Commits · master · The Samba Team / Samba

This project is mirrored from https://git.samba.org/samba.git. Pull mirroring updated Jan 23, 2022.

22 Jan, 2022 1 commit

s3:libnet: Do not set ADS_AUTH_ALLOW_NTLMSSP in FIPS mode · fa5413b6

Pavel Filipenský authored Jan 21, 2022 and

Stefan Metzmacher committed Jan 22, 2022

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955



Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sat Jan 22 00:27:52 UTC 2022 on sn-devel-184

fa5413b6

21 Jan, 2022 13 commits

s3:winbindd: Do not set ADS_AUTH_ALLOW_NTLMSSP in FIPS mode · f03abaec

Pavel Filipenský authored Jan 18, 2022 and

Stefan Metzmacher committed Jan 21, 2022

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955



Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

f03abaec

s3:winbindd: Remove trailing spaces from winbindd_ads.c · fcf225a3

Pavel Filipenský authored Jan 18, 2022 and

Stefan Metzmacher committed Jan 21, 2022

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955

Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

fcf225a3

s4:selftest: plan test suite samba4.blackbox.test_weak_disable_ntlmssp_ldap · 9624e60e

Pavel Filipenský authored Jan 04, 2022 and

Stefan Metzmacher committed Jan 21, 2022

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955

Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

9624e60e

tests: Add test for disabling NTLMSSP for ldap client connections · eb0fa26d

Pavel Filipenský authored Jan 03, 2022 and

Stefan Metzmacher committed Jan 21, 2022

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955

Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

eb0fa26d

s3:libads: Disable NTLMSSP if not allowed (for builds without kerberos) · 17ea2ccd

Pavel Filipenský authored Jan 03, 2022 and

Stefan Metzmacher committed Jan 21, 2022

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955



Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

17ea2ccd

s3:libads: Improve debug messages for SASL bind · 5f6251ab

Pavel Filipenský authored Jan 07, 2022 and

Stefan Metzmacher committed Jan 21, 2022

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955



Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

5f6251ab

s3:libads: Disable NTLMSSP for FIPS · 7785eb9b

Pavel Filipenský authored Dec 09, 2021 and

Stefan Metzmacher committed Jan 21, 2022

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955



Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

7785eb9b

s3:libads: Remove trailing spaces from sasl.c · 49d18f2d

Pavel Filipenský authored Dec 08, 2021 and

Stefan Metzmacher committed Jan 21, 2022

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955

Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

49d18f2d

s3:utils: set ads->auth.flags using krb5_state · afcdb090

Pavel Filipenský authored Dec 10, 2021 and

Stefan Metzmacher committed Jan 21, 2022

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955



Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

afcdb090

wafsamba: Add our own implmentation to generate the clangdb · 6843bdae

Stefan Metzmacher authored Jan 21, 2022



Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

6843bdae

wafsamba: Remove clangdb code which doesn't work · 85dbc023

Stefan Metzmacher authored Jan 21, 2022



This generates an incomplete database where defines and includes are missing.

Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

85dbc023

build: Without getrandom() require gnutls 3.7.2 · 82a21581

VL authored Jan 17, 2022 and

Jeremy Allison committed Jan 21, 2022

gnutls before 3.7.2 and without getrandom() will open /dev/urandom at library
initialization time before main() is run. We use closefrom(3) in samba-bgqd and
samba-dcerpd, which closes /dev/urandom, which then breaks gnutls. On system
with getrandom(), no file descriptor is opened and gnutls 3.7.2+ will open and
close /dev/urandom whenever it needs to access it.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jan 21 21:42:08 UTC 2022 on sn-devel-184

82a21581

bootstrap: use compat-gnutls37-devel for centos7 · d0aa04e8
Stefan Metzmacher authored Jan 20, 2022 and Jeremy Allison committed Jan 21, 2022
```
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
```
d0aa04e8

