auth/credentials: Use salt on credentials object for Creds.get_aes256_key()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>

diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
index 341c984f60c8625c30b9577d631bc4351046c89e..9c11bbd9bcad6daa4167b61749bfcfcab698b759 100644 (file)
--- a/auth/credentials/credentials.h
+++ b/auth/credentials/credentials.h
@@ -351,7 +351,6 @@ NTSTATUS netlogon_creds_session_encrypt(
 int cli_credentials_get_aes256_key(struct cli_credentials *cred,
                                   TALLOC_CTX *mem_ctx,
                                   struct loadparm_context *lp_ctx,
-                                  const char *salt,
                                   DATA_BLOB *aes_256);
 
 /**

diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
index 4463401a7672969ffd0d14e9f6949cb65debd031..4e7a1a3b265626672c4a8eda0753b0ace8406da2 100644 (file)
--- a/auth/credentials/credentials_krb5.c
+++ b/auth/credentials/credentials_krb5.c
@@ -1484,13 +1484,13 @@ _PUBLIC_ void cli_credentials_set_target_service(struct cli_credentials *cred, c
 _PUBLIC_ int cli_credentials_get_aes256_key(struct cli_credentials *cred,
                                            TALLOC_CTX *mem_ctx,
                                            struct loadparm_context *lp_ctx,
-                                           const char *salt,
                                            DATA_BLOB *aes_256)
 {
        struct smb_krb5_context *smb_krb5_context = NULL;
        krb5_error_code krb5_ret;
        int ret;
        const char *password = NULL;
+       const char *salt = NULL;
        krb5_data cleartext_data;
        krb5_data salt_data = {
                .length = 0,
@@ -1502,6 +1502,11 @@ _PUBLIC_ int cli_credentials_get_aes256_key(struct cli_credentials *cred,
                return EINVAL;
        }
 
+       salt = cli_credentials_get_salt_principal(cred);
+       if (salt == NULL) {
+               return EINVAL;
+       }
+
        password = cli_credentials_get_password(cred);
        if (password == NULL) {
                return EINVAL;

diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c
index 40773ff74a9e8c327599c01a39e99f732ee79dd7..6d73a0a2c32de8eafe450e9c29565fd3da178d3e 100644 (file)
--- a/auth/credentials/pycredentials.c
+++ b/auth/credentials/pycredentials.c
@@ -1007,7 +1007,6 @@ static PyObject *py_creds_get_aes256_key(PyObject *self, PyObject *args)
        struct loadparm_context *lp_ctx = NULL;
        TALLOC_CTX *mem_ctx = NULL;
        PyObject *py_lp_ctx = Py_None;
-       const char *salt = NULL;
        DATA_BLOB aes_256;
        int code;
        PyObject *ret = NULL;
@@ -1017,7 +1016,7 @@ static PyObject *py_creds_get_aes256_key(PyObject *self, PyObject *args)
                return NULL;
        }
 
-       if (!PyArg_ParseTuple(args, "s|O", &salt, &py_lp_ctx))
+       if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
                return NULL;
 
        mem_ctx = talloc_new(NULL);
@@ -1035,7 +1034,6 @@ static PyObject *py_creds_get_aes256_key(PyObject *self, PyObject *args)
        code = cli_credentials_get_aes256_key(creds,
                                              mem_ctx,
                                              lp_ctx,
-                                             salt,
                                              &aes_256);
        if (code != 0) {
                PyErr_SetString(PyExc_RuntimeError,
@@ -1629,9 +1627,9 @@ static PyMethodDef py_creds_methods[] = {
                .ml_name  = "get_aes256_key",
                .ml_meth  = py_creds_get_aes256_key,
                .ml_flags = METH_VARARGS,
-               .ml_doc   = "S.get_aes256_key(salt[, lp]) -> bytes\n"
+               .ml_doc   = "S.get_aes256_key([lp]) -> bytes\n"
                            "Generate an AES256 key using the current password and\n"
-                           "the specified salt",
+                           "the salt on this credentials object",
        },
        {
                .ml_name  = "encrypt_netr_crypt_password",

diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py
index 8af8be7341e5ab0e2ed681a689da78543d10ec51..2b888c4f0f7fcb83440de9fc3b97130176635fc2 100644 (file)
--- a/python/samba/netcmd/user/readpasswords/common.py
+++ b/python/samba/netcmd/user/readpasswords/common.py
@@ -489,7 +489,8 @@ class GetPasswordCommand(Command):
                         decrypted = tmp.get_nt_hash()
                         current_hash = unicodePwd
                     elif aes256_key is not None and kerberos_salt is not None:
-                        decrypted = tmp.get_aes256_key(kerberos_salt)
+                        tmp.set_kerberos_salt_principal(kerberos_salt)
+                        decrypted = tmp.get_aes256_key()
                         current_hash = aes256_key.value
 
                     if current_hash is not None and current_hash == decrypted: