Compare commits
26 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
1d12bc92cb | ||
|
|
9d960aa7dc | ||
|
|
702128d53c | ||
|
|
3f06841aef | ||
|
|
3a9f5d3bb2 | ||
|
|
38398b649b | ||
|
|
4b26702db6 | ||
|
|
0ed44241f3 | ||
|
|
32d6e0b192 | ||
|
8765be8a0c | ||
|
bf08b1efb1 | ||
|
|
8d61cef699 | ||
|
|
dc112b2d52 | ||
|
6a17bf060e | ||
|
|
d2e8446548 | ||
|
|
ae52bff41c | ||
|
|
d9a57ff08d | ||
|
|
d15e8be882 | ||
|
|
96c7f6360c | ||
|
|
4d223e30d1 | ||
|
|
3193ace05e | ||
|
|
c3fc35c53d | ||
|
|
62cd094850 | ||
|
|
9449c82b06 | ||
|
|
f7f42087f6 | ||
|
|
32d4b560ed |
8 changed files with 885 additions and 629 deletions
30
.gitignore
vendored
30
.gitignore
vendored
|
|
@ -199,3 +199,33 @@ samba-3.6.0pre1.tar.gz
|
|||
/samba-4.12.0rc4.tar.asc
|
||||
/samba-4.12.0.tar.xz
|
||||
/samba-4.12.0.tar.asc
|
||||
/samba-4.12.1.tar.xz
|
||||
/samba-4.12.1.tar.asc
|
||||
/samba-4.12.2.tar.xz
|
||||
/samba-4.12.2.tar.asc
|
||||
/samba-4.12.3.tar.xz
|
||||
/samba-4.12.3.tar.asc
|
||||
/samba-4.12.4.tar.xz
|
||||
/samba-4.12.4.tar.asc
|
||||
/samba-4.12.5.tar.xz
|
||||
/samba-4.12.5.tar.asc
|
||||
/samba-4.12.6.tar.xz
|
||||
/samba-4.12.6.tar.asc
|
||||
/samba-4.12.7.tar.xz
|
||||
/samba-4.12.7.tar.asc
|
||||
/samba-4.12.8.tar.xz
|
||||
/samba-4.12.8.tar.asc
|
||||
/samba-4.12.9.tar.xz
|
||||
/samba-4.12.9.tar.asc
|
||||
/samba-4.12.10.tar.xz
|
||||
/samba-4.12.10.tar.asc
|
||||
/samba-4.12.11.tar.xz
|
||||
/samba-4.12.11.tar.asc
|
||||
/samba-4.12.12.tar.xz
|
||||
/samba-4.12.12.tar.asc
|
||||
/samba-4.12.13.tar.xz
|
||||
/samba-4.12.13.tar.asc
|
||||
/samba-4.12.14.tar.xz
|
||||
/samba-4.12.14.tar.asc
|
||||
/samba-4.12.15.tar.xz
|
||||
/samba-4.12.15.tar.asc
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -1,174 +0,0 @@
|
|||
From 04b262f686b5b16ba659ade1e4b5778e2b219f0a Mon Sep 17 00:00:00 2001
|
||||
From: Isaac Boukris <iboukris@gmail.com>
|
||||
Date: Mon, 16 Sep 2019 16:40:12 +0300
|
||||
Subject: [PATCH 1/2] Adapt sign_authdata in our KDB module for krb5 v1.18
|
||||
|
||||
Signed-off-by: Isaac Boukris <iboukris@samba.org>
|
||||
---
|
||||
source4/kdc/mit-kdb/kdb_samba.c | 2 +-
|
||||
source4/kdc/mit-kdb/kdb_samba.h | 21 +++++++++++++++++++++
|
||||
source4/kdc/mit-kdb/kdb_samba_policies.c | 24 ++++++++++++++++++++++++
|
||||
3 files changed, 46 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/source4/kdc/mit-kdb/kdb_samba.c b/source4/kdc/mit-kdb/kdb_samba.c
|
||||
index c5157d6ed1b..02bbdca9f54 100644
|
||||
--- a/source4/kdc/mit-kdb/kdb_samba.c
|
||||
+++ b/source4/kdc/mit-kdb/kdb_samba.c
|
||||
@@ -139,7 +139,7 @@ static void kdb_samba_db_free_principal_e_data(krb5_context context,
|
||||
|
||||
kdb_vftabl kdb_function_table = {
|
||||
.maj_ver = KRB5_KDB_DAL_MAJOR_VERSION,
|
||||
- .min_ver = 1,
|
||||
+ .min_ver = KRB5_KDB_DAL_MAJOR_VERSION == 6 ? 1 : 0,
|
||||
|
||||
.init_library = kdb_samba_init_library,
|
||||
.fini_library = kdb_samba_fini_library,
|
||||
diff --git a/source4/kdc/mit-kdb/kdb_samba.h b/source4/kdc/mit-kdb/kdb_samba.h
|
||||
index 22ef9085b6a..ad4f6e27573 100644
|
||||
--- a/source4/kdc/mit-kdb/kdb_samba.h
|
||||
+++ b/source4/kdc/mit-kdb/kdb_samba.h
|
||||
@@ -114,6 +114,7 @@ krb5_error_code kdb_samba_dbekd_encrypt_key_data(krb5_context context,
|
||||
|
||||
/* from kdb_samba_policies.c */
|
||||
|
||||
+#if KRB5_KDB_API_VERSION < 10
|
||||
krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
unsigned int flags,
|
||||
krb5_const_principal client_princ,
|
||||
@@ -127,6 +128,26 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
krb5_timestamp authtime,
|
||||
krb5_authdata **tgt_auth_data,
|
||||
krb5_authdata ***signed_auth_data);
|
||||
+#else
|
||||
+krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
+ unsigned int flags,
|
||||
+ krb5_const_principal client_princ,
|
||||
+ krb5_const_principal server_princ,
|
||||
+ krb5_db_entry *client,
|
||||
+ krb5_db_entry *server,
|
||||
+ krb5_db_entry *krbtgt,
|
||||
+ krb5_db_entry *local_krbtgt,
|
||||
+ krb5_keyblock *client_key,
|
||||
+ krb5_keyblock *server_key,
|
||||
+ krb5_keyblock *krbtgt_key,
|
||||
+ krb5_keyblock *local_krbtgt_key,
|
||||
+ krb5_keyblock *session_key,
|
||||
+ krb5_timestamp authtime,
|
||||
+ krb5_authdata **tgt_auth_data,
|
||||
+ void *authdata_info,
|
||||
+ krb5_data ***auth_indicators,
|
||||
+ krb5_authdata ***signed_auth_data);
|
||||
+#endif
|
||||
|
||||
krb5_error_code kdb_samba_db_check_policy_as(krb5_context context,
|
||||
krb5_kdc_req *kdcreq,
|
||||
diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
|
||||
index fc80329f221..e2f7174b0c2 100644
|
||||
--- a/source4/kdc/mit-kdb/kdb_samba_policies.c
|
||||
+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
|
||||
@@ -287,6 +287,7 @@ done:
|
||||
return code;
|
||||
}
|
||||
|
||||
+#if KRB5_KDB_API_VERSION < 10
|
||||
krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
unsigned int flags,
|
||||
krb5_const_principal client_princ,
|
||||
@@ -301,6 +302,29 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
krb5_authdata **tgt_auth_data,
|
||||
krb5_authdata ***signed_auth_data)
|
||||
{
|
||||
+#else
|
||||
+krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
+ unsigned int flags,
|
||||
+ krb5_const_principal client_princ,
|
||||
+ krb5_const_principal server_princ,
|
||||
+ krb5_db_entry *client,
|
||||
+ krb5_db_entry *server,
|
||||
+ krb5_db_entry *krbtgt,
|
||||
+ krb5_db_entry *local_krbtgt,
|
||||
+ krb5_keyblock *client_key,
|
||||
+ krb5_keyblock *server_key,
|
||||
+ krb5_keyblock *krbtgt_key,
|
||||
+ krb5_keyblock *local_krbtgt_key,
|
||||
+ krb5_keyblock *session_key,
|
||||
+ krb5_timestamp authtime,
|
||||
+ krb5_authdata **tgt_auth_data,
|
||||
+ void *authdata_info,
|
||||
+ krb5_data ***auth_indicators,
|
||||
+ krb5_authdata ***signed_auth_data)
|
||||
+{
|
||||
+ krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt;
|
||||
+ krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
|
||||
+#endif
|
||||
krb5_const_principal ks_client_princ;
|
||||
krb5_authdata **authdata = NULL;
|
||||
krb5_boolean is_as_req;
|
||||
--
|
||||
2.24.1
|
||||
|
||||
|
||||
From c968ec07fa403ed919dcda7b3087e0d10d1e7a32 Mon Sep 17 00:00:00 2001
|
||||
From: Isaac Boukris <iboukris@gmail.com>
|
||||
Date: Thu, 16 Jan 2020 22:00:21 +0100
|
||||
Subject: [PATCH 2/2] Sign and verify PAC with ticket principal instead of
|
||||
canon principal
|
||||
|
||||
With MIT library 1.18 the KDC no longer set
|
||||
KRB5_KDB_FLAG_CANONICALIZE for enterprise principals which allows
|
||||
us to not canonicalize them (like in Windwos / Heimdal).
|
||||
|
||||
However, it now breaks the PAC signature verification as it was
|
||||
wrongly done using canonical client rather than ticket client name.
