s3: not use as-needed by default and auto use if enable-developer is active

[samba.git] / source3 / libsmb / clikrb5.c

diff --git a/source3/libsmb/clikrb5.c b/source3/libsmb/clikrb5.c
index 3da64d60c2f3704cbe029298da82363ea5f2fc7b..68b45d89089be3245bb878d981f43af4b7a4e3a3 100644 (file)
--- a/source3/libsmb/clikrb5.c
+++ b/source3/libsmb/clikrb5.c
@@ -20,10 +20,16 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
-#define KRB5_DEPRECATED 1       /* this file uses DEPRECATED interfaces! */
-
 #include "includes.h"
+#include "smb_krb5.h"
+
+#ifndef KRB5_AUTHDATA_WIN2K_PAC
+#define KRB5_AUTHDATA_WIN2K_PAC 128
+#endif
+
+#ifndef KRB5_AUTHDATA_IF_RELEVANT
+#define KRB5_AUTHDATA_IF_RELEVANT 1
+#endif
 
 #ifdef HAVE_KRB5
 
@@ -820,11 +826,12 @@ cleanup_princ:
 }
 
 /*
-  get a kerberos5 ticket for the given service 
+  get a kerberos5 ticket for the given service
 */
-int cli_krb5_get_ticket(const char *principal, time_t time_offset, 
-                       DATA_BLOB *ticket, DATA_BLOB *session_key_krb5, 
-                       uint32 extra_ap_opts, const char *ccname, 
+int cli_krb5_get_ticket(TALLOC_CTX *mem_ctx,
+                       const char *principal, time_t time_offset,
+                       DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
+                       uint32_t extra_ap_opts, const char *ccname,
                        time_t *tgs_expire,
                        const char *impersonate_princ_s)
 
@@ -837,15 +844,15 @@ int cli_krb5_get_ticket(const char *principal, time_t time_offset,
        krb5_enctype enc_types[] = {
 #ifdef ENCTYPE_ARCFOUR_HMAC
                ENCTYPE_ARCFOUR_HMAC,
-#endif 
-               ENCTYPE_DES_CBC_MD5, 
-               ENCTYPE_DES_CBC_CRC, 
+#endif
+               ENCTYPE_DES_CBC_MD5,
+               ENCTYPE_DES_CBC_CRC,
                ENCTYPE_NULL};
 
        initialize_krb5_error_table();
        retval = krb5_init_context(&context);
        if (retval) {
-               DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n", 
+               DEBUG(1, ("krb5_init_context failed (%s)\n",
                         error_message(retval)));
                goto failed;
        }
@@ -856,56 +863,60 @@ int cli_krb5_get_ticket(const char *principal, time_t time_offset,
 
        if ((retval = krb5_cc_resolve(context, ccname ?
                        ccname : krb5_cc_default_name(context), &ccdef))) {
-               DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
+               DEBUG(1, ("krb5_cc_default failed (%s)\n",
                         error_message(retval)));
                goto failed;
        }
 
        if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
-               DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
+               DEBUG(1, ("krb5_set_default_tgs_ktypes failed (%s)\n",
                         error_message(retval)));
                goto failed;
        }
 
-       if ((retval = ads_krb5_mk_req(context, 
-                                       &auth_context, 
-                                       AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
-                                       principal,
-                                       ccdef, &packet,
-                                       tgs_expire,
-                                       impersonate_princ_s))) {
+       retval = ads_krb5_mk_req(context, &auth_context,
+                               AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
+                               principal, ccdef, &packet,
+                               tgs_expire, impersonate_princ_s);
+       if (retval) {
                goto failed;
        }
 
-       get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
+       get_krb5_smb_session_key(mem_ctx, context, auth_context,
+                                session_key_krb5, false);
 
-       *ticket = data_blob(packet.data, packet.length);
+       *ticket = data_blob_talloc(mem_ctx, packet.data, packet.length);
 
-       kerberos_free_data_contents(context, &packet); 
+       kerberos_free_data_contents(context, &packet);
 
 failed:
 
-       if ( context ) {
+       if (context) {
                if (ccdef)
                        krb5_cc_close(context, ccdef);
                if (auth_context)
                        krb5_auth_con_free(context, auth_context);
                krb5_free_context(context);
        }
-               
+
        return retval;
 }
 
- bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote)
- {
+bool get_krb5_smb_session_key(TALLOC_CTX *mem_ctx,
+                             krb5_context context,
+                             krb5_auth_context auth_context,
+                             DATA_BLOB *session_key, bool remote)
+{
        krb5_keyblock *skey = NULL;
        krb5_error_code err = 0;
        bool ret = false;
 
        if (remote) {
-               err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
+               err = krb5_auth_con_getremotesubkey(context,
+                                                   auth_context, &skey);
        } else {
-               err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
+               err = krb5_auth_con_getlocalsubkey(context,
+                                                  auth_context, &skey);
        }
 
        if (err || skey == NULL) {
@@ -913,19 +924,25 @@ failed:
                goto done;
        }
 
-       DEBUG(10, ("Got KRB5 session key of length %d\n",  (int)KRB5_KEY_LENGTH(skey)));
-       *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
-       dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
+       DEBUG(10, ("Got KRB5 session key of length %d\n",
+                  (int)KRB5_KEY_LENGTH(skey)));
+
+       *session_key = data_blob_talloc(mem_ctx,
+                                        KRB5_KEY_DATA(skey),
+                                        KRB5_KEY_LENGTH(skey));
+       dump_data_pw("KRB5 Session Key:\n",
+                    session_key->data,
+                    session_key->length);
 
        ret = true;
 
- done:
+done:
        if (skey) {
                krb5_free_keyblock(context, skey);
        }
 
        return ret;
- }
+}
 
 
 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
@@ -2265,8 +2282,10 @@ char *smb_krb5_principal_get_realm(krb5_context context,
 
 #else /* HAVE_KRB5 */
  /* this saves a few linking headaches */
- int cli_krb5_get_ticket(const char *principal, time_t time_offset, 
-                       DATA_BLOB *ticket, DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
+ int cli_krb5_get_ticket(TALLOC_CTX *mem_ctx,
+                       const char *principal, time_t time_offset,
+                       DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
+                       uint32_t extra_ap_opts,
                        const char *ccname, time_t *tgs_expire,
                        const char *impersonate_princ_s)
 {