUG(1, ("talloc_arry(char *, %d) failed\n",
+			  count));
+		goto failed;
+	}
+		
+	for (i=0; i<search->attributes[0].num_values; i++) {
+		sasl_names[i] = (const char *)search->attributes[0].values[i].data;
+	}
+	sasl_names[i] = NULL;
+	
+	mechs = gensec_security_by_sasl(tmp_ctx, sasl_names);
+	if (!mechs || !mechs[0]) {
+		DEBUG(1, ("None of the %d proposed SASL mechs were acceptable\n",
+			  count));
+		goto failed;
+	}
+
+	status = gensec_start_mech_by_ops(conn->gensec, mechs[0]);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to set GENSEC client mechanism: %s/%s %s\n",
+			  mechs[0]->name, mechs[0]->sasl_name, nt_errstr(status)));
+		goto failed;
+	}
+
 	while (1) {
 		NTSTATUS gensec_status;
 		struct ldap_message *response;
-- 
cgit 


From 687545e94e0cb4f2bac0596f7f78797cca312e73 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 5 Dec 2005 04:10:13 +0000
Subject: r12062: SASL negotiation now requires a gensec_security context, so
 that we only try permitted mechanims.

Andrew Bartlett
(This used to be commit 0f50239dc40ee128e4985f8aec5bb5f440a4f3f0)
---
 source4/libcli/ldap/ldap_bind.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 81e0c8b4e6..766416f575 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -223,7 +223,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	}
 	sasl_names[i] = NULL;
 	
-	mechs = gensec_security_by_sasl(tmp_ctx, sasl_names);
+	mechs = gensec_security_by_sasl(conn->gensec, tmp_ctx, sasl_names);
 	if (!mechs || !mechs[0]) {
 		DEBUG(1, ("None of the %d proposed SASL mechs were acceptable\n",
 			  count));
-- 
cgit 


From d4de4c2d210d2e8c9b5aedf70695594809ad6a0b Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Fri, 30 Dec 2005 13:16:54 +0000
Subject: r12608: Remove some unused #include lines. (This used to be commit
 70e7449318aa0e9d2639c76730a7d1683b2f4981)

---
 source4/libcli/ldap/ldap_bind.c | 1 -
 1 file changed, 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 766416f575..6b1c321d49 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -23,7 +23,6 @@
 */
 
 #include "includes.h"
-#include "libcli/ldap/ldap.h"
 #include "libcli/ldap/ldap_client.h"
 #include "auth/auth.h"
 
-- 
cgit 


From c908d0b2aa111659e57a73efb8c33c413965c846 Mon Sep 17 00:00:00 2001
From: Simo Sorce <idra@samba.org>
Date: Fri, 6 Jan 2006 04:01:23 +0000
Subject: r12733: Merge ldap/ldb controls into main tree There's still lot of
 work to do but the patch is stable enough to be pushed into the main samba4
 tree.

Simo.
(This used to be commit 77125feaff252cab44d26593093a9c211c846ce8)
---
 source4/libcli/ldap/ldap_bind.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 6b1c321d49..1f6ef77631 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -23,6 +23,7 @@
 */
 
 #include "includes.h"
+#include "libcli/ldap/ldap.h"
 #include "libcli/ldap/ldap_client.h"
 #include "auth/auth.h"
 
@@ -41,6 +42,7 @@ static struct ldap_message *new_ldap_simple_bind_msg(struct ldap_connection *con
 	res->r.BindRequest.dn = talloc_strdup(res, dn);
 	res->r.BindRequest.mechanism = LDAP_AUTH_MECH_SIMPLE;
 	res->r.BindRequest.creds.password = talloc_strdup(res, pw);
+	res->controls = NULL;
 
 	return res;
 }
@@ -128,6 +130,7 @@ static struct ldap_message *new_ldap_sasl_bind_msg(struct ldap_connection *conn,
 	res->r.BindRequest.mechanism = LDAP_AUTH_MECH_SASL;
 	res->r.BindRequest.creds.SASL.mechanism = talloc_strdup(res, sasl_mechanism);
 	res->r.BindRequest.creds.SASL.secblob = *secblob;
+	res->controls = NULL;
 
 	return res;
 }
@@ -186,7 +189,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	}
 
 	status = ildap_search(conn, "", LDAP_SEARCH_SCOPE_BASE, "", supported_sasl_mech_attrs, 
-			      False, &sasl_mechs_msgs);
+			      False, NULL, NULL, &sasl_mechs_msgs);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(1, ("Failed to inquire of target's available sasl mechs in rootdse search: %s\n", 
 			  nt_errstr(status)));
-- 
cgit 


From f256a9c55e4785e4383a0546e75bba355a51fa04 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sat, 4 Feb 2006 09:53:50 +0000
Subject: r13342: Make the GSSAPI SASL mech actually work, by (shock horror)
 reading the spec.

