sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-29 11:21:54 +03:00
Code
98,398 Commits 60 Branches 1,144 Tags 452 MiB
578f2c7c7d
Commit Graph

562 Commits

Author SHA1 Message Date
Stefan Metzmacher
14b6e0a599 s4:kdc/db-glue: samba_kdc_trust_message2entry() should use the normalized principal as salt 
smbclient //w2012r2-183.w2012r2-l4.base/netlogon -c 'ls' -k yes -Uadministrator@S4XDOM.BASE%A1b2C3d4
worked while
smbclient //w2012r2-183.w2012r2-l4.base/netlogon -c 'ls' -k yes -Uadministrator@s4xdom.base
failed, if aes keys are used across the trust.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Mar 27 04:02:05 CET 2015 on sn-devel-104
 2015-03-27 04:02:05 +01:00
Günther Deschner
4b12fcebaf s4-kdc/db_glue: avoid accessing private struct members when there are accessor funcs. 
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
e2eef86431 s4-kdc/db_glue: use smb_krb5_principal_set_type(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
ac23b7dd52 s4-kdc/db-glue: make sure to use smb_krb5_get_pw_salt and smb_krb5_create_key_from_string. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
cebecffd98 s4-kdc/db-glue: use smb_krb5_principal_get_comp_string in dbglue. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
2a0e2dd52a s4-kdc/db-glue: use principal_comp_str{case}cmp. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
6d6e411fb8 s4-kdc/db-glue: add principal_comp_str{case}cmp 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
714862defd s4-kdc: pass down only a samba_kdc_entry to samba_krbtgt_is_in_db(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
0501db1a67 s4-kdc: pass down only a samba_kdc_entry to samba_kdc_get_pac_blob(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
78c0cf292b s4-kdc: pass down only a samba_kdc_entry to samba_princ_needs_pac(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
ba1838300c s4-kdc/db_glue: pass down only a samba_kdc_entry to samba_kdc_check_s4u2proxy(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
f4b087b483 s4-kdc/db_glue: pass down only a samba_kdc_entry to samba_kdc_check_pkinit_ms_upn_match(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
7afd9e6aca s4-kdc/db_glue: pass down only a samba_kdc_entry to samba_kdc_check_s4u2self(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
1afd3d3262 s4-kdc: build some kdc components only for Heimdal KDCs. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
77ede580e9 lib/krb5_wrap: provide KRB5KDC_ERR_KEY_EXPIRED error code matching MIT. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Günther Deschner
9a0263a7c3 s4-kdc/db_glue: workaround different CLIENT_NAME_MISMATCH error codes. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-27 01:26:16 +01:00
Andreas Schneider
a9bcc86504 kdc-db-glue: Remove unused code. 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Andreas Schneider
b21b2d596e kdc-db-glue: Do not allocate memory for the principal 
The function we are calling already allocate memory.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Andreas Schneider
aa1431e53f kdc-db-glue: Fix memory cleanup to avoid crashes. 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Andreas Schneider
6ada266dcf kdc-db-glue: Fix function format of samba_kdc_message2entry() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Andreas Schneider
b9072d9741 kdc-db-glue: Fix a NULL pointer dereference. 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Günther Deschner
13cd1d5c58 s4-kdc/db_glue: bad idea to free parent mem_ctx when sub function got a failure. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Günther Deschner
6d6712fdde s4-kdc/pac_glue: only include required headers. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Günther Deschner
c5965c41ae s4-kdc/pac_glue: use ENCTYPE_ARCFOUR_HMAC just like in db_glue. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Günther Deschner
e49802a02d s4-kdc/db-glue: use krb5_copy_data_contents in samba_kdc_message2entry_keys(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Günther Deschner
51191bd9d8 s4-kdc/pac_glue: use krb5_copy_data_contents in samba_make_krb5_pac(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Günther Deschner
c5eb9b388e s4-kdc/db_glue: use KRB5_PW_SALT instead of hdb type. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Günther Deschner
683ba8a09d s4-kdc/db_glue: use smb_krb5_principal_get_type() to access private members 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Günther Deschner
3ee26c43b9 s4-kdc/db_glue: use KRB5_KEY_TYPE to access private key members. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Günther Deschner
0163c9403e s4-kdc/db_glue: use time_t directly instead of KerberosTime. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:54 +01:00
Günther Deschner
668f1e9ab0 s4-kdc/db_glue: use krb5_principal_get_comp_string() to access members of private structs. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
75602bf1ae s4-kdc/db_glue: use krb5_princ_size() instead of inspecting private structs. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
10a06fcd55 s4-kdc/db_glue: use smb_krb5_principal_get_realm(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Stefan Metzmacher
8b2cada705 s4:kdc/db-glue: pass a valid principal from samba_kdc_seq() to samba_kdc_message2entry() 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
463be9f676 s4-kdc/db_glue: use smb_krb5_principal_set_realm(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
b705ec95d4 s4-kdc/db_glue: use krb5_copy_principal(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
7296f1b2f5 s4-kdc/db_glue: use smb_krb5_make_principal(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
2b29bfe62a s4-kdc/db_glue: use smb_krb5_keyblock_init_contents(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
07edd10ba5 s4-kdc/db_glue: no need to include kdc/kdc-glue.h header here. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
2f6cdbbb90 s4-kdc/db_glue: no need to NULL entry_ex->entry.generation. 
The whole entry_ex->entry struct is initialized already.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
b74413b339 s4-kdc/db_glue: remove unused hdb_entry_ex from samba_kdc_seq(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
d82388501f s4-kdc/db_glue: fix Debug messages. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Günther Deschner
97137347f3 s4-kdc/pac-glue: use kerberos_free_data_contents(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-20 23:25:53 +01:00
Stefan Metzmacher
8421c403e2 s4:kdc: fix realm for outgoing trusts in samba_kdc_trust_message2entry() 
This is a regression introduced in commit
8dd37327b0.

