sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-27 03:21:53 +03:00
Code
89f8c35ac4
samba-mirror/librpc/idl/krb5pac.idl

135 lines
3.5 KiB
Plaintext
Raw Normal View History

r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
/*
krb5 PAC
*/
#include "idl_types.h"
r19588: Use include and import statements rather than depends() and helper(). (This used to be commit 347ae9628202ca4de4318ef8156999239aad9192)
2006-11-07 01:54:49 +03:00
import "security.idl", "netlogon.idl", "samr.idl";
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
[
r15222: Use more standard UUIDs. Should help AIX build. Andrew Bartlett (This used to be commit cde98e9ad1990ae9da89d6449b3f0e15f00f4e54)
2006-04-25 00:15:35 +04:00
uuid("12345778-1234-abcd-0000-00000000"),
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
version(0.0),
r3810: create a LIB_SECURITY subsystem - move dom_sid, security_descriptor, security_* funtions to one place and rename some of them metze (This used to be commit b620bdd672cfdf0e009492e648b0709e6b6d8596)
2004-11-17 17:35:29 +03:00
pointer_default(unique),
r19588: Use include and import statements rather than depends() and helper(). (This used to be commit 347ae9628202ca4de4318ef8156999239aad9192)
2006-11-07 01:54:49 +03:00
helpstring("Active Directory KRB5 PAC")
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
]
interface krb5pac
{
typedef struct {
r1558: the unknown_time is the same as the logon_time in the PAC_LOGON_INFO the account_name is a 'nstring' metze (This used to be commit bb906e5e9e566e7ed931436956ba8323503875f9)
2004-07-21 13:57:39 +04:00
NTTIME logon_time;
krb5pac.idl: use charset() instead of string type with flags metze (This used to be commit 30657ae0ebdb85ae995a3dfe3ce123851fd92e0f)
2008-02-13 19:31:17 +03:00
[value(2*strlen_m(account_name))] uint16 size;
[charset(UTF16)] uint8 account_name[size];
r7993: Further work on the Krb5 PAC. We now generate the PAC, and can verifiy both our own PAC and the PAC from Win2k3. This commit adds the PAC generation code, spits out the code to get the information we need from the NETLOGON server back into a auth/ helper function, and adds a number of glue functions. In the process of building the PAC generation code, some hints in the Microsoft PAC specification shed light on other parts of the code, and the updates to samr.idl and netlogon.idl come from those hints. Also in this commit: The Heimdal build package has been split up, so as to only link the KDC with smbd, not the client utils. To enable the PAC to be veified with gensec_krb5 (which isn't quite dead yet), the keyblock has been passed back to the calling layer. Andrew Bartlett (This used to be commit e2015671c2f7501f832ff402873ffe6e53b89466)
2005-06-29 17:55:09 +04:00
} PAC_LOGON_NAME;
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
r10181: Fix the build (This used to be commit 231d01a3e79b26884409d24d8e25fc4ab8567d89)
2005-09-13 01:10:40 +04:00
typedef [public,flag(NDR_PAHEX)] struct {
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
uint32 type;
r10145: Allow a variable length signature, so we can support signing with other than arcfour-hmac-md5. Currently we still fail to verify other signatures however. Andrew Bartlett (This used to be commit 2e5884fc2472c6bcc7e6e083c28a4da6b2f72af1)
2005-09-10 14:39:45 +04:00
[flag(NDR_REMAINING)] DATA_BLOB signature;
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
} PAC_SIGNATURE_DATA;
Fix "ndr_size_PAC_LOGON_INFO defined but not used" build warning This patch removes the gensize option from krb5pac.idl because it generates an unused function that has been causing warnings during the s3 build. I re-ran 'make samba3-idl' to update the generated files for s3. For s4 I ran a full build with no problems.
