sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-16 09:57:47 +03:00
Code

CVE-2020-25718 tests/krb5: Only fetch RODC account credentials when necessary

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Joseph Sutton 2021-10-29 15:43:28 +13:00 committed by Jule Anger
parent 50e11804fa
commit b28a7db8a4
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
python/samba/tests/krb5/kdc_base_test.py
View File

@ -710,9 +710,6 @@ class KDCBaseTest(RawKerberosTest):
self.assertFalse(not_delegated)
samdb = self.get_samdb()
rodc_samdb = self.get_rodc_samdb()
rodc_dn = self.get_server_dn(rodc_samdb)
user_name = self.get_new_username()
if name_prefix is not None:
@ -764,6 +761,9 @@ class KDCBaseTest(RawKerberosTest):
# Handle secret replication to the RODC.
if allowed_replication or revealed_to_rodc:
rodc_samdb = self.get_rodc_samdb()
rodc_dn = self.get_server_dn(rodc_samdb)
# Allow replicating this account's secrets if requested, or allow
# it only temporarily if we're about to replicate them.
allowed_cleanup = self.add_to_group(
@ -784,6 +784,9 @@ class KDCBaseTest(RawKerberosTest):
revealed=revealed_to_rodc)
if denied_replication:
rodc_samdb = self.get_rodc_samdb()
rodc_dn = self.get_server_dn(rodc_samdb)
# Deny replicating this account's secrets to the RODC.
self.add_to_group(dn, rodc_dn, 'msDS-NeverRevealGroup')