sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-26 21:57:41 +03:00
Code

mit-kdb: support MIT Kerberos 1.16 KDB API changes

Browse Source 
MIT Kerberos 1.16 adds ability to audit local and remote addresses
during AS_REQ processing. As result, audit_as_req callback signature
was changed to include the addresses and KDB API version was increased.

Change mit-kdb code to properly expose audit_as_req signature KDC
expects in 1.16 version. Also update #ifdefs to account for the new
KDB API version.

This commit does not add actual audit of the local and remote IP
addresses, it only makes it possible to compile against MIT Kerberos
1.16.

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jan 19 01:36:22 CET 2018 on sn-devel-144
This commit is contained in:
Alexander Bokovoy 2017-10-24 12:01:39 +03:00 committed by Andreas Schneider
parent 3be1e68ce6
commit 7c1c8c6817
3 changed files with 42 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
source4/kdc/mit-kdb/kdb_samba.h
View File

@ -78,7 +78,7 @@ krb5_error_code kdb_samba_db_put_principal(krb5_context context,
krb5_error_code kdb_samba_db_delete_principal(krb5_context context,
krb5_const_principal princ);
#if KRB5_KDB_API_VERSION == 8
#if KRB5_KDB_API_VERSION >= 8
krb5_error_code kdb_samba_db_iterate(krb5_context context,
char *match_entry,
int (*func)(krb5_pointer, krb5_db_entry *),
@ -148,12 +148,23 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
const krb5_db_entry *server,
krb5_const_principal proxy);
#if KRB5_KDB_API_VERSION >= 9
void kdb_samba_db_audit_as_req(krb5_context kcontext,
krb5_kdc_req *request,
const krb5_address *local_addr,
const krb5_address *remote_addr,
krb5_db_entry *client,
krb5_db_entry *server,
krb5_timestamp authtime,
krb5_error_code error_code);
#else
void kdb_samba_db_audit_as_req(krb5_context kcontext,
krb5_kdc_req *request,
krb5_db_entry *client,
krb5_db_entry *server,
krb5_timestamp authtime,
krb5_error_code error_code);
#endif
/* from kdb_samba_change_pwd.c */

42
source4/kdc/mit-kdb/kdb_samba_policies.c
View File

@ -432,20 +432,10 @@ done:
return code;
}
void kdb_samba_db_audit_as_req(krb5_context context,
krb5_kdc_req *request,
krb5_db_entry *client,
krb5_db_entry *server,
krb5_timestamp authtime,
krb5_error_code error_code)
static void samba_bad_password_count(krb5_db_entry *client,
krb5_error_code error_code)
{
struct mit_samba_context *mit_ctx;
mit_ctx = ks_get_context(context);
if (mit_ctx == NULL) {
return;
}
switch (error_code) {
case 0:
mit_samba_zero_bad_password_count(client);
@ -456,3 +446,29 @@ void kdb_samba_db_audit_as_req(krb5_context context,
break;
}
}
#if KRB5_KDB_API_VERSION >= 9
void kdb_samba_db_audit_as_req(krb5_context context,
krb5_kdc_req *request,
const krb5_address *local_addr,
const krb5_address *remote_addr,
krb5_db_entry *client,
krb5_db_entry *server,
krb5_timestamp authtime,
krb5_error_code error_code)
{
samba_bad_password_count(client, error_code);
/* TODO: perform proper audit logging for addresses */
}
#else
void kdb_samba_db_audit_as_req(krb5_context context,
krb5_kdc_req *request,
krb5_db_entry *client,
krb5_db_entry *server,
krb5_timestamp authtime,
krb5_error_code error_code)
{
samba_bad_password_count(client, error_code);
}
#endif

2
source4/kdc/mit-kdb/kdb_samba_principals.c
View File

@ -308,7 +308,7 @@ krb5_error_code kdb_samba_db_delete_principal(krb5_context context,
return KRB5_KDB_DB_INUSE;
}
#if KRB5_KDB_API_VERSION == 8
#if KRB5_KDB_API_VERSION >= 8
krb5_error_code kdb_samba_db_iterate(krb5_context context,
char *match_entry,
int (*func)(krb5_pointer, krb5_db_entry *),