char *utf8_name;
size_t converted_size;
- if (!push_utf8_allocate(&utf8_name, name, &converted_size)) {
+ if (!push_utf8_talloc(talloc_tos(), &utf8_name, name, &converted_size)) {
return ENOMEM;
}
ret = krb5_parse_name(context, utf8_name, principal);
- SAFE_FREE(utf8_name);
+ TALLOC_FREE(utf8_name);
return ret;
}
size_t converted_size;
*principal = NULL;
- if (!push_utf8_allocate(&utf8_name, name, &converted_size)) {
+ if (!push_utf8_talloc(talloc_tos(), &utf8_name, name, &converted_size)) {
return ENOMEM;
}
ret = krb5_parse_name_norealm(context, utf8_name, principal);
- SAFE_FREE(utf8_name);
+ TALLOC_FREE(utf8_name);
return ret;
}
#endif
/**************************************************************
krb5_parse_name that returns a UNIX charset name. Must
- be freed with normal free() call.
+ be freed with talloc_free() call.
**************************************************************/
- krb5_error_code smb_krb5_unparse_name(krb5_context context,
- krb5_const_principal principal,
- char **unix_name)
+krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx,
+ krb5_context context,
+ krb5_const_principal principal,
+ char **unix_name)
{
krb5_error_code ret;
char *utf8_name;
return ret;
}
- if (!pull_utf8_allocate(unix_name, utf8_name, &converted_size)) {
+ if (!pull_utf8_talloc(mem_ctx, unix_name, utf8_name, &converted_size)) {
krb5_free_unparsed_name(context, utf8_name);
return ENOMEM;
}
DATA_BLOB *edata_out)
{
DATA_BLOB edata_contents;
- ASN1_DATA data;
+ ASN1_DATA *data;
int edata_type;
if (!edata->length) {
return False;
}
- asn1_load(&data, *edata);
- asn1_start_tag(&data, ASN1_SEQUENCE(0));
- asn1_start_tag(&data, ASN1_CONTEXT(1));
- asn1_read_Integer(&data, &edata_type);
+ data = asn1_init(mem_ctx);
+ if (data == NULL) {
+ return false;
+ }
+
+ asn1_load(data, *edata);
+ asn1_start_tag(data, ASN1_SEQUENCE(0));
+ asn1_start_tag(data, ASN1_CONTEXT(1));
+ asn1_read_Integer(data, &edata_type);
if (edata_type != KRB5_PADATA_PW_SALT) {
DEBUG(0,("edata is not of required type %d but of type %d\n",
KRB5_PADATA_PW_SALT, edata_type));
- asn1_free(&data);
+ asn1_free(data);
return False;
}
- asn1_start_tag(&data, ASN1_CONTEXT(2));
- asn1_read_OctetString(&data, &edata_contents);
- asn1_end_tag(&data);
- asn1_end_tag(&data);
- asn1_end_tag(&data);
- asn1_free(&data);
+ asn1_start_tag(data, ASN1_CONTEXT(2));
+ asn1_read_OctetString(data, talloc_autofree_context(), &edata_contents);
+ asn1_end_tag(data);
+ asn1_end_tag(data);
+ asn1_end_tag(data);
+ asn1_free(data);
*edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length);
bool unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
{
DATA_BLOB pac_contents;
- ASN1_DATA data;
+ ASN1_DATA *data;
int data_type;
if (!auth_data->length) {
return False;
}
- asn1_load(&data, *auth_data);
- asn1_start_tag(&data, ASN1_SEQUENCE(0));
- asn1_start_tag(&data, ASN1_SEQUENCE(0));
- asn1_start_tag(&data, ASN1_CONTEXT(0));
- asn1_read_Integer(&data, &data_type);
+ data = asn1_init(mem_ctx);
+ if (data == NULL) {
+ return false;
+ }
+
+ asn1_load(data, *auth_data);
+ asn1_start_tag(data, ASN1_SEQUENCE(0));
+ asn1_start_tag(data, ASN1_SEQUENCE(0));
+ asn1_start_tag(data, ASN1_CONTEXT(0));
+ asn1_read_Integer(data, &data_type);
if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
- asn1_free(&data);
+ asn1_free(data);
return False;
}
- asn1_end_tag(&data);
- asn1_start_tag(&data, ASN1_CONTEXT(1));
- asn1_read_OctetString(&data, &pac_contents);
- asn1_end_tag(&data);
- asn1_end_tag(&data);
- asn1_end_tag(&data);
- asn1_free(&data);
+ asn1_end_tag(data);
+ asn1_start_tag(data, ASN1_CONTEXT(1));
+ asn1_read_OctetString(data, talloc_autofree_context(), &pac_contents);
+ asn1_end_tag(data);
+ asn1_end_tag(data);
+ asn1_end_tag(data);
+ asn1_free(data);
*unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
cc_type, krb5_cc_get_name(context, ccache),
- http_timestring(credsp->times.endtime)));
+ http_timestring(talloc_tos(), credsp->times.endtime)));
/* we will probably need new tickets if the current ones
will expire within 10 seconds.
DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
- http_timestring((unsigned)credsp->times.endtime),
+ http_timestring(talloc_tos(), (unsigned)credsp->times.endtime),
(unsigned)credsp->times.endtime));
if (expire_time) {
ccache,
&in_data );
if (retval) {
- DEBUG( 1, ("ads_krb5_get_fwd_ticket failed (%s)\n",
+ DEBUG( 3, ("ads_krb5_get_fwd_ticket failed (%s)\n",
error_message( retval ) ) );
- goto cleanup_creds;
+
+ /*
+ * This is not fatal. Delete the *auth_context and continue
+ * with krb5_mk_req_extended to get a non-forwardable ticket.
+ */
+
+ if (in_data.data) {
+ free( in_data.data );
+ in_data.data = NULL;
+ in_data.length = 0;
+ }
+ krb5_auth_con_free(context, *auth_context);
+ *auth_context = NULL;
}
}
#endif
bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote)
{
- krb5_keyblock *skey;
- krb5_error_code err;
- bool ret = False;
+ krb5_keyblock *skey = NULL;
+ krb5_error_code err = 0;
+ bool ret = false;
- if (remote)
+ if (remote) {
err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
- else
+ } else {
err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
- if (err == 0 && skey != NULL) {
- DEBUG(10, ("Got KRB5 session key of length %d\n", (int)KRB5_KEY_LENGTH(skey)));
- *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
- dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
+ }
+
+ if (err || skey == NULL) {
+ DEBUG(10, ("KRB5 error getting session key %d\n", err));
+ goto done;
+ }
- ret = True;
+ DEBUG(10, ("Got KRB5 session key of length %d\n", (int)KRB5_KEY_LENGTH(skey)));
+ *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
+ dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
+ ret = true;
+
+ done:
+ if (skey) {
krb5_free_keyblock(context, skey);
- } else {
- DEBUG(10, ("KRB5 error getting session key %d\n", err));
}
return ret;
krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
{
-#if defined(HAVE_KRB5_KT_FREE_ENTRY)
- return krb5_kt_free_entry(context, kt_entry);
-#elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
+/* Try krb5_free_keytab_entry_contents first, since
+ * MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and
+ * krb5_kt_free_entry but only has a prototype for the first, while the
+ * second is considered private.
+ */
+#if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
return krb5_free_keytab_entry_contents(context, kt_entry);
+#elif defined(HAVE_KRB5_KT_FREE_ENTRY)
+ return krb5_kt_free_entry(context, kt_entry);
#else
#error UNKNOWN_KT_FREE_FUNCTION
#endif
}
if ( DEBUGLEVEL >= 10 ) {
- if (smb_krb5_unparse_name(context, server, &name) == 0) {
+ if (smb_krb5_unparse_name(talloc_tos(), context, server, &name) == 0) {
DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
kvno, enctype, name));
- SAFE_FREE(name);
+ TALLOC_FREE(name);
}
}
addrs = (krb5_address **)SMB_MALLOC(sizeof(krb5_address *) * num_addr);
if (addrs == NULL) {
- SAFE_FREE(kerb_addr);
+ SAFE_FREE(*kerb_addr);
return ENOMEM;
}
addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
if (addrs[0] == NULL) {
SAFE_FREE(addrs);
- SAFE_FREE(kerb_addr);
+ SAFE_FREE(*kerb_addr);
return ENOMEM;
}
if (addrs[0]->contents == NULL) {
SAFE_FREE(addrs[0]);
SAFE_FREE(addrs);
- SAFE_FREE(kerb_addr);
+ SAFE_FREE(*kerb_addr);
return ENOMEM;
}
{
addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
if (addrs == NULL) {
- SAFE_FREE(kerb_addr);
+ SAFE_FREE(*kerb_addr);
return ENOMEM;
}
if (addrs->val[0].address.data == NULL) {
SAFE_FREE(addrs->val);
SAFE_FREE(addrs);
- SAFE_FREE(kerb_addr);
+ SAFE_FREE(*kerb_addr);
return ENOMEM;
}
tmp += 5;
}
+ if (tmp[0] == '/') {
+ /* Treat as a FILE: keytab definition. */
+ found_valid_name = true;
+ }
+
if (found_valid_name) {
if (tmp[0] != '/') {
ret = KRB5_KT_BADNAME;
git.samba.org / ira / wip.git / blobdiff