Author: gd Date: 2007-05-11 12:02:33 +0000 (Fri, 11 May 2007) New Revision: 22795
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22795 Log: Merge krb5_get_init_creds_opt_get_error() usage from 3_0. Guenther Modified: branches/SAMBA_3_0_26/source/configure.in branches/SAMBA_3_0_26/source/include/ads.h branches/SAMBA_3_0_26/source/libads/kerberos.c branches/SAMBA_3_0_26/source/libsmb/clikrb5.c branches/SAMBA_3_0_26/source/nsswitch/winbindd_cred_cache.c branches/SAMBA_3_0_26/source/nsswitch/winbindd_pam.c Changeset: Modified: branches/SAMBA_3_0_26/source/configure.in =================================================================== --- branches/SAMBA_3_0_26/source/configure.in 2007-05-11 11:54:41 UTC (rev 22794) +++ branches/SAMBA_3_0_26/source/configure.in 2007-05-11 12:02:33 UTC (rev 22795) @@ -3538,6 +3538,7 @@ AC_CHECK_FUNC_EXT(initialize_krb5_error_table, $KRB5_LIBS) AC_CHECK_FUNC_EXT(krb5_get_init_creds_opt_alloc, $KRB5_LIBS) AC_CHECK_FUNC_EXT(krb5_get_init_creds_opt_free, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_get_init_creds_opt_get_error, $KRB5_LIBS) LIBS="$KRB5_LIBS $LIBS" Modified: branches/SAMBA_3_0_26/source/include/ads.h =================================================================== --- branches/SAMBA_3_0_26/source/include/ads.h 2007-05-11 11:54:41 UTC (rev 22794) +++ branches/SAMBA_3_0_26/source/include/ads.h 2007-05-11 12:02:33 UTC (rev 22795) @@ -298,6 +298,12 @@ #ifdef HAVE_KRB5 typedef struct { + NTSTATUS ntstatus; + uint32 unknown1; + uint32 unknown2; /* 0x00000001 */ +} KRB5_EDATA_NTSTATUS; + +typedef struct { #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */ krb5_address **addrs; #elif defined(HAVE_KRB5_ADDRESSES) /* Heimdal */ Modified: branches/SAMBA_3_0_26/source/libads/kerberos.c =================================================================== --- branches/SAMBA_3_0_26/source/libads/kerberos.c 2007-05-11 11:54:41 UTC (rev 22794) +++ branches/SAMBA_3_0_26/source/libads/kerberos.c 2007-05-11 12:02:33 UTC (rev 22795) @@ -55,6 +55,127 @@ return 0; } +static BOOL smb_krb5_err_io_nstatus(TALLOC_CTX *mem_ctx, + DATA_BLOB *edata_blob, + KRB5_EDATA_NTSTATUS *edata) +{ + BOOL ret = False; + prs_struct ps; + + if (!mem_ctx || !edata_blob || !edata) + return False; + + if (!prs_init(&ps, edata_blob->length, mem_ctx, UNMARSHALL)) + return False; + + if (!prs_copy_data_in(&ps, (char *)edata_blob->data, edata_blob->length)) + goto out; + + prs_set_offset(&ps, 0); + + if (!prs_ntstatus("ntstatus", &ps, 1, &edata->ntstatus)) + goto out; + + if (!prs_uint32("unknown1", &ps, 1, &edata->unknown1)) + goto out; + + if (!prs_uint32("unknown2", &ps, 1, &edata->unknown2)) /* only seen 00000001 here */ + goto out; + + ret = True; + out: + prs_mem_free(&ps); + + return ret; +} + + static BOOL smb_krb5_get_ntstatus_from_krb5_error(krb5_error *error, + NTSTATUS *nt_status) +{ + DATA_BLOB edata; + DATA_BLOB unwrapped_edata; + TALLOC_CTX *mem_ctx; + KRB5_EDATA_NTSTATUS parsed_edata; + +#ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR + edata = data_blob(error->e_data->data, error->e_data->length); +#else + edata = data_blob(error->e_data.data, error->e_data.length); +#endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */ + +#ifdef DEVELOPER + dump_data(10, edata.data, edata.length); +#endif /* DEVELOPER */ + + mem_ctx = talloc_init("smb_krb5_get_ntstatus_from_krb5_error"); + if (mem_ctx == NULL) { + data_blob_free(&edata); + return False; + } + + if (!unwrap_edata_ntstatus(mem_ctx, &edata, &unwrapped_edata)) { + data_blob_free(&edata); + TALLOC_FREE(mem_ctx); + return False; + } + + data_blob_free(&edata); + + if (!smb_krb5_err_io_nstatus(mem_ctx, &unwrapped_edata, &parsed_edata)) { + data_blob_free(&unwrapped_edata); + TALLOC_FREE(mem_ctx); + return False; + } + + data_blob_free(&unwrapped_edata); + + if (nt_status) { + *nt_status = parsed_edata.ntstatus; + } + + TALLOC_FREE(mem_ctx); + + return True; +} + + static BOOL smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(krb5_context