← Back to branch summary

~ubuntu-branches/ubuntu/vivid/samba/vivid

« back to all changes in this revision

Viewing changes to source4/heimdal/kdc/default_config.c

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2011-12-21 13:18:04 UTC
  • mfrom: (0.39.21 sid)
  • Revision ID: package-import@ubuntu.com-20111221131804-xtlr39wx6njehxxr
Tags: 2:3.6.1-3ubuntu1
* Merge from Debian testing.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/patches/error-trans.fix-276472:
    - Add the translation of Unix Error code -ENOTSUP to NT Error Code
    - NT_STATUS_NOT_SUPPORTED to prevent the Permission denied error.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/control:
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
  + debian/samba.logrotate, debian/samba-common.dhcp, debian/samba.if-up:
    - Make them upstart compatible
  + debian/samba.postinst: 
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/patches/fix-debuglevel-name-conflict.patch: don't use 'debug_level'
    as a global variable name in an NSS module 
  + Dropped:
    - debian/patches/error-trans.fix-276472
    - debian/patches/fix-debuglevel-name-conflict.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
source4/heimdal/kdc/default_config.c
1
1
/*
2
2
 * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
3
3
 * (Royal Institute of Technology, Stockholm, Sweden).
4
 
 *
5
4
 * All rights reserved.
6
5
 *
 
6
 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
 
7
 *
7
8
 * Redistribution and use in source and binary forms, with or without
8
9
 * modification, are permitted provided that the following conditions
9
10
 * are met:
36
37
#include <getarg.h>
37
38
#include <parse_bytes.h>
38
39
 
39
 
RCSID("$Id$");
40
 
 
41
40
krb5_error_code
42
41
krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config)
43
42
{
215
214
                                      "kdc", "kdc_warn_pwexpire", NULL);
216
215
 
217
216
 
218
 
#ifdef PKINIT
219
217
    c->enable_pkinit =
220
218
        krb5_config_get_bool_default(context,
221
219
                                     NULL,
223
221
                                     "kdc",
224
222
                                     "enable-pkinit",
225
223
                                     NULL);
226
 
    if (c->enable_pkinit) {
227
 
        const char *user_id, *anchors, *file;
228
 
        char **pool_list, **revoke_list;
229
 
 
230
 
        user_id =
231
 
            krb5_config_get_string(context, NULL,
232
 
                                   "kdc", "pkinit_identity", NULL);
233
 
        if (user_id == NULL)
234
 
            krb5_errx(context, 1, "pkinit enabled but no identity");
235
 
 
236
 
        anchors = krb5_config_get_string(context, NULL,
237
 
                                         "kdc", "pkinit_anchors", NULL);
238
 
        if (anchors == NULL)
239
 
            krb5_errx(context, 1, "pkinit enabled but no X509 anchors");
240
 
 
241
 
        pool_list =
242
 
            krb5_config_get_strings(context, NULL,
243
 
                                    "kdc", "pkinit_pool", NULL);
244
 
 
245
 
        revoke_list =
246
 
            krb5_config_get_strings(context, NULL,
247
 
                                    "kdc", "pkinit_revoke", NULL);
248
 
 
249
 
        file = krb5_config_get_string(context, NULL,
250
 
                                      "kdc", "pkinit_kdc_ocsp", NULL);
251
 
        if (file) {
252
 
            c->pkinit_kdc_ocsp_file = strdup(file);
253
 
            if (c->pkinit_kdc_ocsp_file == NULL)
254
 
                krb5_errx(context, 1, "out of memory");
255
 
        }
256
 
 
257
 
        file = krb5_config_get_string(context, NULL,
258
 
                                      "kdc", "pkinit_kdc_friendly_name", NULL);
259
 
        if (file) {
260
 
            c->pkinit_kdc_friendly_name = strdup(file);
261
 
            if (c->pkinit_kdc_friendly_name == NULL)
262
 
                krb5_errx(context, 1, "out of memory");
263
 
        }
264
 
 
265
 
 
266
 
        _kdc_pk_initialize(context, c, user_id, anchors,
267
 
                           pool_list, revoke_list);
268
 
 
269
 
        krb5_config_free_strings(pool_list);
270
 
        krb5_config_free_strings(revoke_list);
271
 
 
272
 
        c->pkinit_princ_in_cert =
273
 
            krb5_config_get_bool_default(context, NULL,
274
 
                                         c->pkinit_princ_in_cert,
275
 
                                         "kdc",
276
 
                                         "pkinit_principal_in_certificate",
277
 
                                         NULL);
278
 
 
279
 
        c->pkinit_require_binding =
280
 
            krb5_config_get_bool_default(context, NULL,
281
 
                                         c->pkinit_require_binding,
282
 
                                         "kdc",
283
 
                                         "pkinit_win2k_require_binding",
284
 
                                         NULL);
285
 
    }
286
 
 
 