|
||||
|
||||
Signed-off-by: Isaac Boukris <iboukris@samba.org>
|
||||
---
|
||||
source4/kdc/mit-kdb/kdb_samba_policies.c | 12 ++----------
|
||||
1 file changed, 2 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
|
||||
index e2f7174b0c2..6a5f06a8a8c 100644
|
||||
--- a/source4/kdc/mit-kdb/kdb_samba_policies.c
|
||||
+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
|
||||
@@ -325,20 +325,12 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt;
|
||||
krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
|
||||
#endif
|
||||
- krb5_const_principal ks_client_princ;
|
||||
krb5_authdata **authdata = NULL;
|
||||
krb5_boolean is_as_req;
|
||||
krb5_error_code code;
|
||||
krb5_pac pac = NULL;
|
||||
krb5_data pac_data;
|
||||
|
||||
- /* Prefer canonicalised name from client entry */
|
||||
- if (client != NULL) {
|
||||
- ks_client_princ = client->princ;
|
||||
- } else {
|
||||
- ks_client_princ = client_princ;
|
||||
- }
|
||||
-
|
||||
is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
|
||||
|
||||
if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) {
|
||||
@@ -351,7 +343,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
if (!is_as_req) {
|
||||
code = ks_verify_pac(context,
|
||||
flags,
|
||||
- ks_client_princ,
|
||||
+ client_princ,
|
||||
client,
|
||||
server,
|
||||
krbtgt,
|
||||
@@ -378,7 +370,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
goto done;
|
||||
}
|
||||
|
||||
- code = krb5_pac_sign(context, pac, authtime, ks_client_princ,
|
||||
+ code = krb5_pac_sign(context, pac, authtime, client_princ,
|
||||
server_key, krbtgt_key, &pac_data);
|
||||
if (code != 0) {
|
||||
DBG_ERR("krb5_pac_sign failed: %d\n", code);
|
||||
--
|
||||
2.24.1
|
||||
|
||||
|
|
@ -1,438 +0,0 @@
|
|||
From a1fdd83ab776f981e992c3f2fc8c341d6b37a0d4 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
||||
Date: Thu, 5 Mar 2020 22:45:48 +0100
|
||||
Subject: [PATCH 1/3] s4-torture: add rpc test for ChangeServiceConfigW
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313
|
||||
|
||||
Guenther
|
||||
|
||||
Signed-off-by: Guenther Deschner <gd@samba.org>
|
||||
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||
(cherry picked from commit 0825324bc75d2ab10164a1f137be782d84c822b8)
|
||||
---
|
||||
selftest/knownfail | 3 ++
|
||||
source4/torture/rpc/svcctl.c | 78 +++++++++++++++++++++++++++++++++++-
|
||||
2 files changed, 80 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/selftest/knownfail b/selftest/knownfail
|
||||
index c9ef0851172..20441c078b4 100644
|
||||
--- a/selftest/knownfail
|
||||
+++ b/selftest/knownfail
|
||||
@@ -234,6 +234,9 @@
|
||||
^samba3.rpc.eventlog.eventlog.GetNumRecords\(ad_dc\)
|
||||
^samba3.rpc.eventlog.eventlog.OpenEventLog\(ad_dc\)
|
||||
^samba3.rap.basic.netsessiongetinfo\(ad_dc\)
|
||||
+# not implemented
|
||||
+^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\)
|
||||
+^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\)
|
||||
#
|
||||
# This makes less sense when not running against an AD DC
|
||||
#
|
||||
diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c
|
||||
index ebb2bc6ad0e..bd16ed4627d 100644
|
||||
--- a/source4/torture/rpc/svcctl.c
|
||||
+++ b/source4/torture/rpc/svcctl.c
|
||||
@@ -3,7 +3,7 @@
|
||||
test suite for svcctl rpc operations
|
||||
|
||||
Copyright (C) Jelmer Vernooij 2004
|
||||
- Copyright (C) Guenther Deschner 2008,2009
|
||||
+ Copyright (C) Guenther Deschner 2008,2009,2020
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@@ -623,6 +623,80 @@ static bool test_SCManager(struct torture_context *tctx,
|
||||
return true;
|
||||
}
|
||||
|
||||
+static bool test_ChangeServiceConfigW(struct torture_context *tctx,
|
||||
+ struct dcerpc_pipe *p)
|
||||
+{
|
||||
+ struct svcctl_ChangeServiceConfigW r;
|
||||
+ struct svcctl_QueryServiceConfigW q;
|
||||
+ struct policy_handle h, s;
|
||||
+ NTSTATUS status;
|
||||
+ struct dcerpc_binding_handle *b = p->binding_handle;
|
||||
+ struct QUERY_SERVICE_CONFIG query;
|
||||
+ bool ok;
|
||||
+
|
||||
+ uint32_t offered = 0;
|
||||
+ uint32_t needed = 0;
|
||||
+
|
||||
+ ok = test_OpenSCManager(b, tctx, &h);
|
||||
+ if (!ok) {
|
||||
+ return false;
|
||||
+ }
|
||||
+
|
||||
+ ok = test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s);
|
||||
+ if (!ok) {
|
||||
+ return false;
|
||||
+ }
|
||||
+
|
||||
+ q.in.handle = &s;
|
||||
+ q.in.offered = offered;
|
||||
+ q.out.query = &query;
|
||||
+ q.out.needed = &needed;
|
||||
+
|
||||
+ status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &q);
|
||||
+ torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!");
|
||||
+
|
||||
+ if (W_ERROR_EQUAL(q.out.result, WERR_INSUFFICIENT_BUFFER)) {
|
||||
+ q.in.offered = needed;
|
||||
+ status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &q);
|
||||
+ torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!");
|
||||
+ }
|
||||
+ torture_assert_werr_ok(tctx, q.out.result, "QueryServiceConfigW failed!");
|
||||
+
|
||||
+ r.in.handle = &s;
|
||||
+ r.in.type = query.service_type;
|
||||
+ r.in.start_type = query.start_type;
|
||||
+ r.in.error_control = query.error_control;
|
||||
+
|
||||
+ /*
|
||||
+ * according to MS-SCMR 3.1.4.11 NULL params are supposed to leave the
|
||||
+ * existing values intact.
|
||||
+ */
|
||||
+
|
||||
+ r.in.binary_path = NULL;
|
||||
+ r.in.load_order_group = NULL;
|
||||
+ r.in.dependencies = NULL;
|
||||
+ r.in.service_start_name = NULL;
|
||||
+ r.in.password = NULL;
|
||||
+ r.in.display_name = NULL;
|
||||
+ r.out.tag_id = NULL;
|
||||
+
|
||||
+ status = dcerpc_svcctl_ChangeServiceConfigW_r(b, tctx, &r);
|
||||
+ torture_assert_ntstatus_ok(tctx, status, "ChangeServiceConfigW failed!");
|
||||
+ torture_assert_werr_ok(tctx, r.out.result, "ChangeServiceConfigW failed!");
|
||||
+
|
||||
+ ok = test_CloseServiceHandle(b, tctx, &s);
|
||||
+ if (!ok) {
|
||||
+ return false;
|
||||
+ }
|
||||
+
|
||||
+ ok = test_CloseServiceHandle(b, tctx, &h);
|
||||
+ if (!ok) {
|
||||
+ return false;
|
||||
+ }
|
||||
+
|
||||
+ return true;
|
||||
+}
|
||||
+
|
||||
struct torture_suite *torture_rpc_svcctl(TALLOC_CTX *mem_ctx)
|
||||
{
|
||||
struct torture_suite *suite = torture_suite_create(mem_ctx, "svcctl");
|
||||
@@ -652,6 +726,8 @@ struct torture_suite *torture_rpc_svcctl(TALLOC_CTX *mem_ctx)
|
||||
test_StartServiceW);
|
||||
torture_rpc_tcase_add_test(tcase, "ControlService",
|
||||
test_ControlService);
|
||||
+ torture_rpc_tcase_add_test(tcase, "ChangeServiceConfigW",
|
||||
+ test_ChangeServiceConfigW);
|
||||
|
||||
return suite;
|
||||
}
|
||||
--
|
||||
2.24.1
|
||||
|
||||
|
||||
From 1168f1c392b3e315b5a4af9be793b93234420786 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
||||
Date: Thu, 5 Mar 2020 20:42:21 +0100
|
||||
Subject: [PATCH 2/3] s4-torture: add ndr svcctl testsuite
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313
|
||||
|
||||
Guenther
|
||||
|
||||
Signed-off-by: Guenther Deschner <gd@samba.org>
|
||||
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||
(cherry picked from commit c3fa0b2df9fc53dddcc3160b6a3dc751bbb389a4)
|
||||
---
|
||||
librpc/idl/svcctl.idl | 2 +-
|
||||
selftest/knownfail | 5 +++
|
||||
source4/torture/ndr/ndr.c | 1 +
|
||||
source4/torture/ndr/svcctl.c | 85 +++++++++++++++++++++++++++++++++++
|
||||
source4/torture/wscript_build | 1 +
|
||||
5 files changed, 93 insertions(+), 1 deletion(-)
|
||||
create mode 100644 source4/torture/ndr/svcctl.c
|
||||
|
||||
diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl
|
||||
index 671a1dc47be..e909bf2dbed 100644
|
||||
--- a/librpc/idl/svcctl.idl
|
||||
+++ b/librpc/idl/svcctl.idl
|
||||
@@ -188,7 +188,7 @@ import "misc.idl", "security.idl";
|
||||
SVCCTL_DISABLED = 0x00000004
|
||||
} svcctl_StartType;
|
||||
|
||||
- WERROR svcctl_ChangeServiceConfigW(
|
||||
+ [public] WERROR svcctl_ChangeServiceConfigW(
|
||||
[in,ref] policy_handle *handle,
|
||||
[in] uint32 type,
|
||||
[in] svcctl_StartType start_type,
|
||||
diff --git a/selftest/knownfail b/selftest/knownfail
|
||||
index 20441c078b4..c5d4cdd9419 100644
|
||||
--- a/selftest/knownfail
|
||||
+++ b/selftest/knownfail
|
||||
@@ -237,6 +237,11 @@
|
||||
# not implemented
|
||||
^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\)
|
||||
^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\)
|
||||
+# broken IDL
|
||||
+^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_IN
|
||||
+^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_OUT
|
||||
+^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_IN
|
||||
+^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_OUT
|
||||
#
|
||||
# This makes less sense when not running against an AD DC
|
||||
#
|
||||
diff --git a/source4/torture/ndr/ndr.c b/source4/torture/ndr/ndr.c
|
||||
index 32efe90757d..690301f31b1 100644
|
||||
--- a/source4/torture/ndr/ndr.c
|
||||
+++ b/source4/torture/ndr/ndr.c
|
||||
@@ -708,6 +708,7 @@ struct torture_suite *torture_local_ndr(TALLOC_CTX *mem_ctx)
|
||||
torture_suite_add_suite(suite, ndr_krb5pac_suite(suite));
|
||||
torture_suite_add_suite(suite, ndr_cabinet_suite(suite));
|
||||
torture_suite_add_suite(suite, ndr_charset_suite(suite));
|
||||
+ torture_suite_add_suite(suite, ndr_svcctl_suite(suite));
|
||||
|
||||
torture_suite_add_simple_test(suite, "string terminator",
|
||||
test_check_string_terminator);
|
||||
diff --git a/source4/torture/ndr/svcctl.c b/source4/torture/ndr/svcctl.c
|
||||
new file mode 100644
|
||||
index 00000000000..1c9404597cd
|
||||
--- /dev/null
|
||||
+++ b/source4/torture/ndr/svcctl.c
|
||||
@@ -0,0 +1,85 @@
|
||||
+/*
|
||||
+ Unix SMB/CIFS implementation.
