]> git.ipfire.org Git - thirdparty/samba.git/log
projects / thirdparty / samba.git / log
? search:
summary | shortlog | log | commit | commitdiff | tree
first ⋅ prev ⋅ next
thirdparty/samba.git
3 years agoCVE-2020-25717 wb_sids2xids: directly use state->all_ids to collect results
commit | commitdiff | tree
Stefan Metzmacher [Tue, 15 Sep 2020 12:17:37 +0000 (14:17 +0200)] 
CVE-2020-25717 wb_sids2xids: directly use state->all_ids to collect results

In order to translate the indexes from state->lookup_sids[]
for wb_lookupsids_send/recv() and state->map_ids.ids[]
for dcerpc_wbint_Sids2UnixIDs_send/recv() back to
state->all_ids.ids[] or state->sids[] we have state->tmp_idx[].

This simplifies wb_sids2xids_recv() a lot and make further
restructuring much easier.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 374acc2e5fcc3c4b40f41906d0349499e3304841)

3 years agoCVE-2020-25717 wb_sids2xids: change 'i' to 'li' in wb_sids2xids_lookupsids_done()
commit | commitdiff | tree
Stefan Metzmacher [Tue, 15 Sep 2020 11:58:26 +0000 (13:58 +0200)] 
CVE-2020-25717 wb_sids2xids: change 'i' to 'li' in wb_sids2xids_lookupsids_done()

With all the indexes we have into various array, this makes clear
'li' is the index into the state->lookup_sids array.

This makes the following changes easier to review.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 19c8b6a8b188e45a6342a3d1308085800388a38e)

3 years agoCVE-2020-25717 wb_sids2xids: refactor wb_sids2xids_done() a bit
commit | commitdiff | tree
Stefan Metzmacher [Tue, 15 Sep 2020 11:54:24 +0000 (13:54 +0200)] 
CVE-2020-25717 wb_sids2xids: refactor wb_sids2xids_done() a bit

Here we don't change the logic.

It will make the following changes easier.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit cda61f592a0b33d36da8da9b6837312396cceec4)

3 years agoCVE-2020-25717 wb_sids2xids: inline wb_sids2xids_extract_for_domain_index() into...
commit | commitdiff | tree
Stefan Metzmacher [Tue, 15 Sep 2020 11:36:43 +0000 (13:36 +0200)] 
CVE-2020-25717 wb_sids2xids: inline wb_sids2xids_extract_for_domain_index() into wb_sids2xids_next_sids2unix()

Instead of re-creating the dom_ids element,
we just use a pre-allocated map_ids_in array.

This is a bit tricky as we need to use map_ids_out as a copy of
map_ids_in, because the _ids argument of dcerpc_wbint_Sids2UnixIDs_send()
in [in,out], which means that _ids->ids is changed between
dcerpc_wbint_Sids2UnixIDs_send() and dcerpc_wbint_Sids2UnixIDs_recv()!

If the domain doesn't need any mappings, we'll move to the next domain
early, for now this can't happend but it will in future.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit f6bb0ed21f82f2cf1f238f9f00cd049ecf8673af)

3 years agoCVE-2020-25717 wb_sids2xids: move more checks to wb_sids2xids_next_sids2unix()
commit | commitdiff | tree
Stefan Metzmacher [Tue, 15 Sep 2020 11:19:14 +0000 (13:19 +0200)] 
CVE-2020-25717 wb_sids2xids: move more checks to wb_sids2xids_next_sids2unix()

For the first run this is a no-op, but it simplified the caller.

We'll call wb_sids2xids_next_sids2unix() in a few more places in future
and it's easier to have this all within wb_sids2xids_next_sids2unix().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 231c8d04b19a1c17937f988d142ca5c0f889d4e0)

3 years agoCVE-2020-25717 wb_sids2xids: rename 'non_cached' to 'lookup_sids'
commit | commitdiff | tree
Stefan Metzmacher [Thu, 10 Sep 2020 15:45:24 +0000 (17:45 +0200)] 
CVE-2020-25717 wb_sids2xids: rename 'non_cached' to 'lookup_sids'

This array is used to pass to wb_lookupsids_send()
and that will be the only reason to have this in future.

For now it's used for all non cached sids, but that will
also change in the next commits.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 797b11f198e819300007997ce536bc6d05f19843)

3 years agoCVE-2020-25717 wb_sids2xids: maintain struct wbint_TransIDArray all_ids as cache
commit | commitdiff | tree
Stefan Metzmacher [Thu, 10 Sep 2020 14:45:03 +0000 (16:45 +0200)] 
CVE-2020-25717 wb_sids2xids: maintain struct wbint_TransIDArray all_ids as cache

Entries with domain_index == UINT32_MAX are valid cache entries.

In the following commits we'll fill in missing entries step by step
until all entries are marked as filled.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 04956350a5725325954b2caba662ecd6dace7829)

3 years agoCVE-2020-25717 wb_sids2xids: split out wb_sids2xids_next_sids2unix()
commit | commitdiff | tree
Ralph Boehme [Fri, 3 Jul 2020 14:39:26 +0000 (16:39 +0200)] 
CVE-2020-25717 wb_sids2xids: split out wb_sids2xids_next_sids2unix()

Put the code that calls the per-domain idmap backend
in its own function.

This makes further reconstruction easier.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 79c1d3aaf6d465a8edd1871edb85211f8715fea1)

3 years agoCVE-2020-25717 winbindd: defer the setup_child() from init_idmap_child()
commit | commitdiff | tree
Stefan Metzmacher [Fri, 11 Sep 2020 13:42:42 +0000 (15:42 +0200)] 
CVE-2020-25717 winbindd: defer the setup_child() from init_idmap_child()

At startup we trigger a wb_parent_idmap_setup_send() and make
sure setup_child() is called just before wb_parent_idmap_setup_recv()
finished.

