From: Joseph Sutton <josephsutton@catalyst.net.nz>
Date: Tue, 26 Oct 2021 08:06:58 +0000 (+1300)
Subject: CVE-2020-25719 tests/krb5: Add test for user-to-user with no sname
X-Git-Tag: samba-4.13.14~72
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d151c2528d1e3f662b60f429bf314d6a10b76d09;p=thirdparty%2Fsamba.git

CVE-2020-25719 tests/krb5: Add test for user-to-user with no sname

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14873

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py
index 2005d71fa81..b0f60c0a8ce 100755
--- a/python/samba/tests/krb5/kdc_tgs_tests.py
+++ b/python/samba/tests/krb5/kdc_tgs_tests.py
@@ -1122,6 +1122,14 @@ class KdcTgsTests(KDCBaseTest):
         self._user2user(tgt, creds, sname=sname,
                         expected_error=KDC_ERR_S_PRINCIPAL_UNKNOWN)
 
+    def test_user2user_no_sname(self):
+        creds = self._get_creds()
+        tgt = self._get_tgt(creds)
+
+        self._user2user(tgt, creds, sname=False,
+                        expected_error=(KDC_ERR_GENERIC,
+                                        KDC_ERR_S_PRINCIPAL_UNKNOWN))
+
     def test_user2user_service_ticket(self):
         creds = self._get_creds()
         tgt = self._get_tgt(creds)
@@ -2025,16 +2033,24 @@ class KdcTgsTests(KDCBaseTest):
                  expected_status=None):
         srealm = target_creds.get_realm()
 
-        if sname is None:
-            target_name = target_creds.get_username()
-            if target_name == 'krbtgt':
-                sname = self.PrincipalName_create(name_type=NT_SRV_INST,
-                                                  names=[target_name, srealm])
-            else:
-                if target_name[-1] == '$':
-                    target_name = target_name[:-1]
-                sname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
-                                                  names=['host', target_name])
+        if sname is False:
+            sname = None
+            expected_sname = self.get_krbtgt_sname()
+        else:
+            if sname is None:
+                target_name = target_creds.get_username()
+                if target_name == 'krbtgt':
+                    sname = self.PrincipalName_create(
+                        name_type=NT_SRV_INST,
+                        names=[target_name, srealm])
+                else:
+                    if target_name[-1] == '$':
+                        target_name = target_name[:-1]
+                    sname = self.PrincipalName_create(
+                        name_type=NT_PRINCIPAL,
+                        names=['host', target_name])
+
+            expected_sname = sname
 
         if additional_ticket is not None:
             additional_tickets = [additional_ticket.ticket]
@@ -2062,7 +2078,7 @@ class KdcTgsTests(KDCBaseTest):
             expected_crealm=tgt.crealm,
             expected_cname=expected_cname,
             expected_srealm=srealm,
-            expected_sname=sname,
+            expected_sname=expected_sname,
             ticket_decryption_key=decryption_key,
             generate_padata_fn=generate_padata_fn,
             check_error_fn=check_error_fn,
diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
index 41ad710d2f2..fc2917761a1 100644
--- a/selftest/knownfail_heimdal_kdc
+++ b/selftest/knownfail_heimdal_kdc
@@ -323,6 +323,7 @@
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_authdata_no_pac
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_matching_sname_host
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_pac
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_sname
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_non_existent_sname
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_req
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_allowed_denied
diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc
index cf3fc5abbaf..aa66f4cb0fc 100644
--- a/selftest/knownfail_mit_kdc
+++ b/selftest/knownfail_mit_kdc
@@ -441,6 +441,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_upn_dns_info_ex_user
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_authdata_no_pac
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_pac
+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_sname
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_req
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_allowed_denied
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_denied