CVE-2020-25717: s3:auth: simplify make_session_info_krb5() by removing unused arguments

This is only ever be called in standalone mode with an MIT realm,
so we don't have a PAC/info3 structure.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c
index 8649dd87efcf98cfb2384bc1812e11f1f7635f50..b429c5f9f04b23d9a787dd5e27898f8f28081193 100644 (file)
--- a/source3/auth/auth_generic.c
+++ b/source3/auth/auth_generic.c
@@ -227,7 +227,7 @@ static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx,
 
        status = make_session_info_krb5(mem_ctx,
                                        ntuser, ntdomain, username, pw,
-                                       NULL, is_guest, is_mapped, NULL /* No session key for now, caller will sort it out */,
+                                       is_guest, is_mapped,
                                        session_info);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",

diff --git a/source3/auth/proto.h b/source3/auth/proto.h
index 46fae447347f19b79bedcdd9c2fa1050bac4c5e2..fb7f663512b687d1b5ceb04e453c7c059ac85e04 100644 (file)
--- a/source3/auth/proto.h
+++ b/source3/auth/proto.h
@@ -434,9 +434,7 @@ NTSTATUS make_session_info_krb5(TALLOC_CTX *mem_ctx,
                                char *ntdomain,
                                char *username,
                                struct passwd *pw,
-                               const struct netr_SamInfo3 *info3,
                                bool mapped_to_guest, bool username_was_mapped,
-                               DATA_BLOB *session_key,
                                struct auth_session_info **session_info);
 
 /* The following definitions come from auth/auth_samba4.c  */

diff --git a/source3/auth/user_krb5.c b/source3/auth/user_krb5.c
index 7b69ca6c222e957c06fd28777a3920a4017d2bcd..b8f37cbeee05e3c4b0661c264d780f6afa116257 100644 (file)
--- a/source3/auth/user_krb5.c
+++ b/source3/auth/user_krb5.c
@@ -150,9 +150,7 @@ NTSTATUS make_session_info_krb5(TALLOC_CTX *mem_ctx,
                                char *ntdomain,
                                char *username,
                                struct passwd *pw,
-                               const struct netr_SamInfo3 *info3,
                                bool mapped_to_guest, bool username_was_mapped,
-                               DATA_BLOB *session_key,
                                struct auth_session_info **session_info)
 {
        NTSTATUS status;
@@ -166,20 +164,6 @@ NTSTATUS make_session_info_krb5(TALLOC_CTX *mem_ctx,
                        return status;
                }
 
-       } else if (info3) {
-               /* pass the unmapped username here since map_username()
-                  will be called again in make_server_info_info3() */
-
-               status = make_server_info_info3(mem_ctx,
-                                               ntuser, ntdomain,
-                                               &server_info,
-                                               info3);
-               if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(1, ("make_server_info_info3 failed: %s!\n",
-                                 nt_errstr(status)));
-                       return status;
-               }
-
        } else {
                /*
                 * We didn't get a PAC, we have to make up the user
@@ -231,7 +215,7 @@ NTSTATUS make_session_info_krb5(TALLOC_CTX *mem_ctx,
 
        server_info->nss_token |= username_was_mapped;
 
-       status = create_local_token(mem_ctx, server_info, session_key, ntuser, session_info);
+       status = create_local_token(mem_ctx, server_info, NULL, ntuser, session_info);
        talloc_free(server_info);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(10,("failed to create local token: %s\n",
@@ -261,9 +245,7 @@ NTSTATUS make_session_info_krb5(TALLOC_CTX *mem_ctx,
                                char *ntdomain,
                                char *username,
                                struct passwd *pw,
-                               const struct netr_SamInfo3 *info3,
                                bool mapped_to_guest, bool username_was_mapped,
-                               DATA_BLOB *session_key,
                                struct auth_session_info **session_info)
 {
        return NT_STATUS_NOT_IMPLEMENTED;