This makes sure our view of the idmap config in the parent matches
what we have in the child.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 28e020c0a863411cfa95e3b1ed943d922b8635bd)

3 years agoCVE-2020-25717 winbindd: assert wb_parent_idmap_setup_send/recv() was called before...
commit | commitdiff | tree
Stefan Metzmacher [Fri, 11 Sep 2020 12:12:17 +0000 (14:12 +0200)] 
CVE-2020-25717 winbindd: assert wb_parent_idmap_setup_send/recv() was called before idmap_child_handle()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit b8c74b7b46d1c7f6b66e565ee08f8c88d6dc2cc4)

3 years agoCVE-2020-25717 wb_queryuser: explain why wb_parent_idmap_setup_send/recv is not needed
commit | commitdiff | tree
Stefan Metzmacher [Fri, 11 Sep 2020 11:52:17 +0000 (13:52 +0200)] 
CVE-2020-25717 wb_queryuser: explain why wb_parent_idmap_setup_send/recv is not needed

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 82fd07793f065e150729848566e7c30f4f4d472e)

3 years agoCVE-2020-25717 wb_sids2xids: call wb_parent_idmap_setup_send/recv as the first step
commit | commitdiff | tree
Stefan Metzmacher [Fri, 11 Sep 2020 10:52:40 +0000 (12:52 +0200)] 
CVE-2020-25717 wb_sids2xids: call wb_parent_idmap_setup_send/recv as the first step

This isn't really used yet, but it will in the next commits.

Also idmap_child_handle() will soon assert that
wb_parent_idmap_setup_send/recv() was called before it's used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit d42aaeba6e0820acd17f204ff7ab6d1aede1b303)

3 years agoCVE-2020-25717 wb_xids2sids: make use of the new wb_parent_idmap_setup_send/recv...
commit | commitdiff | tree
Stefan Metzmacher [Fri, 11 Sep 2020 10:31:13 +0000 (12:31 +0200)] 
CVE-2020-25717 wb_xids2sids: make use of the new wb_parent_idmap_setup_send/recv() helpers

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit a8f57c94fc2294c309ecb18ea79d0acac86c495b)

3 years agoCVE-2020-25717 winbindd: add generic wb_parent_idmap_setup_send/recv() helpers
commit | commitdiff | tree
Stefan Metzmacher [Fri, 11 Sep 2020 10:16:00 +0000 (12:16 +0200)] 
CVE-2020-25717 winbindd: add generic wb_parent_idmap_setup_send/recv() helpers

This is more or less a copy of wb_xids2sids_init_dom_maps_send/recv,
but it's more generic and doesn't imply global state.

It also closes a initialization race by using a tevent_queue to
serialize the calls.

In the next commits we'll replace wb_xids2sids_init_dom_maps_send/recv.

We'll also use the new function in the wb_sids2xids code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 209e81a2ea8c972ee57e2f0c9579da843c0e2ac7)

3 years agoCVE-2020-25717 winbindd: add and use is_idmap_child()
commit | commitdiff | tree
Stefan Metzmacher [Fri, 11 Sep 2020 12:06:04 +0000 (14:06 +0200)] 
CVE-2020-25717 winbindd: add and use is_idmap_child()

We should avoid calling idmap_child() as much as possible.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit cd9a9702c1f97c47bd3447e2014eeff3e56268cf)

3 years agoCVE-2020-25717 winbindd: add and use idmap_child_pid()
commit | commitdiff | tree
Stefan Metzmacher [Fri, 11 Sep 2020 12:06:04 +0000 (14:06 +0200)] 
CVE-2020-25717 winbindd: add and use idmap_child_pid()

We should avoid calling idmap_child() as much as possible.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 2103543629004a3a22e7bf60305bb15bf3b316be)

3 years agoCVE-2020-25717 wb_sids2xids: avoid idmap_child() and use idmap_child_handle() instead
commit | commitdiff | tree
Stefan Metzmacher [Thu, 10 Sep 2020 13:49:34 +0000 (15:49 +0200)] 
CVE-2020-25717 wb_sids2xids: avoid idmap_child() and use idmap_child_handle() instead

This is the only aspect we need here.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 1694de1ae6ce63377d0afc47e84e55e4745905d7)

3 years agoCVE-2020-25717 wb_xids2sids: avoid idmap_child() and use idmap_child_handle() instead
commit | commitdiff | tree
Stefan Metzmacher [Fri, 11 Sep 2020 10:35:09 +0000 (12:35 +0200)] 
CVE-2020-25717 wb_xids2sids: avoid idmap_child() and use idmap_child_handle() instead

This is the only aspect we need here.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 5cc21a9d319e00397ad98900d81ffb9d1d70514f)

3 years agoCVE-2020-25717 wb_queryuser: avoid idmap_child() and use idmap_child_handle() instead
commit | commitdiff | tree
Stefan Metzmacher [Fri, 11 Sep 2020 11:52:17 +0000 (13:52 +0200)] 
CVE-2020-25717 wb_queryuser: avoid idmap_child() and use idmap_child_handle() instead

This is the only aspect we need here.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 7dbe5b4897448aa71b5a8a2175850b4010316b88)

3 years agoCVE-2020-25717 winbindd/idmap: apply const to struct nss_info_methods pointers
commit | commitdiff | tree
Stefan Metzmacher [Thu, 21 Mar 2019 11:30:37 +0000 (12:30 +0100)] 
CVE-2020-25717 winbindd/idmap: apply const to struct nss_info_methods pointers

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 7518a0ca32cade2b8b9eac0e2b5416ae685ffcff)

3 years agoCVE-2020-25717 winbindd/idmap: apply const to struct idmap_methods pointers
commit | commitdiff | tree
Stefan Metzmacher [Thu, 21 Mar 2019 11:30:37 +0000 (12:30 +0100)] 
CVE-2020-25717 winbindd/idmap: apply const to struct idmap_methods pointers

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 95b0dac0af5bc7ee85c6c8099dda135c36c9684b)

3 years agoCVE-2020-25717 test_idmap_tdb_common: correctly initialize the idmap domain with...
commit | commitdiff | tree
Stefan Metzmacher [Thu, 21 Mar 2019 11:29:00 +0000 (12:29 +0100)] 
CVE-2020-25717 test_idmap_tdb_common: correctly initialize the idmap domain with an init function

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit f5eec89011cf7b577375d83247524587f170b592)

3 years agoCVE-2020-25717 s3:passdb: use ID_TYPE_* instead of WBC_ID_TYPE_*
commit | commitdiff | tree
Stefan Metzmacher [Tue, 15 Sep 2020 14:46:44 +0000 (16:46 +0200)] 
CVE-2020-25717 s3:passdb: use ID_TYPE_* instead of WBC_ID_TYPE_*

Currently these enums have the same values, but that will
change in future.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 58e9b62222ad62c81cdf11d704859a227cb2902b)

