4a8bf8a4fb
Resolves: #1430761
544 lines
18 KiB
Diff
544 lines
18 KiB
Diff
From 334a4870cbbfefcd09c10f432a320ceaac29a14a Mon Sep 17 00:00:00 2001
|
|
From: Alexander Bokovoy <ab@samba.org>
|
|
Date: Fri, 3 Mar 2017 17:08:09 +0200
|
|
Subject: [PATCH 1/6] gssapi: check for gss_acquire_cred_from
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12611
|
|
|
|
Signed-off-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
(cherry picked from commit d630a364f9d74443e482934f76cd7107c331e108)
|
|
---
|
|
wscript_configure_system_mitkrb5 | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/wscript_configure_system_mitkrb5 b/wscript_configure_system_mitkrb5
|
|
index 06a9821..d3e8ebf 100644
|
|
--- a/wscript_configure_system_mitkrb5
|
|
+++ b/wscript_configure_system_mitkrb5
|
|
@@ -92,6 +92,7 @@ conf.CHECK_FUNCS_IN('''
|
|
gsskrb5_extract_authz_data_from_sec_context
|
|
gss_krb5_export_lucid_sec_context
|
|
gss_import_cred gss_export_cred
|
|
+ gss_acquire_cred_from
|
|
''', 'gssapi gssapi_krb5')
|
|
conf.CHECK_VARIABLE('GSS_KRB5_CRED_NO_CI_FLAGS_X', headers=possible_gssapi_headers)
|
|
conf.CHECK_FUNCS_IN('krb5_mk_req_extended krb5_kt_compare', 'krb5')
|
|
--
|
|
2.9.3
|
|
|
|
|
|
From 4b4a95436a56ee91e6bef8e905656c387ce2f62c Mon Sep 17 00:00:00 2001
|
|
From: Alexander Bokovoy <ab@samba.org>
|
|
Date: Fri, 3 Mar 2017 16:14:57 +0200
|
|
Subject: [PATCH 2/6] lib/krb5_wrap: add smb_gss_krb5_import_cred wrapper
|
|
|
|
Wrap gss_krb5_import_cred() to allow re-implementing it with
|
|
gss_acquire_cred_from() for newer MIT versions. gss_acquire_cred_from()
|
|
works fine with GSSAPI interposer (GSS-proxy) while
|
|
gss_krb5_import_cred() is not interposed yet.
|
|
|
|
The wrapper has additional parameter, krb5_context handle, to facilitate
|
|
with credentials cache name discovery. All our callers to
|
|
gss_krb5_import_cred() already have krb5 context handy.
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12611
|
|
|
|
Signed-off-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
(cherry picked from commit 0e6e8dd2600c699a7a02e3d11fed21b5bc49858d)
|
|
---
|
|
lib/krb5_wrap/gss_samba.c | 121 ++++++++++++++++++++++++++++++++++++++++++++++
|
|
lib/krb5_wrap/gss_samba.h | 13 +++++
|
|
2 files changed, 134 insertions(+)
|
|
|
|
diff --git a/lib/krb5_wrap/gss_samba.c b/lib/krb5_wrap/gss_samba.c
|
|
index b444633..757ffc5 100644
|
|
--- a/lib/krb5_wrap/gss_samba.c
|
|
+++ b/lib/krb5_wrap/gss_samba.c
|
|
@@ -48,4 +48,125 @@ int smb_gss_oid_equal(const gss_OID first_oid, const gss_OID second_oid)
|
|
}
|
|
#endif /* !HAVE_GSS_OID_EQUAL */
|
|
|
|
+
|
|
+/* wrapper around gss_krb5_import_cred() that prefers to use gss_acquire_cred_from()
|
|
+ * if this GSSAPI extension is available. gss_acquire_cred_from() is properly
|
|
+ * interposed by GSSPROXY while gss_krb5_import_cred() is not.
|
|
+ *
|
|
+ * This wrapper requires a proper krb5_context to resolve ccache name.