GSSAPI differs from GSS-SPNEGO in an additional 3 packets, negotiating
a buffer size and what integrity protection/privacy should be used.

I worked off draft-ietf-sasl-gssapi-03, and this works against Win2k3.

I'm doing this in the hope that Apple clients as well as SASL-based
LDAP tools may get a bit further.

I still can't get ldapsearch to work, it fails with the ever-helpful
'Local error'.

Andrew Bartlett
(This used to be commit 3e462897754b30306c1983af2d137329dd937ad6)
---
 source4/libcli/ldap/ldap_bind.c | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 1f6ef77631..2880298dd5 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -152,7 +152,6 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	int count, i;
 
 	const char **sasl_names;
-	const struct gensec_security_ops **mechs;
 	
 	static const char *supported_sasl_mech_attrs[] = {
 		"supportedSASLMechanisms", 
@@ -225,17 +224,10 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	}
 	sasl_names[i] = NULL;
 	
-	mechs = gensec_security_by_sasl(conn->gensec, tmp_ctx, sasl_names);
-	if (!mechs || !mechs[0]) {
-		DEBUG(1, ("None of the %d proposed SASL mechs were acceptable\n",
-			  count));
-		goto failed;
-	}
-
-	status = gensec_start_mech_by_ops(conn->gensec, mechs[0]);
+	status = gensec_start_mech_by_sasl_list(conn->gensec, sasl_names);
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(1, ("Failed to set GENSEC client mechanism: %s/%s %s\n",
-			  mechs[0]->name, mechs[0]->sasl_name, nt_errstr(status)));
+		DEBUG(1, ("None of the %d proposed SASL mechs were acceptable: %s\n",
+			  count, nt_errstr(status)));
 		goto failed;
 	}
 
@@ -265,11 +257,12 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		    !NT_STATUS_IS_OK(status)) {
 			break;
 		}
-		if (output.length == 0) {
+		if (NT_STATUS_IS_OK(status) && output.length == 0) {
 			break;
 		}
 
-		msg = new_ldap_sasl_bind_msg(tmp_ctx, "GSS-SPNEGO", &output);
+		/* Perhaps we should make gensec_start_mech_by_sasl_list() return the name we got? */
+		msg = new_ldap_sasl_bind_msg(tmp_ctx, conn->gensec->ops->sasl_name, &output);
 		if (msg == NULL) {
 			status = NT_STATUS_NO_MEMORY;
 			goto failed;
-- 
cgit 


From 7449f4d8030e7d4a14c75d35af5ea68cf682d24f Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Wed, 15 Feb 2006 15:19:10 +0000
Subject: r13508: some ASN.1 element in LDAP are optional, make it possible to
 code the difference between a zero length and a NULL DATA_BLOB...

metze
(This used to be commit 54f0b19c55df8ad3882f31a114e2ea0e4cf940ae)
---
 source4/libcli/ldap/ldap_bind.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 2880298dd5..cacb0d150e 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -129,7 +129,16 @@ static struct ldap_message *new_ldap_sasl_bind_msg(struct ldap_connection *conn,
 	res->r.BindRequest.dn = "";
 	res->r.BindRequest.mechanism = LDAP_AUTH_MECH_SASL;
 	res->r.BindRequest.creds.SASL.mechanism = talloc_strdup(res, sasl_mechanism);
-	res->r.BindRequest.creds.SASL.secblob = *secblob;
+	if (secblob) {
+		res->r.BindRequest.creds.SASL.secblob = talloc(res, DATA_BLOB);
+		if (!res->r.BindRequest.creds.SASL.secblob) {
+			talloc_free(res);
+			return NULL;
+		}
+		*res->r.BindRequest.creds.SASL.secblob = *secblob;
+	} else {
+		res->r.BindRequest.creds.SASL.secblob = NULL;
+	}
 	res->controls = NULL;
 
 	return res;
@@ -262,7 +271,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		}
 
 		/* Perhaps we should make gensec_start_mech_by_sasl_list() return the name we got? */
-		msg = new_ldap_sasl_bind_msg(tmp_ctx, conn->gensec->ops->sasl_name, &output);
+		msg = new_ldap_sasl_bind_msg(tmp_ctx, conn->gensec->ops->sasl_name, (output.data?&output:NULL));
 		if (msg == NULL) {
 			status = NT_STATUS_NO_MEMORY;
 			goto failed;
@@ -297,7 +306,11 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		if (!NT_STATUS_EQUAL(gensec_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 			break;
 		}
-		input = response->r.BindResponse.SASL.secblob;
+		if (response->r.BindResponse.SASL.secblob) {
+			input = *response->r.BindResponse.SASL.secblob;
+		} else {
+			input = data_blob(NULL, 0);
+		}
 	}
 
 	if (NT_STATUS_IS_OK(status) &&
-- 
cgit 


From 60f3ef505238aaceb40101d5e839d2e303c9c7bd Mon Sep 17 00:00:00 2001
From: Simo Sorce <idra@samba.org>
Date: Sun, 23 Apr 2006 17:22:32 +0000
Subject: r15181: Don't try kerberos sign/seal when in SSL (This used to be
 commit 3be3b1130c41e8e372531c137c46f91c5c0acf98)