20 Jan, 2022 4 commits

libcli/dns: Fix TCP fallback · f60780c8

VL authored Jan 20, 2022 and

Jeremy Allison committed Jan 20, 2022



A customer has come across a DNS server that really just cuts a SRV
reply if it's too long. This makes the packet invalid according to
ndr_pull and according to wireshark. DNS_FLAG_TRUNCATION is however
set. As this seems to be legal according to the DNS RFCs, we need to
hand-parse the first two uint16's and look whether DNS_FLAG_TRUNCATION
is set.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jan 20 18:01:41 UTC 2022 on sn-devel-184

f60780c8

autobuild: Fix path for libwbclient ldd checks · d1891a0c

Andreas Schneider authored Jan 20, 2022 and

Stefan Metzmacher committed Jan 20, 2022


Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jan 20 14:19:02 UTC 2022 on sn-devel-184

d1891a0c

s4:dsdb/vlv_pagination: fix segfault in vlv_results() · 7d16a56b

Stefan Metzmacher authored Jan 19, 2022

It can happen that the vlv_results() failes, e.g. due to
LDB_ERR_TIME_LIMIT_EXCEEDED, if that happens we should not
dereference ares->response, if ares is NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14952

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jan 20 10:04:39 UTC 2022 on sn-devel-184

7d16a56b

s4:dsdb/paged_results: fix segfault in paged_results() · 19fa22b1

Stefan Metzmacher authored Jan 19, 2022

It can happen that the paged_results() failes, e.g. due to
LDB_ERR_TIME_LIMIT_EXCEEDED, if that happens we should not
dereference ares->response, if ares is NULL.

We also should not call ldb_module_done() if paged_results()
fails, as it was already called.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14952

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

19fa22b1

19 Jan, 2022 22 commits

HEIMDAL: move code from source4/heimdal* to third_party/heimdal* · 7055827b

Stefan Metzmacher authored Jan 19, 2022



This makes it clearer that we always want to do heimdal changes
via the lorikeet-heimdal repository.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>

Autobuild-User(master): Joseph Sutton <jsutton@samba.org>
Autobuild-Date(master): Wed Jan 19 21:41:59 UTC 2022 on sn-devel-184

7055827b

s4:torture: Adapt KDC canon test to Heimdal upstream changes · 1954e50f

Joseph Sutton authored Jan 06, 2022



NOTE: This commit finally works again!
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

1954e50f

s4:torture: Remove PAC-REQUEST check for RESPONSE_TOO_BIG · a24280dc

Joseph Sutton authored Dec 09, 2021



Needed by the Heimdal upgrade...

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

a24280dc

s4:torture: Fix Orpheus' Lyre tests · 9eead485

Joseph Sutton authored Dec 10, 2021



The enc-pa-rep request protection allows these tests to now pass as
expected.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

9eead485

s4:torture: Adapt LSA tests to newer Heimdal version · b59687a7

Joseph Sutton authored Dec 06, 2021



The Heimdal upgrade results in some changes that affect these tests. The
cname is now non-NULL in certain circumstances, the IO counts are
different due to a change between the ordering of capaths and referrals,
some requests no longer fail, and referral tickets are not cached
anymore, and so cannot be checked.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

b59687a7

s4:torture: return ETYPE_INFO2 on PREAUTH_FAILED · 7679d596

Isaac Boukris authored Nov 09, 2018

This is an alternative to 978bc868


which got overriten by the upgrade merge.
One difference however, is that we don't return ENC_TIMESTAMP like
in PREAUTH_REQUIRED but only ETYPE_INFO2 same as Windows.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

7679d596

selftest: Expect FAST support for both MIT and Heimdal · 0b9c8b9e

Joseph Sutton authored Dec 30, 2021



NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

0b9c8b9e

selftest: set [libdefaults] fcache_strict_checking = false · 2232d840

Stefan Metzmacher authored Feb 02, 2016



We're using uid_wrapper so the checks will fail.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>

2232d840

selftest: knownfail updates after Heimdal Upgrade · 71685966

Andrew Bartlett authored Dec 08, 2021



The Heimdal upgrade brings the new feature of FAST, allowing more tests to pass.

