It breaks our torture tests whenever we temper with the packet
in the send_to_kdc callback eg unsetting canonicalize flag etc,
we get spurius ERR_BAD_INTEGRITY
The tests need to be worked out.
See RFC 6806.

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

with regard to the order of capath vs referral and so on.

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

This is an alternative to 978bc868


which got overriten by the upgrade merge.
One difference however, is that we don't return ENC_TIMESTAMP like
in PREAUTH_REQUIRED but only ETYPE_INFO2 same as Windows.

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

by default while parsing, so we should exepct that in
torture_krb5_pre_send_tgs_req_krbtgt_canon_test() callback.

The alternative would be to set the type manually to
KRB5_NT_PRINCIPAL after parsing.

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

New heimdal client code calls capath flow (first) even
if the KRB5_GC_CANONICALIZE flag was requested, this
helps when the ccache is initialized with a tgt like
'krbtgt/realm@REALM', and you ask a service ticket for
'user@realm', where capath function succeeds with no
packets while the old code would fail with KRB5_CC_NOTFOUND".

Note that it'd sets the canonicalize flag in capath
flow, which is a bit strange since it won't use referrals.

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

Due to change of order in _krb5_get_cred_kdc_any() between capath
and referrals (now capath comes first), the actual error returned
by the KDC, KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN gets shadowd by the
KRB5KDC_ERR_PATH_NOT_ACCEPTED error returned from the referral fallback.

Note, we already check the actual error from KDC in the post callbacks.

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

even for enterprise server principal, same as windows.

This worked ok before the upgrade, due to another bug
in tgs_build_reply() (which got fixed upstream - need
to check the actual commit), where we'd miss a goto
after setting KRB5KRB_AP_ERR_NOT_US.

See:
https://github.com/samba-team/samba/blob/f33749fc84dacb164d1ac43f6bfcae7afcca34b3/source4/heimdal/kdc/krb5tgs.c#L1829



Signed-off-by: Isaac Boukris <iboukris@gmail.com>

and allow the realm to be canonicalized. This is
useful when Windows KDC returns the canonical realm
instead of requested lc or netbios realm.

TODO: Is this ok ? in find_cred we seem to be okay
with any realm.
The old code didn't check at all it seems (check
when this was introduced).

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

even if canonicalize falg is not set, same as Windows.

Regression introduced by upstream commit:
378f34b4be9865ed3949918fba8d2dd877b395c0

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

s4:heimdal: import lorikeet-heimdal-201809182344-fast (commit 7d483a1286ff7f6d1968dc32764b9bcd3cf7bbe9)

s4:heimdal: import lorikeet-heimdal-201809171727-py3 (commit 892166469419ab5d6925aa736b21d81160ba9e49)

This could be reverted in the future, but for now the certificate validation is not what
we are testing and this allows the heimdal upgrade to work.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

These all need to be in sync

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

../source3/passdb/pdb_samba_dsdb.c: In function ‘pdb_samba_dsdb_set_trusteddom_pw’:
../source3/passdb/pdb_samba_dsdb.c:2778:6: error: assuming signed overflow does not occur when simplifying conditional to constant [-Werror=strict-overflow]
   if (i == 0) {
      ^
cc1: all warnings being treated as errors

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

s4:heimdal: import lorikeet-heimdal-201809171727-py3 (commit 14810a96326d13945334b44500441d4aec1656b0)

gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.10)
with -O3 -Werror=unused-result

../source4/heimdal/lib/krb5/dcache.c:85:5: error: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result [-Werror=unused-result]
     asprintf(&path, "%s/primary-XXXXXX", dc->dir);
     ^
../source4/heimdal/lib/krb5/dcache.c: In function ‘primary_create’:
../source4/heimdal/lib/krb5/dcache.c:56:5: error: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result [-Werror=unused-result]
     asprintf(&primary, "%s/primary", dc->dir);
     ^
../source4/heimdal/lib/krb5/dcache.c: In function ‘dcc_gen_new’:
../source4/heimdal/lib/krb5/dcache.c:423:5: error: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result [-Werror=unused-result]
     asprintf(&name, ":%s/tktXXXXXX", dc->dir);
     ^
../source4/heimdal/lib/krb5/dcache.c: In function ‘dcc_resolve’:
../source4/heimdal/lib/krb5/dcache.c:340:2: error: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result [-Werror=unused-result]
  asprintf(&dc->name, ":%s/%s", dc->dir, residual);
  ^
../source4/heimdal/lib/krb5/dcache.c:348:5: error: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result [-Werror=unused-result]
     asprintf(&filename, "FILE%s", dc->name);
     ^
cc1: all warnings being treated as errors

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Patches dropped:

heimdal: Split parse_{units,time}.h out to allow a re-include after the #undef
(fixed upstream, only in lorikeet-heimdal)

Add initializer for stack pointers
(fixed usptream by 13eeb30a1d07573d1879f0907473ab4778cee9f0)
a998c007

s4:heimdal fix a compile warning
fc8e507b

heimdal: Fix the O3 developer build
81da2aa6

Fix the O3 developer build
38628b1e

Objected to and issues likley fixed by coverity scan work upstream
https://github.com/heimdal/heimdal/pull/409#pullrequestreview-153919020

Patches rewritten:

heimdal: Fix printing a short int into a string
abd74c3b

https://github.com/heimdal/heimdal/pull/410#pullrequestreview-153921200

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

https://github.com/heimdal/heimdal/pull/406

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

(This is due to generated parsers)

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

../source3/libsmb/namequery.c: In function ‘get_dc_list’:
../source3/libsmb/namequery.c:3142:5: error: assuming signed overflow does not occur when simplifying conditional to constant [-Werror=strict-overflow]
  if (num_addresses == 0) {
     ^
../source3/libsmb/namequery.c:3166:8: error: assuming signed overflow does not occur when simplifying conditional to constant [-Werror=strict-overflow]
  while ((local_count<num_addresses) &&
        ^

This comes from the smb.conf 'password server' or the server afinity cache.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

s4:heimdal: import lorikeet-heimdal-201809040408-plus-samba-patches (commit 355c84cac63a6bc9f610dece1598ec2afe34a6db)

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

TODO CHECK heimdal: Fix loss of information in _gsskrb5_canon_name() from call to krb5_sname_to_principal()

This would discard the realm the client specified.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Gary Lockyer authored Sep 25, 2017 and Andrew Bartlett committed Sep 19, 2018

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>

Gary Lockyer authored Sep 25, 2017 and Andrew Bartlett committed Sep 19, 2018

(const excepted)

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>