---
 source4/libcli/ldap/ldap_bind.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index cacb0d150e..585bdbb234 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -25,6 +25,7 @@
 #include "includes.h"
 #include "libcli/ldap/ldap.h"
 #include "libcli/ldap/ldap_client.h"
+#include "lib/tls/tls.h"
 #include "auth/auth.h"
 
 static struct ldap_message *new_ldap_simple_bind_msg(struct ldap_connection *conn, 
@@ -173,7 +174,11 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		goto failed;
 	}
 
-	gensec_want_feature(conn->gensec, 0 | GENSEC_FEATURE_SIGN | GENSEC_FEATURE_SEAL);
+	/* require Kerberos SIGN/SEAL only if we don't use SSL
+	 * Windows seem not to like double encryption */
+	if (conn->tls == NULL || (! tls_enabled(conn->tls))) {
+		gensec_want_feature(conn->gensec, 0 | GENSEC_FEATURE_SIGN | GENSEC_FEATURE_SEAL);
+	}
 
 	status = gensec_set_credentials(conn->gensec, creds);
 	if (!NT_STATUS_IS_OK(status)) {
-- 
cgit 


From 8f164299473553ee28f4fbf1d9a120840c5e5feb Mon Sep 17 00:00:00 2001
From: Simo Sorce <idra@samba.org>
Date: Tue, 25 Apr 2006 11:50:32 +0000
Subject: r15238: Add some code to automatically reconnect if we want to. (This
 used to be commit e2102999e26566543162455b34adbd2b0486b74d)

---
 source4/libcli/ldap/ldap_bind.c | 53 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 585bdbb234..c33d53f775 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -28,6 +28,39 @@
 #include "lib/tls/tls.h"
 #include "auth/auth.h"
 
+struct ldap_simple_creds {
+	const char *dn;
+	const char *pw;
+};
+
+NTSTATUS ldap_rebind(struct ldap_connection *conn)
+{
+	NTSTATUS status;
+	struct ldap_simple_creds *creds;
+
+	switch (conn->bind.type) {
+	case LDAP_BIND_SASL:
+		status = ldap_bind_sasl(conn, (struct cli_credentials *)conn->bind.creds);
+		break;
+		
+	case LDAP_BIND_SIMPLE:
+		creds = (struct ldap_simple_creds *)conn->bind.creds;
+
+		if (creds == NULL) {
+			return NT_STATUS_UNSUCCESSFUL;
+		}
+
+		status = ldap_bind_simple(conn, creds->dn, creds->pw);
+		break;
+
+	default:
+		return NT_STATUS_UNSUCCESSFUL;
+	}
+
+	return status;
+}
+
+
 static struct ldap_message *new_ldap_simple_bind_msg(struct ldap_connection *conn, 
 						     const char *dn, const char *pw)
 {
@@ -110,6 +143,20 @@ NTSTATUS ldap_bind_simple(struct ldap_connection *conn,
 
 	talloc_free(req);
 
+	if (NT_STATUS_IS_OK(status)) {
+		struct ldap_simple_creds *creds = talloc(conn, struct ldap_simple_creds);
+		if (creds == NULL) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		creds->dn = talloc_strdup(creds, dn);
+		creds->pw = talloc_strdup(creds, pw);
+		if (creds->dn == NULL || creds->pw == NULL) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		conn->bind.type = LDAP_BIND_SIMPLE;
+		conn->bind.creds = creds;
+	}
+
 	return status;
 }
 
@@ -325,6 +372,12 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	}
 
 	talloc_free(tmp_ctx);
+
+	if (NT_STATUS_IS_OK(status)) {
+		conn->bind.type = LDAP_BIND_SASL;
+		conn->bind.creds = creds;
+	}
+
 	return status;
 
 failed:
-- 
cgit 


From 742c110cd67f4995639822981e8bfcb1f652f2c4 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 2 May 2006 20:15:47 +0000
Subject: r15400: Move the TLS code behind the socket interface.

This reduces caller complexity, because the TLS code is now called
just like any other socket.  (A new socket context is returned by the
tls_init_server and tls_init_client routines).

When TLS is not available, the original socket is returned.

