sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-05 09:18:06 +03:00
Code

CVE-2022-2031 tests/krb5: Add test that we cannot provide a TGT to kpasswd

Browse Source 
The kpasswd service should require a kpasswd service ticket, and
disallow TGTs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

[jsutton@samba.org Fixed knownfail conflicts]

[jsutton@samba.org Fixed knownfail conflicts]
This commit is contained in:
Joseph Sutton 2022-06-10 19:17:11 +12:00 committed by Jule Anger
parent 340181bc11
commit 95afbc2da9
3 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
python/samba/tests/krb5/kpasswd_tests.py
View File

@ -31,6 +31,7 @@ from samba.tests.krb5.rfc4120_constants import (
KDC_ERR_TGT_REVOKED, KDC_ERR_TGT_REVOKED,
KDC_ERR_TKT_EXPIRED, KDC_ERR_TKT_EXPIRED,
KPASSWD_ACCESSDENIED, KPASSWD_ACCESSDENIED,
KPASSWD_AUTHERROR,
KPASSWD_HARDERROR, KPASSWD_HARDERROR,
KPASSWD_INITIAL_FLAG_NEEDED, KPASSWD_INITIAL_FLAG_NEEDED,
KPASSWD_MALFORMED, KPASSWD_MALFORMED,
@ -779,6 +780,33 @@ class KpasswdTests(KDCBaseTest):
self._make_tgs_request(creds, service_creds, ticket, self._make_tgs_request(creds, service_creds, ticket,
expect_error=False) expect_error=False)
# Show that we cannot provide a TGT to kpasswd to change the password.
def test_kpasswd_tgt(self):
# Create an account for testing, and get a TGT.
creds = self._get_creds()
tgt = self.get_tgt(creds)
# Change the sname of the ticket to match that of kadmin/changepw.
tgt.set_sname(self.get_kpasswd_sname())
expected_code = KPASSWD_AUTHERROR
expected_msg = b'A TGT may not be used as a ticket to kpasswd'
# Set the password.
new_password = generate_random_password(32, 32)
self.kpasswd_exchange(tgt,
new_password,
expected_code,
expected_msg,
mode=self.KpasswdMode.SET)
# Change the password.
self.kpasswd_exchange(tgt,
new_password,
expected_code,
expected_msg,
mode=self.KpasswdMode.CHANGE)
# Test that kpasswd rejects requests with a service ticket. # Test that kpasswd rejects requests with a service ticket.
def test_kpasswd_non_initial(self): def test_kpasswd_non_initial(self):
# Create an account for testing, and get a TGT. # Create an account for testing, and get a TGT.

4
selftest/knownfail_heimdal_kdc
View File

@ -271,3 +271,7 @@
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
#
# Kpasswd tests
#
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_tgt.ad_dc

4
selftest/knownfail_mit_kdc
View File

@ -581,3 +581,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
#
# Kpasswd tests
#
samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_tgt.ad_dc