sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-02 09:47:23 +03:00
Code

CVE-2022-2031 gensec_krb5: Add helper function to check if client sent an initial ticket

Browse Source 
This will be used in the kpasswd service to ensure that the client has
an initial ticket to kadmin/changepw, and not a service ticket.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
This commit is contained in:
Joseph Sutton 2022-05-18 16:06:31 +12:00 committed by Jule Anger
parent e0c135e6c1
commit bbfbbb9f64
5 changed files with 157 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
source4/auth/gensec/gensec_krb5.c
View File

@ -44,27 +44,11 @@
#include "../lib/util/asn1.h"
#include "auth/kerberos/pac_utils.h"
#include "gensec_krb5.h"
#include "gensec_krb5_internal.h"
#include "gensec_krb5_helpers.h"
_PUBLIC_ NTSTATUS gensec_krb5_init(TALLOC_CTX *);
enum GENSEC_KRB5_STATE {
GENSEC_KRB5_SERVER_START,
GENSEC_KRB5_CLIENT_START,
GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
GENSEC_KRB5_DONE
};
struct gensec_krb5_state {
enum GENSEC_KRB5_STATE state_position;
struct smb_krb5_context *smb_krb5_context;
krb5_auth_context auth_context;
krb5_data enc_ticket;
krb5_keyblock *keyblock;
krb5_ticket *ticket;
bool gssapi;
krb5_flags ap_req_options;
};
static int gensec_krb5_destroy(struct gensec_krb5_state *gensec_krb5_state)
{
if (!gensec_krb5_state->smb_krb5_context) {

72
source4/auth/gensec/gensec_krb5_helpers.c Normal file
View File

@ -0,0 +1,72 @@
/*
Unix SMB/CIFS implementation.
Kerberos backend for GENSEC
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
Copyright (C) Andrew Tridgell 2001
Copyright (C) Luke Howard 2002-2003
Copyright (C) Stefan Metzmacher 2004-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "auth/auth.h"
#include "auth/gensec/gensec.h"
#include "auth/gensec/gensec_internal.h"
#include "gensec_krb5_internal.h"
#include "gensec_krb5_helpers.h"
#include "system/kerberos.h"
#include "auth/kerberos/kerberos.h"
static struct gensec_krb5_state *get_private_state(const struct gensec_security *gensec_security)
{
struct gensec_krb5_state *gensec_krb5_state = NULL;
if (strcmp(gensec_security->ops->name, "krb5") != 0) {
/* We require that the krb5 mechanism is being used. */
return NULL;
}
gensec_krb5_state = talloc_get_type(gensec_security->private_data,
struct gensec_krb5_state);
return gensec_krb5_state;
}
/*
* Returns 1 if our ticket has the initial flag set, 0 if not, and -1 in case of
* error.
*/
int gensec_krb5_initial_ticket(const struct gensec_security *gensec_security)
{
struct gensec_krb5_state *gensec_krb5_state = NULL;
gensec_krb5_state = get_private_state(gensec_security);
if (gensec_krb5_state == NULL) {
return -1;
}
if (gensec_krb5_state->ticket == NULL) {
/* We don't have a ticket */
return -1;
}
#ifdef SAMBA4_USES_HEIMDAL
return gensec_krb5_state->ticket->ticket.flags.initial;
#else /* MIT KERBEROS */
return (gensec_krb5_state->ticket->enc_part2->flags & TKT_FLG_INITIAL) ? 1 : 0;
#endif /* SAMBA4_USES_HEIMDAL */
}

32
source4/auth/gensec/gensec_krb5_helpers.h Normal file
View File

@ -0,0 +1,32 @@
/*
Unix SMB/CIFS implementation.
Kerberos backend for GENSEC
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
Copyright (C) Andrew Tridgell 2001
Copyright (C) Luke Howard 2002-2003
Copyright (C) Stefan Metzmacher 2004-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
struct gensec_security;
/*
* Returns 1 if our ticket has the initial flag set, 0 if not, and -1 in case of
* error.
*/
int gensec_krb5_initial_ticket(const struct gensec_security *gensec_security);

47
source4/auth/gensec/gensec_krb5_internal.h Normal file
View File

@ -0,0 +1,47 @@
/*
Unix SMB/CIFS implementation.
Kerberos backend for GENSEC
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
Copyright (C) Andrew Tridgell 2001
Copyright (C) Luke Howard 2002-2003
Copyright (C) Stefan Metzmacher 2004-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "auth/gensec/gensec.h"
#include "system/kerberos.h"
#include "auth/kerberos/kerberos.h"
enum GENSEC_KRB5_STATE {
GENSEC_KRB5_SERVER_START,
GENSEC_KRB5_CLIENT_START,
GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
GENSEC_KRB5_DONE
};
struct gensec_krb5_state {
enum GENSEC_KRB5_STATE state_position;
struct smb_krb5_context *smb_krb5_context;
krb5_auth_context auth_context;
krb5_data enc_ticket;
krb5_keyblock *keyblock;
krb5_ticket *ticket;
bool gssapi;
krb5_flags ap_req_options;
};

4
source4/auth/gensec/wscript_build
View File

@ -18,6 +18,10 @@ bld.SAMBA_MODULE('gensec_krb5',
enabled=bld.AD_DC_BUILD_IS_ENABLED()
)
bld.SAMBA_SUBSYSTEM('gensec_krb5_helpers',
source='gensec_krb5_helpers.c',
deps='gensec_krb5',
enabled=bld.AD_DC_BUILD_IS_ENABLED())
bld.SAMBA_MODULE('gensec_gssapi',
source='gensec_gssapi.c',