s4-kdc Add 'flags' parameter to db fetch calls

This will allow these calls to honour the flags passed in from the KDC

Andrew Bartlett

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index 1dec6a55c7d7fd87acb014f2f944151cbac49f74..addcf96f391b5fdbeac59457a2e271e94bf2988f 100644 (file)
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -1062,6 +1062,7 @@ static krb5_error_code samba_kdc_fetch_client(krb5_context context,
                                               struct samba_kdc_db_context *kdc_db_ctx,
                                               TALLOC_CTX *mem_ctx,
                                               krb5_const_principal principal,
+                                              unsigned flags,
                                               hdb_entry_ex *entry_ex) {
        struct ldb_dn *realm_dn;
        krb5_error_code ret;
@@ -1084,6 +1085,7 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context,
                                              struct samba_kdc_db_context *kdc_db_ctx,
                                              TALLOC_CTX *mem_ctx,
                                              krb5_const_principal principal,
+                                             unsigned flags,
                                              uint32_t krbtgt_number,
                                              hdb_entry_ex *entry_ex)
 {
@@ -1092,6 +1094,7 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context,
        struct ldb_message *msg = NULL;
        struct ldb_dn *realm_dn = ldb_get_default_basedn(kdc_db_ctx->samdb);
 
+       krb5_principal alloc_principal = NULL;
        if (principal->name.name_string.len != 2
            || (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) != 0)) {
                /* Not a krbtgt */
@@ -1108,6 +1111,7 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context,
                 * krbtgt */
 
                int lret;
+               char *realm_fixed;
 
                if (krbtgt_number == kdc_db_ctx->my_krbtgt_number) {
                        lret = dsdb_search_one(kdc_db_ctx->samdb, mem_ctx,
@@ -1141,6 +1145,28 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context,
                        return HDB_ERR_NOENTRY;
                }
 
+               realm_fixed = strupper_talloc(mem_ctx, lpcfg_realm(lp_ctx));
+               if (!realm_fixed) {
+                       ret = ENOMEM;
+                       krb5_set_error_message(context, ret, "strupper_talloc: out of memory");
+                       return ret;
+               }
+
+               ret = krb5_copy_principal(context, principal, &alloc_principal);
+               if (ret) {
+                       return ret;
+               }
+
+               free(alloc_principal->name.name_string.val[1]);
+               alloc_principal->name.name_string.val[1] = strdup(realm_fixed);
+               talloc_free(realm_fixed);
+               if (!alloc_principal->name.name_string.val[1]) {
+                       ret = ENOMEM;
+                       krb5_set_error_message(context, ret, "samba_kdc_fetch: strdup() failed!");
+                       return ret;
+               }
+               principal = alloc_principal;
+
                ret = samba_kdc_message2entry(context, kdc_db_ctx, mem_ctx,
                                        principal, SAMBA_KDC_ENT_TYPE_KRBTGT,
                                        realm_dn, msg, entry_ex);
@@ -1278,10 +1304,11 @@ static krb5_error_code samba_kdc_lookup_server(krb5_context context,
 }
 
 static krb5_error_code samba_kdc_fetch_server(krb5_context context,
-                                              struct samba_kdc_db_context *kdc_db_ctx,
-                                              TALLOC_CTX *mem_ctx,
-                                              krb5_const_principal principal,
-                                              hdb_entry_ex *entry_ex)
+                                             struct samba_kdc_db_context *kdc_db_ctx,
+                                             TALLOC_CTX *mem_ctx,
+                                             krb5_const_principal principal,
+                                             unsigned flags,
+                                             hdb_entry_ex *entry_ex)
 {
        krb5_error_code ret;
        struct ldb_dn *realm_dn;
@@ -1332,20 +1359,20 @@ krb5_error_code samba_kdc_fetch(krb5_context context,
        }
 
        if (flags & HDB_F_GET_CLIENT) {
-               ret = samba_kdc_fetch_client(context, kdc_db_ctx, mem_ctx, principal, entry_ex);
+               ret = samba_kdc_fetch_client(context, kdc_db_ctx, mem_ctx, principal, flags, entry_ex);
                if (ret != HDB_ERR_NOENTRY) goto done;
        }
        if (flags & HDB_F_GET_SERVER) {
                /* krbtgt fits into this situation for trusted realms, and for resolving different versions of our own realm name */
-               ret = samba_kdc_fetch_krbtgt(context, kdc_db_ctx, mem_ctx, principal, krbtgt_number, entry_ex);
+               ret = samba_kdc_fetch_krbtgt(context, kdc_db_ctx, mem_ctx, principal, flags, krbtgt_number, entry_ex);
                if (ret != HDB_ERR_NOENTRY) goto done;
 
                /* We return 'no entry' if it does not start with krbtgt/, so move to the common case quickly */
-               ret = samba_kdc_fetch_server(context, kdc_db_ctx, mem_ctx, principal, entry_ex);
+               ret = samba_kdc_fetch_server(context, kdc_db_ctx, mem_ctx, principal, flags, entry_ex);
                if (ret != HDB_ERR_NOENTRY) goto done;
        }
        if (flags & HDB_F_GET_KRBTGT) {
-               ret = samba_kdc_fetch_krbtgt(context, kdc_db_ctx, mem_ctx, principal, krbtgt_number, entry_ex);
+               ret = samba_kdc_fetch_krbtgt(context, kdc_db_ctx, mem_ctx, principal, flags, krbtgt_number, entry_ex);
                if (ret != HDB_ERR_NOENTRY) goto done;
        }