3 years agoCVE-2020-25717 winbind.idl: rename wbint_TransID.type to wbint_TransID.type_hint
commit | commitdiff | tree
Stefan Metzmacher [Tue, 15 Sep 2020 14:01:04 +0000 (16:01 +0200)] 
CVE-2020-25717 winbind.idl: rename wbint_TransID.type to wbint_TransID.type_hint

This makes it clear that it's a hint from the parent to the
child.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 1576421dbdd2cfe9a47516224cb54bf15ba51132)

3 years agoldb: version 2.2.3 ldb-2.2.3
commit | commitdiff | tree
Stefan Metzmacher [Tue, 2 Nov 2021 14:19:31 +0000 (15:19 +0100)] 
ldb: version 2.2.3

Backport all C code changes from ldb-2.4.1
to be available for Samba 4.13.x

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(v4-13-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-13-test): Tue Nov  2 22:41:39 UTC 2021 on sn-devel-184

3 years agoldb_kv_index: fix empty initializer compile warning
commit | commitdiff | tree
Björn Jacke [Mon, 19 Oct 2020 00:39:46 +0000 (02:39 +0200)] 
ldb_kv_index: fix empty initializer compile warning

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit c862ad64aea31d1d5ec66385bb50d9b97e609071)

3 years agoldb: Use hex_byte() in ldb_binary_decode()
commit | commitdiff | tree
Volker Lendecke [Mon, 4 Jan 2021 12:55:01 +0000 (13:55 +0100)] 
ldb: Use hex_byte() in ldb_binary_decode()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit b6a57c49c00a778f954aaf10db6ebe6dca8f5ae2)

3 years agolib: Add "hex_byte()" to replace.h
commit | commitdiff | tree
Volker Lendecke [Mon, 4 Jan 2021 12:12:30 +0000 (13:12 +0100)] 
lib: Add "hex_byte()" to replace.h

This is required in quite a few places, and replace.h has things like
ZERO_STRUCT already, so this is not completely outplaced.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit c8d9ce3f7c8c486ab21e320a0adcb71311dcb453)

3 years agoldb_controls: control_to_string avoids crash
commit | commitdiff | tree
Douglas Bagnall [Fri, 24 Jul 2020 00:41:29 +0000 (12:41 +1200)] 
ldb_controls: control_to_string avoids crash

Otherwise a malformed control with unexpected NULL data will segfault
ldb_control_to_string(), though this is not very likely to affect
anyone in practice as converting controls to strings is rarely
necessary. If it happens at all in Samba it is in Python code.

Found by Honggfuzz using fuzz_ldb_parse_control.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Wed Jul 29 04:43:23 UTC 2020 on sn-devel-184

(cherry picked from commit 2aace18f170644da9c293342a6df5e5b2ae8da25)

3 years agolib:ldb-samba: Improve calculate_popt_array_length()
commit | commitdiff | tree
Andreas Schneider [Thu, 17 Dec 2020 18:16:13 +0000 (19:16 +0100)] 
lib:ldb-samba: Improve calculate_popt_array_length()

Note that memcmp() doesn't work well with padding bytes. So avoid it!

(gdb) ptype/o struct poptOption
/* offset    |  size */  type = struct poptOption {
/*    0      |     8 */    const char *longName;
/*    8      |     1 */    char shortName;
/* XXX  3-byte hole  */
/*   12      |     4 */    unsigned int argInfo;
/*   16      |     8 */    void *arg;
/*   24      |     4 */    int val;
/* XXX  4-byte hole  */
/*   32      |     8 */    const char *descrip;
/*   40      |     8 */    const char *argDescrip;

                           /* total size (bytes):   48 */

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit c2c7c1f50a8acb3169e19ba4329aa78839b66def)

3 years agolib:ldb: Use C99 initializers for builtin_popt_options[]
commit | commitdiff | tree
Andreas Schneider [Thu, 17 Dec 2020 10:56:08 +0000 (11:56 +0100)] 
lib:ldb: Use C99 initializers for builtin_popt_options[]

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit a593065c7f22e17434f33d0132cc6a7073acf414)

3 years agopyldb: fix a typo
commit | commitdiff | tree
Björn Baumbach [Mon, 18 Jan 2021 15:48:21 +0000 (16:48 +0100)] 
pyldb: fix a typo

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Rowland penny <rpenny@samba.org>
(cherry picked from commit 6fcde09f093db5d26c582a3c28531265f06b9fde)

3 years agoldb: improve comments for ldb_module_connect_backend()
commit | commitdiff | tree
Douglas Bagnall [Fri, 29 Jan 2021 00:49:02 +0000 (13:49 +1300)] 
ldb: improve comments for ldb_module_connect_backend()

There is no flags argument.
There are more URI forms.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 48068a58df0313cd904f27e2c918ee10275ae373)

3 years agoldb: correct comments in attrib_handers val_to_int64
commit | commitdiff | tree
Douglas Bagnall [Fri, 5 Mar 2021 20:57:44 +0000 (09:57 +1300)] 
ldb: correct comments in attrib_handers val_to_int64

c.f. the identical static function in lib/ldb-samba/ldif_handlers.c

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 46e6f6ef8436df7e083f34556c25f66f65ea1ce5)

3 years agoldb.h: remove undefined async_ctx function signatures
commit | commitdiff | tree
Douglas Bagnall [Fri, 18 Dec 2020 22:43:56 +0000 (11:43 +1300)] 
ldb.h: remove undefined async_ctx function signatures

These functions do not exist.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 1a05b58edaf96e7da707f9ad0a237551dbe13eb5)

3 years agolib:ldb: Add missing break in switch statement
commit | commitdiff | tree
Andreas Schneider [Mon, 1 Feb 2021 13:21:21 +0000 (14:21 +0100)] 
lib:ldb: Add missing break in switch statement

error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough]

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 1ffacac547a8ce29c6696dda73991a8db7e34dfd)

3 years agopyldb: Fix Message.items() for a message containing elements
commit | commitdiff | tree
Joseph Sutton [Fri, 28 May 2021 02:15:43 +0000 (14:15 +1200)] 
pyldb: Fix Message.items() for a message containing elements

Previously, message elements were being freed before the call to
Py_BuildValue(), resulting in an exception being raised. Additionally,
only the first element of the returned list was ever assigned to.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 3e4ec0a90a222c1cff4a91912afc703ca4cbbb0e)