Andrew Bartlett
(This used to be commit 09b2f30dfa7a640f5187b4933204e9680be61497)
---
 source4/libcli/ldap/ldap_bind.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index c33d53f775..6714d68b0e 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -223,7 +223,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 
 	/* require Kerberos SIGN/SEAL only if we don't use SSL
 	 * Windows seem not to like double encryption */
-	if (conn->tls == NULL || (! tls_enabled(conn->tls))) {
+	if (!tls_enabled(conn->sock)) {
 		gensec_want_feature(conn->gensec, 0 | GENSEC_FEATURE_SIGN | GENSEC_FEATURE_SEAL);
 	}
 
-- 
cgit 


From ba07fa43d0b0090f5e686d8c1822468049f52416 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sun, 23 Jul 2006 02:50:08 +0000
Subject: r17197: This patch moves the encryption of bulk data on SASL
 negotiated security contexts from the application layer into the socket
 layer.

This improves a number of correctness aspects, as we now allow LDAP
packets to cross multiple SASL packets.  It should also make it much
easier to write async LDAP tests from windows clients, as they use SASL
by default.  It is also vital to allowing OpenLDAP clients to use GSSAPI
against Samba4, as it negotiates a rather small SASL buffer size.

This patch mirrors the earlier work done to move TLS into the socket
layer.

Unusual in this pstch is the extra read callback argument I take.  As
SASL is a layer on top of a socket, it is entirely possible for the
SASL layer to drain a socket dry, but for the caller not to have read
all the decrypted data.  This would leave the system without an event
to restart the read (as the socket is dry).

As such, I re-invoke the read handler from a timed callback, which
should trigger on the next running of the event loop.  I believe that
the TLS code does require a similar callback.

In trying to understand why this is required, imagine a SASL-encrypted
LDAP packet in the following formation:

+-----------------+---------------------+
| SASL  Packet #1 | SASL Packet #2      |
----------------------------------------+
| LDAP Packet #1       | LDAP Packet #2 |
----------------------------------------+

In the old code, this was illegal, but it is perfectly standard
SASL-encrypted LDAP.  Without the callback, we would read and process
the first LDAP packet, and the SASL code would have read the second SASL
packet (to decrypt enough data for the LDAP packet), and no data would
remain on the socket.

Without data on the socket, read events stop.  That is why I add timed
events, until the SASL buffer is drained.

Another approach would be to add a hack to the event system, to have it
pretend there remained data to read off the network (but that is ugly).

In improving the code, to handle more real-world cases, I've been able
to remove almost all the special-cases in the testnonblock code.  The
only special case is that we must use a deterministic partial packet
when calling send, rather than a random length.  (1 + n/2).  This is
needed because of the way the SASL and TLS code works, and the 'resend
on failure' requirements.

Andrew Bartlett
(This used to be commit 5d7c9c12cb2b39673172a357092b80cd814850b0)
---
 source4/libcli/ldap/ldap_bind.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 6714d68b0e..2b209c3871 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -27,6 +27,8 @@
 #include "libcli/ldap/ldap_client.h"
 #include "lib/tls/tls.h"
 #include "auth/auth.h"
+#include "auth/gensec/socket.h"
+#include "lib/stream/packet.h"
 
 struct ldap_simple_creds {
 	const char *dn;
@@ -365,15 +367,23 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		}
 	}
 
-	if (NT_STATUS_IS_OK(status) &&
-	    (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL) ||
-	     gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN))) {
-		conn->enable_wrap = True;
-	}
-
 	talloc_free(tmp_ctx);
 
 	if (NT_STATUS_IS_OK(status)) {
+		struct socket_context *socket = gensec_socket_init(conn->gensec, 
+								   conn->sock,
+								   conn->event.event_ctx, 
+								   ldap_read_io_handler,
+								   conn);
+		if (socket) {
+			conn->sock = socket;
+			talloc_steal(conn->sock, socket);
+			packet_set_socket(conn->packet, socket);
+		} else {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+		
 		conn->bind.type = LDAP_BIND_SASL;
 		conn->bind.creds = creds;
 	}
-- 
cgit 


From 9d6f2767179fad2f9a067c67c09afddb6304e4eb Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 25 Jul 2006 00:57:27 +0000
Subject: r17222: Change the function prototypes for the GENSEc and TLS socket
 creation routines to return an NTSTATUS.  This should help track down errors.

Use a bit of talloc_steal and talloc_unlink to get the real socket to
be a child of the GENSEC or TLS socket.

Always return a new socket, even for the 'pass-though' case.

