diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2010-05-06 12:45:14 +1000 |
|---|---|---|
| committer | Günther Deschner <gd@samba.org> | 2010-05-11 22:52:37 +0200 |
| commit | 454b0b3f20ee8bdf56a12930261391e06567169c (patch) | |
| tree | 164d017f86a2d8d4150a7bc69c6ece0ba7d3c145 /source3/libads/kerberos_verify.c | |
| parent | d0a87f0098073b2b7c8b637eccbb9bd91aaa8a80 (diff) | |
| download | samba-454b0b3f20ee8bdf56a12930261391e06567169c.tar.gz samba-454b0b3f20ee8bdf56a12930261391e06567169c.tar.bz2 samba-454b0b3f20ee8bdf56a12930261391e06567169c.zip | |
s3:kerberos Return PAC_LOGON_INFO rather than the full PAC_DATA
All the callers just want the PAC_LOGON_INFO, so search for that in
ads_verify_ticket(), and don't bother the callers with the rest of the
PAC.
This change makes sense on it's own (removing boilerplate wrappers
that just confuse the code), but it also makes it much easier to
implement a matching ads_verify_ticket() function in Samba4 for the
s3compat proposal.
Andrew Bartlett
Signed-off-by: Günther Deschner <gd@samba.org>
Diffstat (limited to 'source3/libads/kerberos_verify.c')
| -rw-r--r-- | source3/libads/kerberos_verify.c | 25 |
1 files changed, 20 insertions, 5 deletions
diff --git a/source3/libads/kerberos_verify.c b/source3/libads/kerberos_verify.c index bf9bca6311..4d7bb8d20b 100644 --- a/source3/libads/kerberos_verify.c +++ b/source3/libads/kerberos_verify.c @@ -405,7 +405,7 @@ NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx, time_t time_offset, const DATA_BLOB *ticket, char **principal, - struct PAC_DATA **pac_data, + struct PAC_LOGON_INFO **logon_info, DATA_BLOB *ap_rep, DATA_BLOB *session_key, bool use_replay_cache) @@ -433,7 +433,7 @@ NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx, ZERO_STRUCT(auth_data); *principal = NULL; - *pac_data = NULL; + *logon_info = NULL; *ap_rep = data_blob_null; *session_key = data_blob_null; @@ -611,12 +611,27 @@ NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx, } if (got_auth_data) { - pac_ret = decode_pac_data(mem_ctx, &auth_data, context, keyblock, client_principal, authtime, pac_data); + struct PAC_DATA *pac_data; + pac_ret = decode_pac_data(mem_ctx, &auth_data, context, keyblock, client_principal, authtime, &pac_data); + data_blob_free(&auth_data); if (!NT_STATUS_IS_OK(pac_ret)) { DEBUG(3,("ads_verify_ticket: failed to decode PAC_DATA: %s\n", nt_errstr(pac_ret))); - *pac_data = NULL; + } else { + uint32_t i; + for (i=0; i < pac_data->num_buffers; i++) { + + if (pac_data->buffers[i].type != PAC_TYPE_LOGON_INFO) { + continue; + } + + *logon_info = pac_data->buffers[i].info->logon_info.info; + } + + if (!*logon_info) { + DEBUG(1,("correctly decoded PAC but found no logon_info! This should not happen\n")); + return NT_STATUS_INVALID_USER_BUFFER; + } } - data_blob_free(&auth_data); } #if 0 |