--- samba-3.0.28a/source/Makefile.in	
+++ samba-3.0.28a/source/Makefile.in	
@@ -151,7 +151,7 @@ 
 
 # Note that all executable programs now provide for an optional executable suffix.
 
-SBIN_PROGS = bin/smbd@EXEEXT@ bin/nmbd@EXEEXT@ bin/swat@EXEEXT@ @EXTRA_SBIN_PROGS@
+SBIN_PROGS = bin/smbd@EXEEXT@ bin/nmbd@EXEEXT@ bin/swat@EXEEXT@ @EXTRA_SBIN_PROGS@ @CIFSUPCALL_PROGS@
 
 ROOT_SBIN_PROGS = @CIFSMOUNT_PROGS@
 
@@ -653,6 +653,12 @@ 
 
 CIFS_UMOUNT_OBJ = client/umount.cifs.o
 
+CIFS_UPCALL_OBJ = client/cifs.upcall.o libsmb/clikrb5.o libsmb/clispnego.o \
+		libsmb/asn1.o libsmb/nterr.o libsmb/dcerpc_err.o \
+		libsmb/smbdes.o libsmb/smbencrypt.o libsmb/ntlmssp_parse.o \
+		$(PARAM_OBJ) $(LIBNMB_OBJ) $(KRBCLIENT_OBJ) $(SECRETS_OBJ) \
+		$(ERRORMAP_OBJ) $(RPC_PARSE_OBJ1) $(DOSERR_OBJ) $(LIB_DUMMY_OBJ)
+
 NMBLOOKUP_OBJ = utils/nmblookup.o $(PARAM_OBJ) $(LIBNMB_OBJ) $(RPC_PARSE_OBJ1) $(DOSERR_OBJ) \
                $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) $(SECRETS_OBJ) $(LIBSAMBA_OBJ)
 
@@ -1029,6 +1035,12 @@ 
 	@echo Linking $@
 	@$(CC) $(FLAGS) -o $@ $(CIFS_UMOUNT_OBJ) $(DYNEXP) $(LDFLAGS)
 
+bin/cifs.upcall@EXEEXT@: $(BINARY_PREREQS) $(CIFS_UPCALL_OBJ) $(LIBSMBCLIENT_OBJ1) $(LIB_OBJ) @BUILD_POPT@
+	@echo Linking $@
+	@$(CC) $(FLAGS) -o $@ $(CIFS_UPCALL_OBJ) $(DYNEXP) $(LDFLAGS) \
+		-lkeyutils $(LIBSMBCLIENT_OBJ1) $(LIB_OBJ) \
+		$(KRB5LIBS) $(LDAP_LIBS) $(POPT_LIBS) $(LIBS) 
+
 bin/testparm@EXEEXT@: proto_exists $(TESTPARM_OBJ) @BUILD_POPT@ bin/.dummy
 	@echo Linking $@
 	@$(CC) $(FLAGS) -o $@ $(TESTPARM_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) $(LDAP_LIBS) @POPTLIBS@
@@ -1573,7 +1585,7 @@ 
 	@echo Linking $@
 	@$(CC) $(FLAGS) -o $@ $(DYNEXP) script/tests/timelimit.o
 
-install: installservers installbin @INSTALL_CIFSMOUNT@ installman installscripts installdat installswat installmodules @INSTALL_LIBSMBCLIENT@ @INSTALL_LIBMSRPC@ @INSTALL_PAM_MODULES@ @INSTALL_LIBSMBSHAREMODES@
+install: installservers installbin @INSTALL_CIFSMOUNT@ @INSTALL_CIFSUPCALL@ installman installscripts installdat installswat installmodules @INSTALL_LIBSMBCLIENT@ @INSTALL_LIBMSRPC@ @INSTALL_PAM_MODULES@ @INSTALL_LIBSMBSHAREMODES@
 
 
 install-everything: install installmodules
@@ -1599,6 +1611,10 @@ 
 	@$(SHELL) $(srcdir)/script/installdirs.sh $(INSTALLPERMS) $(DESTDIR) $(ROOTSBINDIR)
 	@$(SHELL) script/installbin.sh $(INSTALLPERMS) $(DESTDIR) $(prefix) $(ROOTSBINDIR) @CIFSMOUNT_PROGS@
 