|
||||
+ test suite for svcctl ndr operations
|
||||
+
|
||||
+ Copyright (C) Guenther Deschner 2020
|
||||
+
|
||||
+ This program is free software; you can redistribute it and/or modify
|
||||
+ it under the terms of the GNU General Public License as published by
|
||||
+ the Free Software Foundation; either version 3 of the License, or
|
||||
+ (at your option) any later version.
|
||||
+
|
||||
+ This program is distributed in the hope that it will be useful,
|
||||
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
+ GNU General Public License for more details.
|
||||
+
|
||||
+ You should have received a copy of the GNU General Public License
|
||||
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
+*/
|
||||
+
|
||||
+#include "includes.h"
|
||||
+#include "torture/ndr/ndr.h"
|
||||
+#include "librpc/gen_ndr/ndr_svcctl.h"
|
||||
+#include "torture/ndr/proto.h"
|
||||
+#include "param/param.h"
|
||||
+
|
||||
+static const uint8_t svcctl_ChangeServiceConfigW_req_data[] = {
|
||||
+ 0x00, 0x00, 0x00, 0x00, 0xcd, 0x94, 0x05, 0x40, 0x30, 0x28, 0x00, 0x49,
|
||||
+ 0x8d, 0xe4, 0x8e, 0x85, 0xb7, 0x19, 0x5c, 0x83, 0x10, 0x01, 0x00, 0x00,
|
||||
+ 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
||||
+};
|
||||
+
|
||||
+static bool svcctl_ChangeServiceConfigW_req_check(struct torture_context *tctx,
|
||||
+ struct svcctl_ChangeServiceConfigW *r)
|
||||
+{
|
||||
+ struct policy_handle handle = { 0 };
|
||||
+ GUID_from_string("400594cd-2830-4900-8de4-8e85b7195c83", &handle.uuid);
|
||||
+
|
||||
+ torture_assert_guid_equal(tctx, r->in.handle->uuid, handle.uuid, "handle");
|
||||
+ torture_assert_u32_equal(tctx, r->in.type, 0x00000110, "type");
|
||||
+ torture_assert_u32_equal(tctx, r->in.start_type, SVCCTL_AUTO_START, "start_type");
|
||||
+ torture_assert_u32_equal(tctx, r->in.error_control, SVCCTL_SVC_ERROR_NORMAL, "error_control");
|
||||
+ torture_assert_str_equal(tctx, r->in.binary_path, NULL, "binary_path");
|
||||
+ torture_assert_str_equal(tctx, r->in.load_order_group, NULL, "load_order_group");
|
||||
+ torture_assert_str_equal(tctx, r->in.dependencies, NULL, "dependencies");
|
||||
+ torture_assert_str_equal(tctx, r->in.service_start_name, NULL, "service_start_name");
|
||||
+ torture_assert_str_equal(tctx, r->in.password, NULL, "password");
|
||||
+ torture_assert_str_equal(tctx, r->in.display_name, NULL, "display_name");
|
||||
+
|
||||
+ return true;
|
||||
+}
|
||||
+
|
||||
+static const uint8_t svcctl_ChangeServiceConfigW_rep_data[] = {
|
||||
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
||||
+};
|
||||
+
|
||||
+static bool svcctl_ChangeServiceConfigW_rep_check(struct torture_context *tctx,
|
||||
+ struct svcctl_ChangeServiceConfigW *r)
|
||||
+{
|
||||
+ torture_assert(tctx, r->out.tag_id == NULL, "tag_id");
|
||||
+ torture_assert_werr_ok(tctx, r->out.result, "result");
|
||||
+
|
||||
+ return true;
|
||||
+}
|
||||
+
|
||||
+struct torture_suite *ndr_svcctl_suite(TALLOC_CTX *ctx)
|
||||
+{
|
||||
+ struct torture_suite *suite = torture_suite_create(ctx, "svcctl");
|
||||
+
|
||||
+ torture_suite_add_ndr_pull_fn_test(suite,
|
||||
+ svcctl_ChangeServiceConfigW,
|
||||
+ svcctl_ChangeServiceConfigW_req_data,
|
||||
+ NDR_IN,
|
||||
+ svcctl_ChangeServiceConfigW_req_check);
|
||||
+
|
||||
+ torture_suite_add_ndr_pull_fn_test(suite,
|
||||
+ svcctl_ChangeServiceConfigW,
|
||||
+ svcctl_ChangeServiceConfigW_rep_data,
|
||||
+ NDR_OUT,
|
||||
+ svcctl_ChangeServiceConfigW_rep_check);
|
||||
+ return suite;
|
||||
+}
|
||||
diff --git a/source4/torture/wscript_build b/source4/torture/wscript_build
|
||||
index 65af160b322..05a6fbcbf14 100644
|
||||
--- a/source4/torture/wscript_build
|
||||
+++ b/source4/torture/wscript_build
|
||||
@@ -71,6 +71,7 @@ bld.SAMBA_SUBSYSTEM('TORTURE_NDR',
|
||||
ndr/winspool.c
|
||||
ndr/cabinet.c
|
||||
ndr/charset.c
|
||||
+ ndr/svcctl.c
|
||||
''',
|
||||
autoproto='ndr/proto.h',
|
||||
deps='torture krb5samba',
|
||||
--
|
||||
2.24.1
|
||||
|
||||
|
||||
From 28d86d48adfee6c1d03ea192b69be87a0b9ce400 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
||||
Date: Wed, 4 Mar 2020 15:23:43 +0100
|
||||
Subject: [PATCH 3/3] librpc: fix IDL for svcctl_ChangeServiceConfigW
|
||||
|
||||
Found while trying to run winexe against Windows Server 2019.