Andrew Bartlett
(This used to be commit 003e2ab93c87267ba28cd67bd85975bad62a8ea2)
---
 source4/libcli/ldap/ldap_bind.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 2b209c3871..f1f7872455 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -370,15 +370,18 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	talloc_free(tmp_ctx);
 
 	if (NT_STATUS_IS_OK(status)) {
-		struct socket_context *socket = gensec_socket_init(conn->gensec, 
-								   conn->sock,
-								   conn->event.event_ctx, 
-								   ldap_read_io_handler,
-								   conn);
-		if (socket) {
-			conn->sock = socket;
-			talloc_steal(conn->sock, socket);
-			packet_set_socket(conn->packet, socket);
+		struct socket_context *sasl_socket;
+		status = gensec_socket_init(conn->gensec, 
+					    conn->sock,
+					    conn->event.event_ctx, 
+					    ldap_read_io_handler,
+					    conn,
+					    &sasl_socket);
+		if (NT_STATUS_IS_OK(status)) {
+			talloc_steal(conn->sock, sasl_socket);
+			talloc_unlink(conn, conn->sock);
+			conn->sock = sasl_socket;
+			packet_set_socket(conn->packet, conn->sock);
 		} else {
 			status = NT_STATUS_NO_MEMORY;
 			goto failed;
-- 
cgit 


From ec8d486e267b60ebad3eac937580986155b75914 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Tue, 25 Jul 2006 12:48:40 +0000
Subject: r17230: don't overwrite the error with NT_STATUS_NO_MEMORY

metze
(This used to be commit f2196bf9b662d3f38d59eceb8c54f9d2e3f7b505)
---
 source4/libcli/ldap/ldap_bind.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index f1f7872455..4fdd87a25b 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -377,16 +377,13 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 					    ldap_read_io_handler,
 					    conn,
 					    &sasl_socket);
-		if (NT_STATUS_IS_OK(status)) {
-			talloc_steal(conn->sock, sasl_socket);
-			talloc_unlink(conn, conn->sock);
-			conn->sock = sasl_socket;
-			packet_set_socket(conn->packet, conn->sock);
-		} else {
-			status = NT_STATUS_NO_MEMORY;
-			goto failed;
-		}
-		
+		if (!NT_STATUS_IS_OK(status)) goto failed;
+
+		talloc_steal(conn->sock, sasl_socket);
+		talloc_unlink(conn, conn->sock);
+		conn->sock = sasl_socket;
+		packet_set_socket(conn->packet, conn->sock);
+
 		conn->bind.type = LDAP_BIND_SASL;
 		conn->bind.creds = creds;
 	}
-- 
cgit 


From 556aab78a0ff18505f7c8561586abc977adf8e43 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 4 Sep 2006 03:59:04 +0000
Subject: r18025: Don't try to set a target host if there isn't one (such as
 with ldapi://).

Andrew Bartlett
(This used to be commit 556a21faeed0b6e3cc6efcfa8e0939b151a802de)
---
 source4/libcli/ldap/ldap_bind.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 4fdd87a25b..f617cbe102 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -236,11 +236,13 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		goto failed;
 	}
 
-	status = gensec_set_target_hostname(conn->gensec, conn->host);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(1, ("Failed to set GENSEC target hostname: %s\n", 
-			  nt_errstr(status)));
-		goto failed;
+	if (conn->host) {
+		status = gensec_set_target_hostname(conn->gensec, conn->host);
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(1, ("Failed to set GENSEC target hostname: %s\n", 
+				  nt_errstr(status)));
+			goto failed;
+		}
 	}
 
 	status = gensec_set_target_service(conn->gensec, "ldap");
-- 
cgit 


From 13dbee3ffea6065a826f010e50c9b4eb2c6ad109 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 7 Nov 2006 00:48:36 +0000
Subject: r19598: Ahead of a merge to current lorikeet-heimdal:

Break up auth/auth.h not to include the world.

Add credentials_krb5.h with the kerberos dependent prototypes.

Andrew Bartlett
(This used to be commit 2b569c42e0fbb596ea82484d0e1cb22e193037b9)
---
 source4/libcli/ldap/ldap_bind.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index f617cbe102..c4c731e4f5 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -26,7 +26,7 @@
 #include "libcli/ldap/ldap.h"
 #include "libcli/ldap/ldap_client.h"
 #include "lib/tls/tls.h"
-#include "auth/auth.h"
+#include "auth/gensec/gensec.h"
 #include "auth/gensec/socket.h"
 #include "lib/stream/packet.h"
 
-- 
cgit 


From b236d54c42a01343c4b0ec68d70a47a48531e71d Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Tue, 12 Dec 2006 22:43:35 +0000
Subject: r20141: use the gensec_features of the cli_credentials for ildap
 connections, instead of hardcoded GENSEC_FEATURE_SEAL.