However it causes a regression in FL2003 for the returned salt format in
the AS-REP, but FL 2003 has not been the default since Samba 4.2 as AES
keys are much stronger and should be preferred.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

71685966

selftest: Update SimpleKerberosTests now that Samba supports FAST · e5b9cc8f

Andrew Bartlett authored Jun 18, 2021



Heimdal matches Windows in this respect

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

e5b9cc8f

tests/krb5: Add option to check reply padata · 64e539bb

Joseph Sutton authored Nov 30, 2021



So far we have only been checking padata in error replies and with FAST.
We should also check it in the general success case.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

64e539bb

s4:kdc: Return PA-SUPPORTED-ENCTYPES · 0be58f55

Joseph Sutton authored Dec 24, 2021



NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

0be58f55

s4:kdc: Set supported enctypes in KDC entry · cb382f7c

Joseph Sutton authored Dec 24, 2021



This allows us to return the supported enctypes to the client as
PA-SUPPORTED-ENCTYPES padata.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

cb382f7c

s4:kdc: Add PAC_ATTRIBUTES integration for Heimdal · 6c2a97d3

Joseph Sutton authored Dec 22, 2021



NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

6c2a97d3

s4:kdc: Set require_pac and no-ENC_TS in FAST for new Heimdal import · ba154d62

Andrew Bartlett authored Dec 15, 2021



This allows us to continue to avoid CVE-2020-25719 in particular
and pass our tests for expected FAST behaviour as the patches
we requested by upstream to be conditional, not hard-coded.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

ba154d62

s4:kdc/heimdal: Always include the salt in the PA-ETYPE-INFO[2] · 3dbf9677

Andrew Bartlett authored Jun 17, 2021



This matches Windows and is detected by our samba.tests.krb5.as_canonicalization_tests
test as this always expects the salt, which Windows always provides.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

3dbf9677

s4:kdc: cope with upstream rename of configuration parameters. · 28701dc2

Gary Lockyer authored Sep 22, 2017



This copes with the upstream commit:

commit c757eb7fb04a9b0ca883ddb72c1bc75bf5d814f3
Author: Nicolas Williams <nico@cryptonector.com>
Date:   Fri Nov 25 17:21:04 2011 -0600

    Rename and fix as/tgs-use-strongest-key config parameters

        Different ticket session key enctype selection options should
        distinguish between target principal type (krbtgt vs. not), not
        between KDC request types.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>

[abartlet@samba.org Researched and updated the commit message]
Reviewed-by: Stefan Metzmacher <metze@samba.org>

28701dc2

s4:kdc: Move calls using the samba4 name to be right after each other · c7bd176f

Andrew Bartlett authored Sep 17, 2018



These all need to be in sync

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

c7bd176f

s4:kdc: Adapt KDC to new Heimdal to load samba4 HDB plugin for keytab · 0d107482

Andrew Bartlett authored Sep 17, 2018



NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

0d107482

s4:kdc/hdb: Store and retrieve a FX-COOKIE value · 8d7e9366

Andrew Bartlett authored Sep 19, 2018



Note Windows uses the string "MICROSOFT" as cookie,
so it's wrong to have a per DC cookie, but we need to
adjust the Heimdal logic to support that.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

8d7e9366

s4:kdc: Set entry.flags.force_canonicalize to override the new Heimdal behaviour · 8329e8d4

Andrew Bartlett authored Jun 23, 2021



This is needed to give hdb_samba4 the full control over the returned
principal, rather than the new code in the Heimdal KDC.

Including changes selected from code by Stefan Metzmacher <metze@samba.org>
in his Heimdal upgrade branch.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

8329e8d4

s4:kerberos: adapt the heimdal send_to_kdc hooks to the send_to_kdc/realm plugin interface · eb5c3bb9

Stefan Metzmacher authored Feb 03, 2016



With the recent heimdal upgrade we better try to use the send_to_realm()
hooks as it allows us to handle the KDC lookup as well as only getting
each logical request just once in the testing code, which makes it
let dependend on the heimdal internal kdc lookup logic.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>

eb5c3bb9