r1790: a few updates on krb5 PAC...

metze
(This used to be commit 5a3a10c004ee2c94c42f08d52b36c75b413bdb79)

diff --git a/source4/libcli/auth/gensec_krb5.c b/source4/libcli/auth/gensec_krb5.c
index 18053b5ded7072948c26362a99d10a8002d7d4fa..0effed219861a52402277abf1e1fd3e1ec60db6c 100644 (file)
--- a/source4/libcli/auth/gensec_krb5.c
+++ b/source4/libcli/auth/gensec_krb5.c
@@ -50,7 +50,7 @@ struct gensec_krb5_state {
 static NTSTATUS gensec_krb5_pac_checksum(DATA_BLOB pac_data,
                                            struct PAC_SIGNATURE_DATA *sig,
                                            struct gensec_krb5_state *gensec_krb5_state,
-                                           uint32 cksum_type)
+                                           uint32 keyusage)
 {
        krb5_error_code ret;
        krb5_crypto crypto;
@@ -63,20 +63,27 @@ static NTSTATUS gensec_krb5_pac_checksum(DATA_BLOB pac_data,
 
        ret = krb5_crypto_init(gensec_krb5_state->krb5_context,
                                &gensec_krb5_state->krb5_keyblock,
-                               cksum_type,
+                               0,
                                &crypto);
        if (ret) {
                DEBUG(0,("krb5_crypto_init() failed\n"));
                return NT_STATUS_FOOBAR;
        }
-
+{
+int i;
+for (i=0; i < 40; i++) {
+       keyusage = i;
        ret = krb5_verify_checksum(gensec_krb5_state->krb5_context,
                                        crypto,
-                                       cksum_type,
+                                       keyusage,
                                        pac_data.data,
                                        pac_data.length,
                                        &cksum);
-
+       if (!ret) {
+               DEBUG(0,("PAC Verified: keyusage: %d\n", keyusage));
+               break;
+       }
+}}
        krb5_crypto_destroy(gensec_krb5_state->krb5_context, crypto);
 
        if (ret) {
@@ -89,7 +96,7 @@ static NTSTATUS gensec_krb5_pac_checksum(DATA_BLOB pac_data,
        return NT_STATUS_OK;
 }
 
-NTSTATUS gensec_krb5_decode_pac(TALLOC_CTX *mem_ctx,
+static NTSTATUS gensec_krb5_decode_pac(TALLOC_CTX *mem_ctx,
                                struct PAC_LOGON_INFO *logon_info_out,
                                DATA_BLOB blob,
                                struct gensec_krb5_state *gensec_krb5_state)
@@ -101,7 +108,7 @@ NTSTATUS gensec_krb5_decode_pac(TALLOC_CTX *mem_ctx,
        struct PAC_SIGNATURE_DATA *kdc_sig_ptr;
        struct PAC_LOGON_INFO *logon_info = NULL;
        struct PAC_DATA pac_data;
-       DATA_BLOB tmp_blob;
+       DATA_BLOB tmp_blob = data_blob(NULL, 0);
        int i;
 
        status = ndr_pull_struct_blob(&blob, mem_ctx, &pac_data,
@@ -110,7 +117,6 @@ NTSTATUS gensec_krb5_decode_pac(TALLOC_CTX *mem_ctx,
                DEBUG(0,("can't parse the PAC\n"));
                return status;
        }
-
        NDR_PRINT_DEBUG(PAC_DATA, &pac_data);
 
        if (pac_data.num_buffers < 3) {
@@ -164,13 +170,20 @@ NTSTATUS gensec_krb5_decode_pac(TALLOC_CTX *mem_ctx,
        }
 
        /* clear the kdc_key */
-       memset((void *)kdc_sig_ptr , '\0', sizeof(*kdc_sig_ptr));
+/*     memset((void *)kdc_sig_ptr , '\0', sizeof(*kdc_sig_ptr));*/
 
        status = ndr_push_struct_blob(&tmp_blob, mem_ctx, &pac_data,
                                              (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
+       status = ndr_pull_struct_blob(&tmp_blob, mem_ctx, &pac_data,
+                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0,("can't parse the PAC\n"));
+               return status;
+       }
+       /*NDR_PRINT_DEBUG(PAC_DATA, &pac_data);*/
 
        /* verify by kdc_key */
        status = gensec_krb5_pac_checksum(tmp_blob, &kdc_sig, gensec_krb5_state, 0);
@@ -180,13 +193,20 @@ NTSTATUS gensec_krb5_decode_pac(TALLOC_CTX *mem_ctx,
        }
 
        /* clear the service_key */
-       memset((void *)srv_sig_ptr , '\0', sizeof(*srv_sig_ptr));
+/*     memset((void *)srv_sig_ptr , '\0', sizeof(*srv_sig_ptr));*/
 
        status = ndr_push_struct_blob(&tmp_blob, mem_ctx, &pac_data,
                                              (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
+       status = ndr_pull_struct_blob(&tmp_blob, mem_ctx, &pac_data,
+                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0,("can't parse the PAC\n"));
+               return status;
+       }
+       NDR_PRINT_DEBUG(PAC_DATA, &pac_data);
 
        /* verify by servie_key */
        status = gensec_krb5_pac_checksum(tmp_blob, &srv_sig, gensec_krb5_state, 0);

diff --git a/source4/librpc/idl/krb5pac.idl b/source4/librpc/idl/krb5pac.idl
index 6c2bad4590e1721a3e0c46e4609d5befd3ecda22..3ebac2b1f296daff0596216f920d95ee15371928 100644 (file)
--- a/source4/librpc/idl/krb5pac.idl
+++ b/source4/librpc/idl/krb5pac.idl
@@ -19,7 +19,7 @@ interface krb5pac
 
        typedef [flag(NDR_PAHEX)] struct {
                uint32 type;
-               uint8 signature[16];
+               uint8 signature[20];
        } PAC_SIGNATURE_DATA;
 
        typedef struct {
@@ -33,9 +33,9 @@ interface krb5pac
        } EXTRA_SIDS;
 
        typedef struct {
-               uint16 size;
-               uint16 length;
-               unistr_noterm *string;
+               [value(strlen_m(r->string)*2)]  uint16 size;
+               [value(r->size)]                uint16 length;
+               unistr_noterm                   *string;
        } pac_String;
 
        /* This is awfully similar to a samr_user_info_23, but not identical.