From: Stefan Metzmacher <metze@samba.org>
Date: Wed, 7 Aug 2019 10:11:58 +0000 (+0200)
Subject: s3:libsmb: add a cache for cli_session_creds_prepare_krb5()
X-Git-Tag: ldb-2.2.0~170
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b458f8fbb7febf3584fa648128b4e1dc764059f7;p=thirdparty%2Fsamba.git

s3:libsmb: add a cache for cli_session_creds_prepare_krb5()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
---

diff --git a/source3/include/client.h b/source3/include/client.h
index 6a3b1b02ff3..c9d1f00146e 100644
--- a/source3/include/client.h
+++ b/source3/include/client.h
@@ -95,6 +95,14 @@ struct cli_state {
 		struct smbXcli_tcon *tcon;
 		struct idr_context *open_handles;
 	} smb2;
+
+	/*
+	 * We don't want to kinit twice if
+	 * cli_session_creds_prepare_krb5()
+	 * is called more than once for a given
+	 * cli_state cli_credentials combination.
+	 */
+	const struct cli_credentials *last_prepared_creds;
 };
 
 struct file_info {
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 1fb1f0127b9..c1be7fc3943 100644
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -305,6 +305,18 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
 	 * only if required!
 	 */
 	setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
+
+	if (cli->last_prepared_creds == creds) {
+		DBG_DEBUG("Re-using previously prepared Kerberos credentials "
+			  "for %s to access %s.\n",
+			  user_principal,
+			  target_hostname);
+		TALLOC_FREE(frame);
+		return NT_STATUS_OK;
+	}
+
+	cli->last_prepared_creds = NULL;
+
 	ret = kerberos_kinit_password_ext(user_principal,
 					  pass,
 					  0,
@@ -362,6 +374,8 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
 		  canon_principal,
 		  target_hostname);
 
+	cli->last_prepared_creds = creds;
+
 	TALLOC_FREE(frame);
 	return NT_STATUS_OK;
 }