That means plain LDAP is now the default.

metze
(This used to be commit b69471866c2a6c61002147938f233f2f63963ba4)
---
 source4/libcli/ldap/ldap_bind.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index c4c731e4f5..addc8cf91e 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -28,6 +28,7 @@
 #include "lib/tls/tls.h"
 #include "auth/gensec/gensec.h"
 #include "auth/gensec/socket.h"
+#include "auth/credentials/credentials.h"
 #include "lib/stream/packet.h"
 
 struct ldap_simple_creds {
@@ -211,7 +212,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	int count, i;
 
 	const char **sasl_names;
-	
+	uint32_t old_gensec_features;
 	static const char *supported_sasl_mech_attrs[] = {
 		"supportedSASLMechanisms", 
 		NULL 
@@ -225,10 +226,12 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 
 	/* require Kerberos SIGN/SEAL only if we don't use SSL
 	 * Windows seem not to like double encryption */
-	if (!tls_enabled(conn->sock)) {
-		gensec_want_feature(conn->gensec, 0 | GENSEC_FEATURE_SIGN | GENSEC_FEATURE_SEAL);
+	old_gensec_features = cli_credentials_get_gensec_features(creds);
+	if (tls_enabled(conn->sock)) {
+		cli_credentials_set_gensec_features(creds, 0);
 	}
 
+	/* this call also sets the gensec_want_features */
 	status = gensec_set_credentials(conn->gensec, creds);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(1, ("Failed to set GENSEC creds: %s\n", 
@@ -236,6 +239,9 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		goto failed;
 	}
 
+	/* reset the original gensec_features */
+	cli_credentials_set_gensec_features(creds, old_gensec_features);
+
 	if (conn->host) {
 		status = gensec_set_target_hostname(conn->gensec, conn->host);
 		if (!NT_STATUS_IS_OK(status)) {
-- 
cgit 


From 0479a2f1cbae51fcd8dbdc3c148c808421fb4d25 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Tue, 10 Jul 2007 02:07:03 +0000
Subject: r23792: convert Samba4 to GPLv3

There are still a few tidyups of old FSF addresses to come (in both s3
and s4). More commits soon.
(This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
---
 source4/libcli/ldap/ldap_bind.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index addc8cf91e..cbe8772414 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -8,7 +8,7 @@
     
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
@@ -17,8 +17,7 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
    
 */
 
-- 
cgit 


From 2151cde58014ea2e822c13d2f8a369b45dc19ca8 Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Sat, 6 Oct 2007 22:28:14 +0000
Subject: r25554: Convert last instances of BOOL, True and False to the
 standard types. (This used to be commit
 566aa14139510788548a874e9213d91317f83ca9)

---
 source4/libcli/ldap/ldap_bind.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index cbe8772414..d285735d4e 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -258,7 +258,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 	}
 
 	status = ildap_search(conn, "", LDAP_SEARCH_SCOPE_BASE, "", supported_sasl_mech_attrs, 
-			      False, NULL, NULL, &sasl_mechs_msgs);
+			      false, NULL, NULL, &sasl_mechs_msgs);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(1, ("Failed to inquire of target's available sasl mechs in rootdse search: %s\n", 
 			  nt_errstr(status)));
-- 
cgit 


From ecea5ce24553989103d4a06296b24f4d29f30a36 Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Mon, 3 Dec 2007 17:41:50 +0100
Subject: r26260: Store loadparm context in gensec context. (This used to be
 commit b9e3a4862e267be39d603fed8207a237c3d72081)

---
 source4/libcli/ldap/ldap_bind.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index d285735d4e..60bfb52e2d 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -29,6 +29,7 @@
 #include "auth/gensec/socket.h"
 #include "auth/credentials/credentials.h"
 #include "lib/stream/packet.h"
+#include "param/param.h"
 
 struct ldap_simple_creds {
 	const char *dn;
@@ -217,7 +218,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *cr
 		NULL 
 	};
 
-	status = gensec_client_start(conn, &conn->gensec, NULL);
+	status = gensec_client_start(conn, &conn->gensec, NULL, global_loadparm);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(0, ("Failed to start GENSEC engine (%s)\n", nt_errstr(status)));
 		goto failed;
-- 
cgit 


From 9ebcd7a0df117158f1817b7d3a9a21ad4e1fa97a Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Tue, 4 Dec 2007 01:51:36 +0100
Subject: r26277: Move loadparm context higher up the stack. (This used to be
 commit 38fa08310ce573e9b46e76c840ddda6f18863573)

---
 source4/libcli/ldap/ldap_bind.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 60bfb52e2d..99b471e9a6 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -199,7 +199,8 @@ static struct ldap_message *new_ldap_sasl_bind_msg(struct ldap_connection *conn,
 /*
   perform a sasl bind using the given credentials
 */
-NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, struct cli_credentials *creds)
+NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, 
+			struct cli_credentials *creds)
 {
 	NTSTATUS status;
 	TALLOC_CTX *tmp_ctx = NULL;
-- 
cgit 


From a72c5053c587f0ed6113ef514fe3739cb81e7abf Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Sat, 8 Dec 2007 23:32:43 +0100
Subject: r26353: Remove use of global_loadparm. (This used to be commit
 17637e4490e42db6cdef619286c4d5a0982e9d1a)

