Attachment 102810 Details for Bug 215645

[patch] adjust clockskew for kerberos spnego session setup

samba3-cli_clockskew.diff (text/plain), 11.75 KB, created by Guenther Deschner on 2006-10-27 12:06:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Guenther Deschner

Created: 2006-10-27 12:06:52 UTC

Size: 11.75 KB

patch

obsolete

>Index: python/py_common.c
>===================================================================
>--- python/py_common.c	(revision 18988)
>+++ python/py_common.c	(working copy)
>@@ -226,7 +226,7 @@
> 
> 	result = cli_full_connection(
> 		&cli, NULL, server, NULL, 0, "IPC$", "IPC",
>-		username, domain, password, 0, Undefined, NULL);
>+		username, domain, password, 0, Undefined, 0, NULL);
> 	
> 	if (!NT_STATUS_IS_OK(result)) {
> 		*errstr = SMB_STRDUP("error connecting to IPC$ pipe");
>Index: rpcclient/rpcclient.c
>===================================================================
>--- rpcclient/rpcclient.c	(revision 18988)
>+++ rpcclient/rpcclient.c	(working copy)
>@@ -800,7 +800,7 @@
> 					lp_workgroup(),
> 					cmdline_auth_info.password, 
> 					cmdline_auth_info.use_kerberos ? CLI_FULL_CONNECTION_USE_KERBEROS : 0,
>-					cmdline_auth_info.signing_state,NULL);
>+					cmdline_auth_info.signing_state, 0, NULL);
> 	
> 	if (!NT_STATUS_IS_OK(nt_status)) {
> 		DEBUG(0,("Cannot connect to server.  Error was %s\n", nt_errstr(nt_status)));
>Index: rpcclient/cmd_spoolss.c
>===================================================================
>--- rpcclient/cmd_spoolss.c	(revision 18988)
>+++ rpcclient/cmd_spoolss.c	(working copy)
>@@ -2631,7 +2631,7 @@
> 					lp_workgroup(),
> 					cmdline_auth_info.password, 
> 					cmdline_auth_info.use_kerberos ? CLI_FULL_CONNECTION_USE_KERBEROS : 0,
>-					cmdline_auth_info.signing_state, NULL);
>+					cmdline_auth_info.signing_state, 0, NULL);
> 					
> 	if ( !NT_STATUS_IS_OK(nt_status) )
> 		return WERR_GENERAL_FAILURE;
>Index: smbd/change_trust_pw.c
>===================================================================
>--- smbd/change_trust_pw.c	(revision 18988)
>+++ smbd/change_trust_pw.c	(working copy)
>@@ -61,7 +61,7 @@
> 					   NULL, 0,
> 					   "IPC$", "IPC",  
> 					   "", "",
>-					   "", 0, Undefined, NULL))) {
>+					   "", 0, Undefined, 0, NULL))) {
> 		DEBUG(0,("modify_trust_password: Connection to %s failed!\n", dc_name));
> 		nt_status = NT_STATUS_UNSUCCESSFUL;
> 		goto failed;
>Index: auth/auth_domain.c
>===================================================================
>--- auth/auth_domain.c	(revision 18988)
>+++ auth/auth_domain.c	(working copy)
>@@ -75,7 +75,7 @@
> 	/* Attempt connection */
> 	*retry = True;
> 	result = cli_full_connection(cli, global_myname(), dc_name, &dc_ip, 0, 
>-		"IPC$", "IPC", "", "", "", 0, Undefined, retry);
>+		"IPC$", "IPC", "", "", "", 0, Undefined, 0, retry);
> 
> 	if (!NT_STATUS_IS_OK(result)) {
> 		/* map to something more useful */
>Index: libsmb/trusts_util.c
>===================================================================
>--- libsmb/trusts_util.c	(revision 18988)
>+++ libsmb/trusts_util.c	(working copy)
>@@ -169,7 +172,7 @@
> 	/* setup the anonymous connection */
> 
> 	result = cli_full_connection( &cli, global_myname(), dc_name, &dc_ip, 0, "IPC$", "IPC",
>-		"", "", "", 0, Undefined, &retry);
>+		"", "", "", 0, Undefined, 0, &retry);
> 	if ( !NT_STATUS_IS_OK(result) )
> 		goto done;
> 
>Index: libsmb/libsmbclient.c
>===================================================================
>--- libsmb/libsmbclient.c	(revision 18988)
>+++ libsmb/libsmbclient.c	(working copy)
>@@ -954,7 +957,7 @@
>                                                 &ip, 0, "IPC$", "?????",  
>                                                 username, workgroup,
>                                                 password, 0,
>-                                                Undefined, NULL);
>+                                                Undefined, 0, NULL);
>                 if (! NT_STATUS_IS_OK(nt_status)) {
>                         DEBUG(1,("cli_full_connection failed! (%s)\n",
>                                  nt_errstr(nt_status)));
>Index: libsmb/cliconnect.c
>===================================================================
>--- libsmb/cliconnect.c	(revision 18988)