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313
|
||||
|
||||
Guenther
|
||||
|
||||
Signed-off-by: Guenther Deschner <gd@samba.org>
|
||||
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||
(cherry picked from commit ebda529b59105e9b70cc74377fe4d54cc16b4f37)
|
||||
---
|
||||
examples/winexe/winexe.c | 2 ++
|
||||
librpc/idl/svcctl.idl | 23 ++++++++++++++++++-----
|
||||
selftest/knownfail | 5 -----
|
||||
source4/torture/ndr/svcctl.c | 3 +++
|
||||
source4/torture/rpc/svcctl.c | 3 +++
|
||||
5 files changed, 26 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c
|
||||
index 22f748b1d45..fc6b15f8e52 100644
|
||||
--- a/examples/winexe/winexe.c
|
||||
+++ b/examples/winexe/winexe.c
|
||||
@@ -625,8 +625,10 @@ static NTSTATUS winexe_svc_install(
|
||||
NULL, /* load_order_group */
|
||||
NULL, /* tag_id */
|
||||
NULL, /* dependencies */
|
||||
+ 0, /* dwDependSize */
|
||||
NULL, /* service_start_name */
|
||||
NULL, /* password */
|
||||
+ 0, /* dwPwSize */
|
||||
NULL, /* display_name */
|
||||
&werr);
|
||||
|
||||
diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl
|
||||
index e909bf2dbed..a9dd3dec990 100644
|
||||
--- a/librpc/idl/svcctl.idl
|
||||
+++ b/librpc/idl/svcctl.idl
|
||||
@@ -13,6 +13,17 @@ import "misc.idl", "security.idl";
|
||||
helpstring("Service Control")
|
||||
] interface svcctl
|
||||
{
|
||||
+ const int MAX_SERVICE_NAME_LENGTH = 256;
|
||||
+ const short SC_MAX_DEPEND_SIZE = 4 * 1024;
|
||||
+ const short SC_MAX_NAME_LENGTH = MAX_SERVICE_NAME_LENGTH + 1;
|
||||
+ const short SC_MAX_PATH_LENGTH = 32 * 1024;
|
||||
+ const short SC_MAX_PWD_SIZE = 514;
|
||||
+ const short SC_MAX_COMPUTER_NAME_LENGTH = 1024;
|
||||
+ const short SC_MAX_ACCOUNT_NAME_LENGTH = 2 * 1024;
|
||||
+ const short SC_MAX_COMMENT_LENGTH = 128;
|
||||
+ const short SC_MAX_ARGUMENT_LENGTH = 1024;
|
||||
+ const short SC_MAX_ARGUMENTS = 1024;
|
||||
+
|
||||
typedef struct {
|
||||
uint32 is_locked;
|
||||
[string,charset(UTF16)] uint16 *lock_owner;
|
||||
@@ -195,11 +206,13 @@ import "misc.idl", "security.idl";
|
||||
[in] svcctl_ErrorControl error_control,
|
||||
[in,unique] [string,charset(UTF16)] uint16 *binary_path,
|
||||
[in,unique] [string,charset(UTF16)] uint16 *load_order_group,
|
||||
- [out,ref] uint32 *tag_id,
|
||||
- [in,unique] [string,charset(UTF16)] uint16 *dependencies,
|
||||
- [in,unique] [string,charset(UTF16)] uint16 *service_start_name,
|
||||
- [in,unique] [string,charset(UTF16)] uint16 *password,
|
||||
- [in,unique] [string,charset(UTF16)] uint16 *display_name
|
||||
+ [in,out,unique] uint32 *tag_id,
|
||||
+ [in,unique,size_is(dwDependSize)] [string,charset(UTF16)] uint16 *dependencies,
|
||||
+ [in,range(0, SC_MAX_DEPEND_SIZE)] uint32 dwDependSize,
|
||||
+ [in,unique,range(0, SC_MAX_ACCOUNT_NAME_LENGTH)] [string,charset(UTF16)] uint16 *service_start_name,
|
||||
+ [in,unique,size_is(dwPwSize)] [string,charset(UTF16)] uint16 *password,
|
||||
+ [in,range(0, SC_MAX_PWD_SIZE)] uint32 dwPwSize,
|
||||
+ [in,unique,range(0, SC_MAX_NAME_LENGTH)] [string,charset(UTF16)] uint16 *display_name
|
||||
);
|
||||
|
||||
/*****************/
|
||||
diff --git a/selftest/knownfail b/selftest/knownfail
|
||||
index c5d4cdd9419..20441c078b4 100644
|
||||
--- a/selftest/knownfail
|
||||
+++ b/selftest/knownfail
|
||||
@@ -237,11 +237,6 @@
|
||||
# not implemented
|
||||
^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\)
|
||||
^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\)
|
||||
-# broken IDL
|
||||
-^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_IN
|
||||
-^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_OUT
|
||||
-^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_IN
|
||||
-^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_OUT
|
||||
#
|
||||
# This makes less sense when not running against an AD DC
|
||||
#
|
||||
diff --git a/source4/torture/ndr/svcctl.c b/source4/torture/ndr/svcctl.c
|
||||
index 1c9404597cd..6592beda02e 100644
|
||||
--- a/source4/torture/ndr/svcctl.c
|
||||
+++ b/source4/torture/ndr/svcctl.c
|
||||
@@ -45,9 +45,12 @@ static bool svcctl_ChangeServiceConfigW_req_check(struct torture_context *tctx,
|
||||
torture_assert_u32_equal(tctx, r->in.error_control, SVCCTL_SVC_ERROR_NORMAL, "error_control");
|
||||
torture_assert_str_equal(tctx, r->in.binary_path, NULL, "binary_path");
|
||||
torture_assert_str_equal(tctx, r->in.load_order_group, NULL, "load_order_group");
|
||||
+ torture_assert(tctx, r->in.tag_id == NULL, "tag_id");
|
||||
torture_assert_str_equal(tctx, r->in.dependencies, NULL, "dependencies");
|
||||
+ torture_assert_u32_equal(tctx, r->in.dwDependSize, 0, "dwDependSize");
|
||||
torture_assert_str_equal(tctx, r->in.service_start_name, NULL, "service_start_name");
|
||||
torture_assert_str_equal(tctx, r->in.password, NULL, "password");
|
||||
+ torture_assert_u32_equal(tctx, r->in.dwPwSize, 0, "dwPwSize");
|
||||
torture_assert_str_equal(tctx, r->in.display_name, NULL, "display_name");
|
||||
|
||||
return true;
|
||||
diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c
|
||||
index bd16ed4627d..746b399360e 100644
|
||||
--- a/source4/torture/rpc/svcctl.c
|
||||
+++ b/source4/torture/rpc/svcctl.c
|
||||
@@ -675,9 +675,12 @@ static bool test_ChangeServiceConfigW(struct torture_context *tctx,
|
||||
r.in.binary_path = NULL;
|
||||
r.in.load_order_group = NULL;
|
||||
r.in.dependencies = NULL;
|
||||
+ r.in.dwDependSize = 0;
|
||||
r.in.service_start_name = NULL;
|
||||
r.in.password = NULL;
|
||||
+ r.in.dwPwSize = 0;
|
||||
r.in.display_name = NULL;
|
||||
+ r.in.tag_id = NULL;
|
||||
r.out.tag_id = NULL;
|
||||
|
||||
status = dcerpc_svcctl_ChangeServiceConfigW_r(b, tctx, &r);
|
||||
--
|
||||
2.24.1
|
||||
|
||||
BIN
samba-pubkey_AA99442FB680B620.gpg
Normal file
BIN
samba-pubkey_AA99442FB680B620.gpg
Normal file
Binary file not shown.
726
samba-s4u.patch
Normal file
726
samba-s4u.patch
Normal file
|
|
@ -0,0 +1,726 @@
|
|||
From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001
|
||||
From: Isaac Boukris <iboukris@gmail.com>
|
||||
Date: Fri, 27 Sep 2019 18:25:03 +0300
|
||||
Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support
|
||||
|
||||
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
|
||||
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
|
||||
---
|
||||
source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++---------
|
||||
source4/kdc/mit_samba.c | 47 ++----
|
||||
source4/kdc/mit_samba.h | 6 +-
|
||||
wscript_configure_system_mitkrb5 | 3 +
|
||||
6 files changed, 91 insertions(+), 115 deletions(-)
|
||||
|
||||
diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
|
||||
index 9197551ed61..944324d9a2f 100644
|
||||
--- a/source4/kdc/mit-kdb/kdb_samba_policies.c
|
||||
+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
|
||||
@@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context,
|
||||
krb5_keyblock *krbtgt_key,
|
||||
krb5_timestamp authtime,
|
||||
krb5_authdata **tgt_auth_data,
|
||||
- krb5_pac *pac)
|
||||
+ krb5_pac *out_pac)
|
||||
{
|
||||
struct mit_samba_context *mit_ctx;
|
||||
krb5_authdata **authdata = NULL;
|
||||
- krb5_pac ipac = NULL;
|
||||
- DATA_BLOB logon_data = { NULL, 0 };
|
||||
+ krb5_keyblock *header_server_key = NULL;
|
||||
+ krb5_key_data *impersonator_kd = NULL;
|
||||
+ krb5_keyblock impersonator_key = {0};
|
||||
krb5_error_code code;
|
||||
+ krb5_pac pac;
|
||||
+
|
||||
+ *out_pac = NULL;
|
||||
|
||||
mit_ctx = ks_get_context(context);
|
||||
if (mit_ctx == NULL) {
|
||||
@@ -230,41 +234,43 @@ static krb5_error_code ks_verify_pac(krb5_context context,
|
||||
code = krb5_pac_parse(context,
|
||||
authdata[0]->contents,
|
||||
authdata[0]->length,
|
||||
- &ipac);
|
||||
+ &pac);
|
||||
if (code != 0) {
|
||||
goto done;
|
||||
}
|
||||
|
||||
- /* TODO: verify this is correct
|
||||
- *
|
||||
- * In the constrained delegation case, the PAC is from a service
|
||||
- * ticket rather than a TGT; we must verify the server and KDC
|
||||
- * signatures to assert that the server did not forge the PAC.
|
||||
+ /*
|
||||
+ * For constrained delegation in MIT version < 1.18 we aren't provided
|
||||
+ * with the 2nd ticket server key to verify the PAC.
|
||||
+ * We can workaround that by fetching the key from the client db entry,
|
||||
+ * which is the impersonator account in that version.
|
||||
+ * TODO: use the provided entry in the new 1.18 version.