2008-10-24 00:41:44 +04:00
typedef struct {
r4338: reuse netlogon structs in the krb5 PAC that simplifies the code a lot... also add a note: we should fail the krb5 auth if there's no PAC present (when heimdal is ready for that:-) metze (This used to be commit 532641a7003d23b034a253d166482f18c2de6191)
2004-12-23 05:23:42 +03:00
netr_SamInfo3 info3;
r1679: fix add the extrasids and resource group array in the EXTRA_SIDS idl isn't verified to be correct yet metze (This used to be commit 43fd611593af030a3d86d2640be6b1de959939c7)
2004-08-10 05:03:44 +04:00
dom_sid2 *res_group_dom_sid;
r7993: Further work on the Krb5 PAC. We now generate the PAC, and can verifiy both our own PAC and the PAC from Win2k3. This commit adds the PAC generation code, spits out the code to get the information we need from the NETLOGON server back into a auth/ helper function, and adds a number of glue functions. In the process of building the PAC generation code, some hints in the Microsoft PAC specification shed light on other parts of the code, and the updates to samr.idl and netlogon.idl come from those hints. Also in this commit: The Heimdal build package has been split up, so as to only link the KDC with smbd, not the client utils. To enable the PAC to be veified with gensec_krb5 (which isn't quite dead yet), the keyblock has been passed back to the calling layer. Andrew Bartlett (This used to be commit e2015671c2f7501f832ff402873ffe6e53b89466)
2005-06-29 17:55:09 +04:00
samr_RidWithAttributeArray res_groups;
idl: finally share krb5_pac.idl. Guenther
2008-10-20 13:11:19 +04:00
} PAC_LOGON_INFO;
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
Add new Windows 2008 Kerberos PAC Type 12 (apparently again undocumented). We need at least to parse this in order to correctly support kerberized session setup from w2k8 as well as local pam_winbind logons using kerberos. Guenther (cherry picked from commit 4ba62d49d740c43cf17ceef1534cf1c8a7e4a130) (This used to be commit ef0971206cda598e6bfad2ff06a3d2e9e8131682)
2008-03-04 14:26:05 +03:00
typedef struct {
[value(2*strlen_m(upn_name))] uint16 upn_size;
Slowly making progress on PAC_UNKNOWN_12. unknown1 and unknown2 are offset headers for the strings. Guenther (cherry picked from commit 7af70e75b9abf92921f33ec4207ad486ee2493d6) (This used to be commit ad19da7f83761948f379921560da34bb6a01e625)
2008-03-06 16:15:07 +03:00
uint16 upn_offset;
Add new Windows 2008 Kerberos PAC Type 12 (apparently again undocumented). We need at least to parse this in order to correctly support kerberized session setup from w2k8 as well as local pam_winbind logons using kerberos. Guenther (cherry picked from commit 4ba62d49d740c43cf17ceef1534cf1c8a7e4a130) (This used to be commit ef0971206cda598e6bfad2ff06a3d2e9e8131682)
2008-03-04 14:26:05 +03:00
[value(2*strlen_m(domain_name))] uint16 domain_size;
Slowly making progress on PAC_UNKNOWN_12. unknown1 and unknown2 are offset headers for the strings. Guenther (cherry picked from commit 7af70e75b9abf92921f33ec4207ad486ee2493d6) (This used to be commit ad19da7f83761948f379921560da34bb6a01e625)
2008-03-06 16:15:07 +03:00
uint16 domain_offset;
Add new Windows 2008 Kerberos PAC Type 12 (apparently again undocumented). We need at least to parse this in order to correctly support kerberized session setup from w2k8 as well as local pam_winbind logons using kerberos. Guenther (cherry picked from commit 4ba62d49d740c43cf17ceef1534cf1c8a7e4a130) (This used to be commit ef0971206cda598e6bfad2ff06a3d2e9e8131682)
2008-03-04 14:26:05 +03:00
uint16 unknown3; /* 0x01 */
uint16 unknown4;
uint32 unknown5;
[charset(UTF16)] uint8 upn_name[upn_size+2];
[charset(UTF16)] uint8 domain_name[domain_size+2];
Slowly making progress on PAC_UNKNOWN_12. unknown1 and unknown2 are offset headers for the strings. Guenther (cherry picked from commit 7af70e75b9abf92921f33ec4207ad486ee2493d6) (This used to be commit ad19da7f83761948f379921560da34bb6a01e625)
