sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-12 20:58:37 +03:00
Code

CVE-2022-2031 tests/krb5: Allow requesting a TGT to a different sname and realm

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

[jsutton@samba.org Fixed conflict due to lacking rc4_support parameter]

[jsutton@samba.org Fixed conflicts due to lacking client_name_type and
 expected_cname parameters]
This commit is contained in:
Joseph Sutton 2022-05-24 19:34:59 +12:00 committed by Jule Anger
parent e44b70b862
commit 2815de0510
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
python/samba/tests/krb5/kdc_base_test.py
View File

@ -1344,10 +1344,12 @@ class KDCBaseTest(RawKerberosTest):
expected_flags=None, unexpected_flags=None,
pac_request=True, expect_pac=True, fresh=False):
user_name = tgt.cname['name-string'][0]
ticket_sname = tgt.sname
if target_name is None:
target_name = target_creds.get_username()[:-1]
cache_key = (user_name, target_name, service, to_rodc, kdc_options,
pac_request, str(expected_flags), str(unexpected_flags),
str(ticket_sname),
expect_pac)
if not fresh:
@ -1414,6 +1416,7 @@ class KDCBaseTest(RawKerberosTest):
expected_flags=None, unexpected_flags=None,
expected_account_name=None, expected_upn_name=None,
expected_sid=None,
sname=None, realm=None,
pac_request=True, expect_pac=True,
expect_pac_attrs=None, expect_pac_attrs_pac_request=None,
expect_requester_sid=None,
@ -1422,6 +1425,7 @@ class KDCBaseTest(RawKerberosTest):
cache_key = (user_name, to_rodc, kdc_options, pac_request,
str(expected_flags), str(unexpected_flags),
expected_account_name, expected_upn_name, expected_sid,
str(sname), str(realm),
expect_pac, expect_pac_attrs,
expect_pac_attrs_pac_request, expect_requester_sid)
@ -1431,15 +1435,21 @@ class KDCBaseTest(RawKerberosTest):
if tgt is not None:
return tgt
realm = creds.get_realm()
if realm is None:
realm = creds.get_realm()
salt = creds.get_salt()
etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5)
cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
names=[user_name])
sname = self.PrincipalName_create(name_type=NT_SRV_INST,
names=['krbtgt', realm])
if sname is None:
sname = self.PrincipalName_create(name_type=NT_SRV_INST,
names=['krbtgt', realm])
expected_sname = self.PrincipalName_create(
name_type=NT_SRV_INST, names=['krbtgt', realm.upper()])
else:
expected_sname = sname
till = self.get_KerberosTime(offset=36000)
@ -1505,9 +1515,6 @@ class KDCBaseTest(RawKerberosTest):
expected_realm = realm.upper()
expected_sname = self.PrincipalName_create(
name_type=NT_SRV_INST, names=['krbtgt', realm.upper()])
rep, kdc_exchange_dict = self._test_as_exchange(
cname=cname,
realm=realm,