ctx, + krb5_get_init_creds_opt *opt, + NTSTATUS *nt_status) +{ + BOOL ret = False; + krb5_error *error = NULL; + +#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR + ret = krb5_get_init_creds_opt_get_error(ctx, opt, &error); + if (ret) { + DEBUG(1,("krb5_get_init_creds_opt_get_error gave: %s\n", + error_message(ret))); + return False; + } +#endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR */ + + if (!error) { + DEBUG(1,("no krb5_error\n")); + return False; + } + +#ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR + if (!error->e_data) { +#else + if (error->e_data.data == NULL) { +#endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */ + DEBUG(1,("no edata in krb5_error\n")); + krb5_free_error(ctx, error); + return False; + } + + ret = smb_krb5_get_ntstatus_from_krb5_error(error, nt_status); + + krb5_free_error(ctx, error); + + return ret; +} + /* simulate a kinit, putting the tgt in the given cache location. If cache_name == NULL place in default cache location. @@ -68,19 +189,22 @@ const char *cache_name, BOOL request_pac, BOOL add_netbios_addr, - time_t renewable_time) + time_t renewable_time, + NTSTATUS *ntstatus) { krb5_context ctx = NULL; krb5_error_code code = 0; krb5_ccache cc = NULL; - krb5_principal me; + krb5_principal me = NULL; krb5_creds my_creds; krb5_get_init_creds_opt *opt = NULL; smb_krb5_addresses *addr = NULL; + ZERO_STRUCT(my_creds); + initialize_krb5_error_table(); if ((code = krb5_init_context(&ctx))) - return code; + goto out; if (time_offset != 0) { krb5_set_real_time(ctx, time(NULL) + time_offset, 0); @@ -91,21 +215,15 @@ getenv("KRB5_CONFIG"))); if ((code = krb5_cc_resolve(ctx, cache_name ? cache_name : krb5_cc_default_name(ctx), &cc))) { - krb5_free_context(ctx); - return code; + goto out; } if ((code = smb_krb5_parse_name(ctx, principal, &me))) { - krb5_cc_close(ctx, cc); - krb5_free_context(ctx); - return code; + goto out; } - code = smb_krb5_get_init_creds_opt_alloc(ctx, &opt); - if (code) { - krb5_cc_close(ctx, cc); - krb5_free_context(ctx); - return code; + if ((code = smb_krb5_get_init_creds_opt_alloc(ctx, &opt))) { + goto out; } krb5_get_init_creds_opt_set_renew_life(opt, renewable_time); @@ -117,55 +235,29 @@ #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST if (request_pac) { - code = krb5_get_init_creds_opt_set_pac_request(ctx, opt, (krb5_boolean)request_pac); - if (code) { - krb5_cc_close(ctx, cc); - krb5_free_principal(ctx, me); - krb5_free_context(ctx); - return code; + if ((code = krb5_get_init_creds_opt_set_pac_request(ctx, opt, (krb5_boolean)request_pac))) { + goto out; } } #endif if (add_netbios_addr) { - code = smb_krb5_gen_netbios_krb5_address(&addr); - if (code) { - krb5_cc_close(ctx, cc); - krb5_free_principal(ctx, me); - krb5_free_context(ctx); - return code; + if ((code = smb_krb5_gen_netbios_krb5_address(&addr))) { + goto out; } krb5_get_init_creds_opt_set_address_list(opt, addr->addrs); } if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password), - kerb_prompter, NULL, 0, NULL, opt))) - { - smb_krb5_get_init_creds_opt_free(ctx, opt); - smb_krb5_free_addresses(ctx, addr); - krb5_cc_close(ctx, cc); - krb5_free_principal(ctx, me); - krb5_free_context(ctx); - return code; + kerb_prompter, NULL, 0, NULL, opt))) { + goto out; } - smb_krb5_get_init_creds_opt_free(ctx, opt); - if ((code = krb5_cc_initialize(ctx, cc, me))) { - smb_krb5_free_addresses(ctx, addr); - krb5_free_cred_contents(ctx, &my_creds); - krb5_cc_close(ctx, cc); - krb5_free_principal(ctx, me); - krb5_free_context(ctx); - return code; + goto out; } if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) { - krb5_cc_close(ctx, cc); - smb_krb5_free_addresses(ctx, addr); - krb5_free_cred_contents(ctx, &my_creds); - krb5_free_principal(ctx, me); - krb5_free_context(ctx); - return code; + goto out; } if (expire_time) { @@ -175,14 +267,47 @@ if (renew_till_time) { *renew_till_time = (time_t) my_creds.times.renew_till; } + out: + if (ntstatus) { - krb5_cc_close(ctx, cc); - smb_krb5_free_addresses(ctx, addr); + NTSTATUS