|
|
+ * All gss_krb5_import_cred() callers in Samba already have krb5_context available. */
|
|
+uint32_t smb_gss_krb5_import_cred(uint32_t *minor_status, krb5_context ctx,
|
|
+ krb5_ccache id, krb5_principal keytab_principal,
|
|
+ krb5_keytab keytab, gss_cred_id_t *cred)
|
|
+{
|
|
+ uint32_t major_status = 0;
|
|
+
|
|
+#if HAVE_GSS_ACQUIRE_CRED_FROM
|
|
+ uint32_t minor = 0;
|
|
+ gss_key_value_element_desc ccache_element = {
|
|
+ .key = "ccache",
|
|
+ .value = NULL,
|
|
+ };
|
|
+
|
|
+ gss_key_value_element_desc keytab_element = {
|
|
+ .key = "keytab",
|
|
+ .value = NULL,
|
|
+ };
|
|
+
|
|
+ gss_key_value_element_desc elements[2];
|
|
+
|
|
+ gss_key_value_set_desc cred_store = {
|
|
+ .elements = &ccache_element,
|
|
+ .count = 1,
|
|
+ };
|
|
+
|
|
+ gss_OID_set mech_set = GSS_C_NO_OID_SET;
|
|
+ gss_cred_usage_t cred_usage = GSS_C_INITIATE;
|
|
+ gss_name_t name = NULL;
|
|
+ gss_buffer_desc pr_name = {
|
|
+ .value = NULL,
|
|
+ .length = 0,
|
|
+ };
|
|
+
|
|
+ if (id != NULL) {
|
|
+ major_status = krb5_cc_get_full_name(ctx,
|
|
+ id,
|
|
+ discard_const(&ccache_element.value));
|
|
+ if (major_status != 0) {
|
|
+ return major_status;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ if (keytab != NULL) {
|
|
+ keytab_element.value = malloc(4096);
|
|
+ if (!keytab_element.value) {
|
|
+ return ENOMEM;
|
|
+ }
|
|
+ major_status = krb5_kt_get_name(ctx,
|
|
+ keytab,
|
|
+ discard_const(keytab_element.value), 4096);
|
|
+ if (major_status != 0) {
|
|
+ free(discard_const(keytab_element.value));
|
|
+ return major_status;
|
|
+ }
|
|
+ cred_usage = GSS_C_ACCEPT;
|
|
+ cred_store.elements = &keytab_element;
|
|
+
|
|
+ if (keytab_principal != NULL) {
|
|
+ major_status = krb5_unparse_name(ctx, keytab_principal, (char**)&pr_name.value);
|
|
+ if (major_status != 0) {
|
|
+ free(discard_const(keytab_element.value));
|
|
+ return major_status;
|
|
+ }
|
|
+ pr_name.length = strlen(pr_name.value);
|
|
+
|
|
+ major_status = gss_import_name(minor_status,
|
|
+ &pr_name,
|
|
+ discard_const(GSS_KRB5_NT_PRINCIPAL_NAME),
|
|
+ &name);
|
|
+ if (major_status != 0) {
|
|
+ krb5_free_unparsed_name(ctx, pr_name.value);
|
|
+ free(discard_const(keytab_element.value));
|
|
+ return major_status;
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+
|
|
+ if (id != NULL && keytab != NULL) {
|
|
+ elements[0] = ccache_element;
|
|
+ elements[1] = keytab_element;
|
|
+
|
|
+ cred_store.elements = elements;
|
|
+ cred_store.count = 2;
|
|
+ cred_usage = GSS_C_BOTH;
|
|
+ }
|
|
+
|
|
+ major_status = gss_acquire_cred_from(minor_status,
|
|
+ name,
|
|
+ 0,
|
|
+ mech_set,
|
|
+ cred_usage,
|
|
+ &cred_store,
|
|
+ cred,
|
|
+ NULL,
|
|
+ NULL);
|
|
+
|
|
+ if (pr_name.value != NULL) {
|
|
+ (void)gss_release_name(&minor, &name);
|
|
+ krb5_free_unparsed_name(ctx, pr_name.value);
|
|
+ }
|
|
+ if (keytab_element.value != NULL) {
|
|
+ free(discard_const(keytab_element.value));
|
|
+ }
|
|
+ krb5_free_string(ctx, discard_const(ccache_element.value));
|
|
+#else
|
|
+ major_status = gss_krb5_import_cred(minor_status,
|
|
+ id,
|
|
+ keytab_principal,
|
|
+ keytab, cred);
|
|
+#endif
|
|
+ return major_status;
|
|
+}
|
|
+
|
|
+
|
|
#endif /* HAVE_GSSAPI */
|
|
diff --git a/lib/krb5_wrap/gss_samba.h b/lib/krb5_wrap/gss_samba.h
|
|
index 5319932..89aee34 100644
|
|
--- a/lib/krb5_wrap/gss_samba.h
|
|
+++ b/lib/krb5_wrap/gss_samba.h
|
|
@@ -25,6 +25,7 @@
|
|
#ifdef HAVE_GSSAPI
|
|
|
|
#include "system/gssapi.h"
|
|
+#include "krb5_samba.h"
|
|
|
|
#if defined(HAVE_GSS_OID_EQUAL)
|
|
#define smb_gss_oid_equal gss_oid_equal
|
|
@@ -32,5 +33,17 @@
|
|
int smb_gss_oid_equal(const gss_OID first_oid, const gss_OID second_oid);
|
|
#endif /* HAVE_GSS_OID_EQUAL */
|
|
|
|
+/* wrapper around gss_krb5_import_cred() that prefers to use gss_acquire_cred_from()
|
|
+ * if this GSSAPI extension is available. gss_acquire_cred_from() is properly
|
|
+ * interposed by GSS-proxy while gss_krb5_import_cred() is not.
