sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-10 01:18:15 +03:00
Code

CVE-2022-2031 tests/krb5: Allow requesting a TGT to a different sname and realm

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

[jsutton@samba.org Fixed conflict due to lacking rc4_support parameter]
This commit is contained in:
Joseph Sutton 2022-05-24 19:34:59 +12:00 committed by Jule Anger
parent 3e52255fd1
commit 06c7f3d3f6
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
python/samba/tests/krb5/kdc_base_test.py
View File

@ -1361,10 +1361,12 @@ class KDCBaseTest(RawKerberosTest):
expected_flags=None, unexpected_flags=None,
pac_request=True, expect_pac=True, fresh=False):
user_name = tgt.cname['name-string'][0]
ticket_sname = tgt.sname
if target_name is None:
target_name = target_creds.get_username()[:-1]
cache_key = (user_name, target_name, service, to_rodc, kdc_options,
pac_request, str(expected_flags), str(unexpected_flags),
str(ticket_sname),
expect_pac)
if not fresh:
@ -1433,6 +1435,7 @@ class KDCBaseTest(RawKerberosTest):
expected_account_name=None, expected_upn_name=None,
expected_cname=None,
expected_sid=None,
sname=None, realm=None,
pac_request=True, expect_pac=True,
expect_pac_attrs=None, expect_pac_attrs_pac_request=None,
expect_requester_sid=None,
@ -1446,6 +1449,7 @@ class KDCBaseTest(RawKerberosTest):
client_name_type,
str(expected_flags), str(unexpected_flags),
expected_account_name, expected_upn_name, expected_sid,
str(sname), str(realm),
str(expected_cname),
expect_pac, expect_pac_attrs,
expect_pac_attrs_pac_request, expect_requester_sid)
@ -1456,15 +1460,21 @@ class KDCBaseTest(RawKerberosTest):
if tgt is not None:
return tgt
realm = creds.get_realm()
if realm is None:
realm = creds.get_realm()
salt = creds.get_salt()
etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5)
cname = self.PrincipalName_create(name_type=client_name_type,
names=user_name.split('/'))
sname = self.PrincipalName_create(name_type=NT_SRV_INST,
names=['krbtgt', realm])
if sname is None:
sname = self.PrincipalName_create(name_type=NT_SRV_INST,
names=['krbtgt', realm])
expected_sname = self.PrincipalName_create(
name_type=NT_SRV_INST, names=['krbtgt', realm.upper()])
else:
expected_sname = sname
if expected_cname is None:
expected_cname = cname
@ -1533,9 +1543,6 @@ class KDCBaseTest(RawKerberosTest):
expected_realm = realm.upper()
expected_sname = self.PrincipalName_create(
name_type=NT_SRV_INST, names=['krbtgt', realm.upper()])
rep, kdc_exchange_dict = self._test_as_exchange(
cname=cname,
realm=realm,