---
 source4/libcli/ldap/ldap_bind.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 99b471e9a6..ba1ae90ebd 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -43,7 +43,8 @@ NTSTATUS ldap_rebind(struct ldap_connection *conn)
 
 	switch (conn->bind.type) {
 	case LDAP_BIND_SASL:
-		status = ldap_bind_sasl(conn, (struct cli_credentials *)conn->bind.creds);
+		status = ldap_bind_sasl(conn, (struct cli_credentials *)conn->bind.creds,
+					global_loadparm);
 		break;
 		
 	case LDAP_BIND_SIMPLE:
@@ -200,7 +201,8 @@ static struct ldap_message *new_ldap_sasl_bind_msg(struct ldap_connection *conn,
   perform a sasl bind using the given credentials
 */
 NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, 
-			struct cli_credentials *creds)
+			struct cli_credentials *creds,
+			struct loadparm_context *lp_ctx)
 {
 	NTSTATUS status;
 	TALLOC_CTX *tmp_ctx = NULL;
@@ -219,7 +221,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn,
 		NULL 
 	};
 
-	status = gensec_client_start(conn, &conn->gensec, NULL, global_loadparm);
+	status = gensec_client_start(conn, &conn->gensec, NULL, lp_ctx);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(0, ("Failed to start GENSEC engine (%s)\n", nt_errstr(status)));
 		goto failed;
-- 
cgit 


From b65dba2245bf382c47d65c95ac9b1efa43918fc0 Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Mon, 10 Dec 2007 04:33:16 +0100
Subject: r26355: Eliminate global_loadparm in more places. (This used to be
 commit 5d589a0d94bd76a9b4c9fc748854e8098ea43c4d)

---
 source4/libcli/ldap/ldap_bind.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index ba1ae90ebd..bd548be38e 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -44,7 +44,7 @@ NTSTATUS ldap_rebind(struct ldap_connection *conn)
 	switch (conn->bind.type) {
 	case LDAP_BIND_SASL:
 		status = ldap_bind_sasl(conn, (struct cli_credentials *)conn->bind.creds,
-					global_loadparm);
+					conn->lp_ctx);
 		break;
 		
 	case LDAP_BIND_SIMPLE:
-- 
cgit 


From 3da665e9ac324320fed68a21163fffdf4bd3df89 Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Mon, 10 Dec 2007 18:42:07 +0100
Subject: r26385: Integrate gensec-socket into gensec. (This used to be commit
 78bb444b4b73df9a84f8702814f9b30b32ffd885)

---
 source4/libcli/ldap/ldap_bind.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index bd548be38e..fd15ff2fc7 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -26,7 +26,6 @@
 #include "libcli/ldap/ldap_client.h"
 #include "lib/tls/tls.h"
 #include "auth/gensec/gensec.h"
-#include "auth/gensec/socket.h"
 #include "auth/credentials/credentials.h"
 #include "lib/stream/packet.h"
 #include "param/param.h"
@@ -221,6 +220,8 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn,
 		NULL 
 	};
 
+	gensec_init(lp_ctx);
+
 	status = gensec_client_start(conn, &conn->gensec, NULL, lp_ctx);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(0, ("Failed to start GENSEC engine (%s)\n", nt_errstr(status)));
-- 
cgit 


From 3e75f222bcdf114238cc4f2bcc61332dc059135f Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Wed, 19 Dec 2007 23:27:42 +0100
Subject: r26539: Remove unnecessary statics. (This used to be commit
 e53e79eebef3ece6978f0a2b4a1ee0a0814bb5d2)

---
 source4/libcli/ldap/ldap_bind.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index fd15ff2fc7..264a6b39ee 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -215,7 +215,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn,
 
 	const char **sasl_names;
 	uint32_t old_gensec_features;
-	static const char *supported_sasl_mech_attrs[] = {
+	const char *supported_sasl_mech_attrs[] = {
 		"supportedSASLMechanisms", 
 		NULL 
 	};
-- 
cgit 


From 0500b87092540d300b4e021a0fb95ce16a44fbd2 Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Thu, 20 Dec 2007 00:02:15 +0100
Subject: r26540: Revert my previous commit after concerns raised by Andrew.
 (This used to be commit 6ac86f8be7d9a8c5ab396a93e6d1e6819e11f173)

---
 source4/libcli/ldap/ldap_bind.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 264a6b39ee..fd15ff2fc7 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -215,7 +215,7 @@ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn,
 
 	const char **sasl_names;
 	uint32_t old_gensec_features;
-	const char *supported_sasl_mech_attrs[] = {
+	static const char *supported_sasl_mech_attrs[] = {
 		"supportedSASLMechanisms", 
 		NULL 
 	};
-- 
cgit 


From afe3e8172ddaa5e4aa811faceecda4f943d6e2ef Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Wed, 2 Apr 2008 04:53:27 +0200
Subject: Install public header files again and include required prototypes.
 (This used to be commit 47ffbbf67435904754469544390b67d34c958343)

