s4:kdc: pass krbtgt and server to samba_kdc_update_pac_blob()

This will be used for SID expanding and filtering.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13300

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index 1cd6750f5ab76d097054227991976b58c2ed7485..414e67c6a98e0c644f5db328a3587f43fe9bd54d 100644 (file)
--- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c
@@ -481,7 +481,8 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
        DATA_BLOB *upn_blob = NULL;
        DATA_BLOB *deleg_blob = NULL;
        struct samba_kdc_entry *client_skdc_entry = NULL;
-       struct samba_kdc_entry *krbtgt_skdc_entry;
+       struct samba_kdc_entry *krbtgt_skdc_entry = NULL;
+       struct samba_kdc_entry *server_skdc_entry = NULL;
        bool is_in_db = false;
        bool is_untrusted = false;
        size_t num_types = 0;
@@ -509,6 +510,13 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
                }
        }
 
+       if (server == NULL) {
+               return EINVAL;
+       }
+       server_skdc_entry =
+               talloc_get_type_abort(server->e_data,
+                                     struct samba_kdc_entry);
+
        if (krbtgt == NULL) {
                return EINVAL;
        }
@@ -567,6 +575,8 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
 
                nt_status = samba_kdc_update_pac_blob(tmp_ctx,
                                                      context,
+                                                     krbtgt_skdc_entry,
+                                                     server_skdc_entry,
                                                      *pac,
                                                      pac_blob,
                                                      pac_srv_sig,

diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index 1a862e2a8a368b800c05239f1161aab3597083d9..9b5f30917a6ae5da518b619d6cf686060ae842e9 100644 (file)
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -747,6 +747,8 @@ NTSTATUS samba_kdc_get_pac_blob(TALLOC_CTX *mem_ctx,
 
 NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx,
                                   krb5_context context,
+                                  struct samba_kdc_entry *krbtgt,
+                                  struct samba_kdc_entry *server,
                                   const krb5_pac pac, DATA_BLOB *pac_blob,
                                   struct PAC_SIGNATURE_DATA *pac_srv_sig,
                                   struct PAC_SIGNATURE_DATA *pac_kdc_sig)

diff --git a/source4/kdc/pac-glue.h b/source4/kdc/pac-glue.h
index 92a6bc78023290f03c6c28e0508c2a74e32e354a..2eb7fd3b7558c3eb9bf317110ca4bd3da0faedf8 100644 (file)
--- a/source4/kdc/pac-glue.h
+++ b/source4/kdc/pac-glue.h
@@ -51,6 +51,8 @@ NTSTATUS samba_kdc_get_pac_blob(TALLOC_CTX *mem_ctx,
 
 NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx,
                                   krb5_context context,
+                                  struct samba_kdc_entry *krbtgt,
+                                  struct samba_kdc_entry *server,
                                   const krb5_pac pac, DATA_BLOB *pac_blob,
                                   struct PAC_SIGNATURE_DATA *pac_srv_sig,
                                   struct PAC_SIGNATURE_DATA *pac_kdc_sig);

diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c
index b90578c85084b943777b786ee41f3cbd5ee87801..a7d8de1f417bdbec7d60d534adc4d4eefbda5f12 100644 (file)
--- a/source4/kdc/wdc-samba4.c
+++ b/source4/kdc/wdc-samba4.c
@@ -186,6 +186,7 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context,
                }
 
                nt_status = samba_kdc_update_pac_blob(mem_ctx, context,
+                                                     krbtgt_skdc_entry, p,
                                                      *pac, pac_blob,
                                                      pac_srv_sig, pac_kdc_sig);
                if (!NT_STATUS_IS_OK(nt_status)) {