1
0
mirror of https://github.com/samba-team/samba.git synced 2025-03-12 20:58:37 +03:00
Isaac Boukris 534fd4b6ec CVE-2019-14870: heimdal: add S4U test for delegation_not_allowed
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
2019-12-03 12:50:18 +01:00

74 lines
2.7 KiB
Bash
Executable File

#!/bin/sh
if [ $# -lt 5 ]; then
cat <<EOF
Usage: test_kinit.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
EOF
exit 1;
fi
SERVER=$1
USERNAME=$2
PASSWORD=$3
REALM=$4
DOMAIN=$5
PREFIX=$6
shift 6
failed=0
samba_tool="$VALGRIND $PYTHON $BINDIR/samba-tool"
samba4kinit=kinit
if test -x $BINDIR/samba4kinit; then
samba4kinit=$BINDIR/samba4kinit
fi
samba4kgetcred=kgetcred
if test -x $BINDIR/samba4kgetcred; then
samba4kgetcred=$BINDIR/samba4kgetcred
fi
. `dirname $0`/subunit.sh
. `dirname $0`/common_test_fns.inc
ocache="$PREFIX/tmpoutcache"
KRB5CCNAME_PATH="$PREFIX/tmpccache"
KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
export KRB5CCNAME
rm -rf $KRB5CCNAME_PATH
princ=test_impersonate_princ
impersonator=test_impersonator
target="CIFS/$SERVER.$REALM"
testit "add impersonator principal" $samba_tool user add $impersonator $PASSWORD || failed=`expr $failed + 1`
testit "become a service" $samba_tool spn add "HOST/$impersonator" $impersonator || failed=`expr $failed + 1`
testit "set TrustedToAuthForDelegation" $samba_tool delegation for-any-protocol $impersonator on || failed=`expr $failed + 1`
testit "add msDS-AllowedToDelegateTo" $samba_tool delegation add-service $impersonator $target || failed=`expr $failed + 1`
testit "add a new principal" $samba_tool user add $princ --random-password || failed=`expr $failed + 1`
testit "set not-delegated flag" $samba_tool user sensitive $princ on || failed=`expr $failed + 1`
echo $PASSWORD > $PREFIX/tmppassfile
testit "kinit with password" $samba4kinit -f --password-file=$PREFIX/tmppassfile $impersonator || failed=`expr $failed + 1`
testit "test S4U2Self with normal user" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=${USERNAME} $impersonator || failed=`expr $failed + 1`
testit "test S4U2Proxy with normal user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=`expr $failed + 1`
testit "test S4U2Self with sensitive user" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=$princ $impersonator || failed=`expr $failed + 1`
testit_expect_failure "test S4U2Proxy with sensitive user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=`expr $failed + 1`
rm -f $ocache
testit "unset not-delegated flag" $samba_tool user sensitive $princ off || failed=`expr $failed + 1`
testit "test S4U2Self after unsetting ND flag" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=$princ $impersonator || failed=`expr $failed + 1`
testit "test S4U2Proxy after unsetting ND flag" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=`expr $failed + 1`
rm -f $ocache $PREFIX/tmpccache tmppassfile
exit $failed