mirror of
https://github.com/samba-team/samba.git
synced 2024-12-24 21:34:56 +03:00
28eae08ef7
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Thu Sep 29 11:56:41 CEST 2016 on sn-devel-144
103 lines
2.2 KiB
C
103 lines
2.2 KiB
C
|
|
#include "includes.h"
|
|
#include "system/kerberos.h"
|
|
#include "auth/kerberos/kerberos.h"
|
|
#include "gensec_krb5.h"
|
|
|
|
static krb5_error_code smb_krb5_get_longterm_key(krb5_context context,
|
|
krb5_const_principal server,
|
|
krb5_kvno kvno,
|
|
krb5_enctype etype,
|
|
krb5_keytab keytab,
|
|
krb5_keyblock **keyblock_out)
|
|
{
|
|
krb5_error_code code = EINVAL;
|
|
|
|
krb5_keytab_entry kt_entry;
|
|
|
|
code = krb5_kt_get_entry(context,
|
|
keytab,
|
|
server,
|
|
kvno,
|
|
etype,
|
|
&kt_entry);
|
|
if (code != 0) {
|
|
return code;
|
|
}
|
|
|
|
code = krb5_copy_keyblock(context,
|
|
&kt_entry.key,
|
|
keyblock_out);
|
|
krb5_free_keytab_entry_contents(context, &kt_entry);
|
|
|
|
return code;
|
|
}
|
|
|
|
krb5_error_code smb_krb5_rd_req_decoded(krb5_context context,
|
|
krb5_auth_context *auth_context,
|
|
const krb5_data *request,
|
|
krb5_keytab keytab,
|
|
krb5_principal acceptor_principal,
|
|
krb5_data *reply,
|
|
krb5_ticket **pticket,
|
|
krb5_keyblock **pkeyblock)
|
|
{
|
|
krb5_error_code code;
|
|
krb5_flags ap_req_options = 0;
|
|
krb5_ticket *ticket = NULL;
|
|
krb5_keyblock *keyblock = NULL;
|
|
|
|
*pticket = NULL;
|
|
*pkeyblock = NULL;
|
|
reply->length = 0;
|
|
reply->data = NULL;
|
|
|
|
code = krb5_rd_req(context,
|
|
auth_context,
|
|
request,
|
|
acceptor_principal,
|
|
keytab,
|
|
&ap_req_options,
|
|
&ticket);
|
|
if (code != 0) {
|
|
DBG_ERR("krb5_rd_req failed: %s\n",
|
|
error_message(code));
|
|
return code;
|
|
}
|
|
|
|
/*
|
|
* Get the long term key from the keytab to be able to verify the PAC
|
|
* signature.
|
|
*
|
|
* FIXME: Use ticket->enc_part.kvno ???
|
|
* Getting the latest kvno with passing 0 fixes:
|
|
* make -j test TESTS="samba4.winbind.pac.ad_member"
|
|
*/
|
|
code = smb_krb5_get_longterm_key(context,
|
|
ticket->server,
|
|
0, /* kvno */
|
|
ticket->enc_part.enctype,
|
|
keytab,
|
|
&keyblock);
|
|
if (code != 0) {
|
|
DBG_ERR("smb_krb5_get_longterm_key failed: %s\n",
|
|
error_message(code));
|
|
krb5_free_ticket(context, ticket);
|
|
|
|
return code;
|
|
}
|
|
|
|
code = krb5_mk_rep(context, *auth_context, reply);
|
|
if (code != 0) {
|
|
DBG_ERR("krb5_mk_rep failed: %s\n",
|
|
error_message(code));
|
|
krb5_free_ticket(context, ticket);
|
|
krb5_free_keyblock(context, keyblock);
|
|
}
|
|
|
|
*pticket = ticket;
|
|
*pkeyblock = keyblock;
|
|
|
|
return code;
|
|
}
|