status; + + /* fast path */ + if (code == 0) { + *ntstatus = NT_STATUS_OK; + goto cleanup; + } + + /* try to get ntstatus code out of krb5_error when we have it + * inside the krb5_get_init_creds_opt - gd */ + + if (opt && smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(ctx, opt, &status)) { + *ntstatus = status; + goto cleanup; + } + + /* fall back to self-made-mapping */ + *ntstatus = krb5_to_nt_status(code); + } + + cleanup: krb5_free_cred_contents(ctx, &my_creds); - krb5_free_principal(ctx, me); - krb5_free_context(ctx); - - return 0; + if (me) { + krb5_free_principal(ctx, me); + } + if (addr) { + smb_krb5_free_addresses(ctx, addr); + } + if (opt) { + smb_krb5_get_init_creds_opt_free(ctx, opt); + } + if (cc) { + krb5_cc_close(ctx, cc); + } + if (ctx) { + krb5_free_context(ctx); + } + return code; } @@ -220,7 +345,8 @@ } ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset, - &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable); + &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable, + NULL); if (ret) { DEBUG(0,("kerberos_kinit_password %s failed: %s\n", @@ -479,7 +605,8 @@ cache_name, False, False, - 0); + 0, + NULL); } /************************************************************************ Modified: branches/SAMBA_3_0_26/source/libsmb/clikrb5.c =================================================================== --- branches/SAMBA_3_0_26/source/libsmb/clikrb5.c 2007-05-11 11:54:41 UTC (rev 22794) +++ branches/SAMBA_3_0_26/source/libsmb/clikrb5.c 2007-05-11 12:02:33 UTC (rev 22795) @@ -272,6 +272,45 @@ } #endif +BOOL unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx, + DATA_BLOB *edata, + DATA_BLOB *edata_out) +{ + DATA_BLOB edata_contents; + ASN1_DATA data; + int edata_type; + + if (!edata->length) { + return False; + } + + asn1_load(&data, *edata); + asn1_start_tag(&data, ASN1_SEQUENCE(0)); + asn1_start_tag(&data, ASN1_CONTEXT(1)); + asn1_read_Integer(&data, &edata_type); + + if (edata_type != KRB5_PADATA_PW_SALT) { + DEBUG(0,("edata is not of required type %d but of type %d\n", + KRB5_PADATA_PW_SALT, edata_type)); + asn1_free(&data); + return False; + } + + asn1_start_tag(&data, ASN1_CONTEXT(2)); + asn1_read_OctetString(&data, &edata_contents); + asn1_end_tag(&data); + asn1_end_tag(&data); + asn1_end_tag(&data); + asn1_free(&data); + + *edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length); + + data_blob_free(&edata_contents); + + return True; +} + + BOOL unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data) { DATA_BLOB pac_contents; Modified: branches/SAMBA_3_0_26/source/nsswitch/winbindd_cred_cache.c =================================================================== --- branches/SAMBA_3_0_26/source/nsswitch/winbindd_cred_cache.c 2007-05-11 11:54:41 UTC (rev 22794) +++ branches/SAMBA_3_0_26/source/nsswitch/winbindd_cred_cache.c 2007-05-11 12:02:33 UTC (rev 22795) @@ -111,7 +111,8 @@ entry->ccname, False, /* no PAC required anymore */ True, - WINBINDD_PAM_AUTH_KRB5_RENEW_TIME); + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME, + NULL); gain_root_privilege(); if (ret) { @@ -224,7 +225,8 @@ entry->ccname, False, /* no PAC required anymore */ True, - WINBINDD_PAM_AUTH_KRB5_RENEW_TIME); + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME, + NULL); gain_root_privilege(); if (ret) { Modified: branches/SAMBA_3_0_26/source/nsswitch/winbindd_pam.c =================================================================== --- branches/SAMBA_3_0_26/source/nsswitch/winbindd_pam.c 2007-05-11 11:54:41 UTC (rev 22794) +++ branches/SAMBA_3_0_26/source/nsswitch/winbindd_pam.c 2007-05-11 12:02:33 UTC (rev 22795) @@ -579,12 +579,12 @@ cc, True, True, - WINBINDD_PAM_AUTH_KRB5_RENEW_TIME); + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME, + &result); if (krb5_ret) { DEBUG(1,("winbindd_raw_kerberos_login: kinit failed for '%s' with: %s (%d)\n", principal_s, error_message(krb5_ret), krb5_ret)); - result = krb5_to_nt_status(krb5_ret); goto failed; }