224
 
 
225
 
 
226
    c->pkinit_kdc_identity = 
 
227
        krb5_config_get_string(context, NULL,
 
228
                               "kdc", "pkinit_identity", NULL);
 
229
    c->pkinit_kdc_anchors =
 
230
        krb5_config_get_string(context, NULL,
 
231
                               "kdc", "pkinit_anchors", NULL);
 
232
    c->pkinit_kdc_cert_pool =
 
233
        krb5_config_get_strings(context, NULL,
 
234
                                "kdc", "pkinit_pool", NULL);
 
235
    c->pkinit_kdc_revoke =
 
236
        krb5_config_get_strings(context, NULL,
 
237
                                "kdc", "pkinit_revoke", NULL);
 
238
    c->pkinit_kdc_ocsp_file = 
 
239
        krb5_config_get_string(context, NULL,
 
240
                               "kdc", "pkinit_kdc_ocsp", NULL);
 
241
    c->pkinit_kdc_friendly_name =
 
242
        krb5_config_get_string(context, NULL,
 
243
                               "kdc", "pkinit_kdc_friendly_name", NULL);
 
244
    c->pkinit_princ_in_cert =
 
245
        krb5_config_get_bool_default(context, NULL,
 
246
                                     c->pkinit_princ_in_cert,
 
247
                                     "kdc",
 
248
                                     "pkinit_principal_in_certificate",
 
249
                                     NULL);
 
250
    c->pkinit_require_binding =
 
251
        krb5_config_get_bool_default(context, NULL,
 
252
                                     c->pkinit_require_binding,
 
253
                                     "kdc",
 
254
                                     "pkinit_win2k_require_binding",
 
255
                                     NULL);
287
256
    c->pkinit_dh_min_bits =
288
257
        krb5_config_get_int_default(context, NULL,
289
258
                                    0,
290
259
                                    "kdc", "pkinit_dh_min_bits", NULL);
291
260
 
292
 
#endif
293
 
 
294
261
    *config = c;
295
262
 
296
263
    return 0;
297
264
}
 
265
 
 
266
krb5_error_code
 
267
krb5_kdc_pkinit_config(krb5_context context, krb5_kdc_configuration *config)
 
268
{
 
269
#ifdef PKINIT
 
270
#ifdef __APPLE__
 
271
    config->enable_pkinit = 1;
 
272
 
 
273
    if (config->pkinit_kdc_identity == NULL) {
 
274
        if (config->pkinit_kdc_friendly_name == NULL)
 
275
            config->pkinit_kdc_friendly_name = 
 
276
                strdup("O=System Identity,CN=com.apple.kerberos.kdc");
 
277
        config->pkinit_kdc_identity = strdup("KEYCHAIN:");
 
278
    }
 
279
    if (config->pkinit_kdc_anchors == NULL)
 
280
        config->pkinit_kdc_anchors = strdup("KEYCHAIN:");
 
281
 
 
282
#endif /* __APPLE__ */
 
283
 
 
284
    if (config->enable_pkinit) {
 
285
        if (config->pkinit_kdc_identity == NULL)
 
286
            krb5_errx(context, 1, "pkinit enabled but no identity");
 
287
 
 
288
        if (config->pkinit_kdc_anchors == NULL)
 
289
            krb5_errx(context, 1, "pkinit enabled but no X509 anchors");
 
290
 
 
291
        krb5_kdc_pk_initialize(context, config,
 
292
                               config->pkinit_kdc_identity,
 
293
                               config->pkinit_kdc_anchors,
 
294
                               config->pkinit_kdc_cert_pool,
 
295
                               config->pkinit_kdc_revoke);
 
296
 
 
297
    }
 
298
 
 
299
    return 0;
 
300
#endif /* PKINIT */
 
301
}