3 years agoldb_match: remove redundant check
commit | commitdiff | tree
Douglas Bagnall [Wed, 3 Mar 2021 06:54:37 +0000 (19:54 +1300)] 
ldb_match: remove redundant check

We already ensure the no-trailing-asterisk case ends at the end of the
string.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14044

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit fa93339978040eab52b2722c1716028b48d8d084)

3 years agopyldb: catch potential overflow error in py_timestring
commit | commitdiff | tree
Stefan Metzmacher [Tue, 19 Jan 2021 15:53:55 +0000 (16:53 +0100)] 
pyldb: catch potential overflow error in py_timestring

Pair-Programmed-With: Björn Baumbach <bb@sernet.de>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 71e8b24b8a031de26b21539e36a60f459257d2fd)

3 years agoldb: fix ldb_comparison_fold off-by-one overrun
commit | commitdiff | tree
Douglas Bagnall [Sat, 6 Mar 2021 03:05:15 +0000 (16:05 +1300)] 
ldb: fix ldb_comparison_fold off-by-one overrun

We run one character over in comparing all the bytes in two ldb_vals.

In almost all circumstances both ldb_vals would have an allocated '\0'
in the overrun position, but it is best not to rely on that.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 2b2f4f519454beb6f2a46705675a62274019fc09)

3 years agoldb_match: trailing chunk must match end of string
commit | commitdiff | tree
Douglas Bagnall [Wed, 3 Mar 2021 06:17:36 +0000 (19:17 +1300)] 
ldb_match: trailing chunk must match end of string

A wildcard search is divided into chunks by the asterisks. While most
chunks match the first suitable string, the last chunk matches the
last possible string (unless there is a trailing asterisk, in which
case this distinction is moot).

We always knew this in our hearts, but we tried to do it in a funny
complicated way that stepped through the string, comparing here and
there, leading to CVE-2019-3824 and missed matches (bug 14044).

With this patch, we just jump to the end of the string and compare it.
As well as being correct, this should also improve performance, as the
previous algorithm involved a quadratic loop of erroneous memmem()s.

See https://tools.ietf.org/html/rfc4517

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14044

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit cc098f1cad04b2cfec4ddd6b2511cd5a600f31c6)

3 years agoldb/attrib_handler casefold: simplify space dropping
commit | commitdiff | tree
Douglas Bagnall [Tue, 8 Dec 2020 09:00:55 +0000 (22:00 +1300)] 
ldb/attrib_handler casefold: simplify space dropping

As seen in CVE-2021-20277, ldb_handler_fold() has been making mistakes
when collapsing spaces down to a single space.

This patch fixes the way it handles internal spaces (CVE-2021-20277
was about leading spaces), and involves a rewrite of the parsing loop.

The bug has a detailed description of the problem.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14656

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Apr  7 03:16:39 UTC 2021 on sn-devel-184
(cherry picked from commit  24ddc1ca9cad95673bdd8023d99867707b37085f)

3 years agoVERSION: Bump version up to Samba 4.13.14...
commit | commitdiff | tree
Jule Anger [Fri, 29 Oct 2021 06:12:27 +0000 (08:12 +0200)] 
VERSION: Bump version up to Samba 4.13.14...

and re-enable GIT_SNAPSHOT.

Signed-off-by: Jule Anger <janger@samba.org>
3 years agoVERSION: Disable GIT_SNAPSHOT for the 4.13.13 release. samba-4.13.13
commit | commitdiff | tree
Jule Anger [Fri, 29 Oct 2021 06:11:43 +0000 (08:11 +0200)] 
VERSION: Disable GIT_SNAPSHOT for the 4.13.13 release.

Signed-off-by: Jule Anger <janger@samba.org>
3 years agoWHATSNEW: Add release notes for Samba 4.13.13.
commit | commitdiff | tree
Jule Anger [Fri, 29 Oct 2021 06:11:05 +0000 (08:11 +0200)] 
WHATSNEW: Add release notes for Samba 4.13.13.

Signed-off-by: Jule Anger <janger@samba.org>
3 years agoldb: Release ldb 2.2.1 ldb-2.2.2
commit | commitdiff | tree
Andrew Bartlett [Mon, 4 Oct 2021 08:57:25 +0000 (21:57 +1300)] 
ldb: Release ldb 2.2.1

* Corrected python behaviour for 'in' for LDAP attributes
  contained as part of ldb.Message (bug 14845)
* Fix memory handling in ldb.msg_diff (bug 14836)
* Corrected python docstrings

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14836
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(v4-14-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-14-test): Tue Oct 26 13:03:37 UTC 2021 on sn-devel-184

Autobuild-User(v4-13-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-13-test): Thu Oct 28 09:49:45 UTC 2021 on sn-devel-184

3 years agopyldb: Make ldb.Message containment testing consistent with indexing
commit | commitdiff | tree
Joseph Sutton [Sat, 25 Sep 2021 02:39:59 +0000 (14:39 +1200)] 
pyldb: Make ldb.Message containment testing consistent with indexing

Previously, containment testing using the 'in' operator was handled by
performing an equality comparison between the chosen object and each of
the message's keys in turn. This behaviour was prone to errors due to
not considering differences in case between otherwise equal elements, as
the indexing operations do.

Containment testing should now be more consistent with the indexing
operations and with the get() method of ldb.Message.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 860d8902a9c502d4be83396598cf4a53c80fea69)

3 years agopyldb: Add tests for ldb.Message containment testing
commit | commitdiff | tree
Joseph Sutton [Sat, 25 Sep 2021 01:48:57 +0000 (13:48 +1200)] 
pyldb: Add tests for ldb.Message containment testing

These tests verify that the 'in' operator on ldb.Message is consistent
with indexing and the get() method. This means that the 'dn' element
should always be present, lookups should be case-insensitive, and use of
an invalid type should result in a TypeError.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 865fe238599a732360b77e06e592cb85d459acf8)

3 years agopyldb: Raise TypeError for an invalid ldb.Message index
commit | commitdiff | tree
Joseph Sutton [Sat, 25 Sep 2021 01:39:56 +0000 (13:39 +1200)] 
pyldb: Raise TypeError for an invalid ldb.Message index

Previously, a TypeError was raised and subsequently overridden by a
KeyError.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 22353767ca75af9d9e8fa1e7da372dcb5eddfcb7)

3 years agopyldb: Add test for an invalid ldb.Message index type
commit | commitdiff | tree
Joseph Sutton [Sat, 25 Sep 2021 01:22:05 +0000 (13:22 +1200)] 
pyldb: Add test for an invalid ldb.Message index type