|
||||
*/
|
||||
if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
|
||||
- code = krb5_pac_verify(context,
|
||||
- ipac,
|
||||
- authtime,
|
||||
- client_princ,
|
||||
- server_key,
|
||||
- krbtgt_key);
|
||||
+ /* The impersonator must be local. */
|
||||
+ if (client == NULL) {
|
||||
+ code = KRB5KDC_ERR_BADOPTION;
|
||||
+ goto done;
|
||||
+ }
|
||||
+ /* Fetch and decrypt 2nd ticket server's current key. */
|
||||
+ code = krb5_dbe_find_enctype(context, client, -1, -1, 0,
|
||||
+ &impersonator_kd);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+ code = krb5_dbe_decrypt_key_data(context, NULL,
|
||||
+ impersonator_kd,
|
||||
+ &impersonator_key, NULL);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+ header_server_key = &impersonator_key;
|
||||
} else {
|
||||
- code = krb5_pac_verify(context,
|
||||
- ipac,
|
||||
- authtime,
|
||||
- client_princ,
|
||||
- krbtgt_key,
|
||||
- NULL);
|
||||
- }
|
||||
- if (code != 0) {
|
||||
- goto done;
|
||||
+ header_server_key = krbtgt_key;
|
||||
}
|
||||
|
||||
- /* check and update PAC */
|
||||
- code = krb5_pac_parse(context,
|
||||
- authdata[0]->contents,
|
||||
- authdata[0]->length,
|
||||
- pac);
|
||||
+ code = krb5_pac_verify(context, pac, authtime, client_princ,
|
||||
+ header_server_key, NULL);
|
||||
if (code != 0) {
|
||||
goto done;
|
||||
}
|
||||
@@ -272,17 +278,22 @@ static krb5_error_code ks_verify_pac(krb5_context context,
|
||||
code = mit_samba_reget_pac(mit_ctx,
|
||||
context,
|
||||
flags,
|
||||
- client_princ,
|
||||
client,
|
||||
server,
|
||||
krbtgt,
|
||||
krbtgt_key,
|
||||
- pac);
|
||||
+ &pac);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ *out_pac = pac;
|
||||
+ pac = NULL;
|
||||
|
||||
done:
|
||||
+ krb5_free_keyblock_contents(context, &impersonator_key);
|
||||
krb5_free_authdata(context, authdata);
|
||||
- krb5_pac_free(context, ipac);
|
||||
- free(logon_data.data);
|
||||
+ krb5_pac_free(context, pac);
|
||||
|
||||
return code;
|
||||
}
|
||||
@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
{
|
||||
#endif
|
||||
krb5_authdata **authdata = NULL;
|
||||
- krb5_boolean is_as_req;
|
||||
+ krb5_const_principal pac_client;
|
||||
krb5_error_code code;
|
||||
krb5_pac pac = NULL;
|
||||
krb5_data pac_data;
|
||||
@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
|
||||
#endif
|
||||
|
||||
- /* FIXME: We don't support S4U yet */
|
||||
- if (flags & KRB5_KDB_FLAGS_S4U) {
|
||||
- return KRB5_KDB_DBTYPE_NOSUP;
|
||||
- }
|
||||
-
|
||||
- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
|
||||
-
|
||||
- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) {
|
||||
- code = ks_get_pac(context, client, client_key, &pac);
|
||||
- if (code != 0) {
|
||||
- goto done;
|
||||
- }
|
||||
+ /* In protocol transition, we are currently not provided with the tgt
|
||||
+ * client name to verify the PAC, we could probably skip the name
|
||||
+ * verification and just verify the signatures, but since we don't
|
||||
+ * support cross-realm nor aliases, we can just use server->princ */
|
||||
+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
|
||||
+ pac_client = server->princ;
|
||||
+ } else {
|
||||
+ pac_client = client_princ;
|
||||
}
|
||||
|
||||
- if (!is_as_req) {
|
||||
+ /* TGS request */
|
||||
+ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) {
|
||||
code = ks_verify_pac(context,
|
||||
flags,
|
||||
- client_princ,
|
||||
+ pac_client,
|
||||
client,
|
||||
server,
|
||||
krbtgt,
|
||||
@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
if (code != 0) {
|
||||
goto done;
|
||||
}
|
||||
+
|
||||
+ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */
|
||||
+ if (pac == NULL) {
|
||||
+ code = KRB5_KDB_DBTYPE_NOSUP;
|
||||
+ goto done;
|
||||
+ }
|
||||
}
|
||||
|
||||
- if (pac == NULL && client != NULL) {
|
||||
+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
|
||||
+ krb5_pac_free(context, pac);
|
||||
+ pac = NULL;
|
||||
+ }
|
||||
|
||||
+ /* AS request or local realm protocol transition */
|
||||
+ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) ||
|
||||
+ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) {
|
||||
code = ks_get_pac(context, client, client_key, &pac);
|
||||
if (code != 0) {
|
||||
goto done;
|
||||
}
|
||||
+ /* We require a pac! */
|
||||
+ SMB_ASSERT(pac != NULL);
|
||||
}
|
||||
|
||||
if (pac == NULL) {
|
||||
@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
}
|
||||
|
||||
code = krb5_pac_sign(context, pac, authtime, client_princ,
|
||||
- server_key, krbtgt_key, &pac_data);
|
||||
+ server_key, krbtgt_key, &pac_data);
|
||||
if (code != 0) {
|
||||
DBG_ERR("krb5_pac_sign failed: %d\n", code);
|
||||
goto done;
|
||||
@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
|
||||
KRB5_AUTHDATA_IF_RELEVANT,
|
||||
authdata,
|
||||
signed_auth_data);
|
||||
- if (code != 0) {
|
||||
- goto done;
|
||||
- }
|
||||
-
|
||||
- code = 0;
|
||||
|
||||
done:
|
||||
krb5_pac_free(context, pac);
|
||||
@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
|
||||
* server; -> delegating service
|
||||
* proxy; -> target principal
|
||||
*/
|
||||
- krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server);
|
||||
-
|
||||
- char *target_name = NULL;
|
||||
- bool is_enterprise;
|
||||
- krb5_error_code code;
|
||||
|
||||
mit_ctx = ks_get_context(context);
|
||||
if (mit_ctx == NULL) {
|
||||
return KRB5_KDB_DBNOTINITED;
|
||||
}
|
||||
|
||||
- code = krb5_unparse_name(context, proxy, &target_name);
|
||||
- if (code) {
|
||||
- goto done;
|
||||
- }
|
||||
-
|
||||
- is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL);
|
||||
-
|
||||
- code = mit_samba_check_s4u2proxy(mit_ctx,
|
||||
- delegating_service,
|
||||
- target_name,
|
||||
- is_enterprise);
|
||||
-
|
||||
-done:
|
||||
- free(target_name);
|
||||
- return code;
|
||||
+ return mit_samba_check_s4u2proxy(mit_ctx, server, proxy);
|
||||
}
|
||||
|
||||
|
||||
diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
|
||||
index 54dcd545ea1..f23327c9613 100644
|
||||
--- a/source4/kdc/mit_samba.c
|
||||
+++ b/source4/kdc/mit_samba.c
|
||||
@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
|
||||
krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
|
||||
krb5_context context,
|
||||
int flags,
|
||||
- krb5_const_principal client_principal,
|
||||
krb5_db_entry *client,
|
||||
krb5_db_entry *server,
|
||||
krb5_db_entry *krbtgt,
|
||||
@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
|
||||
context,
|
||||
*pac,
|
||||
server->princ,
|
||||
- discard_const(client_principal),
|
||||
+ client->princ,
|
||||
deleg_blob);
|
||||
if (!NT_STATUS_IS_OK(nt_status)) {
|
||||
DEBUG(0, ("Update delegation info failed: %s\n",
|
||||
@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
|
||||
}
|
||||
|
||||
int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
|
||||
- krb5_db_entry *kentry,
|
||||
- const char *target_name,
|
||||
- bool is_nt_enterprise_name)
|
||||
+ const krb5_db_entry *server,
|
||||
+ krb5_const_principal target_principal)
|
||||
{
|
||||
-#if 1
|
||||
- /*
|
||||
- * This is disabled because mit_samba_update_pac_data() does not handle
|
||||
- * S4U_DELEGATION_INFO
|
||||
- */
|
||||
-
|
||||
- return KRB5KDC_ERR_BADOPTION;
|
||||
-#else
|
||||
- krb5_principal target_principal;
|
||||
- int flags = 0;
|
||||
- int ret;
|
||||
-
|
||||
- if (is_nt_enterprise_name) {
|
||||
- flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE;
|
||||
- }
|
||||
-
|
||||
- ret = krb5_parse_name_flags(ctx->context, target_name,
|
||||
- flags, &target_principal);
|
||||
- if (ret) {
|
||||
- return ret;
|
||||
- }
|
||||
-
|
||||
- ret = samba_kdc_check_s4u2proxy(ctx->context,
|
||||
- ctx->db_ctx,
|
||||
- skdc_entry,
|
||||
- target_principal);
|
||||
-
|
||||
- krb5_free_principal(ctx->context, target_principal);
|
||||
-
|
||||
- return ret;
|
||||
-#endif
|
||||
+ struct samba_kdc_entry *server_skdc_entry =
|
||||
+ talloc_get_type_abort(server->e_data,
|
||||
+ struct samba_kdc_entry);
|
||||
+
|
||||
+ return samba_kdc_check_s4u2proxy(ctx->context,
|
||||
+ ctx->db_ctx,
|
||||
+ server_skdc_entry,
|
||||
+ target_principal);
|
||||
}
|
||||
|
||||
static krb5_error_code mit_samba_change_pwd_error(krb5_context context,
|
||||
diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h
|
||||
index ba824557bd5..5aadf206443 100644
|
||||
--- a/source4/kdc/mit_samba.h
|
||||
+++ b/source4/kdc/mit_samba.h
|
||||
@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
|
||||
krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
|
||||
krb5_context context,
|
||||
int flags,
|
||||
- krb5_const_principal client_principal,
|
||||
krb5_db_entry *client,
|
||||
krb5_db_entry *server,
|
||||
krb5_db_entry *krbtgt,
|
||||
@@ -73,9 +72,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
|
||||
DATA_BLOB *e_data);
|
||||
|
||||
int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
|
||||
- krb5_db_entry *kentry,
|
||||
- const char *target_name,
|
||||
- bool is_nt_enterprise_name);
|
||||
+ const krb5_db_entry *server,
|
||||
+ krb5_const_principal target_principal);
|
||||
|
||||
int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
|
||||
char *pwd,
|
||||
--
|
||||
2.25.4
|
||||
|
||||
From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001
|
||||
From: Isaac Boukris <iboukris@gmail.com>
|
||||
Date: Fri, 27 Sep 2019 18:35:30 +0300
|
||||
Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build
|
||||
|
||||
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
|
||||
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
|
||||
---
|
||||
lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++
|
||||
lib/krb5_wrap/krb5_samba.h | 2 -
|
||||
source4/auth/kerberos/kerberos_util.c | 11 --
|
||||
4 files changed, 185 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
|
||||
index 20ce86c708d..e72ab3c30f7 100644
|
||||
--- a/lib/krb5_wrap/krb5_samba.c
|
||||
+++ b/lib/krb5_wrap/krb5_samba.c
|
||||
@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
|
||||
|
||||
return 0;
|
||||
}
|
||||
+
|
||||
+#else /* MIT */
|
||||
+
|
||||
+static bool princ_compare_no_dollar(krb5_context ctx,
|
||||
+ krb5_principal a,
|
||||
+ krb5_principal b)
|
||||
+{
|
||||
+ bool cmp;
|
||||
+ krb5_principal mod = NULL;
|
||||
+
|
||||
+ if (a->length == 1 && b->length == 1 &&
|
||||
+ a->data[0].length != 0 && b->data[0].length != 0 &&
|
||||
+ a->data[0].data[a->data[0].length -1] !=
|
||||
+ b->data[0].data[b->data[0].length -1]) {
|
||||
+ if (a->data[0].data[a->data[0].length -1] == '$') {
|
||||
+ mod = a;
|
||||
+ mod->data[0].length--;
|
||||
+ } else if (b->data[0].data[b->data[0].length -1] == '$') {
|
||||
+ mod = b;
|
||||
+ mod->data[0].length--;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ cmp = krb5_principal_compare_flags(ctx, a, b,
|
||||
+ KRB5_PRINCIPAL_COMPARE_CASEFOLD);
|
||||
+
|
||||
+ if (mod != NULL) {
|
||||
+ mod->data[0].length++;
|
||||
+ }
|
||||
+
|
||||
+ return cmp;
|
||||
+}
|
||||
+
|
||||
+krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
|
||||
+ krb5_ccache store_cc,
|
||||
+ krb5_principal init_principal,
|
||||
+ const char *init_password,
|
||||
+ krb5_principal impersonate_principal,
|
||||
+ const char *self_service,
|
||||
+ const char *target_service,
|
||||
+ krb5_get_init_creds_opt *krb_options,
|
||||
+ time_t *expire_time,
|
||||
+ time_t *kdc_time)
|
||||
+{
|
||||
+ krb5_error_code code;
|
||||
+ krb5_principal self_princ = NULL;
|
||||
+ krb5_principal target_princ = NULL;
|
||||
+ krb5_creds *store_creds;
|
||||
+ krb5_creds *s4u2self_creds = NULL;
|
||||
+ krb5_creds *s4u2proxy_creds = NULL;
|
||||
+ krb5_creds init_creds = {0};
|
||||
+ krb5_creds mcreds = {0};
|
||||
+ krb5_flags options = KRB5_GC_NO_STORE;
|
||||
+ krb5_ccache tmp_cc;
|
||||
+ bool s4u2proxy;
|
||||
+
|
||||
+ code = krb5_cc_new_unique(ctx, "MEMORY", NULL, &tmp_cc);
|
||||
+ if (code != 0) {
|
||||
+ return code;
|
||||
+ }
|
||||
+
|
||||
+ code = krb5_get_init_creds_password(ctx, &init_creds,
|
||||
+ init_principal,
|
||||
+ init_password,
|
||||
+ NULL, NULL,
|
||||
+ 0,
|
||||
+ NULL,
|
||||
+ krb_options);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ code = krb5_cc_initialize(ctx, tmp_cc, init_creds.client);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ code = krb5_cc_store_cred(ctx, tmp_cc, &init_creds);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ /*
|
||||
+ * Check if we also need S4U2Proxy or if S4U2Self is
|
||||
+ * enough in order to get a ticket for the target.