+installcifsupcall: @CIFSUPCALL_PROGS@
+	@$(SHELL) $(srcdir)/script/installdirs.sh $(INSTALLPERMS) $(DESTDIR) $(SBINDIR)
+	@$(SHELL) script/installbin.sh $(INSTALLPERMS) $(DESTDIR) $(prefix) $(SBINDIR) @CIFSUPCALL_PROGS@
+
 # Some symlinks are required for the 'probing' of modules.
 # This mechanism should go at some point..
 installmodules: modules installdirs
@@ -1716,7 +1732,7 @@ 
 	@echo "  swatdir:     $(SWATDIR)"
 
 
-uninstall: uninstallman uninstallservers uninstallbin @UNINSTALL_CIFSMOUNT@ uninstallscripts uninstalldat uninstallswat uninstallmodules @UNINSTALL_LIBSMBCLIENT@ @UNINSTALL_LIBMSRPC@ @UNINSTALL_PAM_MODULES@ @UNINSTALL_LIBSMBSHAREMODES@
+uninstall: uninstallman uninstallservers uninstallbin @UNINSTALL_CIFSMOUNT@ @UNINSTALL_CIFSUPCALL@ uninstallscripts uninstalldat uninstallswat uninstallmodules @UNINSTALL_LIBSMBCLIENT@ @UNINSTALL_LIBMSRPC@ @UNINSTALL_PAM_MODULES@ @UNINSTALL_LIBSMBSHAREMODES@
 
 uninstallman:
 	@$(SHELL) $(srcdir)/script/uninstallman.sh $(DESTDIR)$(MANDIR) $(srcdir) C
@@ -1730,6 +1746,9 @@ 
 uninstallcifsmount:
 	@$(SHELL) script/uninstallbin.sh $(INSTALLPERMS) $(DESTDIR) $(prefix) $(ROOTSBINDIR) @CIFSMOUNT_PROGS@
 
+uninstallcifsupcall:
+	@$(SHELL) script/uninstallbin.sh $(INSTALLPERMS_BIN) $(DESTDIR) $(prefix) $(SBINDIR) @CIFSUPCALL_PROGS@
+
 uninstallmodules:
 	@$(SHELL) $(srcdir)/script/uninstallmodules.sh $(INSTALLPERMS) $(DESTDIR) $(prefix) $(VFSLIBDIR) $(VFS_MODULES)
 	@$(SHELL) $(srcdir)/script/uninstallmodules.sh $(INSTALLPERMS) $(DESTDIR) $(prefix) $(PDBLIBDIR) $(PDB_MODULES)
--- samba-3.0.28a/source/client/cifs_spnego.h	
+++ samba-3.0.28a/source/client/cifs_spnego.h	
@@ -0,0 +1,46 @@ 
+/*
+ *   fs/cifs/cifs_spnego.h -- SPNEGO upcall management for CIFS
+ *
+ *   Copyright (c) 2007 Red Hat, Inc.
+ *   Author(s): Jeff Layton (jlayton@redhat.com)
+ *              Steve French (sfrench@us.ibm.com)
+ *
+ *   This library is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU Lesser General Public License as published
+ *   by the Free Software Foundation; either version 2.1 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ *   the GNU Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public License
+ *   along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _CIFS_SPNEGO_H
+#define _CIFS_SPNEGO_H
+
+#define CIFS_SPNEGO_UPCALL_VERSION 2
+
+/*
+ * The version field should always be set to CIFS_SPNEGO_UPCALL_VERSION.
+ * The flags field is for future use. The request-key callout should set
+ * sesskey_len and secblob_len, and then concatenate the SessKey+SecBlob
+ * and stuff it in the data field.
+ */
+struct cifs_spnego_msg {
+	uint32_t version;
+	uint32_t flags;
+	uint32_t sesskey_len;
+	uint32_t secblob_len;
+	uint8_t data[1];
+};
+
+#ifdef __KERNEL__
+extern struct key_type cifs_spnego_key_type;
+#endif				/* KERNEL */
+
+#endif				/* _CIFS_SPNEGO_H */
--- samba-3.0.28a/source/configure.in	
+++ samba-3.0.28a/source/configure.in	
@@ -321,6 +321,9 @@ 
 AC_SUBST(CIFSMOUNT_PROGS)
 AC_SUBST(INSTALL_CIFSMOUNT)
 AC_SUBST(UNINSTALL_CIFSMOUNT)
+AC_SUBST(CIFSUPCALL_PROGS)
+AC_SUBST(INSTALL_CIFSUPCALL)
+AC_SUBST(UNINSTALL_CIFSUPCALL)
 AC_SUBST(EXTRA_SBIN_PROGS)
 AC_SUBST(EXTRA_ALL_TARGETS)
 AC_SUBST(CONFIG_LIBS)
@@ -4242,6 +4245,60 @@ 
   esac ]
 )
 