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit b018e51d2725a23b2fedd3058644b8021f6a6a06)

3 years agos4/torture/drs/python: Fix attribute existence check
commit | commitdiff | tree
Joseph Sutton [Sat, 25 Sep 2021 07:18:39 +0000 (19:18 +1200)] 
s4/torture/drs/python: Fix attribute existence check

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit fb758c32e7633178f42dc2c031667b10c2ca6e90)

3 years agopyldb: Fix deleting an ldb.Control critical flag
commit | commitdiff | tree
Joseph Sutton [Fri, 24 Sep 2021 23:16:09 +0000 (11:16 +1200)] 
pyldb: Fix deleting an ldb.Control critical flag

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 9d25a21d6024c6c2f8e4634f45e3944d8acbf8b8)

3 years agopytest:segfault: Add test for deleting an ldb.Control critical flag
commit | commitdiff | tree
Joseph Sutton [Fri, 24 Sep 2021 23:13:02 +0000 (11:13 +1200)] 
pytest:segfault: Add test for deleting an ldb.Control critical flag

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[abartlet@samba.org backported from commit b1adaa517c1237a473bdcf818523f5107df3d6b0
 as @no_gdb_backtrace is not in Samba 4.14]

3 years agopyldb: Fix deleting an ldb.Message dn
commit | commitdiff | tree
Joseph Sutton [Fri, 24 Sep 2021 23:12:16 +0000 (11:12 +1200)] 
pyldb: Fix deleting an ldb.Message dn

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[abartlet@samba.org backported from commit d7af772de88885f46708329ff7bb5798da91d2c7
 due to conflicts in knownfail.d/python-segfaults]

3 years agopytest:segfault: Add test for deleting an ldb.Message dn
commit | commitdiff | tree
Joseph Sutton [Fri, 24 Sep 2021 22:56:25 +0000 (10:56 +1200)] 
pytest:segfault: Add test for deleting an ldb.Message dn

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[abartlet@samba.org backported from commit 6a041f6a99c39632d5c32e9d53b06719c20bef2c
 as other segfaulting tests are listed in knownfail.d/python-segfaults
 and @no_gdb_backtrace is not in 4.14]

3 years agoFix Python docstrings
commit | commitdiff | tree
Joseph Sutton [Wed, 28 Apr 2021 04:48:55 +0000 (16:48 +1200)] 
Fix Python docstrings

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Sep  4 00:55:32 UTC 2021 on sn-devel-184

(cherry picked from commit 02b187303369d3ce0c19dfb72ffa78f86a3911f0)

3 years agopyldb: Avoid use-after-free in msg_diff()
commit | commitdiff | tree
Joseph Sutton [Sun, 12 Sep 2021 23:15:17 +0000 (11:15 +1200)] 
pyldb: Avoid use-after-free in msg_diff()

Make a deep copy of the message elements in msg_diff() so that if either
of the input messages are deallocated early, the result does not refer
to non-existing elements.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14645
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14836
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
[abartlet@samba.org backported from commit
 19a2af02f57d99db8ed3c6b028c3abdf4b553700 due to conflicts in
 the knownfail.d/python-segfaults file]

Autobuild-User(v4-14-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-14-test): Wed Sep 29 13:14:22 UTC 2021 on sn-devel-184

3 years agoldb_msg: Don't fail in ldb_msg_copy() if source DN is NULL
commit | commitdiff | tree
Joseph Sutton [Mon, 13 Sep 2021 23:08:41 +0000 (11:08 +1200)] 
ldb_msg: Don't fail in ldb_msg_copy() if source DN is NULL

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14645
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14836
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit c2bbe774ce03661666a1f48922a9ab681ef4f64b)

3 years agopytest:segfault: Add test for ldb.msg_diff()
commit | commitdiff | tree
Joseph Sutton [Sun, 12 Sep 2021 23:34:56 +0000 (11:34 +1200)] 
pytest:segfault: Add test for ldb.msg_diff()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14645
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14836
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
[abartlet@samba.org backported form from commit
a99a76722d6046a5d63032e3d2bb3f791da948a6 due to conflicts
with other new segfault tests]

3 years agolib/krb5_wrap: Fix missing error check in new salt code
commit | commitdiff | tree
Andrew Bartlett [Thu, 21 Oct 2021 21:50:36 +0000 (10:50 +1300)] 
lib/krb5_wrap: Fix missing error check in new salt code

CID 1492905: Control flow issues  (DEADCODE)

This was a regression in 5eeb441b771a1ffe1ba1c69b72e8795f525a58ed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Oct 23 08:07:13 UTC 2021 on sn-devel-184

(cherry picked from commit 5094d986b7686f057195dcb10764295b88967019)

Autobuild-User(v4-13-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-13-test): Wed Oct 27 23:29:34 UTC 2021 on sn-devel-184

3 years agodsdb: Allow special chars like "@" in samAccountName when generating the salt
commit | commitdiff | tree
Andrew Bartlett [Tue, 19 Oct 2021 03:01:36 +0000 (16:01 +1300)] 
dsdb: Allow special chars like "@" in samAccountName when generating the salt

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Oct 20 12:54:54 UTC 2021 on sn-devel-184

(cherry picked from commit 5eeb441b771a1ffe1ba1c69b72e8795f525a58ed)

3 years agotests/krb5: Add tests for account salt calculation
commit | commitdiff | tree
Joseph Sutton [Tue, 19 Oct 2021 23:46:36 +0000 (12:46 +1300)] 
tests/krb5: Add tests for account salt calculation

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
[abartlet@samba.org backported from commit 46039baa81377df10e5b134e4bb064ed246795e4
 as the no_preauth side of the testsuite shows differences in enctypes
 in Samba 4.14.  The change is only in salt calculation so this is
 not vital]

3 years agotests/krb5: Fix account salt calculation to match Windows
commit | commitdiff | tree
Joseph Sutton [Tue, 19 Oct 2021 23:45:47 +0000 (12:45 +1300)] 
tests/krb5: Fix account salt calculation to match Windows

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 25bdf4c994e4fdb74abbacb1e22237f3f2cc37fe)

3 years agotests/krb5: Allow specifying the UPN for test accounts
commit | commitdiff | tree
Joseph Sutton [Tue, 19 Oct 2021 23:45:08 +0000 (12:45 +1300)] 
tests/krb5: Allow specifying the UPN for test accounts

