s4:kdc: let struct samba_kdc_entry_pac remember the krbtgt samba_kdc_entry

This will allow us later to find the information needed to do
sid filtering of the pac.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>

diff --git a/source4/kdc/hdb-samba4.c b/source4/kdc/hdb-samba4.c
index 32c6d2f8c2210c3dd6b2122fb450c17bcce3adf8..33b2522d4c950ac04074679fc798f679412cd11c 100644 (file)
--- a/source4/kdc/hdb-samba4.c
+++ b/source4/kdc/hdb-samba4.c
@@ -355,7 +355,7 @@ hdb_samba4_check_rbcd(krb5_context context, HDB *db,
 
        client_pac_entry = samba_kdc_entry_pac(header_pac,
                                               client_skdc_entry,
-                                              samba_kdc_entry_is_trust(client_krbtgt_skdc_entry));
+                                              client_krbtgt_skdc_entry);
 
        code = samba_kdc_get_user_info_dc(mem_ctx,
                                          context,
@@ -391,7 +391,7 @@ hdb_samba4_check_rbcd(krb5_context context, HDB *db,
 
                device_pac_entry = samba_kdc_entry_pac(device_pac,
                                                       device_skdc_entry,
-                                                      samba_kdc_entry_is_trust(device_krbtgt_skdc_entry));
+                                                      device_krbtgt_skdc_entry);
 
                code = samba_kdc_get_user_info_dc(mem_ctx,
                                                  context,

diff --git a/source4/kdc/kdc-glue.c b/source4/kdc/kdc-glue.c
index 8b98d0f8f7ef74f0e951be466c6402270ac1dfc2..6fd52ef398541597201eca9dab403acbe9f00c79 100644 (file)
--- a/source4/kdc/kdc-glue.c
+++ b/source4/kdc/kdc-glue.c
@@ -88,5 +88,5 @@ struct samba_kdc_entry_pac samba_kdc_get_device_pac(const astgs_request_t r)
 
        return samba_kdc_entry_pac(device_pac,
                                   device_skdc_entry,
-                                  samba_kdc_entry_is_trust(device_krbtgt_skdc_entry));
+                                  device_krbtgt_skdc_entry);
 }

diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index 4af02fa00d0530edd09921ccc187f67f0ad651d8..e6aa94aee37718757e1463980e084612ba0fa659 100644 (file)
--- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c
@@ -717,7 +717,7 @@ krb5_error_code mit_samba_update_pac(struct mit_samba_context *ctx,
 
        client_pac_entry = samba_kdc_entry_pac_from_trusted(old_pac,
                                                            client_skdc_entry,
-                                                           samba_kdc_entry_is_trust(krbtgt_skdc_entry),
+                                                           krbtgt_skdc_entry,
                                                            is_trusted);
 
        code = samba_kdc_verify_pac(tmp_ctx,

diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index 1d3be9edd57445d1eb2fc870e8e0858a0395f226..2f21d7addbc75bce5b646863517cb04692b97c5c 100644 (file)
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -870,24 +870,24 @@ bool samba_krb5_pac_is_trusted(const struct samba_kdc_entry_pac pac)
 #ifdef HAVE_KRB5_PAC_IS_TRUSTED /* Heimdal */
 struct samba_kdc_entry_pac samba_kdc_entry_pac(krb5_const_pac pac,
                                               struct samba_kdc_entry *entry,
-                                              bool is_from_trust)
+                                              const struct samba_kdc_entry *krbtgt)
 {
        return (struct samba_kdc_entry_pac) {
                .entry = entry,
+               .krbtgt = krbtgt,
                .pac = pac,
-               .is_from_trust = is_from_trust,
        };
 }
 #else /* MIT */
 struct samba_kdc_entry_pac samba_kdc_entry_pac_from_trusted(krb5_const_pac pac,
                                                            struct samba_kdc_entry *entry,
-                                                           bool is_from_trust,
+                                                           const struct samba_kdc_entry *krbtgt,
                                                            bool is_trusted)
 {
        return (struct samba_kdc_entry_pac) {
                .entry = entry,
+               .krbtgt = krbtgt,
                .pac = pac,
-               .is_from_trust = is_from_trust,
                .pac_is_trusted = is_trusted,
        };
 }
@@ -895,7 +895,7 @@ struct samba_kdc_entry_pac samba_kdc_entry_pac_from_trusted(krb5_const_pac pac,
 
 static bool samba_kdc_entry_pac_issued_by_trust(const struct samba_kdc_entry_pac entry)
 {
-       return entry.pac != NULL && entry.is_from_trust;
+       return entry.pac != NULL && samba_kdc_entry_is_trust(entry.krbtgt);
 }
 