2008-03-06 16:15:07 +03:00
uint32 unknown6; /* padding */
Add new Windows 2008 Kerberos PAC Type 12 (apparently again undocumented). We need at least to parse this in order to correctly support kerberized session setup from w2k8 as well as local pam_winbind logons using kerberos. Guenther (cherry picked from commit 4ba62d49d740c43cf17ceef1534cf1c8a7e4a130) (This used to be commit ef0971206cda598e6bfad2ff06a3d2e9e8131682)
2008-03-04 14:26:05 +03:00
} PAC_UNKNOWN_12;
r20639: Commit part 1 of 2. This patch updates our build system and glue to support a new snapshot of lorikeet-heimdal. We now procude a [SUBSYTEM] in the ans1_deps.pl script, and can depend on that in the heimdal_build/config.mk. This is much easier than listing every generated .o file individually. This required some small changes to the build system, due to the way the parent directory was handled for the output of scripts. I've also cleaned up et_deps.pl to handle cleaning up it's generated files on clean. The PAC glue in Heimdal has changed significantly: we no longer have a custom hack in the KDC, instead we have the windc plugin interface. As such, pac-glue.c is much smaller. In the future, when I'm confident of the new code, we will also be able to 'downsize' auth/kerberos/kerberos_pac.c. (I'll include the updated copy of heimdal in the next chekin, to make it clearer what's changed in Samba4 itself). Andrew Bartlett (This used to be commit 75fddbbc0811010a28ca5bb597b573b3f10ef6d6)
2007-01-10 04:51:35 +03:00
typedef [public] struct {
r8156: I found out that the unknown[2] field of the unknown[4] array is a length too, it's always 16 bytes smaller than the size in the PAC_BUFFER we now dump the blob's on LOCAL-PAC with -d 10 metze (This used to be commit 4ef721ce53539ac56ca8ac4d601f512149ca7283)
2005-07-05 10:13:12 +04:00
PAC_LOGON_INFO *info;
idl: finally share krb5_pac.idl. Guenther
2008-10-20 13:11:19 +04:00
} PAC_LOGON_INFO_CTR;
r8148: - make the PAC generation code a bit more readable and add some outof memory checks - move to handmodified pull/push code for PAC_BUFFER to get the _ndr_size field and the subcontext size right - after looking closely to the sample w2k3 PAC in our torture test (and some more in my archive) I found out that the first uint32 before the netr_SamInfo3 was also a pointer, (and we passed a NULL pointer there before, so I think that was the reason why the windows clients doesn't want our PAC) w2k3 uses this for unique pointers: ptr = ndr->ptr_count * 4; ptr |= 0x00020000; ndr->ptr_count; - do one more pull/push round with the sample PAC metze (This used to be commit 0eee17941595e9842a264bf89ac73ca66cea7ed5)
2005-07-04 19:42:08 +04:00
typedef [public,v1_enum] enum {
PAC_TYPE_LOGON_INFO = 1,
PAC_TYPE_SRV_CHECKSUM = 6,
PAC_TYPE_KDC_CHECKSUM = 7,
r21805: Add PAC_TYPE_CONSTRAINED_DELEGATION to the PAC_TYPE enum. (This used to be commit 6fb3b4be10d204bec61a1fddd1c50c1c24d52ebf)
2007-03-13 02:39:00 +03:00
PAC_TYPE_LOGON_NAME = 10,
Add new Windows 2008 Kerberos PAC Type 12 (apparently again undocumented). We need at least to parse this in order to correctly support kerberized session setup from w2k8 as well as local pam_winbind logons using kerberos. Guenther (cherry picked from commit 4ba62d49d740c43cf17ceef1534cf1c8a7e4a130) (This used to be commit ef0971206cda598e6bfad2ff06a3d2e9e8131682)
2008-03-04 14:26:05 +03:00
PAC_TYPE_CONSTRAINED_DELEGATION = 11,
PAC_TYPE_UNKNOWN_12 = 12