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 889476d1754f8ce2a41557ed3bf5242c1293584e)

3 years agotests/krb5: Allow creating machine accounts without a trailing dollar
commit | commitdiff | tree
Joseph Sutton [Tue, 19 Oct 2021 23:44:19 +0000 (12:44 +1300)] 
tests/krb5: Allow creating machine accounts without a trailing dollar

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit f4785ccfefe7c89f84ad847ca3c12f604172b321)

3 years agotests/krb5: Allow specifying prefix or suffix for test account names
commit | commitdiff | tree
Joseph Sutton [Tue, 19 Oct 2021 23:41:39 +0000 (12:41 +1300)] 
tests/krb5: Allow specifying prefix or suffix for test account names

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 7e39994ed341883ac4c8c257220c19dbf70c7bc5)

3 years agotests/krb5: Decrease length of test account prefix
commit | commitdiff | tree
Joseph Sutton [Tue, 19 Oct 2021 23:39:05 +0000 (12:39 +1300)] 
tests/krb5: Decrease length of test account prefix

This allows us more room to test with different account names.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit a5a6296e57cab2b53617d997c37b4e92d4124cc7)

3 years agoselftest/Samba3: replace (winbindd => "yes", skip_wait => 1) with (winbindd => "offline")
commit | commitdiff | tree
Stefan Metzmacher [Tue, 5 Oct 2021 14:42:00 +0000 (16:42 +0200)] 
selftest/Samba3: replace (winbindd => "yes", skip_wait => 1) with (winbindd => "offline")

This is much more flexible and concentrates the logic in a single place.

We'll use winbindd => "offline" in other places soon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14870
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 4dc3c68c9a28f71888e3d6dd3b1f0bcdb8fa45de)

3 years agoselftest/Samba3: remove unused close(USERMAP); calls
commit | commitdiff | tree
Stefan Metzmacher [Fri, 8 Oct 2021 16:04:55 +0000 (18:04 +0200)] 
selftest/Samba3: remove unused close(USERMAP); calls

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14869
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[abartlet@samba.org backported from commit d998f7f8df215866ab32e05be772e24fc0b2131c
 as offline login tests are not in Samba 4.14]

3 years agowaf: Allow building with MIT KRB5 >= 1.20
commit | commitdiff | tree
Andreas Schneider [Mon, 4 Oct 2021 11:02:35 +0000 (13:02 +0200)] 
waf: Allow building with MIT KRB5 >= 1.20

gssrpc/xdr.h:105:1: error: function declaration isn’t a prototype
[-Werror=strict-prototypes]
  105 | typedef bool_t (*xdrproc_t)();
      | ^~~~~~~

This can't be fixed, as the protoype is variadic. It can take up to three
arguments.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14870
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 5d8e794551b5df835f07e2bd8348fef746144601)

3 years agoselftest: Improve error handling and perl style when setting up users in Samba4.pm
commit | commitdiff | tree
Andrew Bartlett [Sun, 17 Oct 2021 22:55:14 +0000 (11:55 +1300)] 
selftest: Improve error handling and perl style when setting up users in Samba4.pm

This catches errors and avoids using global varibles (the old
style file handles are global).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14869
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 459200caba04fd83ed650b9cdfe5b158cf9a149f)

3 years agoselftest: Remove duplicate setup of $base_dn and $ldbmodify
commit | commitdiff | tree
Andrew Bartlett [Mon, 18 Oct 2021 07:44:54 +0000 (20:44 +1300)] 
selftest: Remove duplicate setup of $base_dn and $ldbmodify

These are already set up to the same values above for the full
DC and correct values for the (strange) s4member environment.

By not setting $base_dn again we avoid an error once we start
checking for them.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881
(cherry picked from commit 2c0658d408f17af2abc223b0cb18d8d33e0ecd1a)

3 years agoselftest: krb5 account creation: clarify account type as an enum
commit | commitdiff | tree
Joseph Sutton [Fri, 8 Oct 2021 02:40:09 +0000 (15:40 +1300)] 
selftest: krb5 account creation: clarify account type as an enum

This makes the code clearer with a symbolic constant rather
than a True/False boolean.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14869
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 49306f74eb29a2192019fab9260f9d242f9d5fd9)

3 years agopytest: dynamic tests optionally add __doc__
commit | commitdiff | tree
Douglas Bagnall [Thu, 5 Aug 2021 23:08:10 +0000 (11:08 +1200)] 
pytest: dynamic tests optionally add __doc__

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14869
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit aacb18f920349e13b562c7c97901a0be7b273137)

3 years agoselftest: Increase account lockout windows to make test more realiable
commit | commitdiff | tree
Joseph Sutton [Mon, 20 Sep 2021 04:27:40 +0000 (16:27 +1200)] 
selftest: Increase account lockout windows to make test more realiable

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14868
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 6292f0597f208d7953382341380921cf0fd0a8a8)

3 years agopytest/rodc_rwdc: try to avoid race.
commit | commitdiff | tree
Douglas Bagnall [Wed, 8 Sep 2021 05:01:26 +0000 (17:01 +1200)] 
pytest/rodc_rwdc: try to avoid race.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14868
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit a169e013e66bab15e594ce49b805edebfcd503cf)

3 years agoHEIMDAL:kdc: Fix transit path validation CVE-2017-6594
commit | commitdiff | tree
Viktor Dukhovni [Wed, 10 Aug 2016 23:31:14 +0000 (23:31 +0000)] 
HEIMDAL:kdc: Fix transit path validation CVE-2017-6594

Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm
to not be added to the transit path of issued tickets.  This may, in
some cases, enable bypass of capath policy in Heimdal versions 1.5
through 7.2.

Note, this may break sites that rely on the bug.  With the bug some
incomplete [capaths] worked, that should not have.  These may now break
authentication in some cross-realm configurations.

