From c6b8ba893dd3ed90bca32c0ae89fd33be729c238 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 29 Aug 2008 15:06:30 +1000 Subject: [PATCH] It turns out that the Netlogon PAC verification is encrypted. This test now passes against Win2k3, and a implementation in the Samba4 server should follow shortly. Andrew Bartlett --- source/librpc/idl/krb5pac.idl | 4 +++- source/librpc/idl/netlogon.idl | 7 ++++++- source/torture/rpc/remote_pac.c | 4 +++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/source/librpc/idl/krb5pac.idl b/source/librpc/idl/krb5pac.idl index 699f0b896b6..dcee280150d 100644 --- a/source/librpc/idl/krb5pac.idl +++ b/source/librpc/idl/krb5pac.idl @@ -100,8 +100,10 @@ interface krb5pac PAC_BUFFER_RAW buffers[num_buffers]; } PAC_DATA_RAW; + const int NETLOGON_GENERIC_KRB5_PAC_VALIDATE = 3; + typedef [public] struct { - uint32 MessageType; + [value(NETLOGON_GENERIC_KRB5_PAC_VALIDATE)] uint32 MessageType; uint32 ChecksumLength; uint32 SignatureType; uint32 SignatureLength; diff --git a/source/librpc/idl/netlogon.idl b/source/librpc/idl/netlogon.idl index 006411dfbf7..22981068518 100644 --- a/source/librpc/idl/netlogon.idl +++ b/source/librpc/idl/netlogon.idl @@ -240,6 +240,11 @@ interface netlogon lsa_String unknown4; } netr_PacInfo; + typedef [flag(NDR_PAHEX)] struct { + uint32 length; + [size_is(length)] uint8 *data; + } netr_GenericInfo2; + typedef enum { NetlogonValidationUasInfo = 1, NetlogonValidationSamInfo = 2, @@ -252,7 +257,7 @@ interface netlogon [case(NetlogonValidationSamInfo)] netr_SamInfo2 *sam2; [case(NetlogonValidationSamInfo2)] netr_SamInfo3 *sam3; [case(4)] netr_PacInfo *pac; - [case(NetlogonValidationGenericInfo2)] netr_PacInfo *pac; + [case(NetlogonValidationGenericInfo2)] netr_GenericInfo2 *generic; [case(NetlogonValidationSamInfo4)] netr_SamInfo6 *sam6; } netr_Validation; diff --git a/source/torture/rpc/remote_pac.c b/source/torture/rpc/remote_pac.c index a01077a6c73..58c8ba0ee0e 100644 --- a/source/torture/rpc/remote_pac.c +++ b/source/torture/rpc/remote_pac.c @@ -154,7 +154,9 @@ static bool test_PACVerify(struct torture_context *tctx, (ndr_push_flags_fn_t)ndr_push_PAC_Validate); torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_push_struct_blob of PACValidate structure failed"); - + torture_assert(tctx, (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR), "not willing to even try a PACValidate without RC4 encryption"); + creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length); + /* Validate it over the netlogon pipe */ generic.identity_info.parameter_control = 0; -- 2.34.1