+#################################################
+# check for cifs.upcall support
+AC_CHECK_HEADERS([keyutils.h], [HAVE_KEYUTILS_H=1], [HAVE_KEYUTILS_H=0])
+CIFSUPCALL_PROGS=""
+INSTALL_CIFSUPCALL=""
+UNINSTALL_CIFSUPCALL=""
+AC_MSG_CHECKING(whether to build cifs.upcall)
+AC_ARG_WITH(cifsupcall,
+[AS_HELP_STRING([--with-cifsupcall], [Include cifs.upcall (Linux only) support (default=yes)])],
+[ case "$withval" in
+  no)
+	AC_MSG_RESULT(no)
+	;;
+  *)
+	case "$host_os" in
+	*linux*)
+		if test x"$use_ads" != x"yes"; then
+			AC_MSG_ERROR(ADS support should be enabled for building cifs.upcall)
+		elif test x"$HAVE_KEYUTILS_H" != "x1"; then
+			AC_MSG_ERROR(keyutils package is required for cifs.upcall)
+		else
+			AC_MSG_RESULT(yes)
+			AC_DEFINE(WITH_CIFSUPCALL,1,[whether to build cifs.upcall])
+			CIFSUPCALL_PROGS="bin/cifs.upcall"
+			INSTALL_CIFSUPCALL="installcifsupcall"
+			UNINSTALL_CIFSUPCALL="uninstallcifsupcall"
+		fi
+		;;
+	*)
+		AC_MSG_ERROR(not on a linux system!)
+		;;
+	esac
+    ;;
+  esac ],
+[ case "$host_os" in
+  *linux*)
+        if test x"$use_ads" != x"yes"; then
+                AC_MSG_WARN(ADS support should be enabled for building cifs.upcall)
+        elif test x"$HAVE_KEYUTILS_H" != "x1"; then
+                AC_MSG_WARN(keyutils package is required for cifs.upcall)
+        else
+                AC_MSG_RESULT(yes)
+                AC_DEFINE(WITH_CIFSUPCALL,1,[whether to build cifs.upcall])
+                CIFSUPCALL_PROGS="bin/cifs.upcall"
+                INSTALL_CIFSUPCALL="installcifsupcall"
+                UNINSTALL_CIFSUPCALL="uninstallcifsupcall"
+        fi
+        ;;
+  *)
+        AC_MSG_RESULT(no)
+        ;;
+  esac ]
+)
+
 
 #################################################
 # check for a PAM clear-text auth, accounts, password and session support
--- samba-3.0.28a/source/include/smb.h	
+++ samba-3.0.28a/source/include/smb.h	
@@ -558,6 +558,8 @@ 
 	void (*free)(struct data_blob_ *data_blob);
 } DATA_BLOB;
 
+extern const DATA_BLOB data_blob_null;
+
 /*
  * Structure used to keep directory state information around.
  * Used in NT change-notify code.
--- samba-3.0.28a/source/lib/data_blob.c	
+++ samba-3.0.28a/source/lib/data_blob.c	
@@ -21,6 +21,8 @@ 
 
 #include "includes.h"
 
