1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-01 05:47:28 +03:00

23 Commits

Author SHA1 Message Date
Andrew Bartlett
03d9b7b8b6 librpc/idl: Explain why PAC_TYPE_CLIENT_CLAIMS_INFO is not directly decoded
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-03-31 01:48:30 +00:00
Joseph Sutton
2e8e93fdd1 s4:kdc: Refactor PAC handling
It's getting unwieldy adding new PAC buffer types when each one has to
have its own handling. It also makes the possibility of mistakes more
likely.

Add a new container, 'struct pac_blobs', containing the types of PAC
buffers in a given PAC, with an index for quick access to the types we
support specifically. We can add new blobs (overriding existing ones) by
calling pac_blobs_add_blob(), and override certain blobs that must be
present with pac_blobs_replace_existing().

This removes the need to have a complicated 'switch' statement with
different logic for each PAC buffer type, or a dozen index variables.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20 00:22:32 +00:00
Joseph Sutton
a50a2be622 CVE-2022-37967 Add new PAC checksum
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15231

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-13 13:07:29 +00:00
Joseph Sutton
88c9e2af20 krb5pac.idl: Add definitions for claims PAC buffers
The PAC device info definition comes from [MS-PAC] 2.12.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-09-09 00:14:38 +00:00
Joseph Sutton
f4ed37ad6a CVE-2020-25719 krb5pac.idl: Add PAC_REQUESTER_SID PAC buffer type
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09 19:45:33 +00:00
Joseph Sutton
6ec80380dc CVE-2020-25719 krb5pac.idl: Add PAC_ATTRIBUTES_INFO PAC buffer type
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09 19:45:33 +00:00
Andrew Bartlett
558f440f20 CVE-2020-25721 krb5pac: Add new buffers for samAccountName and objectSID
These appear when PAC_UPN_DNS_FLAG_HAS_SAM_NAME_AND_SID is set.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14835

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2021-11-09 19:45:32 +00:00
Joseph Sutton
aa2e583fde tests/krb5: Check buffer types in PAC with STRICT_CHECKING=1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-10-14 18:59:31 +00:00
Joseph Sutton
ff2f38fae7 krb5pac.idl: Add ticket checksum PAC buffer type
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2021-09-13 23:11:35 +00:00
Gary Lockyer
66218cf1fb krb5pac.idl: remove unused decode functions
Remove the decode_* functions as they are no longer needed, and this
will reduce the amount of untested automatically generated code.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-06 03:30:18 +00:00
Stefan Metzmacher
0e201ecdc5 krb5pac/netlogon: add a comment regarding PAC_LOGON_INFO unique pointers on push
This difference is the reason why we can't fully (ndr)validate some
PAC blobs.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-07-20 21:27:19 +02:00
Stefan Metzmacher
38527702fd krb5pac.idl: implement PAC_UPN_DNS_INFO correct
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-07-20 21:27:18 +02:00
Stefan Metzmacher
8e458360b4 krb5pac: fix push/pull of subcontexts in PAC_BUFFER
We need to have two subcontexts to get the padding right,
the outer subcontext uses NDR_ROUND(_ndr_size, 8), while
the inner subcontext only uses _ndr_size.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-07-20 21:27:18 +02:00
Günther Deschner
4f5dde6730 krb5pac: no need for a noprint PAC_BUFFER.
Guenther

@@ -1,6 +1,7 @@
 _PUBLIC_ void ndr_print_PAC_BUFFER(struct ndr_print *ndr, const char *name, const struct PAC_BUFFER *r)
 {
        ndr_print_struct(ndr, name, "PAC_BUFFER");
+       if (r == NULL) { ndr_print_null(ndr); return; }
        ndr->depth++;
        ndr_print_PAC_TYPE(ndr, "type", r->type);
        ndr_print_uint32(ndr, "_ndr_size", (ndr->flags & LIBNDR_PRINT_SET_VALUES)?_ndr_size_PAC_INFO(r->info,r->type,0):r->_ndr_size);
@@ -11,7 +12,7 @@
                ndr_print_PAC_INFO(ndr, "info", r->info);
        }
        ndr->depth--;
-       ndr_print_uint32(ndr, "_pad", r->_pad);
+       ndr_print_uint32(ndr, "_pad", (ndr->flags & LIBNDR_PRINT_SET_VALUES)?0:r->_pad);
        ndr->depth--;
 }

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-07-20 21:27:18 +02:00
Stefan Metzmacher
4406cf792a krb5pac.idl: introduce PAC_DOMAIN_GROUP_MEMBERSHIP to handle the resource groups
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun 30 07:16:45 CEST 2016 on sn-devel-144
2016-06-30 07:16:45 +02:00
Stefan Metzmacher
fdcdf34947 krb5pac.idl: add PAC_CREDENTIAL related structures
See [MS-PAC] 2.6 PAC Credentials.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30 03:30:23 +02:00
Stefan Metzmacher
8b51eabf31 Revert "Support UPN_DNS_INFO in the PAC"
This reverts commit a6be8a97f705247c1b1cbb0595887d8924740a71.

We fail (often) to parse a krb5pac type 12 buffer due to the incomplete change
which came in via a6be8a97f705247c1b1cbb0595887d8924740a71. This change came
into master and has only been released in RCs so no regression to published
4.0.x releases. We should revert this for 4.1 for now until we can make it work
in all cases (see work on this in
https://git.samba.org/?p=gd/samba/.git;a=shortlog;h=refs/heads/master-krb5pac_type12).
Without this revert the entire PAC parsing may fail which can effect serious
implications (krb5 smb session setup not working).

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10178

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Oct  3 17:08:46 CEST 2013 on sn-devel-104
2013-10-03 17:08:45 +02:00
Simo Sorce
a6be8a97f7 Support UPN_DNS_INFO in the PAC
Previously marked as UNKNOWN_12 the UPN_DNS_INFO is defined in MS-PAC

Autobuild-User(master): Simo Sorce <idra@samba.org>
Autobuild-Date(master): Fri Sep 28 01:13:44 CEST 2012 on sn-devel-104
2012-09-28 01:13:44 +02:00
Stefan Metzmacher
1909060798 krb5pac.idl: add PAC_CONSTRAINED_DELEGATION (S4U_DELEGATION_INFO)
metze
2011-06-28 19:03:10 +02:00
Andrew Bartlett
917b0a23a6 librpc/idl Add [nopython] to krb5pac ndrdump functions
These functions are not real RPC functions, but are used to help
ndrdump operate.  They don't need python bindings.

Andrew Bartlett
2011-04-05 23:46:04 +02:00
Andrew Tridgell
f1c2702b26 idl-pac: add a decoder for the pac info ctr
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> 
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-26 06:29:06 +00:00
Tim Prouty
1b42152454 Fix "ndr_size_PAC_LOGON_INFO defined but not used" build warning
This patch removes the gensize option from krb5pac.idl because it
generates an unused function that has been causing warnings during the
s3 build.  I re-ran 'make samba3-idl' to update the generated files
for s3.  For s4 I ran a full build with no problems.
2008-10-23 15:13:54 -07:00
Günther Deschner
fc8fadf1e9 idl: finally share krb5_pac.idl.
Guenther
2008-10-20 11:11:22 +02:00