(similar to heimdal commit b1e699103f08d6a0ca46a122193c9da65f6cf837)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12998
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Oct 20 10:58:37 UTC 2021 on sn-devel-184

(cherry picked from commit 7e961f3f7a815960ae25377d5b7515184d439690)

3 years agotests/krb5: Add tests for constrained delegation to NO_AUTH_DATA_REQUIRED service
commit | commitdiff | tree
Joseph Sutton [Mon, 18 Oct 2021 03:07:11 +0000 (16:07 +1300)] 
tests/krb5: Add tests for constrained delegation to NO_AUTH_DATA_REQUIRED service

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14871
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Oct 20 09:22:43 UTC 2021 on sn-devel-184

(cherry picked from commit 83a654a4efd39a6e792a6d49e0ecf586e9bc53ef)

3 years agotests/krb5: Ensure PAC is not present if expect_pac is false
commit | commitdiff | tree
Joseph Sutton [Mon, 18 Oct 2021 03:05:19 +0000 (16:05 +1300)] 
tests/krb5: Ensure PAC is not present if expect_pac is false

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14871
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit cc3d27596b9e8a8a46e8ba9c3c1a445477d458cf)

3 years agokdc: Correctly strip PAC, rather than error on UF_NO_AUTH_DATA_REQUIRED for servers
commit | commitdiff | tree
Andrew Bartlett [Mon, 18 Oct 2021 03:00:45 +0000 (16:00 +1300)] 
kdc: Correctly strip PAC, rather than error on UF_NO_AUTH_DATA_REQUIRED for servers

UF_NO_AUTH_DATA_REQUIRED on a server/service account should cause
the PAC to be stripped not to given an error if the PAC was still
present.

Tested against Windows 2019

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14871
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 031a8287642e3c4b9d0b7c6b51f3b1d79b227542)

3 years agokdc: Remove UF_NO_AUTH_DATA_REQUIRED from client principals
commit | commitdiff | tree
Andrew Bartlett [Mon, 18 Oct 2021 02:21:50 +0000 (15:21 +1300)] 
kdc: Remove UF_NO_AUTH_DATA_REQUIRED from client principals

Tests against Windows 2019 show that UF_NO_AUTH_DATA_REQUIRED
applies to services only, not to clients.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14871
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
[abartlet@samba.org backported from commit 92e8ce18a79e88c9b961dc20e39436c4cf653013
 as there was a knownfail conflict with the test_remove_pac case
 which succeeds on this branch]

3 years agotests/krb5: Add tests for requesting a service ticket without a PAC
commit | commitdiff | tree
Joseph Sutton [Fri, 15 Oct 2021 01:29:26 +0000 (14:29 +1300)] 
tests/krb5: Add tests for requesting a service ticket without a PAC

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sun Oct 17 23:40:33 UTC 2021 on sn-devel-184

[abartlet@samba.org backported from commit 9d3a691920205f8a9dc05d0e173e25e6a335f139
 as the MIT KDC 1.16 seen on the reference Ubuntu 18.04 does not fail
 test_remove_pac]

3 years agotests/krb5: Add method to get the PAC from a ticket
commit | commitdiff | tree
Joseph Sutton [Fri, 15 Oct 2021 01:27:25 +0000 (14:27 +1300)] 
tests/krb5: Add method to get the PAC from a ticket

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 288355896a2b6f460c42559ec46ff980ab57782e)

3 years agotests/krb5: Allow specifying whether to expect a PAC with _test_as_exchange()
commit | commitdiff | tree
Joseph Sutton [Fri, 15 Oct 2021 01:27:15 +0000 (14:27 +1300)] 
tests/krb5: Allow specifying whether to expect a PAC with _test_as_exchange()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 0dc69c1327f72384628a869a00482f6528b8671b)

3 years agotests/krb5: Allow get_tgt() to request including or omitting a PAC
commit | commitdiff | tree
Joseph Sutton [Fri, 15 Oct 2021 01:26:40 +0000 (14:26 +1300)] 
tests/krb5: Allow get_tgt() to request including or omitting a PAC

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit e086c6193f6da6fcb5d0bcada2199e9bc7ad25f5)

3 years agoheimdal:kdc: Fix ticket signing without a PAC
commit | commitdiff | tree
Joseph Sutton [Thu, 14 Oct 2021 23:12:30 +0000 (12:12 +1300)] 
heimdal:kdc: Fix ticket signing without a PAC

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit d23d8e859357b0fac4d1f4a49f1dce6cf60d6216)

3 years agoselftest/dbcheck: Fix up RODC one-way links (use correct dbcheck rule)
commit | commitdiff | tree
Andrew Bartlett [Fri, 15 Oct 2021 00:09:20 +0000 (13:09 +1300)] 
selftest/dbcheck: Fix up RODC one-way links (use correct dbcheck rule)

The previous commit was correct on intention, but it was not noticed
as there is a race, that the incorrect rule was appended to.

These links are removed by remove_plausible_deleted_DN_links not
fix_all_old_dn_string_component_mismatch

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Oct 15 10:00:47 UTC 2021 on sn-devel-184

(cherry picked from commit a7ad665e65f0701eb75cac5bc10a366ccd9689f4)

3 years agokrb5: Fix PAC signature leak affecting KDC
commit | commitdiff | tree
Nicolas Williams [Mon, 11 Oct 2021 02:55:59 +0000 (21:55 -0500)] 
krb5: Fix PAC signature leak affecting KDC

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

[jsutton@samba.org Cherry-picked from Heimdal commit
 54581d2d52443a9a07ed5980df331f660b397dcf]

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit f6adfefbbb41b9100736134d0f975f1ec0c33c42)

3 years agos4:kdc: Check ticket signature
commit | commitdiff | tree
Joseph Sutton [Fri, 8 Oct 2021 03:08:39 +0000 (16:08 +1300)] 
s4:kdc: Check ticket signature

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 02fa69c6c73c01d82807be4370e838f3e7c66f35)

3 years agoheimdal: Make _krb5_pac_get_kdc_checksum_info() into a global function
commit | commitdiff | tree
Joseph Sutton [Fri, 8 Oct 2021 02:43:41 +0000 (15:43 +1300)] 
heimdal: Make _krb5_pac_get_kdc_checksum_info() into a global function

This lets us call it from Samba.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 3bdce12789af1e7a7aba56691f184625a432410d)

3 years agos4/heimdal/lib/krb5/pac.c: Align PAC buffers to match Windows
commit | commitdiff | tree
Joseph Sutton [Wed, 11 Aug 2021 01:27:11 +0000 (13:27 +1200)] 
s4/heimdal/lib/krb5/pac.c: Align PAC buffers to match Windows

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 28a5a586c8e9cd155d676dcfcb81a2587ace99d1)

3 years agokdc: correctly generate PAC TGS signature
commit | commitdiff | tree
Luke Howard [Thu, 23 Sep 2021 07:51:51 +0000 (17:51 +1000)] 
kdc: correctly generate PAC TGS signature

When generating an AS-REQ, the TGS signature was incorrectly generated using
the server key, which would fail to validate if the server was not also the
TGS. Fix this.