+const DATA_BLOB data_blob_null = { NULL, 0, NULL };
+
 /*******************************************************************
  Free() a data blob.
 *******************************************************************/
--- samba-3.0.28a/source/client/cifs.upcall.c	
+++ samba-3.0.28a/source/client/cifs.upcall.c	
@@ -0,0 +1,391 @@ 
+/*
+* CIFS user-space helper.
+* Copyright (C) Igor Mammedov (niallain@gmail.com) 2007
+*
+* Used by /sbin/request-key for handling
+* cifs upcall for kerberos authorization of access to share and
+* cifs upcall for DFS srver name resolving (IPv4/IPv6 aware).
+* You should have keyutils installed and add something like the
+* following lines to /etc/request-key.conf file:
+
+create cifs.spnego * * /usr/local/sbin/cifs.upcall %k
+create dns_resolver * * /usr/local/sbin/cifs.upcall %k
+
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License as published by
+* the Free Software Foundation; either version 2 of the License, or
+* (at your option) any later version.
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+* GNU General Public License for more details.
+* You should have received a copy of the GNU General Public License
+* along with this program; if not, write to the Free Software
+* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#include "includes.h"
+#include <keyutils.h>
+
+#include "cifs_spnego.h"
+
+const char *CIFSSPNEGO_VERSION = "1.2";
+static const char *prog = "cifs.upcall";
+typedef enum _secType {
+	NONE = 0,
+	KRB5,
+	MS_KRB5
+} secType_t;
+
+/*
+ * Prepares AP-REQ data for mechToken and gets session key
+ * Uses credentials from cache. It will not ask for password
+ * you should receive credentials for yuor name manually using
+ * kinit or whatever you wish.
+ *
+ * in:
+ * 	oid -		string with OID/ Could be OID_KERBEROS5
+ * 			or OID_KERBEROS5_OLD
+ * 	principal -	Service name.
+ * 			Could be "cifs/FQDN" for KRB5 OID
+ * 			or for MS_KRB5 OID style server principal
+ * 			like "pdc$@YOUR.REALM.NAME"
+ *
+ * out:
+ * 	secblob -	pointer for spnego wrapped AP-REQ data to be stored
+ * 	sess_key-	pointer for SessionKey data to be stored
+ *
+ * ret: 0 - success, others - failure
+*/
+static int
+handle_krb5_mech(const char *oid, const char *principal,
+		     DATA_BLOB * secblob, DATA_BLOB * sess_key)
+{
+	int retval;
+	DATA_BLOB tkt, tkt_wrapped;
+
+	/* get a kerberos ticket for the service and extract the session key */
+	retval = cli_krb5_get_ticket(principal, 0,
+				     &tkt, sess_key, 0, NULL, NULL);
+
+	if (retval)
+		return retval;
+
+	/* wrap that up in a nice GSS-API wrapping */
+	tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
+
+	/* and wrap that in a shiny SPNEGO wrapper */
+	*secblob = gen_negTokenInit(oid, tkt_wrapped);
+
+	data_blob_free(&tkt_wrapped);
+	data_blob_free(&tkt);
+	return retval;
+}
+
+#define DKD_HAVE_HOSTNAME	1
+#define DKD_HAVE_VERSION	2
+#define DKD_HAVE_SEC		4
+#define DKD_HAVE_IPV4		8
+#define DKD_HAVE_IPV6		16
+#define DKD_HAVE_UID		32
+#define DKD_MUSTHAVE_SET (DKD_HAVE_HOSTNAME|DKD_HAVE_VERSION|DKD_HAVE_SEC)
+
+static int
+decode_key_description(const char *desc, int *ver, secType_t * sec,
+			   char **hostname, uid_t * uid)
+{
+	int retval = 0;
+	char *pos;
+	const char *tkn = desc;
+
+	do {