>+++ libsmb/cliconnect.c	(working copy)
>@@ -51,6 +54,18 @@
> 	cli->user_session_key = data_blob(session_key.data, session_key.length);
> }
> 
>+/**
>+ * Adjust clock_skew using kerberos libraries for a kerberized session setup
>+ * @param cli The cli structure to add it to
>+ * @param time_diff The current clock_skew
>+ *
>+ */
>+
>+static void cli_set_time_diff(struct cli_state *cli, const time_t time_diff) 
>+{
>+	cli->clockskew = time_diff;
>+}
>+
> /****************************************************************************
>  Do an old lanman2 style session setup.
> ****************************************************************************/
>@@ -553,7 +568,7 @@
> 	DEBUG(2,("Doing kerberos session setup\n"));
> 
> 	/* generate the encapsulated kerberos5 ticket */
>-	rc = spnego_gen_negTokenTarg(principal, 0, &negTokenTarg, &session_key_krb5, 0);
>+	rc = spnego_gen_negTokenTarg(principal, cli->clockskew, &negTokenTarg, &session_key_krb5, 0);
> 
> 	if (rc) {
> 		DEBUG(1, ("spnego_gen_negTokenTarg failed: %s\n", error_message(rc)));
>@@ -775,9 +790,12 @@
> 
> 		if (pass && *pass) {
> 			int ret;
>-			
>+
>+			/* gd: here we need a krb5 conf prepared as the kinit expects one... - 
>+			  breaks krb5 connects to remote domains */
>+
> 			use_in_memory_ccache();
>-			ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
>+			ret = kerberos_kinit_password(user, pass, cli->clockskew, NULL);
> 			
> 			if (ret){
> 				SAFE_FREE(principal);
>@@ -1506,7 +1524,7 @@
> 			     const char *service, const char *service_type,
> 			     const char *user, const char *domain, 
> 			     const char *password, int flags,
>-			     int signing_state,
>+			     int signing_state, time_t time_diff,
> 			     BOOL *retry) 
> {
> 	NTSTATUS nt_status;
>@@ -1526,6 +1544,8 @@
> 		return nt_status;
> 	}
> 
>+	cli_set_time_diff(cli, time_diff);
>+
> 	nt_status = cli_session_setup(cli, user, password, pw_len, password,
> 				      pw_len, domain);
> 	if (!NT_STATUS_IS_OK(nt_status)) {
>@@ -1688,7 +1708,7 @@
> 	
> 	nt_status = cli_full_connection(&cli, myname, server, server_ip, 0, "IPC$", "IPC", 
> 					user_info->username, lp_workgroup(), user_info->password, 
>-					CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK, Undefined, NULL);
>+					CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK, Undefined, 0, NULL);
> 
> 	if (NT_STATUS_IS_OK(nt_status)) {
> 		return cli;
>@@ -1791,3 +1811,4 @@
> 
> 	return NULL;
> }
>+
>Index: rpc_server/srv_spoolss_nt.c
>===================================================================
>--- rpc_server/srv_spoolss_nt.c	(revision 18988)
>+++ rpc_server/srv_spoolss_nt.c	(working copy)
>@@ -2534,7 +2534,7 @@
> 		"", /* username */
> 		"", /* domain */
> 		"", /* password */
>-		0, lp_client_signing(), NULL );
>+		0, lp_client_signing(), 0, NULL );
> 
> 	if ( !NT_STATUS_IS_OK( ret ) ) {
> 		DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n", 
>Index: sam/idmap_rid.c
>===================================================================
>--- sam/idmap_rid.c	(revision 18988)
>+++ sam/idmap_rid.c	(working copy)
>@@ -226,7 +226,7 @@
> 			username,
> 			lp_workgroup(),
> 			password,
>-			CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK, True, NULL);
>+			CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK, True, 0, NULL);
> 
> 	if (!NT_STATUS_IS_OK(status)) {
> 		DEBUG(1, ("rid_idmap_get_domains: could not setup connection to dc\n"));
>Index: include/client.h
>===================================================================
>--- include/client.h	(revision 18988)
>+++ include/client.h	(working copy)
>@@ -134,6 +134,7 @@
> 	uint32 sesskey;
> 	int serverzone;
> 	uint32 servertime;
>+	time_t clockskew;
> 	int readbraw_supported;
> 	int writebraw_supported;
> 	int timeout; /* in milliseconds. */
>Index: utils/netlookup.c
>===================================================================
>--- utils/netlookup.c	(revision 18988)
>+++ utils/netlookup.c	(working copy)
>@@ -103,6 +103,7 @@
> #endif
> 					0,
> 					Undefined,
>+					0,
> 					NULL);
> 
> 	if (!NT_STATUS_IS_OK(nt_status)) {
>Index: utils/smbcquotas.c
>===================================================================
>--- utils/smbcquotas.c	(revision 18988)
>+++ utils/smbcquotas.c	(working copy)
>@@ -376,7 +376,7 @@