Patch from Isaac Bourkis <iboukris@gmail.com>.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

[jsutton@samba.org Backported from Heimdal commit
 e7863e2af922809dad25a2e948e98c408944d551
 - Samba's Heimdal version does not have the generate_pac() helper
 function.
 - Samba's Heimdal version does not use the 'r' context variable.
]

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 91e684f5dcb48b76e6a322c15acb53cbce5c275a)

3 years agokdc: use ticket client name when signing PAC
commit | commitdiff | tree
Luke Howard [Thu, 23 Sep 2021 04:39:35 +0000 (14:39 +1000)] 
kdc: use ticket client name when signing PAC

The principal in the PAC_LOGON_NAME buffer is expected to match the client name
in the ticket. Previously we were setting this to the canonical client name,
which would have broken PAC validation if the client did not request name
canonicalization

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

[jsutton@samba.org Backported from Heimdal commit
 3b0856cab2b25624deb1f6e0e67637ba96a647ac
 - Renamed variable to avoid shadowing existing variable
]

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 75d1a7cd14b134506061ed64ddb9b99856231d2c)

3 years agokdc: only set HDB_F_GET_KRBTGT when requesting TGS principal
commit | commitdiff | tree
Luke Howard [Sun, 6 Jan 2019 06:54:58 +0000 (17:54 +1100)] 
kdc: only set HDB_F_GET_KRBTGT when requesting TGS principal

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

[jsutton@samba.org Backported from Heimdal commit
 f1dd2b818aa0866960945edea02a6bc782ed697c
 - Removed change to _kdc_find_etype() use_strongest_session_key
 parameter since Samba's Heimdal version uses different logic
]

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit db30b71f79864a20b38a1f812a5df833f3a92de8)

3 years agokrb5: return KRB5KRB_AP_ERR_INAPP_CKSUM if PAC checksum fails
commit | commitdiff | tree
Luke Howard [Fri, 17 Sep 2021 03:57:57 +0000 (13:57 +1000)] 
krb5: return KRB5KRB_AP_ERR_INAPP_CKSUM if PAC checksum fails

Return KRB5KRB_AP_ERR_INAPP_CKSUM instead of EINVAL when verifying a PAC, if
the checksum is absent or unkeyed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

[jsutton@samba.org Cherry-picked from Heimdal commit
c4b99b48c4b18f30d504b427bc1961d7a71f631e]

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit d6a472e953545ec3858ca969c1a4191e4f27ba63)

3 years agokrb5: rework PAC validation loop
commit | commitdiff | tree
Isaac Boukris [Sun, 19 Sep 2021 12:16:58 +0000 (15:16 +0300)] 
krb5: rework PAC validation loop

Avoid allocating the PAC on error.

Closes: #836
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

[jsutton@samba.org Cherry-picked from Heimdal commit
6df8be5091363a1c9a9165465ab8292f817bec81]

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 2773379603a5a625c5d1c6e62f29c442942ff570)

3 years agokrb5: allow NULL parameter to krb5_pac_free()
commit | commitdiff | tree
Isaac Boukris [Sun, 19 Sep 2021 12:04:14 +0000 (15:04 +0300)] 
krb5: allow NULL parameter to krb5_pac_free()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

[jsutton@samba.org Cherry-picked from Heimdal commit
b295167208a96e68515902138f6ce93972892ec5]

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 2d09de5c41e729bccc2d7949d8a3568a95e80e76)

3 years agokdc: sign ticket using Windows PAC
commit | commitdiff | tree
Isaac Boukris [Fri, 13 Aug 2021 09:44:37 +0000 (12:44 +0300)] 
kdc: sign ticket using Windows PAC

Split Windows PAC signing and verification logic, as the signing has to be when
the ticket is ready.

Create sign and verify the PAC KDC signature if the plugin did not, allowing
for S4U2Proxy to work, instead of KRB5SignedPath.

Use the header key to verify PAC server signature, as the same key used to
encrypt/decrypt the ticket should be used for PAC server signature, like U2U
tickets are signed witht the tgt session-key and not with the longterm key,
and so krbtgt should be no different and the header key should be used.

Lookup the delegated client in DB instead of passing the delegator DB entry.

Add PAC ticket-signatures and related functions.

Note: due to the change from KRB5SignedPath to PAC, S4U2Proxy requests
against new KDC will not work if the evidence ticket was acquired from
an old KDC, and vide versa.

Closes: #767
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

[jsutton@samba.org Backported from Heimdal commit
 2ffaba9401d19c718764d4bd24180960290238e9
 - Removed tests
 - Adapted to Samba's version of Heimdal
 - Addressed build failures with -O3
 - Added knownfails
]

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[abartlet@samba.org backported from commit d7b03394a9012960d71489e775d40d10fd6f5232
 due to conflicts in knownfail due to missing tests that crash the
 MIT KDC]

3 years agokdc: remove KRB5SignedPath, to be replaced with PAC
commit | commitdiff | tree
Isaac Boukris [Mon, 28 Dec 2020 20:07:10 +0000 (22:07 +0200)] 
kdc: remove KRB5SignedPath, to be replaced with PAC

KRB5SignedPath was a Heimdal-specific authorization data element used to
protect the authenticity of evidence tickets when used in constrained
delegation (without a Windows PAC).

Remove this, to be replaced with the Windows PAC which itself now supports
signing the entire ticket in the TGS key.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

[jsutton@samba.org Backported from Heimdal commit
 bb1d8f2a8c2545bccdf2c9179ce9259bf1050086
 - Removed tests
 - Removed auditing hook (only present in Heimdal master)
 - Added knownfails
]

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit ccabc7f16cca5b0dcb46233e934e708167f1071b)

3 years agos4/torture: Expect ticket checksum PAC buffer
commit | commitdiff | tree
Joseph Sutton [Fri, 8 Oct 2021 02:42:29 +0000 (15:42 +1300)] 
s4/torture: Expect ticket checksum PAC buffer

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[abartlet@samba.org backported from commit d5002c34ce1ffef795dc83af3175ca0e04d17dfd
 due to missing tests in Samba 4.14 that crashed the MIT KDC]

next
Mirror of https://github.com/samba-team/samba.git