+		pos = index(tkn, ';');
+		if (strncmp(tkn, "host=", 5) == 0) {
+			int len;
+
+			if (pos == NULL) {
+				len = strlen(tkn);
+			} else {
+				len = pos - tkn;
+			}
+			len -= 4;
+			SAFE_FREE(*hostname);
+			*hostname = SMB_XMALLOC_ARRAY(char, len);
+			strlcpy(*hostname, tkn + 5, len);
+			retval |= DKD_HAVE_HOSTNAME;
+		} else if (strncmp(tkn, "ipv4=", 5) == 0) {
+			/* BB: do we need it if we have hostname already? */
+		} else if (strncmp(tkn, "ipv6=", 5) == 0) {
+			/* BB: do we need it if we have hostname already? */
+		} else if (strncmp(tkn, "sec=", 4) == 0) {
+			if (strncmp(tkn + 4, "krb5", 4) == 0) {
+				retval |= DKD_HAVE_SEC;
+				*sec = KRB5;
+			} else if (strncmp(tkn + 4, "mskrb5", 6) == 0) {
+				retval |= DKD_HAVE_SEC;
+				*sec = MS_KRB5;
+			}
+		} else if (strncmp(tkn, "uid=", 4) == 0) {
+			errno = 0;
+			*uid = strtol(tkn + 4, NULL, 16);
+			if (errno != 0) {
+				syslog(LOG_WARNING, "Invalid uid format: %s",
+				       strerror(errno));
+				return 1;
+			} else {
+				retval |= DKD_HAVE_UID;
+			}
+		} else if (strncmp(tkn, "ver=", 4) == 0) {	/* if version */
+			errno = 0;
+			*ver = strtol(tkn + 4, NULL, 16);
+			if (errno != 0) {
+				syslog(LOG_WARNING,
+				       "Invalid version format: %s",
+				       strerror(errno));
+				return 1;
+			} else {
+				retval |= DKD_HAVE_VERSION;
+			}
+		}
+		if (pos == NULL)
+			break;
+		tkn = pos + 1;
+	} while (tkn);
+	return retval;
+}
+
+static int
+cifs_resolver(const key_serial_t key, const char *key_descr)
+{
+	int c;
+	struct addrinfo *addr;
+	char ip[INET6_ADDRSTRLEN];
+	void *p;
+	const char *keyend = key_descr;
+	/* skip next 4 ';' delimiters to get to description */
+	for (c = 1; c <= 4; c++) {
+		keyend = index(keyend+1, ';');
+		if (!keyend) {
+			syslog(LOG_WARNING, "invalid key description: %s",
+					key_descr);
+			return 1;
+		}
+	}
+	keyend++;
+
+	/* resolve name to ip */
+	c = getaddrinfo(keyend, NULL, NULL, &addr);
+	if (c) {
+		syslog(LOG_WARNING, "unable to resolve hostname: %s [%s]",
+				keyend, gai_strerror(c));
+		return 1;
+	}
+
+	/* conver ip to string form */
+	if (addr->ai_family == AF_INET) {
+		p = &(((struct sockaddr_in *)addr->ai_addr)->sin_addr);
+	} else {
+		p = &(((struct sockaddr_in6 *)addr->ai_addr)->sin6_addr);
+	}
+	if (!inet_ntop(addr->ai_family, p, ip, sizeof(ip))) {
+		syslog(LOG_WARNING, "%s: inet_ntop: %s",
+				__FUNCTION__, strerror(errno));
+		freeaddrinfo(addr);
+		return 1;
+	}
+
+	/* setup key */
+	c = keyctl_instantiate(key, ip, strlen(ip)+1, 0);
+	if (c == -1) {
+		syslog(LOG_WARNING, "%s: keyctl_instantiate: %s",
+				__FUNCTION__, strerror(errno));
+		freeaddrinfo(addr);
+		return 1;
+	}
+
+	freeaddrinfo(addr);
+	return 0;
+}
+
+static void
+usage(void)
+{
+	syslog(LOG_WARNING, "Usage: %s [-c] [-v] key_serial", prog);
+	fprintf(stderr, "Usage: %s [-c] [-v] key_serial\n", prog);
+}
+
+int main(const int argc, char *const argv[])
+{
+	struct cifs_spnego_msg *keydata = NULL;
+	DATA_BLOB secblob = data_blob_null;
+	DATA_BLOB sess_key = data_blob_null;
+	secType_t sectype = NONE;
+	key_serial_t key = 0;
+	size_t datalen;
+	long rc = 1;
+	uid_t uid = 0;
+	int kernel_upcall_version = 0;
+	int c, use_cifs_service_prefix = 0;
+	char *buf, *hostname = NULL;
+	const char *oid;
+