---
 source4/libcli/ldap/ldap_bind.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index fd15ff2fc7..2c04edf950 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -23,6 +23,7 @@
 
 #include "includes.h"
 #include "libcli/ldap/ldap.h"
+#include "libcli/ldap/ldap_proto.h"
 #include "libcli/ldap/ldap_client.h"
 #include "lib/tls/tls.h"
 #include "auth/gensec/gensec.h"
@@ -35,7 +36,7 @@ struct ldap_simple_creds {
 	const char *pw;
 };
 
-NTSTATUS ldap_rebind(struct ldap_connection *conn)
+_PUBLIC_ NTSTATUS ldap_rebind(struct ldap_connection *conn)
 {
 	NTSTATUS status;
 	struct ldap_simple_creds *creds;
@@ -88,7 +89,7 @@ static struct ldap_message *new_ldap_simple_bind_msg(struct ldap_connection *con
 /*
   perform a simple username/password bind
 */
-NTSTATUS ldap_bind_simple(struct ldap_connection *conn, 
+_PUBLIC_ NTSTATUS ldap_bind_simple(struct ldap_connection *conn, 
 			  const char *userdn, const char *password)
 {
 	struct ldap_request *req;
@@ -199,7 +200,7 @@ static struct ldap_message *new_ldap_sasl_bind_msg(struct ldap_connection *conn,
 /*
   perform a sasl bind using the given credentials
 */
-NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, 
+_PUBLIC_ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, 
 			struct cli_credentials *creds,
 			struct loadparm_context *lp_ctx)
 {
-- 
cgit 


From 4e83011f72ba3df387512755a17760b42a7bf2f2 Mon Sep 17 00:00:00 2001
From: Simo Sorce <idra@samba.org>
Date: Mon, 21 Apr 2008 17:58:23 -0400
Subject: Remove more event_context_init() uses from function calls within deep
 down the code. Make sure we pass around the event_context where we need it
 instead. All test but a few python ones fail. Jelmer promised to fix them.
 (This used to be commit 3045d391626fba169aa26be52174883e18d323e9)

---
 source4/libcli/ldap/ldap_bind.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 2c04edf950..e1569e7296 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -200,7 +200,7 @@ static struct ldap_message *new_ldap_sasl_bind_msg(struct ldap_connection *conn,
 /*
   perform a sasl bind using the given credentials
 */
-_PUBLIC_ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, 
+_PUBLIC_ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn,
 			struct cli_credentials *creds,
 			struct loadparm_context *lp_ctx)
 {
@@ -223,7 +223,8 @@ _PUBLIC_ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn,
 
 	gensec_init(lp_ctx);
 
-	status = gensec_client_start(conn, &conn->gensec, NULL, lp_ctx);
+	status = gensec_client_start(conn, &conn->gensec,
+				     conn->event.event_ctx, lp_ctx);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(0, ("Failed to start GENSEC engine (%s)\n", nt_errstr(status)));
 		goto failed;
-- 
cgit 


From ab00b65dde3fad666425cd9b4b6e45dabc33b279 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 15 Jul 2008 15:08:57 +1000
Subject: Cleanup ldap_bind_sasl.

With these changes, we don't leak the LDAP socket, and don't reset all
credentials feature flags, just the ones we are actually incompatible
with.

Andrew Bartlett
(This used to be commit 72e52a301102941c41ab423e0212fe9a1aed0405)
---
 source4/libcli/ldap/ldap_bind.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

(limited to 'source4/libcli/ldap/ldap_bind.c')

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index e1569e7296..65673116be 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -234,7 +234,7 @@ _PUBLIC_ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn,
 	 * Windows seem not to like double encryption */
 	old_gensec_features = cli_credentials_get_gensec_features(creds);
 	if (tls_enabled(conn->sock)) {
-		cli_credentials_set_gensec_features(creds, 0);
+		cli_credentials_set_gensec_features(creds, old_gensec_features & ~(GENSEC_FEATURE_SIGN|GENSEC_FEATURE_SEAL));
 	}
 
 	/* this call also sets the gensec_want_features */
@@ -245,7 +245,8 @@ _PUBLIC_ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn,
 		goto failed;
 	}
 
-	/* reset the original gensec_features */
+	/* reset the original gensec_features (on the credentials
+	 * context, so we don't tatoo it ) */
 	cli_credentials_set_gensec_features(creds, old_gensec_features);
 
 	if (conn->host) {
@@ -393,8 +394,6 @@ _PUBLIC_ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn,
 					    &sasl_socket);
 		if (!NT_STATUS_IS_OK(status)) goto failed;
 
-		talloc_steal(conn->sock, sasl_socket);
-		talloc_unlink(conn, conn->sock);
 		conn->sock = sasl_socket;
 		packet_set_socket(conn->packet, conn->sock);
 
-- 
cgit