[SCM] Samba Shared Repository - branch master updated
Andrew Bartlett
abartlet at samba.org
Thu Nov 16 02:47:02 UTC 2023
The branch, master has been updated
via 3f908e19a04 s4-scripting: Remove repl_cleartext_pwd.py
via 4ec50d91097 s4-scripting/devel: Fix str() vs bytes() issue in repl_cleartext_pwd.py
via 79ef40b0262 s4-scripting/devel: Fix repl_cleartext_pwd to use built-in RC4
via 6613b5bd121 s3/utils: Use sddl_decode_err_msg instead of sddl_decode
via b319769ebd1 s3/utils: Detect (and report) failure to parse sddl
via d0d026bdb51 libcli/security: Debug only when we failed to decode
from 7c1e3f0d82a python:tests: Ensure we clean up callbacks in pymessaging tests
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 3f908e19a0422f9552d43e30762d93a8fc988ab2
Author: Andrew Bartlett <abartlet at samba.org>
Date: Thu Nov 16 14:10:45 2023 +1300
s4-scripting: Remove repl_cleartext_pwd.py
This script was the precursor to newer samba-tool commands and no longer
works. The previous commits record some of the work to have it operate in the
modern era, but keeping this around is more trouble than it is worth.
Use these commands instead:
samba-tool drs clone-dc-database --include-secrets
samba-tool user getpassword administrator --attributes=virtualClearTextUTF8
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Reviewed-by: Joseph Sutton <josephsutton at catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet at samba.org>
Autobuild-Date(master): Thu Nov 16 02:46:57 UTC 2023 on atb-devel-224
commit 4ec50d91097dd2467411b1150808ea62652696a3
Author: Andrew Bartlett <abartlet at samba.org>
Date: Thu Mar 30 01:29:22 2023 +0000
s4-scripting/devel: Fix str() vs bytes() issue in repl_cleartext_pwd.py
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Reviewed-by: Joseph Sutton <josephsutton at catalyst.net.nz>
commit 79ef40b02627668e03651782e45b98ffa0373329
Author: Andrew Bartlett <abartlet at samba.org>
Date: Thu Mar 30 14:22:24 2023 +1300
s4-scripting/devel: Fix repl_cleartext_pwd to use built-in RC4
This allows the usage test to pass on our CI hosts without
python-crypto and not uxsuccess on hosts with it.
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Reviewed-by: Joseph Sutton <josephsutton at catalyst.net.nz>
commit 6613b5bd121e3450060053a5ee8cff0ecd69d55e
Author: Noel Power <noel.power at suse.com>
Date: Wed Nov 15 13:07:26 2023 +0000
s3/utils: Use sddl_decode_err_msg instead of sddl_decode
Use sddl_decode_err_msg instead of sddl_decode for possible better
error reporting.
Signed-off-by: Noel Power <noel.power at suse.com>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit b319769ebd1caf4a406211f62cf6086ad3057672
Author: Noel Power <noel.power at suse.com>
Date: Wed Nov 15 12:55:36 2023 +0000
s3/utils: Detect (and report) failure to parse sddl
Signed-off-by: Noel Power <noel.power at suse.com>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit d0d026bdb512b5765f9a8ecc5268fbc238571adc
Author: Noel Power <noel.power at suse.com>
Date: Wed Nov 15 11:29:46 2023 +0000
libcli/security: Debug only when we failed to decode
Signed-off-by: Noel Power <noel.power at suse.com>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
-----------------------------------------------------------------------
Summary of changes:
libcli/security/sddl.c | 13 +-
selftest/knownfail.d/usage | 2 -
source3/utils/smbcacls.c | 61 +++-
source4/scripting/devel/repl_cleartext_pwd.py | 412 --------------------------
4 files changed, 65 insertions(+), 423 deletions(-)
delete mode 100755 source4/scripting/devel/repl_cleartext_pwd.py
Changeset truncated at 500 lines:
diff --git a/libcli/security/sddl.c b/libcli/security/sddl.c
index 2cad84a937a..a4659c107b5 100644
--- a/libcli/security/sddl.c
+++ b/libcli/security/sddl.c
@@ -995,11 +995,14 @@ struct security_descriptor *sddl_decode(TALLOC_CTX *mem_ctx, const char *sddl,
ACE_CONDITION_FLAG_ALLOW_DEVICE,
&msg,
&msg_offset);
- DBG_NOTICE("could not decode '%s'\n", sddl);
- if (msg != NULL) {
- DBG_NOTICE(" %*c\n", (int)msg_offset, '^');
- DBG_NOTICE("error '%s'\n", msg);
- talloc_free(discard_const(msg));
+ if (sd == NULL) {
+ DBG_NOTICE("could not decode '%s'\n", sddl);
+ if (msg != NULL) {
+ DBG_NOTICE(" %*c\n",
+ (int)msg_offset, '^');
+ DBG_NOTICE("error '%s'\n", msg);
+ talloc_free(discard_const(msg));
+ }
}
return sd;
}
diff --git a/selftest/knownfail.d/usage b/selftest/knownfail.d/usage
index b8e0bbc356d..e7d707f0e7d 100644
--- a/selftest/knownfail.d/usage
+++ b/selftest/knownfail.d/usage
@@ -5,7 +5,6 @@ samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_ctdb_etcd_lock.no
samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_depfilter_py.none.
samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_dns_hub_py.none.
samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_gen_hresult_py.none.
-samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_repl_cleartext_pwd_py.none.
samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_run_py.none.
samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_run_py_.none.
samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_smbstatus.none.
@@ -17,7 +16,6 @@ samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_findprovisionusn
samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_machineaccountpw.none.
samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_rebuildextendeddn.none.
samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_renamedc.none.
-samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_repl_cleartext_pwd_py.none.
samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_rodcdns.none.
samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_gpupdate.none.
samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_gpupdate_.none.
diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
index 0575a254c29..c9ae501d172 100644
--- a/source3/utils/smbcacls.c
+++ b/source3/utils/smbcacls.c
@@ -681,7 +681,24 @@ static int cacl_set(struct cli_state *cli, const char *filename,
struct security_descriptor *sd = NULL;
if (sddl) {
- sd = sddl_decode(talloc_tos(), the_acl, get_domain_sid(cli));
+ const char *msg = NULL;
+ size_t msg_offset = 0;
+ enum ace_condition_flags flags =
+ ACE_CONDITION_FLAG_ALLOW_DEVICE;
+ sd = sddl_decode_err_msg(talloc_tos(),
+ the_acl,
+ get_domain_sid(cli),
+ flags,
+ &msg,
+ &msg_offset);
+ if (sd == NULL) {
+ DBG_ERR("could not decode '%s'\n", the_acl);
+ if (msg != NULL) {
+ DBG_ERR(" %*c\n",
+ (int)msg_offset, '^');
+ DBG_ERR("error '%s'\n", msg);
+ }
+ }
} else {
sd = sec_desc_parse(talloc_tos(), cli, the_acl);
}
@@ -1102,8 +1119,25 @@ static NTSTATUS prepare_inheritance_propagation(TALLOC_CTX *ctx, char *filename,
/* parse acl passed on the command line */
if (sddl) {
- cbstate->aclsd = sddl_decode(ctx, the_acl,
- get_domain_sid(cli));
+ const char *msg = NULL;
+ size_t msg_offset = 0;
+ enum ace_condition_flags flags =
+ ACE_CONDITION_FLAG_ALLOW_DEVICE;
+
+ cbstate->aclsd = sddl_decode_err_msg(ctx,
+ the_acl,
+ get_domain_sid(cli),
+ flags,
+ &msg,
+ &msg_offset);
+ if (cbstate->aclsd == NULL) {
+ DBG_ERR("could not decode '%s'\n", the_acl);
+ if (msg != NULL) {
+ DBG_ERR(" %*c\n",
+ (int)msg_offset, '^');
+ DBG_ERR("error '%s'\n", msg);
+ }
+ }
} else {
cbstate->aclsd = sec_desc_parse(ctx, cli, the_acl);
}
@@ -2107,7 +2141,26 @@ static int cacl_restore(struct cli_state *cli,
entries[index].path = lines[i];
}
} else {
- entries[index].sd = sddl_decode(lines, lines[i], sid);
+ const char *msg = NULL;
+ size_t msg_offset = 0;
+ enum ace_condition_flags flags =
+ ACE_CONDITION_FLAG_ALLOW_DEVICE;
+ entries[index].sd = sddl_decode_err_msg(lines,
+ lines[i],
+ sid,
+ flags,
+ &msg,
+ &msg_offset);
+ if(entries[index].sd == NULL) {
+ DBG_ERR("could not decode '%s'\n", lines[i]);
+ if (msg != NULL) {
+ DBG_ERR(" %*c\n",
+ (int)msg_offset, '^');
+ DBG_ERR("error '%s'\n", msg);
+ }
+ result = EXIT_FAILED;
+ goto out;
+ }
entries[index].sd->type |=
SEC_DESC_DACL_AUTO_INHERIT_REQ;
entries[index].sd->type |= SEC_DESC_SACL_AUTO_INHERITED;
diff --git a/source4/scripting/devel/repl_cleartext_pwd.py b/source4/scripting/devel/repl_cleartext_pwd.py
deleted file mode 100755
index 64392919f5b..00000000000
--- a/source4/scripting/devel/repl_cleartext_pwd.py
+++ /dev/null
@@ -1,412 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright Stefan Metzmacher 2011-2012
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-# This is useful to sync passwords from an AD domain.
-#
-# $
-# $ source4/scripting/devel/repl_cleartext_pwd.py \
-# -Uadministrator%A1b2C3d4 \
-# 172.31.9.219 DC=bla,DC=base /tmp/cookie cleartext_utf8 131085 displayName
-# # starting at usn[0]
-# dn: CN=Test User1,CN=Users,DC=bla,DC=base
-# cleartext_utf8: A1b2C3d4
-# displayName:: VABlAHMAdAAgAFUAcwBlAHIAMQA=
-#
-# # up to usn[16449]
-# $
-# $ source4/scripting/devel/repl_cleartext_pwd.py \
-# -Uadministrator%A1b2C3d4
-# 172.31.9.219 DC=bla,DC=base cookie_file cleartext_utf8 131085 displayName
-# # starting at usn[16449]
-# # up to usn[16449]
-# $
-#
-
-import sys
-
-# Find right direction when running from source tree
-sys.path.insert(0, "bin/python")
-
-import samba.getopt as options
-from optparse import OptionParser
-
-from samba.dcerpc import drsuapi, drsblobs, misc
-from samba.ndr import ndr_pack, ndr_unpack, ndr_print
-
-import binascii
-import hashlib
-import Crypto.Cipher.ARC4
-import struct
-import os
-
-from ldif import LDIFWriter
-
-
-class globals:
- def __init__(self):
- self.global_objs = {}
- self.ldif = LDIFWriter(sys.stdout)
-
- def add_attr(self, dn, attname, vals):
- if dn not in self.global_objs:
- self.global_objs[dn] = {}
- self.global_objs[dn][attname] = vals
-
- def print_all(self):
- for dn, obj in self.global_objs.items():
- self.ldif.unparse(dn, obj)
- continue
- self.global_objs = {}
-
-
-def attid_equal(a1, a2):
- return (a1 & 0xffffffff) == (a2 & 0xffffffff)
-
-
-########### main code ###########
-if __name__ == "__main__":
- parser = OptionParser("repl_cleartext_pwd.py [options] server dn cookie_file clear_utf8_name [attid attname attmode] [clear_utf16_name")
- sambaopts = options.SambaOptions(parser)
- credopts = options.CredentialsOptions(parser)
- parser.add_option_group(credopts)
-
- (opts, args) = parser.parse_args()
-
- if len(args) == 4:
- pass
- elif len(args) == 7:
- pass
- elif len(args) >= 8:
- pass
- else:
- parser.error("more arguments required - given=%d" % (len(args)))
-
- server = args[0]
- dn = args[1]
- cookie_file = args[2]
- if len(cookie_file) == 0:
- cookie_file = None
- clear_utf8_name = args[3]
- if len(args) >= 7:
- try:
- attid = int(args[4], 16)
- except Exception:
- attid = int(args[4])
- attname = args[5]
- attmode = args[6]
- if attmode not in ["raw", "utf8"]:
- parser.error("attmode should be 'raw' or 'utf8'")
- else:
- attid = -1
- attname = None
- attmode = "raw"
- if len(args) >= 8:
- clear_utf16_name = args[7]
- else:
- clear_utf16_name = None
-
- lp = sambaopts.get_loadparm()
- creds = credopts.get_credentials(lp)
-
- if not creds.authentication_requested():
- parser.error("You must supply credentials")
-
- gls = globals()
- try:
- f = open(cookie_file, 'r')
- store_blob = f.read()
- f.close()
-
- store_hdr = store_blob[0:28]
- (store_version,
- store_dn_len, store_dn_ofs,
- store_hwm_len, store_hwm_ofs,
- store_utdv_len, store_utdv_ofs) = \
- struct.unpack("<LLLLLLL", store_hdr)
-
- store_dn = store_blob[store_dn_ofs:store_dn_ofs + store_dn_len]
- store_hwm_blob = store_blob[store_hwm_ofs:store_hwm_ofs + store_hwm_len]
- store_utdv_blob = store_blob[store_utdv_ofs:store_utdv_ofs + store_utdv_len]
-
- store_hwm = ndr_unpack(drsuapi.DsReplicaHighWaterMark, store_hwm_blob)
- store_utdv = ndr_unpack(drsblobs.replUpToDateVectorBlob, store_utdv_blob)
-
- assert store_dn == dn
- # print "%s" % ndr_print(store_hwm)
- # print "%s" % ndr_print(store_utdv)
- except Exception:
- store_dn = dn
- store_hwm = drsuapi.DsReplicaHighWaterMark()
- store_hwm.tmp_highest_usn = 0
- store_hwm.reserved_usn = 0
- store_hwm.highest_usn = 0
- store_utdv = None
-
- binding_str = "ncacn_ip_tcp:%s[spnego,seal]" % server
-
- drs_conn = drsuapi.drsuapi(binding_str, lp, creds)
-
- bind_info = drsuapi.DsBindInfoCtr()
- bind_info.length = 28
- bind_info.info = drsuapi.DsBindInfo28()
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_BASE
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT
- (info, drs_handle) = drs_conn.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info)
-
- null_guid = misc.GUID()
-
- naming_context = drsuapi.DsReplicaObjectIdentifier()
- naming_context.dn = dn
- highwatermark = store_hwm
- uptodateness_vector = None
- if store_utdv is not None:
- uptodateness_vector = drsuapi.DsReplicaCursorCtrEx()
- if store_utdv.version == 1:
- uptodateness_vector.cursors = store_utdv.cursors
- elif store_utdv.version == 2:
- cursors = []
- for i in range(0, store_utdv.ctr.count):
- cursor = drsuapi.DsReplicaCursor()
- cursor.source_dsa_invocation_id = store_utdv.ctr.cursors[i].source_dsa_invocation_id
- cursor.highest_usn = store_utdv.ctr.cursors[i].highest_usn
- cursors.append(cursor)
- uptodateness_vector.cursors = cursors
-
- req8 = drsuapi.DsGetNCChangesRequest8()
-
- req8.destination_dsa_guid = null_guid
- req8.source_dsa_invocation_id = null_guid
- req8.naming_context = naming_context
- req8.highwatermark = highwatermark
- req8.uptodateness_vector = uptodateness_vector
- req8.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC |
- drsuapi.DRSUAPI_DRS_PER_SYNC |
- drsuapi.DRSUAPI_DRS_GET_ANC |
- drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
- drsuapi.DRSUAPI_DRS_WRIT_REP)
- req8.max_object_count = 402
- req8.max_ndr_size = 402116
- req8.extended_op = 0
- req8.fsmo_info = 0
- req8.partial_attribute_set = None
- req8.partial_attribute_set_ex = None
- req8.mapping_ctr.num_mappings = 0
- req8.mapping_ctr.mappings = None
-
- user_session_key = drs_conn.user_session_key
-
- print("# starting at usn[%d]" % (highwatermark.highest_usn))
-
- while True:
- (level, ctr) = drs_conn.DsGetNCChanges(drs_handle, 8, req8)
- if ctr.first_object is None and ctr.object_count != 0:
- raise RuntimeError("DsGetNCChanges: NULL first_object with object_count=%u" % (ctr.object_count))
-
- obj_item = ctr.first_object
- while obj_item is not None:
- obj = obj_item.object
-
- if obj.identifier is None:
- obj_item = obj_item.next_object
- continue
-
- # print '%s' % obj.identifier.dn
-
- is_deleted = False
- for i in range(0, obj.attribute_ctr.num_attributes):
- attr = obj.attribute_ctr.attributes[i]
- if attid_equal(attr.attid, drsuapi.DRSUAPI_ATTID_isDeleted):
- is_deleted = True
- if is_deleted:
- obj_item = obj_item.next_object
- continue
-
- spl_crypt = None
- attvals = None
- for i in range(0, obj.attribute_ctr.num_attributes):
- attr = obj.attribute_ctr.attributes[i]
- if attid_equal(attr.attid, attid):
- attvals = []
- for j in range(0, attr.value_ctr.num_values):
- assert attr.value_ctr.values[j].blob is not None
- val_raw = attr.value_ctr.values[j].blob
- val = None
- if attmode == "utf8":
- val_unicode = unicode(val_raw, 'utf-16-le')
- val = val_unicode.encode('utf-8')
- elif attmode == "raw":
- val = val_raw
- else:
- assert False, "attmode[%s]" % attmode
- attvals.append(val)
- if not attid_equal(attr.attid, drsuapi.DRSUAPI_ATTID_supplementalCredentials):
- continue
- assert attr.value_ctr.num_values <= 1
- if attr.value_ctr.num_values == 0:
- break
- assert attr.value_ctr.values[0].blob is not None
- spl_crypt = attr.value_ctr.values[0].blob
-
- if spl_crypt is None:
- obj_item = obj_item.next_object
- continue
-
- assert len(spl_crypt) >= 20
- confounder = spl_crypt[0:16]
- enc_buffer = spl_crypt[16:]
-
- m5 = hashlib.md5()
- m5.update(user_session_key)
- m5.update(confounder)
- enc_key = m5.digest()
-
- rc4 = Crypto.Cipher.ARC4.new(enc_key)
- plain_buffer = rc4.decrypt(enc_buffer)
-
- (crc32_v) = struct.unpack("<L", plain_buffer[0:4])
- attr_val = plain_buffer[4:]
- crc32_c = binascii.crc32(attr_val) & 0xffffffff
- assert int(crc32_v[0]) == int(crc32_c), "CRC32 0x%08X != 0x%08X" % (crc32_v[0], crc32_c)
-
- spl = ndr_unpack(drsblobs.supplementalCredentialsBlob, attr_val)
-
- # print '%s' % ndr_print(spl)
-
- cleartext_hex = None
-
- for i in range(0, spl.sub.num_packages):
- pkg = spl.sub.packages[i]
- if pkg.name != "Primary:CLEARTEXT":
- continue
- cleartext_hex = pkg.data
-
- if cleartext_hex is not None:
- cleartext_utf16 = binascii.a2b_hex(cleartext_hex)
- if clear_utf16_name is not None:
- gls.add_attr(obj.identifier.dn, clear_utf16_name, [cleartext_utf16])
- try:
- cleartext_unicode = unicode(cleartext_utf16, 'utf-16-le')
- cleartext_utf8 = cleartext_unicode.encode('utf-8')
- gls.add_attr(obj.identifier.dn, clear_utf8_name, [cleartext_utf8])
- except Exception:
- pass
-
- if attvals is not None:
- gls.add_attr(obj.identifier.dn, attname, attvals)
-
- krb5_old_hex = None
-
- for i in range(0, spl.sub.num_packages):
- pkg = spl.sub.packages[i]
- if pkg.name != "Primary:Kerberos":
- continue
- krb5_old_hex = pkg.data
-
- if krb5_old_hex is not None:
- krb5_old_raw = binascii.a2b_hex(krb5_old_hex)
- krb5_old = ndr_unpack(drsblobs.package_PrimaryKerberosBlob, krb5_old_raw, allow_remaining=True)
-
- # print '%s' % ndr_print(krb5_old)
-
- krb5_new_hex = None
-
- for i in range(0, spl.sub.num_packages):
- pkg = spl.sub.packages[i]
- if pkg.name != "Primary:Kerberos-Newer-Keys":
- continue
- krb5_new_hex = pkg.data
-
- if krb5_new_hex is not None:
- krb5_new_raw = binascii.a2b_hex(krb5_new_hex)
- krb5_new = ndr_unpack(drsblobs.package_PrimaryKerberosBlob, krb5_new_raw, allow_remaining=True)
-
- # print '%s' % ndr_print(krb5_new)
-
--
Samba Shared Repository
More information about the samba-cvs
mailing list