r8148: - make the PAC generation code a bit more readable and add some outof memory checks - move to handmodified pull/push code for PAC_BUFFER to get the _ndr_size field and the subcontext size right - after looking closely to the sample w2k3 PAC in our torture test (and some more in my archive) I found out that the first uint32 before the netr_SamInfo3 was also a pointer, (and we passed a NULL pointer there before, so I think that was the reason why the windows clients doesn't want our PAC) w2k3 uses this for unique pointers: ptr = ndr->ptr_count * 4; ptr |= 0x00020000; ndr->ptr_count; - do one more pull/push round with the sample PAC metze (This used to be commit 0eee17941595e9842a264bf89ac73ca66cea7ed5)
2005-07-04 19:42:08 +04:00
} PAC_TYPE;
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
Ignore Kerberos PAC type 12. Until we worked out the PAC_TYPE_UNKNOWN_12 format (or received documentation) ignore it so that the PAC parsing can proceed. Guenther (cherry picked from commit 3630ec26c99fdea46c47117d026f9bffb2c4590a) (This used to be commit 0c1ccbc183c1d2967da2d9a17033f3b116ff7387)
2008-03-06 18:41:24 +03:00
typedef struct {
[flag(NDR_REMAINING)] DATA_BLOB remaining;
} DATA_BLOB_REM;
r8148: - make the PAC generation code a bit more readable and add some outof memory checks - move to handmodified pull/push code for PAC_BUFFER to get the _ndr_size field and the subcontext size right - after looking closely to the sample w2k3 PAC in our torture test (and some more in my archive) I found out that the first uint32 before the netr_SamInfo3 was also a pointer, (and we passed a NULL pointer there before, so I think that was the reason why the windows clients doesn't want our PAC) w2k3 uses this for unique pointers: ptr = ndr->ptr_count * 4; ptr |= 0x00020000; ndr->ptr_count; - do one more pull/push round with the sample PAC metze (This used to be commit 0eee17941595e9842a264bf89ac73ca66cea7ed5)
2005-07-04 19:42:08 +04:00
typedef [public,nodiscriminant,gensize] union {
krb5pac.idl: make use of subcontext(0xFFFFFC01) to handle the type Serialization header Now we should be able to handle bigendian PAC_LOGON_INFO buffers. metze (This used to be commit adbff0b0f92aa0742a8293071776b388879cbd8e)
2008-08-19 10:51:45 +04:00
[case(PAC_TYPE_LOGON_INFO)][subcontext(0xFFFFFC01)] PAC_LOGON_INFO_CTR logon_info;
r1770: here's the krb5 server code, there're some cleanups needed and we need to verify the PAC correctly and create the auth_session_info correctly... metze (This used to be commit d8fe497097ee49611bb05c4a2fed36912d8e16b4)
2004-08-12 11:37:49 +04:00
[case(PAC_TYPE_SRV_CHECKSUM)] PAC_SIGNATURE_DATA srv_cksum;
[case(PAC_TYPE_KDC_CHECKSUM)] PAC_SIGNATURE_DATA kdc_cksum;
r7993: Further work on the Krb5 PAC. We now generate the PAC, and can verifiy both our own PAC and the PAC from Win2k3. This commit adds the PAC generation code, spits out the code to get the information we need from the NETLOGON server back into a auth/ helper function, and adds a number of glue functions. In the process of building the PAC generation code, some hints in the Microsoft PAC specification shed light on other parts of the code, and the updates to samr.idl and netlogon.idl come from those hints. Also in this commit: The Heimdal build package has been split up, so as to only link the KDC with smbd, not the client utils. To enable the PAC to be veified with gensec_krb5 (which isn't quite dead yet), the keyblock has been passed back to the calling layer. Andrew Bartlett (This used to be commit e2015671c2f7501f832ff402873ffe6e53b89466)
2005-06-29 17:55:09 +04:00
[case(PAC_TYPE_LOGON_NAME)] PAC_LOGON_NAME logon_name;
cope with arbitrary unknown pac buffer types, so when MS adds a new one we don't break our server (This used to be commit 5e08b285319e35afd3a9a6e6f5f59145350f2d80)
2008-08-14 09:27:48 +04:00
/* when new PAC info types are added they are supposed to be done
in such a way that they are backwards compatible with existing
servers. This makes it safe to just use a [default] for
unknown types, which lets us ignore the data */