> 							    share, "?????",  
> 							    cmdline_auth_info.username, lp_workgroup(),
> 							    cmdline_auth_info.password, 0,
>-							    cmdline_auth_info.signing_state, NULL))) {
>+							    cmdline_auth_info.signing_state, 0, NULL))) {
> 		return c;
> 	} else {
> 		DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));
>Index: utils/smbcacls.c
>===================================================================
>--- utils/smbcacls.c	(revision 18988)
>+++ utils/smbcacls.c	(working copy)
>@@ -789,7 +789,7 @@
> 							    share, "?????",  
> 							    cmdline_auth_info.username, lp_workgroup(),
> 							    cmdline_auth_info.password, 0,
>-							    cmdline_auth_info.signing_state, NULL))) {
>+							    cmdline_auth_info.signing_state, 0, NULL))) {
> 		return c;
> 	} else {
> 		DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));
>Index: utils/net_ads.c
>===================================================================
>--- utils/net_ads.c	(revision 18988)
>+++ utils/net_ads.c	(working copy)
>@@ -1700,7 +1700,7 @@
> 					opt_user_name, opt_workgroup,
> 					opt_password ? opt_password : "", 
> 					CLI_FULL_CONNECTION_USE_KERBEROS, 
>-					Undefined, NULL);
>+					Undefined, ads->auth.time_offset, NULL);
> 
> 	if (NT_STATUS_IS_ERR(nt_status)) {
> 		d_fprintf(stderr, "Unable to open a connnection to %s to obtain data "
>Index: utils/net.c
>===================================================================
>--- utils/net.c	(revision 18988)
>+++ utils/net.c	(working copy)
>@@ -178,7 +178,7 @@
> 					server_ip, opt_port,
> 					service_name, service_type,  
> 					opt_user_name, opt_workgroup,
>-					opt_password, 0, Undefined, NULL);
>+					opt_password, 0, Undefined, 0, NULL);
> 	
> 	if (NT_STATUS_IS_OK(nt_status)) {
> 		return nt_status;
>@@ -225,7 +225,7 @@
> 					server_ip, opt_port,
> 					"IPC$", "IPC",  
> 					"", "",
>-					"", 0, Undefined, NULL);
>+					"", 0, Undefined, 0, NULL);
> 	
> 	if (NT_STATUS_IS_OK(nt_status)) {
> 		return nt_status;
>@@ -248,7 +248,7 @@
> 					"IPC$", "IPC",  
> 					opt_user_name, opt_workgroup,
> 					opt_password, CLI_FULL_CONNECTION_USE_KERBEROS, 
>-					Undefined, NULL);
>+					Undefined, 0, NULL);
> 	
> 	if (NT_STATUS_IS_OK(nt_status)) {
> 		return nt_status;
>Index: torture/torture.c
>===================================================================
>--- torture/torture.c	(revision 18988)
>+++ torture/torture.c	(working copy)
>@@ -222,7 +222,7 @@
> 				     hostname, NULL, port_to_use, 
> 				     sharename, "?????", 
> 				     username, workgroup, 
>-				     password, flags, Undefined, &retry);
>+				     password, flags, Undefined, 0, &retry);
> 	if (!NT_STATUS_IS_OK(status)) {
> 		printf("failed to open share connection: //%s/%s port:%d - %s\n",
> 			hostname, sharename, port_to_use, nt_errstr(status));
>@@ -1240,7 +1240,7 @@
> 				     host, NULL, port_to_use,
> 				     NULL, NULL,
> 				     username, workgroup,
>-				     password, flags, Undefined, &retry);
>+				     password, flags, Undefined, 0, &retry);
> 
> 	if (!NT_STATUS_IS_OK(status)) {
> 		printf("could not open connection\n");
>Index: torture/locktest2.c
>===================================================================
>--- torture/locktest2.c	(revision 18988)
>+++ torture/locktest2.c	(working copy)
>@@ -176,7 +176,7 @@
> 
> 	nt_status = cli_full_connection(&c, myname, server_n, NULL, 0, share, "?????", 
> 					username, lp_workgroup(), password, 0,
>-					Undefined, NULL);
>+					Undefined, 0, NULL);
> 
> 	if (!NT_STATUS_IS_OK(nt_status)) {
> 		DEBUG(0, ("cli_full_connection failed with error %s\n", nt_errstr(nt_status)));
>Index: libgpo/gpo_util.c
>===================================================================
>--- libgpo/gpo_util.c	(revision 18988)
>+++ libgpo/gpo_util.c	(working copy)
>@@ -568,7 +568,7 @@
> 						     share, "A:",
> 						     ads->auth.user_name, NULL, ads->auth.password,
> 						     CLI_FULL_CONNECTION_USE_KERBEROS,
>-						     Undefined, NULL);
>+						     Undefined, ads->auth.time_offset, NULL);
> 			if (!NT_STATUS_IS_OK(result)) {
> 				DEBUG(10,("check_refresh_gpo: failed to connect: %s\n", nt_errstr(result)));
> 				goto out;

Actions: View | Diff

Attachments on bug 215645: 102810 | 102811 | 102821 | 103041