s3-gse Use Heimdal gsskrb5_extract_authz_data_from_sec_context when available

This seems to work against Heimdal, but the existing code did not.

This requires moving the PAC unwrap into gse_get_authz_data(), so it
is renamed to gse_get_pac_data().

Andrew Bartlett

diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
index 87c945095a29139b62142828e804711a9bb5316b..6277338c0844e88f1753ba9679b631e4250a8c37 100644 (file)
--- a/source3/librpc/crypto/gse.c
+++ b/source3/librpc/crypto/gse.c
@@ -656,16 +656,37 @@ NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
        return NT_STATUS_OK;
 }
 
-NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
-                           TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
+NTSTATUS gse_get_pac_data(struct gse_context *gse_ctx,
+                         TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
 {
        OM_uint32 gss_min, gss_maj;
        gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
+       DATA_BLOB auth_data;
 
        if (!gse_ctx->authenticated) {
                return NT_STATUS_ACCESS_DENIED;
        }
-
+#ifdef HAVE_GSSKRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT
+       {
+               gss_buffer_desc pac_buffer;
+               gss_maj = gsskrb5_extract_authz_data_from_sec_context(&gss_min, 
+                                                                     gse_ctx->gss_ctx,
+                                                                     KRB5_AUTHDATA_WIN2K_PAC,
+                                                                     &pac_buffer);
+       
+       
+               if (gss_maj == 0) {
+                       *pac = data_blob_talloc(mem_ctx, pac_buffer.value, pac_buffer.length);
+                       gss_release_buffer(&gss_min, &pac_buffer);
+                       
+               } else {
+                       DEBUG(0, ("gsskrb5_extract_authz_data_from_sec_context failed [%s]\n",
+                                 gse_errstr(talloc_tos(), gss_maj, gss_min)));
+                       
+                       return NT_STATUS_NOT_FOUND;
+               }
+       }
+#else
        gss_maj = gss_inquire_sec_context_by_oid(
                                &gss_min, gse_ctx->gss_ctx,
                                &gse_authz_data_oid, &set);
@@ -681,14 +702,18 @@ NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
                return NT_STATUS_INTERNAL_ERROR;
        }
 
-       /* for now we just hope it is the first value */
-       *pac = data_blob_talloc(mem_ctx,
-                               set->elements[0].value,
-                               set->elements[0].length);
-
-       gss_maj = gss_release_buffer_set(&gss_min, &set);
+       auth_data = data_blob_const(set->elements[0].value,
+                                   set->elements[0].length);
+       
+       if (!unwrap_pac(mem_ctx, &auth_data, pac)) {
+               DEBUG(1, ("Failed to unwrap PAC\n"));
+               gss_release_buffer_set(&gss_min, &set);
+               return NT_STATUS_ACCESS_DENIED;
+       }
 
-       return NT_STATUS_OK;
+       gss_release_buffer_set(&gss_min, &set);
+#endif
+       return NT_STATUS_OK;    
 }
 
 NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime)

diff --git a/source3/librpc/crypto/gse.h b/source3/librpc/crypto/gse.h
index fbcf5b6e10d0846bb83a029a188a1ae7cf3e0595..27b00d390401e150796a481f15eb2e492adf273f 100644 (file)
--- a/source3/librpc/crypto/gse.h
+++ b/source3/librpc/crypto/gse.h
@@ -54,8 +54,8 @@ DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
                                struct gse_context *gse_ctx);
 NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
                             TALLOC_CTX *mem_ctx, char **client_name);
-NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
-                           TALLOC_CTX *mem_ctx, DATA_BLOB *pac);
+NTSTATUS gse_get_pac_data(struct gse_context *gse_ctx,
+                         TALLOC_CTX *mem_ctx, DATA_BLOB *pac);
 NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime);
 
 size_t gse_get_signature_length(struct gse_context *gse_ctx,

diff --git a/source3/rpc_server/dcesrv_gssapi.c b/source3/rpc_server/dcesrv_gssapi.c
index ec024596332316ef14ef8d45e2cbc0c5aaeb90c3..c289adcd8792945d1ffbf8b45bc03ca6d1678004 100644 (file)
--- a/source3/rpc_server/dcesrv_gssapi.c
+++ b/source3/rpc_server/dcesrv_gssapi.c
@@ -105,7 +105,6 @@ NTSTATUS gssapi_server_get_user_info(struct gse_context *gse_ctx,
                                     struct auth_serversupplied_info **server_info)
 {
        TALLOC_CTX *tmp_ctx;
-       DATA_BLOB auth_data;
        time_t tgs_authtime;
        NTTIME tgs_authtime_nttime;
        DATA_BLOB pac;
@@ -129,7 +128,7 @@ NTSTATUS gssapi_server_get_user_info(struct gse_context *gse_ctx,
                return NT_STATUS_NO_MEMORY;
        }
 
-       status = gse_get_authz_data(gse_ctx, tmp_ctx, &auth_data);
+       status = gse_get_pac_data(gse_ctx, tmp_ctx, &pac);
        if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
                /* TODO: Fetch user by principal name ? */
                status = NT_STATUS_ACCESS_DENIED;
@@ -139,13 +138,6 @@ NTSTATUS gssapi_server_get_user_info(struct gse_context *gse_ctx,
                goto done;
        }
 
-       bret = unwrap_pac(tmp_ctx, &auth_data, &pac);
-       if (!bret) {
-               DEBUG(1, ("Failed to unwrap PAC\n"));
-               status = NT_STATUS_ACCESS_DENIED;
-               goto done;
-       }
-
        status = gse_get_client_name(gse_ctx, tmp_ctx, &princ_name);
        if (!NT_STATUS_IS_OK(status)) {
                goto done;