+	openlog(prog, 0, LOG_DAEMON);
+
+	while ((c = getopt(argc, argv, "cv")) != -1) {
+		switch (c) {
+		case 'c':{
+			use_cifs_service_prefix = 1;
+			break;
+			}
+		case 'v':{
+			printf("version: %s\n", CIFSSPNEGO_VERSION);
+			goto out;
+			}
+		default:{
+			syslog(LOG_WARNING, "unknown option: %c", c);
+			goto out;
+			}
+		}
+	}
+
+	/* is there a key? */
+	if (argc <= optind) {
+		usage();
+		goto out;
+	}
+
+	/* get key and keyring values */
+	errno = 0;
+	key = strtol(argv[optind], NULL, 10);
+	if (errno != 0) {
+		key = 0;
+		syslog(LOG_WARNING, "Invalid key format: %s", strerror(errno));
+		goto out;
+	}
+
+	rc = keyctl_describe_alloc(key, &buf);
+	if (rc == -1) {
+		syslog(LOG_WARNING, "keyctl_describe_alloc failed: %s",
+		       strerror(errno));
+		rc = 1;
+		goto out;
+	}
+
+	if ((strncmp(buf, "cifs.resolver", sizeof("cifs.resolver")-1) == 0) ||
+	    (strncmp(buf, "dns_resolver", sizeof("dns_resolver")-1) == 0)) {
+		rc = cifs_resolver(key, buf);
+		goto out;
+	}
+
+	rc = decode_key_description(buf, &kernel_upcall_version, &sectype,
+				    &hostname, &uid);
+	if ((rc & DKD_MUSTHAVE_SET) != DKD_MUSTHAVE_SET) {
+		syslog(LOG_WARNING,
+		       "unable to get from description necessary params");
+		rc = 1;
+		SAFE_FREE(buf);
+		goto out;
+	}
+	SAFE_FREE(buf);
+
+	if (kernel_upcall_version > CIFS_SPNEGO_UPCALL_VERSION) {
+		syslog(LOG_WARNING,
+		       "incompatible kernel upcall version: 0x%x",
+		       kernel_upcall_version);
+		rc = 1;
+		goto out;
+	}
+
+	if (rc & DKD_HAVE_UID) {
+		rc = setuid(uid);
+		if (rc == -1) {
+			syslog(LOG_WARNING, "setuid: %s", strerror(errno));
+			goto out;
+		}
+	}
+
+	/* BB: someday upcall SPNEGO blob could be checked here to decide
+	 * what mech to use */
+
+	// do mech specific authorization
+	switch (sectype) {
+	case MS_KRB5:
+	case KRB5:{
+			char *princ;
+			size_t len;
+
+			/* for "cifs/" service name + terminating 0 */
+			len = strlen(hostname) + 5 + 1;
+			princ = SMB_XMALLOC_ARRAY(char, len);
+			if (!princ) {
+				rc = 1;
+				break;
+			}
+			if (use_cifs_service_prefix) {
+				strlcpy(princ, "cifs/", len);
+			} else {
+				strlcpy(princ, "host/", len);
+			}
+			strlcpy(princ + 5, hostname, len - 5);
+
+			if (sectype == MS_KRB5)
+				oid = OID_KERBEROS5_OLD;
+			else
+				oid = OID_KERBEROS5;
+
+			rc = handle_krb5_mech(oid, princ, &secblob, &sess_key);
+			SAFE_FREE(princ);
+			break;
+		}
+	default:{
+			syslog(LOG_WARNING, "sectype: %d is not implemented",
+			       sectype);
+			rc = 1;
+			break;
+		}
+	}
+
+	if (rc) {
+		goto out;
+	}
+
+	/* pack SecurityBLob and SessionKey into downcall packet */
+	datalen =
+	    sizeof(struct cifs_spnego_msg) + secblob.length + sess_key.length;
+	keydata = (struct cifs_spnego_msg*)SMB_XMALLOC_ARRAY(char, datalen);
+	if (!keydata) {
+		rc = 1;
+		goto out;
+	}
+	keydata->version = kernel_upcall_version;
+	keydata->flags = 0;
+	keydata->sesskey_len = sess_key.length;
+	keydata->secblob_len = secblob.length;
+	memcpy(&(keydata->data), sess_key.data, sess_key.length);
+	memcpy(&(keydata->data) + keydata->sesskey_len,
+	       secblob.data, secblob.length);
+
+	/* setup key */
+	rc = keyctl_instantiate(key, keydata, datalen, 0);
+	if (rc == -1) {
+		syslog(LOG_WARNING, "keyctl_instantiate: %s", strerror(errno));
