From 8d454d5916693561a2978932f6f2fccdf6b7cd9b Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Thu, 19 Mar 2015 13:09:21 -0700
Subject: [PATCH 1/2] docs: Mark 'client use spnego principal' as deprecated
 and also a bad idea.

Bug 10888 - smbclient doesn't ignore "not_defined_in_RFC4178@please_ignore"

https://bugzilla.samba.org/show_bug.cgi?id=10888

Signed-off-by: Jeremy Allison <jra@samba.org>
---
 docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml | 7 +++++++
 lib/param/param_table.c                                   | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml b/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml
index 6ec1eb1..792a738 100644
--- a/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml
+++ b/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml
@@ -14,6 +14,10 @@
     servers known only by IP address.  Kerberos relies on names, so
     ordinarily cannot function in this situation. </para>
 
+    <para>This is a VERY BAD IDEA for security reasons, and so this
+    parameter SHOULD NOT BE USED. It will be removed in a future
+    version of Samba.</para>
+
     <para>If disabled, Samba will use the name used to look up the
     server when asking the KDC for a ticket.  This avoids situations
     where a server may impersonate another, soliciting authentication
@@ -23,6 +27,9 @@
     <para>Note that Windows XP SP2 and later versions already follow
     this behaviour, and Windows Vista and later servers no longer
     supply this 'rfc4178 hint' principal on the server side.</para>
+
+    <para>This parameter is deprecated in Samba 4.2.1 and will be removed
+    (along with the functionality) in a later release of Samba.</para>
 </description>
 <value type="default">no</value>
 </samba:parameter>
diff --git a/lib/param/param_table.c b/lib/param/param_table.c
index 447c99b..f775efd 100644
--- a/lib/param/param_table.c
+++ b/lib/param/param_table.c
@@ -765,7 +765,7 @@ struct parm_struct parm_table[] = {
 		.offset		= GLOBAL_VAR(client_use_spnego_principal),
 		.special	= NULL,
 		.enum_list	= NULL,
-		.flags		= FLAG_ADVANCED,
+		.flags		= FLAG_ADVANCED | FLAG_DEPRECATED,
 	},
 	{
 		.label		= "username",
-- 
2.2.0.rc0.207.ga3a616c


From f777d43647456330afde37c02b77fe003931b25a Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Thu, 19 Mar 2015 13:10:33 -0700
Subject: [PATCH 2/2] s3: client - "client use spnego principal = yes" code
 checks wrong name.

Bug 10888 - smbclient doesn't ignore "not_defined_in_RFC4178@please_ignore"

https://bugzilla.samba.org/show_bug.cgi?id=10888

Code patch from <martin.wilck@ts.fujitsu.com>

Signed-off-by: Jeremy Allison <jra@samba.org>
---
 source3/libsmb/cliconnect.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 9cbf11f..4cb4ed4 100644
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -1662,7 +1662,7 @@ static char *cli_session_setup_get_principal(
 	char *principal = NULL;
 
 	if (!lp_client_use_spnego_principal() ||
-	    strequal(principal, ADS_IGNORE_PRINCIPAL)) {
+	    strequal(spnego_principal, ADS_IGNORE_PRINCIPAL)) {
 		spnego_principal = NULL;
 	}
 	if (spnego_principal != NULL) {
-- 
2.2.0.rc0.207.ga3a616c