 NTSTATUS samba_kdc_get_logon_info_blob(TALLOC_CTX *mem_ctx,

diff --git a/source4/kdc/pac-glue.h b/source4/kdc/pac-glue.h
index aa022f7b00151ef93ccc1d99013f1d7764580edc..3a1a99708a8af437fb188c7f631dc0d07a0391c0 100644 (file)
--- a/source4/kdc/pac-glue.h
+++ b/source4/kdc/pac-glue.h
@@ -49,8 +49,8 @@ bool samba_kdc_entry_is_trust(const struct samba_kdc_entry *entry);
 
 struct samba_kdc_entry_pac {
        struct samba_kdc_entry *entry;
+       const struct samba_kdc_entry *krbtgt;
        krb5_const_pac pac; /* NULL indicates that no PAC is present. */
-       bool is_from_trust : 1;
 #ifndef HAVE_KRB5_PAC_IS_TRUSTED /* MIT */
        bool pac_is_trusted : 1;
 #endif /* HAVE_KRB5_PAC_IS_TRUSTED */
@@ -66,11 +66,11 @@ bool samba_krb5_pac_is_trusted(const struct samba_kdc_entry_pac pac);
 #ifdef HAVE_KRB5_PAC_IS_TRUSTED /* Heimdal */
 struct samba_kdc_entry_pac samba_kdc_entry_pac(krb5_const_pac pac,
                                               struct samba_kdc_entry *entry,
-                                              bool is_from_trust);
+                                              const struct samba_kdc_entry *krbtgt_entry);
 #else /* MIT */
 struct samba_kdc_entry_pac samba_kdc_entry_pac_from_trusted(krb5_const_pac pac,
                                                            struct samba_kdc_entry *entry,
-                                                           bool is_from_trust,
+                                                           const struct samba_kdc_entry *krbtgt_entry,
                                                            bool is_trusted);
 #endif /* HAVE_KRB5_PAC_IS_TRUSTED */
 

diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c
index 2d7e6173a51253f573e0c28675ed5aa6f63ecd74..330d21975b7758a34526ce9098e23c9296d311d2 100644 (file)
--- a/source4/kdc/wdc-samba4.c
+++ b/source4/kdc/wdc-samba4.c
@@ -216,7 +216,7 @@ static krb5_error_code samba_wdc_get_pac(void *priv,
 
                        device_pac_entry = samba_kdc_entry_pac(device_pac,
                                                               device_skdc_entry,
-                                                              samba_kdc_entry_is_trust(device_krbtgt_skdc_entry));
+                                                              device_krbtgt_skdc_entry);
 
                        ret = samba_kdc_get_user_info_dc(mem_ctx,
                                                         context,
@@ -396,7 +396,7 @@ static krb5_error_code samba_wdc_verify_pac2(astgs_request_t r,
        krb5_pac_set_trusted(pac, is_trusted);
        client_pac_entry = samba_kdc_entry_pac(pac,
                                               client_skdc_entry,
-                                              samba_kdc_entry_is_trust(krbtgt_skdc_entry));
+                                              krbtgt_skdc_entry);
 
        if (is_s4u2self) {
                flags |= SAMBA_KDC_FLAG_PROTOCOL_TRANSITION;
@@ -515,7 +515,7 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, astgs_request_t r,
                                                         * not have been signed
                                                         * or issued by a krbtgt
                                                         * trust account. */
-                                                       false /* is_from_trust */);
+                                                       NULL /* krbtgt */);
 
        if (client != NULL) {
                client_skdc_entry = talloc_get_type_abort(client->context,
@@ -532,7 +532,7 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, astgs_request_t r,
 
        client_pac_entry = samba_kdc_entry_pac(*pac,
                                               client_skdc_entry,
-                                              samba_kdc_entry_is_trust(krbtgt_skdc_entry));
+                                              krbtgt_skdc_entry);
 
        ret = samba_kdc_update_pac(mem_ctx,
                                   context,