[default] [subcontext(0)] DATA_BLOB_REM unknown;
Ignore Kerberos PAC type 12. Until we worked out the PAC_TYPE_UNKNOWN_12 format (or received documentation) ignore it so that the PAC parsing can proceed. Guenther (cherry picked from commit 3630ec26c99fdea46c47117d026f9bffb2c4590a) (This used to be commit 0c1ccbc183c1d2967da2d9a17033f3b116ff7387)
2008-03-06 18:41:24 +03:00
/* [case(PAC_TYPE_UNKNOWN_12)] PAC_UNKNOWN_12 unknown; */
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
} PAC_INFO;
r8148: - make the PAC generation code a bit more readable and add some outof memory checks - move to handmodified pull/push code for PAC_BUFFER to get the _ndr_size field and the subcontext size right - after looking closely to the sample w2k3 PAC in our torture test (and some more in my archive) I found out that the first uint32 before the netr_SamInfo3 was also a pointer, (and we passed a NULL pointer there before, so I think that was the reason why the windows clients doesn't want our PAC) w2k3 uses this for unique pointers: ptr = ndr->ptr_count * 4; ptr |= 0x00020000; ndr->ptr_count; - do one more pull/push round with the sample PAC metze (This used to be commit 0eee17941595e9842a264bf89ac73ca66cea7ed5)
2005-07-04 19:42:08 +04:00
typedef [public,nopush,nopull,noprint] struct {
PAC_TYPE type;
[value(_ndr_size_PAC_INFO(info, type, 0))] uint32 _ndr_size;
[relative,switch_is(type),subcontext(0),subcontext_size(_subcontext_size_PAC_INFO(r, ndr->flags)),flag(NDR_ALIGN8)] PAC_INFO *info;
[value(0)] uint32 _pad; /* Top half of a 64 bit pointer? */
r1770: here's the krb5 server code, there're some cleanups needed and we need to verify the PAC correctly and create the auth_session_info correctly... metze (This used to be commit d8fe497097ee49611bb05c4a2fed36912d8e16b4)
2004-08-12 11:37:49 +04:00
} PAC_BUFFER;
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
r8110: More PAC work. I still can't get WinXP to accept the PAC, but we are much closer. This changes PIDL to allow a subcontext to have a pad8 flag, saying to pad behind to an 8 byte boundary. This is the only way I can explain the 4 trainling zeros in the signature struct. Far more importantly, the PAC code is now under self-test, both in creating/parsing our own PAC, but also a PAC from my win2k3 server. This required changing auth_anonymous, because I wanted to reuse the anonymous 'server_info' generation code. I'm still having trouble with PIDL, particulary as surrounds value(), but I'll follow up on the list. Andrew Bartlett (This used to be commit 50a54bf4e9bf04d2a8e0aebb3482a2ff655c8bbb)
2005-07-04 06:36:16 +04:00
typedef [public] struct {
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
uint32 num_buffers;
uint32 version;
r1770: here's the krb5 server code, there're some cleanups needed and we need to verify the PAC correctly and create the auth_session_info correctly... metze (This used to be commit d8fe497097ee49611bb05c4a2fed36912d8e16b4)
2004-08-12 11:37:49 +04:00
PAC_BUFFER buffers[num_buffers];
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
} PAC_DATA;
r10171: This seems to work for encoding/decoding a PAC at the buffers only level (required for signature verification). Andrew Bartlett (This used to be commit 76c224f28885759daae45e02a7637f2451dc84d3)
2005-09-12 17:16:56 +04:00
typedef [public] struct {
PAC_TYPE type;
uint32 ndr_size;
r20566: Prepending with r-> is no longer necessary. (This used to be commit 1df96af3103795f609165e7a7344e1bf6046be79)
2007-01-05 23:51:19 +03:00
[relative,subcontext(0),subcontext_size(NDR_ROUND(ndr_size,8)),flag(NDR_ALIGN8)] DATA_BLOB_REM *info;
r10171: This seems to work for encoding/decoding a PAC at the buffers only level (required for signature verification). Andrew Bartlett (This used to be commit 76c224f28885759daae45e02a7637f2451dc84d3)
2005-09-12 17:16:56 +04:00