|
|
+ *
|
|
+ * This wrapper requires a proper krb5_context to resolve the ccache name for
|
|
+ * gss_acquire_cred_from().
|
|
+ *
|
|
+ * All gss_krb5_import_cred() callers in Samba already have krb5_context available. */
|
|
+uint32_t smb_gss_krb5_import_cred(OM_uint32 *minor_status, krb5_context ctx,
|
|
+ krb5_ccache id, krb5_principal keytab_principal,
|
|
+ krb5_keytab keytab, gss_cred_id_t *cred);
|
|
+
|
|
#endif /* HAVE_GSSAPI */
|
|
#endif /* _GSS_SAMBA_H */
|
|
--
|
|
2.9.3
|
|
|
|
|
|
From f06fafce32a27acf4028ab573297c64189b62e30 Mon Sep 17 00:00:00 2001
|
|
From: Alexander Bokovoy <ab@samba.org>
|
|
Date: Fri, 3 Mar 2017 16:57:13 +0200
|
|
Subject: [PATCH 3/6] credentials_krb5: convert to use smb_gss_krb5_import_cred
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12611
|
|
|
|
Signed-off-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
(cherry picked from commit ca8fd793930173b4e625d3f286739de214155bc1)
|
|
---
|
|
auth/credentials/credentials_krb5.c | 22 +++++++++++++---------
|
|
1 file changed, 13 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
|
|
index e974df9..0e68012 100644
|
|
--- a/auth/credentials/credentials_krb5.c
|
|
+++ b/auth/credentials/credentials_krb5.c
|
|
@@ -579,8 +579,9 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
|
|
return ENOMEM;
|
|
}
|
|
|
|
- maj_stat = gss_krb5_import_cred(&min_stat, ccache->ccache, NULL, NULL,
|
|
- &gcc->creds);
|
|
+ maj_stat = smb_gss_krb5_import_cred(&min_stat, ccache->smb_krb5_context->krb5_context,
|
|
+ ccache->ccache, NULL, NULL,
|
|
+ &gcc->creds);
|
|
if ((maj_stat == GSS_S_FAILURE) &&
|
|
(min_stat == (OM_uint32)KRB5_CC_END ||
|
|
min_stat == (OM_uint32)KRB5_CC_NOTFOUND ||
|
|
@@ -597,8 +598,9 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
|
|
return ret;
|
|
}
|
|
|
|
- maj_stat = gss_krb5_import_cred(&min_stat, ccache->ccache, NULL, NULL,
|
|
- &gcc->creds);
|
|
+ maj_stat = smb_gss_krb5_import_cred(&min_stat, ccache->smb_krb5_context->krb5_context,
|
|
+ ccache->ccache, NULL, NULL,
|
|
+ &gcc->creds);
|
|
|
|
}
|
|
|
|
@@ -609,7 +611,7 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
|
|
} else {
|
|
ret = EINVAL;
|
|
}
|
|
- (*error_string) = talloc_asprintf(cred, "gss_krb5_import_cred failed: %s", error_message(ret));
|
|
+ (*error_string) = talloc_asprintf(cred, "smb_gss_krb5_import_cred failed: %s", error_message(ret));
|
|
return ret;
|
|
}
|
|
|
|
@@ -1076,12 +1078,14 @@ _PUBLIC_ int cli_credentials_get_server_gss_creds(struct cli_credentials *cred,
|
|
|
|
if (ktc->password_based || obtained < CRED_SPECIFIED) {
|
|
/* This creates a GSSAPI cred_id_t for match-by-key with only the keytab set */
|
|
- maj_stat = gss_krb5_import_cred(&min_stat, NULL, NULL, ktc->keytab,
|
|
- &gcc->creds);
|
|
+ maj_stat = smb_gss_krb5_import_cred(&min_stat, smb_krb5_context->krb5_context,
|
|
+ NULL, NULL, ktc->keytab,
|
|
+ &gcc->creds);
|
|
} else {
|
|
