CVE-2020-25719 CVE-2020-25717: selftest: remove "gensec:require_pac" settings

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14799
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

[jsutton@samba.org Added knownfail entries]

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/selftest/knownfail.d/no-pac b/selftest/knownfail.d/no-pac
new file mode 100644 (file)
index 0000000..9723d58
--- /dev/null
+++ b/selftest/knownfail.d/no-pac
@@ -0,0 +1,4 @@
+^samba.tests.krb5.test_ccache.samba.tests.krb5.test_ccache.CcacheTests.test_ccache_no_pac
+^samba.tests.krb5.test_ldap.samba.tests.krb5.test_ldap.LdapTests.test_ldap_no_pac
+^samba.tests.krb5.test_rpc.samba.tests.krb5.test_rpc.RpcTests.test_rpc_no_pac
+^samba.tests.krb5.test_smb.samba.tests.krb5.test_smb.SmbTests.test_smb_no_pac

diff --git a/selftest/selftest.pl b/selftest/selftest.pl
index 258a8437922ca333d70e3cab7e047372f5b654f4..48792b59bf1911a7918a18b01fa879fc8ab9b0b2 100755 (executable)
--- a/selftest/selftest.pl
+++ b/selftest/selftest.pl
@@ -609,8 +609,6 @@ sub write_clientconf($$$)
        client min protocol = CORE
        log level = 1
        torture:basedir = $clientdir
-#We don't want to pass our self-tests if the PAC code is wrong
-       gensec:require_pac = true
 #We don't want to run 'speed' tests for very long
         torture:timelimit = 1
         winbind separator = /

diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 7c17060dcb04084c1a80e575ff0bcfcf45313158..156dc16bda0edd66038d080c4cbc94a8ac5b4745 100755 (executable)
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -777,8 +777,6 @@ sub provision_raw_step1($$)
        notify:inotify = false
        ldb:nosync = true
        ldap server require strong auth = yes
-#We don't want to pass our self-tests if the PAC code is wrong
-       gensec:require_pac = true
        log file = $ctx->{logdir}/log.\%m
        log level = $ctx->{server_loglevel}
        lanman auth = Yes