|
||||
+ */
|
||||
+ if (target_service == NULL) {
|
||||
+ s4u2proxy = false;
|
||||
+ } else if (strcmp(target_service, self_service) == 0) {
|
||||
+ s4u2proxy = false;
|
||||
+ } else {
|
||||
+ s4u2proxy = true;
|
||||
+ }
|
||||
+
|
||||
+ code = krb5_parse_name(ctx, self_service, &self_princ);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ /* MIT lacks aliases support in S4U, for S4U2Self we require the tgt
|
||||
+ * client and the request server to be the same principal name. */
|
||||
+ if (!princ_compare_no_dollar(ctx, init_creds.client, self_princ)) {
|
||||
+ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ mcreds.client = impersonate_principal;
|
||||
+ mcreds.server = init_creds.client;
|
||||
+
|
||||
+ code = krb5_get_credentials_for_user(ctx, options, tmp_cc, &mcreds,
|
||||
+ NULL, &s4u2self_creds);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ if (s4u2proxy) {
|
||||
+ code = krb5_parse_name(ctx, target_service, &target_princ);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ mcreds.client = init_creds.client;
|
||||
+ mcreds.server = target_princ;
|
||||
+ mcreds.second_ticket = s4u2self_creds->ticket;
|
||||
+
|
||||
+ code = krb5_get_credentials(ctx, options |
|
||||
+ KRB5_GC_CONSTRAINED_DELEGATION,
|
||||
+ tmp_cc, &mcreds, &s4u2proxy_creds);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ /* Check KDC support of S4U2Proxy extension */
|
||||
+ if (!krb5_principal_compare(ctx, s4u2self_creds->client,
|
||||
+ s4u2proxy_creds->client)) {
|
||||
+ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ store_creds = s4u2proxy_creds;
|
||||
+ } else {
|
||||
+ store_creds = s4u2self_creds;;
|
||||
+
|
||||
+ /* We need to save the ticket with the requested server name
|
||||
+ * or the caller won't be able to find it in cache. */
|
||||
+ if (!krb5_principal_compare(ctx, self_princ,
|
||||
+ store_creds->server)) {
|
||||
+ krb5_free_principal(ctx, store_creds->server);
|
||||
+ store_creds->server = NULL;
|
||||
+ code = krb5_copy_principal(ctx, self_princ,
|
||||
+ &store_creds->server);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ code = krb5_cc_initialize(ctx, store_cc, store_creds->client);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ code = krb5_cc_store_cred(ctx, store_cc, store_creds);
|
||||
+ if (code != 0) {
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ if (expire_time) {
|
||||
+ *expire_time = (time_t) store_creds->times.endtime;
|
||||
+ }
|
||||
+
|
||||
+ if (kdc_time) {
|
||||
+ *kdc_time = (time_t) store_creds->times.starttime;
|
||||
+ }
|
||||
+
|
||||
+done:
|
||||
+ krb5_cc_destroy(ctx, tmp_cc);
|
||||
+ krb5_free_cred_contents(ctx, &init_creds);
|
||||
+ krb5_free_creds(ctx, s4u2self_creds);
|
||||
+ krb5_free_creds(ctx, s4u2proxy_creds);
|
||||
+ krb5_free_principal(ctx, self_princ);
|
||||
+ krb5_free_principal(ctx, target_princ);
|
||||
+
|
||||
+ return code;
|
||||
+}
|
||||
#endif
|
||||
|
||||
#if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
|
||||
diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h
|
||||
index ca9a893e4f7..3264ce5eb3b 100644
|
||||
--- a/lib/krb5_wrap/krb5_samba.h
|
||||
+++ b/lib/krb5_wrap/krb5_samba.h
|
||||
@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx,
|
||||
krb5_get_init_creds_opt *krb_options,
|
||||
time_t *expire_time,
|
||||
time_t *kdc_time);
|
||||
-#ifdef SAMBA4_USES_HEIMDAL
|
||||
krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
|
||||
krb5_ccache store_cc,
|
||||
krb5_principal init_principal,
|
||||
@@ -263,7 +262,6 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
|
||||
krb5_get_init_creds_opt *krb_options,
|
||||
time_t *expire_time,
|
||||
time_t *kdc_time);
|
||||
-#endif
|
||||
|
||||
#if defined(HAVE_KRB5_MAKE_PRINCIPAL)
|
||||
#define smb_krb5_make_principal krb5_make_principal
|
||||
diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
|
||||
index 544d9d853cc..c14d8c72d8c 100644
|
||||
--- a/source4/auth/kerberos/kerberos_util.c
|
||||
+++ b/source4/auth/kerberos/kerberos_util.c
|
||||
@@ -234,9 +234,7 @@ done:
|
||||
{
|
||||
krb5_error_code ret;
|
||||
const char *password;
|
||||
-#ifdef SAMBA4_USES_HEIMDAL
|
||||
const char *self_service;
|
||||
-#endif
|
||||
const char *target_service;
|
||||
time_t kdc_time = 0;
|
||||
krb5_principal princ;
|
||||
@@ -268,9 +266,7 @@ done:
|
||||
return ret;
|
||||
}
|
||||
|
||||
-#ifdef SAMBA4_USES_HEIMDAL
|
||||
self_service = cli_credentials_get_self_service(credentials);
|
||||
-#endif
|
||||
target_service = cli_credentials_get_target_service(credentials);
|
||||
|
||||
password = cli_credentials_get_password(credentials);
|
||||
@@ -331,7 +327,6 @@ done:
|
||||
#endif
|
||||
if (password) {
|
||||
if (impersonate_principal) {
|
||||
-#ifdef SAMBA4_USES_HEIMDAL
|
||||
ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context,
|
||||
ccache,
|
||||
princ,
|
||||
@@ -342,12 +337,6 @@ done:
|
||||
krb_options,
|
||||
NULL,
|
||||
&kdc_time);
|
||||
-#else
|
||||
- talloc_free(mem_ctx);
|
||||
- (*error_string) = "INTERNAL error: s4u2 ops "
|
||||
- "are not supported with MIT build yet";
|
||||
- return EINVAL;
|
||||
-#endif
|
||||
} else {
|
||||
ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context,
|
||||
ccache,
|
||||
--
|
||||
2.25.4
|
||||
|
||||
|
||||
|
||||
From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001
|
||||
From: Isaac Boukris <iboukris@gmail.com>
|
||||
Date: Sat, 19 Sep 2020 14:16:20 +0200
|
||||
Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code
|
||||
|
||||
---
|
||||
source4/heimdal/lib/hdb/hdb.h | 1 +
|
||||
source4/kdc/db-glue.c | 8 ++++++--
|
||||
source4/kdc/mit_samba.c | 3 +++
|
||||
source4/kdc/sdb.h | 1 +
|
||||
4 files changed, 11 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h
|
||||
index 6a09ecb6fe1..bc5211fef35 100644
|
||||
--- a/source4/heimdal/lib/hdb/hdb.h
|
||||
+++ b/source4/heimdal/lib/hdb/hdb.h
|
||||
@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
|
||||
#define HDB_F_ALL_KVNOS 2048 /* we want all the keys, live or not */
|
||||
#define HDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */
|
||||
#define HDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */
|
||||
+#define HDB_F_FORCE_CANON 16384 /* force canonicalition */
|
||||
|
||||
/* hdb_capability_flags */
|
||||
#define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
|
||||
diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
|
||||
index a560a1cd84b..c27b6a8ef4c 100644
|
||||
--- a/source4/kdc/db-glue.c
|
||||
+++ b/source4/kdc/db-glue.c
|
||||
@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
|
||||
}
|
||||
}
|
||||
|
||||
- } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) {
|
||||
+ } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { // was this supposed to be || ?
