s4: Use same function signature for convert_* as s3.

[nivanova/samba-autobuild/.git] / source4 / kdc / kpasswdd.c

diff --git a/source4/kdc/kpasswdd.c b/source4/kdc/kpasswdd.c
index 603332e69eb4282157d0e57e9f0b223f424ea20c..67404af2ab2e629e92876ea14c294d2b719198df 100644 (file)
--- a/source4/kdc/kpasswdd.c
+++ b/source4/kdc/kpasswdd.c
@@ -25,7 +25,7 @@
 #include "lib/events/events.h"
 #include "lib/socket/socket.h"
 #include "system/network.h"
-#include "lib/util/dlinklist.h"
+#include "../lib/util/dlinklist.h"
 #include "lib/ldb/include/ldb.h"
 #include "auth/gensec/gensec.h"
 #include "auth/credentials/credentials.h"
@@ -47,7 +47,7 @@
 struct kpasswd_socket {
        struct socket_context *sock;
        struct kdc_server *kdc;
-       struct fd_event *fde;
+       struct tevent_fd *fde;
 
        /* a queue of outgoing replies that have been deferred */
        struct kdc_reply *send_queue;
@@ -65,7 +65,7 @@ static bool kpasswdd_make_error_reply(struct kdc_server *kdc,
        
        DEBUG(result_code ? 3 : 10, ("kpasswdd: %s\n", error_string));
 
-       len = push_utf8_talloc(mem_ctx, lp_iconv_convenience(kdc->task->lp_ctx), &error_string_utf8, error_string);
+       len = push_utf8_talloc(mem_ctx, &error_string_utf8, error_string);
        if (len == -1) {
                return false;
        }
@@ -175,7 +175,7 @@ static bool kpasswd_make_pwchange_reply(struct kdc_server *kdc,
 static bool kpasswdd_change_password(struct kdc_server *kdc,
                                     TALLOC_CTX *mem_ctx, 
                                     struct auth_session_info *session_info,
-                                    const char *password,
+                                    const DATA_BLOB *password,
                                     DATA_BLOB *reply)
 {
        NTSTATUS status;
@@ -219,6 +219,8 @@ static bool kpasswd_process_request(struct kdc_server *kdc,
                                    DATA_BLOB *reply)
 {
        struct auth_session_info *session_info;
+       size_t pw_len;
+
        if (!NT_STATUS_IS_OK(gensec_session_info(gensec_security, 
                                                 &session_info))) {
                return kpasswdd_make_error_reply(kdc, mem_ctx, 
@@ -230,12 +232,18 @@ static bool kpasswd_process_request(struct kdc_server *kdc,
        switch (version) {
        case KRB5_KPASSWD_VERS_CHANGEPW:
        {
-               char *password = talloc_strndup(mem_ctx, (const char *)input->data, input->length);
-               if (!password) {
+               DATA_BLOB password;
+               if (!convert_string_talloc_convenience(mem_ctx, lp_iconv_convenience(kdc->task->lp_ctx), 
+                                              CH_UTF8, CH_UTF16, 
+                                              (const char *)input->data, 
+                                              input->length,
+                                              (void **)&password.data, &pw_len, false)) {
                        return false;
                }
+               password.length = pw_len;
+       
                return kpasswdd_change_password(kdc, mem_ctx, session_info, 
-                                               password, reply);
+                                               &password, reply);
                break;
        }
        case KRB5_KPASSWD_VERS_SETPW:
@@ -248,7 +256,7 @@ static bool kpasswd_process_request(struct kdc_server *kdc,
                krb5_context context = kdc->smb_krb5_context->krb5_context;
 
                ChangePasswdDataMS chpw;
-               char *password;
+               DATA_BLOB password;
 
                krb5_principal principal;
                char *set_password_on_princ;
@@ -271,13 +279,17 @@ static bool kpasswd_process_request(struct kdc_server *kdc,
                                                        reply);
                }
                
-               password = talloc_strndup(mem_ctx, 
-                                         (const char *)chpw.newpasswd.data, 
-                                         chpw.newpasswd.length);
-               if (!password) {
+               if (!convert_string_talloc_convenience(mem_ctx, lp_iconv_convenience(kdc->task->lp_ctx), 
+                                              CH_UTF8, CH_UTF16, 
+                                              (const char *)chpw.newpasswd.data, 
+                                              chpw.newpasswd.length,
+                                              (void **)&password.data, &pw_len, false)) {
                        free_ChangePasswdDataMS(&chpw);
                        return false;
                }
+               
+               password.length = pw_len;
+       
                if ((chpw.targname && !chpw.targrealm) 
                    || (!chpw.targname && chpw.targrealm)) {
                        return kpasswdd_make_error_reply(kdc, mem_ctx, 
@@ -306,7 +318,7 @@ static bool kpasswd_process_request(struct kdc_server *kdc,
                } else {
                        free_ChangePasswdDataMS(&chpw);
                        return kpasswdd_change_password(kdc, mem_ctx, session_info, 
-                                                       password, reply);
+                                                       &password, reply);
                }
                free_ChangePasswdDataMS(&chpw);
 
@@ -371,7 +383,7 @@ static bool kpasswd_process_request(struct kdc_server *kdc,
                        /* Admin password set */
                        status = samdb_set_password(samdb, mem_ctx,
                                                    set_password_on_dn, NULL,
-                                                   msg, password, NULL, NULL, 
+                                                   msg, &password, NULL, NULL, 
                                                    false, /* this is not a user password change */
                                                    &reject_reason, &dominfo);
                }
@@ -468,12 +480,6 @@ bool kpasswdd_process(struct kdc_server *kdc,
        ap_req = data_blob_const(&input->data[header_len], ap_req_len);
        krb_priv_req = data_blob_const(&input->data[header_len + ap_req_len], krb_priv_len);
        
-       nt_status = gensec_server_start(tmp_ctx, kdc->task->event_ctx, kdc->task->lp_ctx, kdc->task->msg_ctx, &gensec_security);
-       if (!NT_STATUS_IS_OK(nt_status)) {
-               talloc_free(tmp_ctx);
-               return false;
-       }
-
        server_credentials = cli_credentials_init(tmp_ctx);
        if (!server_credentials) {
                DEBUG(1, ("Failed to init server credentials\n"));
@@ -500,7 +506,16 @@ bool kpasswdd_process(struct kdc_server *kdc,
                return ret;
        }
        
-       nt_status = gensec_set_credentials(gensec_security, server_credentials);
+       /* We don't strictly need to call this wrapper, and could call
+        * gensec_server_start directly, as we have no need for NTLM
+        * and we have a PAC, but this ensures that the wrapper can be
+        * safely extended for other helpful things in future */
+       nt_status = samba_server_gensec_start(tmp_ctx, kdc->task->event_ctx, 
+                                             kdc->task->msg_ctx,
+                                             kdc->task->lp_ctx,
+                                             server_credentials,
+                                             "kpasswd", 
+                                             &gensec_security);
        if (!NT_STATUS_IS_OK(nt_status)) {
                talloc_free(tmp_ctx);
                return false;