gkdi.idl: Add ‘additional_info’ field to KeyEnvelope structure

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/librpc/idl/gkdi.idl b/librpc/idl/gkdi.idl
index db45df2613b654a37687a2001b8be10a86cc43a3..29769919d466b2ebc4cccd2951823c1a25571d03 100644 (file)
--- a/librpc/idl/gkdi.idl
+++ b/librpc/idl/gkdi.idl
@@ -42,9 +42,15 @@ interface gkdi
                [range(0, 31)] uint32 l1_index;
                [range(0, 31)] uint32 l2_index;
                GUID root_key_id;
-               uint32 unknown; /* This might be the length of a key that is rarely or never present. */
+               uint32 additional_info_len;
                [value(2 * ndr_charset_length(domain_name, CH_UTF16))] uint32 domain_name_len;
                [value(2 * ndr_charset_length(forest_name, CH_UTF16))] uint32 forest_name_len;
+               /*
+                * https://lists.samba.org/archive/cifs-protocol/2023-December/004170.html
+                * This is the public key blob of an ephemeral public key used in secret
+                * agreement, or a random number used in deriving a symmetric key.
+                */
+               [flag(NDR_SECRET)] uint8 additional_info[additional_info_len];
                nstring domain_name; /* DNS name of the domain which generated the key. */
                nstring forest_name; /* DNS name of the forest which generated the key. */
        } KeyEnvelope;

diff --git a/python/samba/tests/ndr/gkdi.py b/python/samba/tests/ndr/gkdi.py
index 58e3ce8c3767727525be3125e0822d479ecb1dab..a02a99fb4928726027dc997e0e075a11fcbb7d82 100755 (executable)
--- a/python/samba/tests/ndr/gkdi.py
+++ b/python/samba/tests/ndr/gkdi.py
@@ -62,7 +62,8 @@ class KeyEnvelopeTests(samba.tests.TestCase):
 
         self.assertEqual(self.root_key_id, envelope.root_key_id)
 
-        self.assertEqual(0, envelope.unknown)
+        self.assertEqual(0, envelope.additional_info_len)
+        self.assertFalse(envelope.additional_info)
 
         self.assertEqual(self.domain_name, envelope.domain_name)
         self.assertEqual(utf16_encoded_len(self.domain_name), envelope.domain_name_len)
@@ -84,7 +85,8 @@ class KeyEnvelopeTests(samba.tests.TestCase):
 
         envelope.root_key_id = self.root_key_id
 
-        envelope.unknown = 0
+        envelope.additional_info = []
+        envelope.additional_info_len = 0
 
         envelope.domain_name = self.domain_name
         envelope.forest_name = self.forest_name