Now we change 'realm' before calling
ret = krb5_principal_set_realm(context, entry_ex->entry.principal, realm);
as before commit 8dd37327b0.

Without this we'd set entry_ex->entry.principal to
krbtgt/DOMA.EXAMPLE.COM@DOMA.EXAMPLE.COM instead
of krbtgt/DOMA.EXAMPLE.COM@DOMB.EXAMPLE.COM,
while we use krbtgt/DOMA.EXAMPLE.COM@DOMB.EXAMPLE.COM as
salt for the keys.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Mar 18 18:56:51 CET 2015 on sn-devel-104
 2015-03-18 18:56:51 +01:00
Andrew Bartlett
7f5740f342 kdc: Ensure we cope with a samAccountName with a space in it 
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
 2015-03-12 17:13:42 +01:00
Andrew Bartlett
a1ddee8d2f kdc: Fix S4U2Self handling with KRB5_NT_ENTERPRISE_PRINCIPAL containing a UPN 
This is now handled properly by samba_kdc_lookup_server() and this wrapper actually
breaks things.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2015-03-09 09:35:05 +01:00
Andrew Bartlett
f32564d643 kdc: make Samba KDC pass new TGS-REQ and AS-REQ (to self) testing 
This also reverts 51b94ab3fd as our
testing shows Windows 2012R2 does not have this behaviour.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
 2015-02-08 08:07:07 +01:00
Andrew Bartlett
01c6991d36 kdc: fixup KDC to use functions portable to MIT krb5 
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
 2015-02-08 08:07:07 +01:00
Andrew Bartlett
c1819f5fd1 kdc: Correctly return the krbtgt/realm@REALM principal from our KDC 
This needs to vary depending on if the client requested the canonicalize flag

This was found by our new krb5.kdc test

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
 2015-01-23 05:42:08 +01:00
Andrew Bartlett
69fb2a7616 kdc: Add TODO to remind us where we need to hook for RODC to get secrets 
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
 2015-01-23 05:42:08 +01:00