[value(0)] uint32 _pad; /* Top half of a 64 bit pointer? */
} PAC_BUFFER_RAW;
typedef [public] struct {
uint32 num_buffers;
uint32 version;
PAC_BUFFER_RAW buffers[num_buffers];
} PAC_DATA_RAW;
It turns out that the Netlogon PAC verification is encrypted. This test now passes against Win2k3, and a implementation in the Samba4 server should follow shortly. Andrew Bartlett (This used to be commit c6b8ba893dd3ed90bca32c0ae89fd33be729c238)
2008-08-29 09:06:30 +04:00
const int NETLOGON_GENERIC_KRB5_PAC_VALIDATE = 3;
Add a test to explore Netlogon PAC validation However, I have still not figured out this protocol yet, and the docs are rather unclear... :-( Andrew Bartlett (This used to be commit d878643071a1477435a267e2944461d367cdfa79)
2008-08-27 15:36:27 +04:00
typedef [public] struct {
It turns out that the Netlogon PAC verification is encrypted. This test now passes against Win2k3, and a implementation in the Samba4 server should follow shortly. Andrew Bartlett (This used to be commit c6b8ba893dd3ed90bca32c0ae89fd33be729c238)
2008-08-29 09:06:30 +04:00
[value(NETLOGON_GENERIC_KRB5_PAC_VALIDATE)] uint32 MessageType;
Add a test to explore Netlogon PAC validation However, I have still not figured out this protocol yet, and the docs are rather unclear... :-( Andrew Bartlett (This used to be commit d878643071a1477435a267e2944461d367cdfa79)
2008-08-27 15:36:27 +04:00
uint32 ChecksumLength;
Implement NETLOGON PAC verfication on the server-side This is implemented by means of a message to the KDC, to avoid having to link most of the KDC into netlogon. Andrew Bartlett (This used to be commit 82fcd7941f5c54da2d994c8bd99dd8d86299a296)
2008-09-03 09:30:17 +04:00
int32 SignatureType;
Add a test to explore Netlogon PAC validation However, I have still not figured out this protocol yet, and the docs are rather unclear... :-( Andrew Bartlett (This used to be commit d878643071a1477435a267e2944461d367cdfa79)
2008-08-27 15:36:27 +04:00
uint32 SignatureLength;
Further rework the RPC-PAC test. This would seem to match the documentation requirements for the PAC verfication over NETLOGON, but I can't get Win2k3 to accept it so far. Andrew Bartlett (This used to be commit acfa87f3411a61bdd9066fbbba2bcfbe2a60cbbe)
2008-08-28 10:30:17 +04:00
[flag(NDR_REMAINING)] DATA_BLOB ChecksumAndSignature;
Add a test to explore Netlogon PAC validation However, I have still not figured out this protocol yet, and the docs are rather unclear... :-( Andrew Bartlett (This used to be commit d878643071a1477435a267e2944461d367cdfa79)
2008-08-27 15:36:27 +04:00
} PAC_Validate;
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
void decode_pac(
[in] PAC_DATA pac
);
r10171: This seems to work for encoding/decoding a PAC at the buffers only level (required for signature verification). Andrew Bartlett (This used to be commit 76c224f28885759daae45e02a7637f2451dc84d3)
2005-09-12 17:16:56 +04:00
void decode_pac_raw(
[in] PAC_DATA_RAW pac
);
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
void decode_login_info(
[in] PAC_LOGON_INFO logon_info
);
Add a test to explore Netlogon PAC validation However, I have still not figured out this protocol yet, and the docs are rather unclear... :-( Andrew Bartlett (This used to be commit d878643071a1477435a267e2944461d367cdfa79)
2008-08-27 15:36:27 +04:00
void decode_pac_validate(
[in] PAC_Validate pac_validate
);
idl: finally share krb5_pac.idl. Guenther
2008-10-20 13:11:19 +04:00
/* used for samba3 netsamlogon cache */
typedef [public] struct {
time_t timestamp;
netr_SamInfo3 info3;
} netsamlogoncache_entry;
r1552: commit the first version of the pidl generated krb5 PAC parser NOTE: there a lot of work todo, maybe we need to extent pidl metze (This used to be commit b94a09d461291d9dd47c5859537d6025f02a80ff)
2004-07-21 00:30:29 +04:00
}
Copy Permalink