|
||||
ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);
|
||||
if (ret) {
|
||||
krb5_clear_error_message(context);
|
||||
goto out;
|
||||
}
|
||||
- } else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) {
|
||||
+ } else if (((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) || (flags & SDB_F_FORCE_CANON)){
|
||||
/*
|
||||
* SDB_F_CANON maps from the canonicalize flag in the
|
||||
* packet, and has a different meaning between AS-REQ
|
||||
* and TGS-REQ. We only change the principal in the AS-REQ case
|
||||
+ *
|
||||
+ * The SDB_F_FORCE_CANON if for the new MIT kdc code that wants
|
||||
+ * the canonical name in all lookups, and takes care to canonicalize
|
||||
+ * only when appropriate.
|
||||
*/
|
||||
ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);
|
||||
if (ret) {
|
||||
diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
|
||||
index f23327c9613..4084e893cc2 100644
|
||||
--- a/source4/kdc/mit_samba.c
|
||||
+++ b/source4/kdc/mit_samba.c
|
||||
@@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
|
||||
if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {
|
||||
sflags |= SDB_F_CANON;
|
||||
}
|
||||
+#if KRB5_KDB_API_VERSION >= 10
|
||||
+ sflags |= SDB_F_FORCE_CANON;
|
||||
+#endif
|
||||
if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY |
|
||||
KRB5_KDB_FLAG_INCLUDE_PAC)) {
|
||||
/*
|
||||
diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h
|
||||
index c929acccce6..a9115ec23d7 100644
|
||||
--- a/source4/kdc/sdb.h
|
||||
+++ b/source4/kdc/sdb.h
|
||||
@@ -116,6 +116,7 @@ struct sdb_entry_ex {
|
||||
#define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */
|
||||
#define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */
|
||||
#define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */
|
||||
+#define SDB_F_FORCE_CANON 16384 /* force canonicalition */
|
||||
|
||||
void sdb_free_entry(struct sdb_entry_ex *e);
|
||||
void free_sdb_entry(struct sdb_entry *s);
|
||||
--
|
||||
2.25.4
|
||||
|
||||
142
samba.spec
142
samba.spec
|
|
@ -6,15 +6,15 @@
|
|||
# ctdb is enabled by default, you can disable it with: --without clustering
|
||||
%bcond_without clustering
|
||||
|
||||
%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
|
||||
%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
|
||||
|
||||
%define main_release 5
|
||||
%define main_release 0
|
||||
|
||||
%define samba_version 4.12.0
|
||||
%define samba_version 4.12.15
|
||||
%define talloc_version 2.3.1
|
||||
%define tdb_version 1.4.3
|
||||
%define tevent_version 0.10.2
|
||||
%define ldb_version 2.1.1
|
||||
%define ldb_version 2.1.5
|
||||
# This should be rc1 or nil
|
||||
%define pre_release %nil
|
||||
|
||||
|
|
@ -88,11 +88,16 @@
|
|||
%global with_winexe 0
|
||||
%endif
|
||||
|
||||
%global with_vfs_io_uring 0
|
||||
%ifarch aarch64 ppc64le s390x x86_64 i686
|
||||
%global with_vfs_io_uring 1
|
||||
%endif
|
||||
|
||||
%global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba"
|
||||
|
||||
Name: samba
|
||||
Version: %{samba_version}
|
||||
Release: %{samba_release}.1
|
||||
Release: %{samba_release}
|
||||
|
||||
%if 0%{?rhel}
|
||||
Epoch: 0
|
||||
|
|
@ -113,7 +118,7 @@ URL: https://www.samba.org
|
|||
# This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz
|
||||
Source0: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.gz#/samba-%{version}%{pre_release}.tar.xz
|
||||
Source1: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.asc
|
||||
Source2: gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg
|
||||
Source2: samba-pubkey_AA99442FB680B620.gpg
|
||||
|
||||
# Red Hat specific replacement-files
|
||||
Source10: samba.logrotate
|
||||
|
|
@ -124,8 +129,7 @@ Source14: samba.pamd
|
|||
|
||||
Source201: README.downgrade
|
||||
|
||||
Patch100: new_mit_118.patch
|
||||
Patch101: samba-4.12.0-winexe.patch
|
||||
Patch1: samba-s4u.patch
|
||||
|
||||
Requires(pre): /usr/sbin/groupadd
|
||||
Requires(post): systemd
|
||||
|
|
@ -224,6 +228,10 @@ BuildRequires: glusterfs-devel >= 3.4.0.16
|
|||
BuildRequires: libcephfs-devel
|
||||
%endif
|
||||
|
||||
%if %{with_vfs_io_uring}
|
||||
BuildRequires: liburing-devel
|
||||
%endif
|
||||
|
||||
%if %{with_dc}
|
||||
# Add python3-iso8601 to avoid that the
|
||||
# version in Samba is being packaged
|
||||
|
|
@ -380,7 +388,6 @@ Requires: ldb-tools
|
|||
# See bug 1507420
|
||||
%samba_requires_eq libldb
|
||||
|
||||
Requires: python3-crypto
|
||||
Requires: python3-%{name} = %{samba_depver}
|
||||
Requires: python3-%{name}-dc = %{samba_depver}
|
||||
Requires: krb5-server >= %{required_mit_krb5}
|
||||
|
|
@ -1299,6 +1306,9 @@ fi
|
|||
%{_libdir}/samba/vfs/full_audit.so
|
||||
%{_libdir}/samba/vfs/gpfs.so
|
||||
%{_libdir}/samba/vfs/glusterfs_fuse.so
|
||||
%if %{with_vfs_io_uring}
|
||||
%{_libdir}/samba/vfs/io_uring.so
|
||||
%endif
|
||||
%{_libdir}/samba/vfs/linux_xfs_sgid.so
|
||||
%{_libdir}/samba/vfs/media_harmony.so
|
||||
%{_libdir}/samba/vfs/offline.so
|
||||
|
|
@ -1319,6 +1329,10 @@ fi
|
|||
%{_libdir}/samba/vfs/worm.so
|
||||
%{_libdir}/samba/vfs/xattr_tdb.so
|
||||
|
||||
%dir %{_datadir}/samba
|
||||
%dir %{_datadir}/samba/mdssvc
|
||||
%{_datadir}/samba/mdssvc/elasticsearch_mappings.json
|
||||
|
||||
%{_unitdir}/nmb.service
|
||||
%{_unitdir}/smb.service
|
||||
%attr(1777,root,root) %dir /var/spool/samba
|
||||
|
|
@ -1348,6 +1362,9 @@ fi
|
|||
%{_mandir}/man8/vfs_full_audit.8*
|
||||
%{_mandir}/man8/vfs_gpfs.8*
|
||||
%{_mandir}/man8/vfs_glusterfs_fuse.8*
|
||||
%if %{with_vfs_io_uring}
|
||||
%{_mandir}/man8/vfs_io_uring.8*
|
||||
%endif
|
||||
%{_mandir}/man8/vfs_linux_xfs_sgid.8*
|
||||
%{_mandir}/man8/vfs_media_harmony.8*
|
||||
%{_mandir}/man8/vfs_offline.8*
|
||||
|
|
@ -1432,9 +1449,6 @@ fi
|
|||
%{_mandir}/man8/cifsdd.8.*
|
||||
%{_mandir}/man8/samba-regedit.8*
|
||||
%{_mandir}/man8/smbspool.8*
|
||||
%dir %{_datadir}/samba
|
||||
%dir %{_datadir}/samba/mdssvc
|
||||
%{_datadir}/samba/mdssvc/elasticsearch_mappings.json
|
||||
|
||||
### CLIENT-LIBS
|
||||
%files client-libs
|
||||
|
|
@ -1522,7 +1536,6 @@ fi
|
|||
%{_libdir}/samba/libsmb-transport-samba4.so
|
||||
%{_libdir}/samba/libsmbclient-raw-samba4.so
|
||||
%{_libdir}/samba/libsmbd-base-samba4.so
|
||||
%{_libdir}/samba/libsmbd-conn-samba4.so
|
||||
%{_libdir}/samba/libsmbd-shim-samba4.so
|
||||
%{_libdir}/samba/libsmbldaphelper-samba4.so
|
||||
%{_libdir}/samba/libsys-rw-samba4.so
|
||||
|
|
@ -1699,7 +1712,6 @@ fi
|
|||
%{_libdir}/samba/service/winbindd.so
|
||||
%{_libdir}/samba/service/wrepl.so
|
||||
%{_libdir}/libdcerpc-server.so.*
|
||||
%{_libdir}/libdcerpc-server-core.so.*
|
||||
%{_libdir}/samba/libdnsserver-common-samba4.so
|
||||
%{_libdir}/samba/libdsdb-module-samba4.so
|
||||
%{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so
|
||||
|
|
@ -1714,6 +1726,8 @@ fi
|
|||
%{_libdir}/samba/bind9/dlz_bind9_10.so
|
||||
%{_libdir}/samba/bind9/dlz_bind9_11.so
|
||||
%{_libdir}/samba/bind9/dlz_bind9_12.so
|
||||
%{_libdir}/samba/bind9/dlz_bind9_14.so
|
||||
%{_libdir}/samba/bind9/dlz_bind9_16.so
|
||||
#endif with_dc
|
||||
%endif
|
||||
|
||||
|
|
@ -1804,6 +1818,7 @@ fi
|
|||
%{_includedir}/samba-4.0/util_ldb.h
|
||||
%{_libdir}/libdcerpc-binding.so
|
||||
%{_libdir}/libdcerpc-samr.so
|
||||
%{_libdir}/libdcerpc-server-core.so
|
||||
%{_libdir}/libdcerpc.so
|
||||
%{_libdir}/libndr-krb5pac.so
|
||||
%{_libdir}/libndr-nbt.so
|
||||
|
|
@ -1834,7 +1849,6 @@ fi
|
|||
%if %with_dc
|
||||
%{_includedir}/samba-4.0/dcerpc_server.h
|
||||
%{_libdir}/libdcerpc-server.so
|
||||
%{_libdir}/libdcerpc-server-core.so
|
||||
%{_libdir}/pkgconfig/dcerpc_server.pc
|
||||
%endif
|
||||
|
||||
|
|
@ -1872,6 +1886,7 @@ fi
|
|||
### LIBS
|
||||
%files libs
|
||||
%{_libdir}/libdcerpc-samr.so.*
|
||||
%{_libdir}/libdcerpc-server-core.so.*
|
||||
|
||||
%{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so
|
||||
%{_libdir}/samba/libauth4-samba4.so
|
||||
|
|
@ -2280,6 +2295,7 @@ fi
|
|||
%{python3_sitearch}/samba/tests/__pycache__/dns_base.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/dns_forwarder.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/dns_invalid.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/dns_packet.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc
|
||||
|
|
@ -2299,6 +2315,7 @@ fi
|
|||