+		goto out;
+	}
+
+	/* BB: maybe we need use timeout for key: for example no more then
+	 * ticket lifietime? */
+	/* keyctl_set_timeout( key, 60); */
+out:
+	/*
+	 * on error, negatively instantiate the key ourselves so that we can
+	 * make sure the kernel doesn't hang it off of a searchable keyring
+	 * and interfere with the next attempt to instantiate the key.
+	 */
+	if (rc != 0  && key == 0)
+		keyctl_negate(key, 1, KEY_REQKEY_DEFL_DEFAULT);
+	data_blob_free(&secblob);
+	data_blob_free(&sess_key);
+	SAFE_FREE(hostname);
+	SAFE_FREE(keydata);
+	return rc;
+}
--- samba-3.0.28a/docs/manpages/cifs.upcall.8	
+++ samba-3.0.28a/docs/manpages/cifs.upcall.8	
@@ -0,0 +1,82 @@ 
+.\"     Title: cifs.upcall
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/>
+.\"      Date: 09/18/2008
+.\"    Manual: System Administration tools
+.\"    Source: Samba 3.2
+.\"
+.TH "CIFS\.UPCALL" "8" "09/18/2008" "Samba 3\.2" "System Administration tools"
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.SH "NAME"
+cifs.upcall - Userspace upcall helper for Common Internet File System (CIFS)
+.SH "SYNOPSIS"
+.HP 1
+cifs\.upcall [\-c] [\-v] {keyid}
+.SH "DESCRIPTION"
+.PP
+This tool is part of the
+\fBsamba\fR(7)
+suite\.
+.PP
+cifs\.upcall is a userspace helper program for the linux CIFS client filesystem\. There are a number of activities that the kernel cannot easily do itself\. This program is a callout program that does these things for the kernel and then returns the result\.
+.PP
+cifs\.upcall is generally intended to be run when the kernel calls request\-key(8)
+for a particular key type\. While it can be run directly from the command\-line, it\'s not generally intended to be run that way\.
+.SH "OPTIONS"
+.PP
+\-c
+.RS 4
+When handling a kerberos upcall, use a service principal that starts with "cifs/"\. The default is to use the "host/" service principal\.
+.RE
+.PP
+\-v
+.RS 4
+Print version number and exit\.
+.RE
+.SH "CONFIGURATION FOR KEYCTL"
+.PP
+cifs\.upcall is designed to be called from the kernel via the request\-key callout program\. This requires that request\-key be told where and how to call this program\. The current cifs\.upcall program handles two different key types:
+.PP
+cifs\.spnego
+.RS 4
+This keytype is for retrieving kerberos session keys
+.RE
+.PP
+dns_resolver
+.RS 4
+This key type is for resolving hostnames into IP addresses
+.RE
+.PP
+To make this program useful for CIFS, you\'ll need to set up entries for them in request\-key\.conf(5)\. Here\'s an example of an entry for each key type:
+.sp
+.RS 4
+.nf
+#OPERATION  TYPE           D C PROGRAM ARG1 ARG2\.\.\.
+#=========  =============  = = ==========================================
+create	    cifs\.spnego    * * /usr/local/sbin/cifs\.upcall \-c %k
+create      dns_resolver   * * /usr/local/sbin/cifs\.upcall %k
+.fi
+.RE
+.PP
+See
+\fBrequest-key.conf5\fR()
+for more info on each field\.
+.SH "SEE ALSO"
+.PP
+
+\fBrequest-key.conf\fR(5),
+\fBmount.cifs\fR(8)
+.SH "AUTHOR"
+.PP
+Igor Mammedov wrote the cifs\.upcall program\.
+.PP
+Jeff Layton authored this manpage\.
+.PP
+The maintainer of the Linux CIFS VFS is Steve French\.
+.PP
+The
+Linux CIFS Mailing list
+is the preferred place to ask questions regarding these programs\.