diff options
| author | Joseph Sutton <josephsutton@catalyst.net.nz> | 2021-11-24 20:42:22 +1300 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2021-11-30 02:42:31 +0000 |
| commit | 90025b6a4d250a15c0f988a9a9150ecfb63069ef (patch) | |
| tree | 65ae9ef284cbb6104ae14d26c230d72da5417a6f /source4/kdc/wdc-samba4.c | |
| parent | e61983c7f2c4daade83b237efb990d0c0645b3a3 (diff) | |
| download | samba-90025b6a4d250a15c0f988a9a9150ecfb63069ef.tar.gz | |
kdc: Don't include extra PAC buffers in service tickets
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4/kdc/wdc-samba4.c')
| -rw-r--r-- | source4/kdc/wdc-samba4.c | 31 |
1 files changed, 21 insertions, 10 deletions
diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c index 8c3ce71529c..17af76f4edb 100644 --- a/source4/kdc/wdc-samba4.c +++ b/source4/kdc/wdc-samba4.c @@ -132,6 +132,7 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context, krb5_error_code ret; NTSTATUS nt_status; bool is_in_db, is_untrusted; + bool is_krbtgt; size_t num_types = 0; uint32_t *types = NULL; uint32_t forced_next_type = 0; @@ -471,7 +472,9 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context, goto out; } - if (!is_untrusted && !server_skdc_entry->is_krbtgt) { + is_krbtgt = krb5_principal_is_krbtgt(context, server->entry.principal); + + if (!is_untrusted && !is_krbtgt) { /* * The client may have requested no PAC when obtaining the * TGT. @@ -576,17 +579,25 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context, type_blob = data_blob_const(&zero_byte, 1); break; case PAC_TYPE_ATTRIBUTES_INFO: - /* just copy... */ - break; + if (is_krbtgt) { + /* just copy... */ + break; + } else { + continue; + } case PAC_TYPE_REQUESTER_SID: - /* - * Replace in the RODC case, otherwise - * requester_sid_blob is NULL and we just copy. - */ - if (requester_sid_blob != NULL) { - type_blob = *requester_sid_blob; + if (is_krbtgt) { + /* + * Replace in the RODC case, otherwise + * requester_sid_blob is NULL and we just copy. + */ + if (requester_sid_blob != NULL) { + type_blob = *requester_sid_blob; + } + break; + } else { + continue; } - break; default: /* just copy... */ break; |