%{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/join.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc
|
||||
%{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc
|
||||
|
|
@ -2445,6 +2462,7 @@ fi
|
|||
%{python3_sitearch}/samba/tests/dns_forwarder_helpers/__pycache__/server.*.pyc
|
||||
%{python3_sitearch}/samba/tests/dns_forwarder_helpers/server.py
|
||||
%{python3_sitearch}/samba/tests/dns_invalid.py
|
||||
%{python3_sitearch}/samba/tests/dns_packet.py
|
||||
%{python3_sitearch}/samba/tests/dns_tkey.py
|
||||
%{python3_sitearch}/samba/tests/dns_wildcard.py
|
||||
%{python3_sitearch}/samba/tests/dsdb.py
|
||||
|
|
@ -2484,6 +2502,7 @@ fi
|
|||
%{python3_sitearch}/samba/tests/kcc/kcc_utils.py
|
||||
%{python3_sitearch}/samba/tests/kcc/ldif_import_export.py
|
||||
%{python3_sitearch}/samba/tests/krb5_credentials.py
|
||||
%{python3_sitearch}/samba/tests/ldap_raw.py
|
||||
%{python3_sitearch}/samba/tests/ldap_referrals.py
|
||||
%{python3_sitearch}/samba/tests/libsmb.py
|
||||
%{python3_sitearch}/samba/tests/loadparm.py
|
||||
|
|
@ -2558,6 +2577,9 @@ fi
|
|||
%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user.*.pyc
|
||||
%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_check_password_script.*.pyc
|
||||
%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA.*.pyc
|
||||
%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_base.*.pyc
|
||||
%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_gpg.*.pyc
|
||||
%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_userPassword.*.pyc
|
||||
%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_wdigest.*.pyc
|
||||
%{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize.*.pyc
|
||||
%{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize_drs.*.pyc
|
||||
|
|
@ -2589,6 +2611,9 @@ fi
|
|||
%{python3_sitearch}/samba/tests/samba_tool/user.py
|
||||
%{python3_sitearch}/samba/tests/samba_tool/user_check_password_script.py
|
||||
%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA.py
|
||||
%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_base.py
|
||||
%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py
|
||||
%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_userPassword.py
|
||||
%{python3_sitearch}/samba/tests/samba_tool/user_wdigest.py
|
||||
%{python3_sitearch}/samba/tests/samba_tool/visualize.py
|
||||
%{python3_sitearch}/samba/tests/samba_tool/visualize_drs.py
|
||||
|
|
@ -2663,6 +2688,7 @@ fi
|
|||
### WINBIND-KRB5-LOCATOR
|
||||
%files winbind-krb5-locator
|
||||
%ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
|
||||
%dir %{_libdir}/samba/krb5
|
||||
%{_libdir}/samba/krb5/winbind_krb5_locator.so
|
||||
%{_mandir}/man8/winbind_krb5_locator.8*
|
||||
|
||||
|
|
@ -3287,6 +3313,7 @@ fi
|
|||
%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall
|
||||
%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath
|
||||
%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net
|
||||
%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf
|
||||
%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof
|
||||
%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill
|
||||
%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ps
|
||||
|
|
@ -3557,9 +3584,94 @@ fi
|
|||
### WINEXE
|
||||
%files winexe
|
||||
%{_bindir}/winexe
|
||||
%{_mandir}/man1/winexe.1*
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Thu Apr 29 2021 Guenther Deschner <gdeschner@redhat.com> - 4.12.15-0
|
||||
- Update to Samba 4.12.15
|
||||
- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254
|
||||
|
||||
* Thu Mar 25 2021 Guenther Deschner <gdeschner@redhat.com> - 4.12.14-0
|
||||
- Update to Samba 4.12.14
|
||||
- related: #1941400, #1942496 - Security fixes for CVE-2020-27840
|
||||
- related: #1941402, #1942497 - Security fixes for CVE-2021-20277
|
||||
|
||||
* Wed Mar 24 2021 Guenther Deschner <gdeschner@redhat.com> - 4.12.13-0
|
||||
- Update to Samba 4.12.13
|
||||
- resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840
|
||||
- resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277
|
||||
|
||||
* Thu Mar 11 2021 Guenther Deschner <gdeschner@redhat.com> - 4.12.12-0
|
||||
- Update to Samba 4.12.12
|
||||
|
||||
* Thu Jan 14 2021 Guenther Deschner <gdeschner@redhat.com> - 4.12.11-0
|
||||
- Update to Samba 4.12.11
|
||||
|
||||
* Thu Nov 05 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.10-0
|
||||
- Update to Samba 4.12.10
|
||||
|
||||
* Thu Oct 29 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.9-0
|
||||
- Update to Samba 4.12.9
|
||||
- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318
|
||||
- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323
|
||||
- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383
|
||||
|
||||
* Thu Oct 22 2020 Alexander Bokovoy <abokovoy@redhat.com> - 4.12.8-1
|
||||
- Add preliminary support for S4U operations in Samba AD DC
|
||||
resolves: #1836630 - Samba DC: Remote Desktop cannot access files
|
||||
- Fix lookup_unix_user_name to allow lookup of realm-qualified users and groups
|
||||
required for upcoming FreeIPA Global Catalog support
|
||||
|
||||
* Wed Oct 07 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.8-0
|
||||
- Update to Samba 4.12.8
|
||||
|
||||
* Fri Sep 18 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.7-0
|
||||
- Update to Samba 4.12.7
|
||||
- resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472
|
||||
|
||||
* Thu Aug 13 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.6-0
|
||||
- Update to Samba 4.12.6
|
||||
|
||||
* Wed Aug 12 2020 Andreas Schneider <asn@redhat.com> - 4.12.15-2
|
||||
- resolves: #1865831 - Add missing /usr/lib64/samba/krb5 directory
|
||||
- resolves: #1866989 - Remove obsolete python3-crypto dependency
|
||||
|
||||
* Tue Jul 14 2020 Andreas Schneider <asn@redhat.com> - 4.12.15-1
|
||||
- Move mdssvc data files to correct package
|
||||
|
||||
* Thu Jul 02 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.5-0
|
||||
- Update to Samba 4.12.5
|
||||
|
||||
* Thu Jul 02 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.4-0
|
||||
- Update to Samba 4.12.4
|
||||
- resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730
|
||||
- resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745
|
||||
- resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760
|
||||
- resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303
|
||||
|
||||
* Tue May 19 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.3-0
|
||||
- Update to Samba 4.12.3
|
||||
|
||||
* Wed May 13 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.2-1
|
||||
- Add support for building the new experimental io_uring VFS module
|
||||
|
||||
* Tue Apr 28 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.2-0
|
||||
- Update to Samba 4.12.2
|
||||
- resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700
|
||||
- resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704
|
||||
|
||||
* Sun Apr 12 2020 Alexander Bokovoy <abokovoy@redhat.com> - 4.12.1-1
|
||||
- Revert POSIX stat tuning in libsmbclient
|
||||
- Resolves rhbz#1801442
|
||||
|
||||
* Tue Apr 07 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.1-0
|
||||
- Update to Samba 4.12.1
|
||||
|
||||
* Sat Mar 21 2020 Alexander Bokovoy <abokovoy@redhat.com> - 4.12.0-6
|
||||
- Fix samba_requires_eq macro definition
|
||||
- Resolves rhbz#1815739
|
||||
|
||||
* Tue Mar 10 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.0-5
|
||||
- Add build requirement for perl-FindBin
|
||||
- resolves: #1661213 - Add winexe subpackage for remote windows command execution
|
||||
|
|
|
|||
4
sources
4
sources
|
|
@ -1,2 +1,2 @@
|
|||
SHA512 (samba-4.12.0.tar.xz) = d9d99136702d339803c96004d68c978405759059e6f71fa303b52d21f4bf5093c43bcec44b22aeee3610a1cdf033edf758ccb4c551de20b7d66632e9a23866b1
|
||||
SHA512 (samba-4.12.0.tar.asc) = b833e0917b3b244ce727d80c0b600a88aa986455b7dfa24df1306fd848e2d192a46e2dfd5a5e878cd0ca3f76e0827ee42f704f93ac86b063e57027b786d262f0
|
||||
SHA512 (samba-4.12.15.tar.xz) = fbacacd429f368238127196b120d1492da55a14102715f065e70ec5f729d30734452f05095780146baa4afed82efebf425f1118e823ed603af9f4c6f04c07978
|
||||
SHA512 (samba-4.12.15.tar.asc) = b5e96bebf12d594f63e81293b254211146bdd3799e3e3c3586c8ace5dc126a433d75f2cce3a10c3081bba893e245175df06a2d194f1937bbbaa28a6917e65aa2
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue