CVE-2020-25719 tests/krb5: Add tests for mismatched names with user-to-user

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14873

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py
index b0f60c0a8ce919d5b4227e2576931c220b32fd63..cfe1ad42d615d60bb8f8c8d6956ec99b7f3e5911 100755 (executable)
--- a/python/samba/tests/krb5/kdc_tgs_tests.py
+++ b/python/samba/tests/krb5/kdc_tgs_tests.py
@@ -43,8 +43,10 @@ from samba.tests.krb5.rfc4120_constants import (
     KDC_ERR_GENERIC,
     KDC_ERR_MODIFIED,
     KDC_ERR_POLICY,
+    KDC_ERR_C_PRINCIPAL_UNKNOWN,
     KDC_ERR_S_PRINCIPAL_UNKNOWN,
     KDC_ERR_TGT_REVOKED,
+    KDC_ERR_WRONG_REALM,
     NT_PRINCIPAL,
     NT_SRV_INST,
 )
@@ -1112,6 +1114,100 @@ class KdcTgsTests(KDCBaseTest):
                         expected_error=(KDC_ERR_BADMATCH,
                                         KDC_ERR_BADOPTION))
 
+    def test_user2user_other_sname(self):
+        other_name = self.get_new_username()
+        spn = f'host/{other_name}'
+        creds = self.get_cached_creds(
+            account_type=self.AccountType.COMPUTER,
+            opts={'spn': spn})
+        tgt = self._get_tgt(creds)
+
+        sname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
+                                          names=['host', other_name])
+
+        self._user2user(tgt, creds, sname=sname, expected_error=0)
+
+    def test_user2user_wrong_sname_krbtgt(self):
+        creds = self._get_creds()
+        tgt = self._get_tgt(creds)
+
+        sname = self.get_krbtgt_sname()
+
+        self._user2user(tgt, creds, sname=sname,
+                        expected_error=(KDC_ERR_BADMATCH,
+                                        KDC_ERR_BADOPTION))
+
+    def test_user2user_wrong_srealm(self):
+        creds = self._get_creds()
+        tgt = self._get_tgt(creds)
+
+        self._user2user(tgt, creds, srealm='OTHER.REALM',
+                        expected_error=(KDC_ERR_WRONG_REALM,
+                                        KDC_ERR_S_PRINCIPAL_UNKNOWN))
+
+    def test_user2user_tgt_correct_realm(self):
+        creds = self._get_creds()
+        tgt = self._get_tgt(creds)
+
+        realm = creds.get_realm().encode('utf-8')
+        tgt = self._modify_tgt(tgt, realm)
+
+        self._user2user(tgt, creds,
+                        expected_error=0)
+
+    def test_user2user_tgt_wrong_realm(self):
+        creds = self._get_creds()
+        tgt = self._get_tgt(creds)
+
+        tgt = self._modify_tgt(tgt, b'OTHER.REALM')
+
+        self._user2user(tgt, creds,
+                        expected_error=0)
+
+    def test_user2user_tgt_correct_cname(self):
+        creds = self._get_creds()
+        tgt = self._get_tgt(creds)
+
+        user_name = creds.get_username()
+        user_name = user_name.encode('utf-8')
+        cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
+                                          names=[user_name])
+
+        tgt = self._modify_tgt(tgt, cname=cname)
+
+        self._user2user(tgt, creds, expected_error=0)
+
+    def test_user2user_tgt_other_cname(self):
+        samdb = self.get_samdb()
+
+        other_name = self.get_new_username()
+        upn = f'{other_name}@{samdb.domain_dns_name()}'
+
+        creds = self.get_cached_creds(
+            account_type=self.AccountType.COMPUTER,
+            opts={'upn': upn})
+        tgt = self._get_tgt(creds)
+
+        cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
+                                          names=[other_name.encode('utf-8')])
+
+        tgt = self._modify_tgt(tgt, cname=cname)
+
+        self._user2user(tgt, creds, expected_error=0)
+
+    def test_user2user_tgt_cname_host(self):
+        creds = self._get_creds()
+        tgt = self._get_tgt(creds)
+
+        user_name = creds.get_username()
+        user_name = user_name.encode('utf-8')
+        cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
+                                          names=[b'host', user_name])
+
+        tgt = self._modify_tgt(tgt, cname=cname)
+
+        self._user2user(tgt, creds, expected_error=KDC_ERR_C_PRINCIPAL_UNKNOWN)
+
     def test_user2user_non_existent_sname(self):
         creds = self._get_creds()
         tgt = self._get_tgt(creds)
@@ -2005,7 +2101,7 @@ class KdcTgsTests(KDCBaseTest):
                              expect_pac=expect_pac)
 
     def _user2user(self, tgt, tgt_creds, expected_error, sname=None,
-                   user_tgt=None, expect_pac=True):
+                   srealm=None, user_tgt=None, expect_pac=True):
         if user_tgt is None:
             user_creds = self._get_mach_creds()
             user_tgt = self.get_tgt(user_creds)
@@ -2015,6 +2111,7 @@ class KdcTgsTests(KDCBaseTest):
                              kdc_options=kdc_options,
                              additional_ticket=tgt,
                              sname=sname,
+                             srealm=srealm,
                              expect_pac=expect_pac)
 
     def _tgs_req(self, tgt, expected_error, target_creds,
@@ -2023,6 +2120,7 @@ class KdcTgsTests(KDCBaseTest):
                  additional_ticket=None,
                  generate_padata_fn=None,
                  sname=None,
+                 srealm=None,
                  expect_claims=True,
                  expect_pac=True,
                  expect_pac_attrs=None,
@@ -2031,7 +2129,10 @@ class KdcTgsTests(KDCBaseTest):
                  expect_edata=False,
                  expected_sid=None,
                  expected_status=None):
-        srealm = target_creds.get_realm()
+        if srealm is False:
+            srealm = None
+        elif srealm is None:
+            srealm = target_creds.get_realm()
 
         if sname is False:
             sname = None

diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py
index 490cd255ec30898574f3b00c3ca77156856c4243..5251e291fde1883b7b70ca7df4b618c073fbce7e 100644 (file)
--- a/python/samba/tests/krb5/rfc4120_constants.py
+++ b/python/samba/tests/krb5/rfc4120_constants.py
@@ -82,6 +82,7 @@ KDC_ERR_SKEW = 37
 KDC_ERR_MODIFIED = 41
 KDC_ERR_INAPP_CKSUM = 50
 KDC_ERR_GENERIC = 60
+KDC_ERR_WRONG_REALM = 68
 KDC_ERR_CLIENT_NAME_MISMATCH = 75
 KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS = 93
 

diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
index fc2917761a1669cfc1c65cc9e5c401c53a5bf230..d1fb5f210afb1d3d3117bf2e8d93fac80f633f35 100644 (file)
--- a/selftest/knownfail_heimdal_kdc
+++ b/selftest/knownfail_heimdal_kdc
@@ -325,6 +325,7 @@
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_pac
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_sname
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_non_existent_sname
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_other_sname
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_req
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_allowed_denied
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_denied
@@ -337,7 +338,14 @@
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_sid_mismatch_nonexisting
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_sid_mismatch_existing
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_sid_mismatch_nonexisting
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_tgt_cname_host
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_tgt_correct_cname
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_tgt_correct_realm
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_tgt_other_cname
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_tgt_wrong_realm
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname_krbtgt
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_srealm
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_authdata_no_pac
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_no_pac
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_allowed_denied

diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc
index aa66f4cb0fc6edecc8b1d2d063befc6ed2830c1c..04efccf4a591248dc50beb24c8a34f2becd1a27f 100644 (file)
--- a/selftest/knownfail_mit_kdc
+++ b/selftest/knownfail_mit_kdc
@@ -442,6 +442,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_authdata_no_pac
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_pac
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_sname
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_other_sname
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_req
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_allowed_denied
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_denied
@@ -454,7 +455,14 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_sid_mismatch_nonexisting
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_sid_mismatch_existing
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_sid_mismatch_nonexisting
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_tgt_cname_host
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_tgt_correct_cname
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_tgt_correct_realm
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_tgt_other_cname
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_tgt_wrong_realm
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname_krbtgt
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_srealm
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_authdata_no_pac
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_no_pac
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_allowed_denied