/* This creates a GSSAPI cred_id_t with the principal and keytab set, matching by name */
|
|
- maj_stat = gss_krb5_import_cred(&min_stat, NULL, princ, ktc->keytab,
|
|
- &gcc->creds);
|
|
+ maj_stat = smb_gss_krb5_import_cred(&min_stat, smb_krb5_context->krb5_context,
|
|
+ NULL, princ, ktc->keytab,
|
|
+ &gcc->creds);
|
|
}
|
|
if (maj_stat) {
|
|
if (min_stat) {
|
|
--
|
|
2.9.3
|
|
|
|
|
|
From 5305bffd4c72a85cc6c3148222ef7e346cbe3d87 Mon Sep 17 00:00:00 2001
|
|
From: Alexander Bokovoy <ab@samba.org>
|
|
Date: Fri, 3 Mar 2017 16:57:50 +0200
|
|
Subject: [PATCH 4/6] libads: convert to use smb_gss_krb5_import_cred
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12611
|
|
|
|
Signed-off-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
(cherry picked from commit 520167992bd2477bc11920d2dc9ec87f2cb339c9)
|
|
---
|
|
source3/libads/sasl.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
|
|
index 8570788..30127fa 100644
|
|
--- a/source3/libads/sasl.c
|
|
+++ b/source3/libads/sasl.c
|
|
@@ -372,7 +372,7 @@ static ADS_STATUS ads_init_gssapi_cred(ADS_STRUCT *ads, gss_cred_id_t *cred)
|
|
goto done;
|
|
}
|
|
|
|
- maj = gss_krb5_import_cred(&min, kccache, NULL, NULL, cred);
|
|
+ maj = smb_gss_krb5_import_cred(&min, kctx, kccache, NULL, NULL, cred);
|
|
if (maj != GSS_S_COMPLETE) {
|
|
status = ADS_ERROR_GSS(maj, min);
|
|
goto done;
|
|
--
|
|
2.9.3
|
|
|
|
|
|
From 1dbc68f9bee19a9c26825cc5be7d81951dcac710 Mon Sep 17 00:00:00 2001
|
|
From: Alexander Bokovoy <ab@samba.org>
|
|
Date: Fri, 3 Mar 2017 16:58:14 +0200
|
|
Subject: [PATCH 5/6] s3-gse: convert to use smb_gss_krb5_import_cred
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12611
|
|
|
|
Signed-off-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
(cherry picked from commit 3d733d5791a6d82edda13ac39790bd8ba893f3d7)
|
|
---
|
|
source3/librpc/crypto/gse.c | 20 +++++++++++---------
|
|
1 file changed, 11 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
|
|
index abf20bc..f4238f3 100644
|
|
--- a/source3/librpc/crypto/gse.c
|
|
+++ b/source3/librpc/crypto/gse.c
|
|
@@ -252,11 +252,12 @@ static NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
|
|
/* TODO: get krb5 ticket using username/password, if no valid
|
|
* one already available in ccache */
|
|
|
|
- gss_maj = gss_krb5_import_cred(&gss_min,
|
|
- gse_ctx->ccache,
|
|
- NULL, /* keytab_principal */
|
|
- NULL, /* keytab */
|
|
- &gse_ctx->creds);
|
|
+ gss_maj = smb_gss_krb5_import_cred(&gss_min,
|
|
+ gse_ctx->k5ctx,
|
|
+ gse_ctx->ccache,
|
|
+ NULL, /* keytab_principal */
|
|
+ NULL, /* keytab */
|
|
+ &gse_ctx->creds);
|
|
if (gss_maj) {
|
|
char *ccache = NULL;
|
|
int kret;
|
|
@@ -268,7 +269,7 @@ static NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
|
|
ccache = NULL;
|
|
}
|
|
|
|
- DEBUG(5, ("gss_krb5_import_cred ccache[%s] failed with [%s] -"
|
|
+ DEBUG(5, ("smb_gss_krb5_import_cred ccache[%s] failed with [%s] -"
|
|
"the caller may retry after a kinit.\n",
|
|
ccache, gse_errstr(gse_ctx, gss_maj, gss_min)));
|
|
SAFE_FREE(ccache);
|
|
@@ -430,12 +431,13 @@ static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
|
|
}
|
|
|
|
/* This creates a GSSAPI cred_id_t with the keytab set */
|
|
- gss_maj = gss_krb5_import_cred(&gss_min, NULL, NULL, gse_ctx->keytab,
|
|
- &gse_ctx->creds);
|
|
+ gss_maj = smb_gss_krb5_import_cred(&gss_min, gse_ctx->k5ctx,
|
|
+ NULL, NULL, gse_ctx->keytab,
|
|
+ &gse_ctx->creds);
|
|
|
|
if (gss_maj != 0
|
|
&& gss_maj != (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME)) {
|
|
- DEBUG(0, ("gss_krb5_import_cred failed with [%s]\n",
|
|
+ DEBUG(0, ("smb_gss_krb5_import_cred failed with [%s]\n",
|
|
gse_errstr(gse_ctx, gss_maj, gss_min)));
|
|
status = NT_STATUS_INTERNAL_ERROR;
|
|
goto done;
|
|
--
|
|
2.9.3
|
|
|
|
|
|
From 3c9390d26cf12e483d98f005b43da7b10348753d Mon Sep 17 00:00:00 2001
|
|
From: Alexander Bokovoy <ab@samba.org>
|
|
Date: Wed, 8 Mar 2017 12:38:49 +0200
|
|
Subject: [PATCH 6/6] s3-gse: move krb5 fallback to smb_gss_krb5_import_cred
|
|
wrapper
|
|
|
|
MIT krb5 1.9 version of gss_krb5_import_cred() may fail when importing
|
|
credentials from a keytab without specifying actual principal.
|
|
This was fixed in MIT krb5 1.9.2 (see commit
|
|
71c3be093db577aa52f6b9a9a3a9f442ca0d8f20 in MIT krb5-1.9 branch, git
|
|
master's version is bd18687a705a8a6cdcb7c140764d1a7c6a3381b5).
|
|
|
|
Move fallback code to the smb_gss_krb5_import_cred wrapper. We only
|
|
expect this fallback to happen with krb5 GSSAPI mechanism, thus hard
|
|
code use of krb5 mech when calling to gss_acquire_cred.
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12611
|
|
|
|
Signed-off-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
|
|
Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
|
|
Autobuild-Date(master): Wed Mar 8 22:00:24 CET 2017 on sn-devel-144
|
|
|
|
(cherry picked from commit 57286d57732d49fdb8b8e21f584787cdbc917c32)
|
|
---
|
|
lib/krb5_wrap/gss_samba.c | 46 +++++++++++++++++++++++++++++++++++++++---
|
|
source3/librpc/crypto/gse.c | 49 +--------------------------------------------
|
|
2 files changed, 44 insertions(+), 51 deletions(-)
|
|
|
|
diff --git a/lib/krb5_wrap/gss_samba.c b/lib/krb5_wrap/gss_samba.c
|
|
index 757ffc5..9e5ad4a 100644
|
|
--- a/lib/krb5_wrap/gss_samba.c
|
|
+++ b/lib/krb5_wrap/gss_samba.c
|
|
@@ -161,9 +161,49 @@ uint32_t smb_gss_krb5_import_cred(uint32_t *minor_status, krb5_context ctx,
|
|
krb5_free_string(ctx, discard_const(ccache_element.value));
|
|
#else
|
|
major_status = gss_krb5_import_cred(minor_status,
|
|
- id,
|
|
- keytab_principal,
|
|
- keytab, cred);
|
|
+ id,
|
|
+ keytab_principal,
|
|
+ keytab, cred);
|
|
+
|
|
+ if (major_status == (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME)) {
|
|
+ if ((keytab_principal == NULL) && (keytab != NULL)) {
|
|
+ /* No principal was specified and MIT krb5 1.9 version failed.
|
|
+ * We have to fall back to set global acceptor identity */
|
|
+ gss_OID_set_desc mech_set;
|
|
+ char *kt_name = NULL;
|
|
+
|
|
+ kt_name = malloc(4096);
|
|
+ if (!kt_name) {
|
|
+ return ENOMEM;
|
|
+ }
|
|
+
|
|
+ major_status = krb5_kt_get_name(ctx,
|
|
+ keytab,
|
|
+ kt_name, 4096);
|
|
+ if (major_status != 0) {
|
|
+ free(kt_name);
|
|
+ return major_status;
|
|
+ }
|
|
+
|
|
+ major_status = gsskrb5_register_acceptor_identity(kt_name);
|
|
+ if (major_status) {
|
|
+ free(kt_name);
|
|
+ return major_status;
|
|
+ }
|
|
+
|
|
+ /* We are dealing with krb5 GSSAPI mech in this fallback */
|
|
+ mech_set.count = 1;
|
|
+ mech_set.elements = gss_mech_krb5;
|
|
+ major_status = gss_acquire_cred(minor_status,
|
|
+ GSS_C_NO_NAME,
|
|
+ GSS_C_INDEFINITE,
|
|
+ &mech_set,
|
|
+ GSS_C_ACCEPT,
|
|
+ cred,
|
|
+ NULL, NULL);
|
|
+ free(kt_name);
|
|
+ }
|
|
+ }
|
|
#endif
|
|
return major_status;
|
|
}
|
|
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
|
|
index f4238f3..a111320 100644
|
|
--- a/source3/librpc/crypto/gse.c
|
|
+++ b/source3/librpc/crypto/gse.c
|
|
@@ -435,58 +435,11 @@ static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
|
|
NULL, NULL, gse_ctx->keytab,
|
|
&gse_ctx->creds);
|
|
|
|
- if (gss_maj != 0
|
|
- && gss_maj != (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME)) {
|
|
+ if (gss_maj != 0) {
|
|
DEBUG(0, ("smb_gss_krb5_import_cred failed with [%s]\n",
|
|
gse_errstr(gse_ctx, gss_maj, gss_min)));
|
|
status = NT_STATUS_INTERNAL_ERROR;
|
|
goto done;
|
|
-
|
|
- /* This is the error the MIT krb5 1.9 gives when it
|
|
- * implements the function, but we do not specify the
|
|
- * principal. However, when we specify the principal
|
|
- * as host$@REALM the GSS acceptor fails with 'wrong
|
|
- * principal in request'. Work around the issue by
|
|
- * falling back to the alternate approach below. */
|
|
- } else if (gss_maj == (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME))
|
|
- /* FIXME!!!
|
|
- * This call sets the default keytab for the whole server, not
|
|
- * just for this context. Need to find a way that does not alter
|
|
- * the state of the whole server ... */
|
|
- {
|
|
- const char *ktname;
|
|
- gss_OID_set_desc mech_set;
|
|
-
|
|
- ret = smb_krb5_kt_get_name(gse_ctx, gse_ctx->k5ctx,
|
|
- gse_ctx->keytab, &ktname);
|
|
- if (ret) {
|
|
- status = NT_STATUS_INTERNAL_ERROR;
|
|
- goto done;
|
|
- }
|
|
-
|
|
- ret = gsskrb5_register_acceptor_identity(ktname);
|
|
- if (ret) {
|
|
- status = NT_STATUS_INTERNAL_ERROR;
|
|
- goto done;
|
|
- }
|
|
-
|
|
- mech_set.count = 1;
|
|
- mech_set.elements = &gse_ctx->gss_mech;
|
|
-
|
|
- gss_maj = gss_acquire_cred(&gss_min,
|
|
- GSS_C_NO_NAME,
|
|
- GSS_C_INDEFINITE,
|
|
- &mech_set,
|
|
- GSS_C_ACCEPT,
|
|
- &gse_ctx->creds,
|
|
- NULL, NULL);
|
|
-
|
|
- if (gss_maj) {
|
|
- DEBUG(0, ("gss_acquire_creds failed with [%s]\n",
|
|
- gse_errstr(gse_ctx, gss_maj, gss_min)));
|
|
- status = NT_STATUS_INTERNAL_ERROR;
|
|
- goto done;
|
|
- }
|
|
}
|
|
|
|
status = NT_STATUS_OK;
|
|
--
|
|
2.9.3
|
|
|