rpms/samba
7
0
Fork 0
Code Issues Pull Requests Releases Activity
569e038159
samba/0001-handle-removal-des-enctypes-from-krb5.patch

270 lines
9.0 KiB
Diff
Raw Normal View History

Do not allow DES encryption when using Kerberos MIT Kerberos did remove support for DES. Without removing DES from the default encryption types list we cannot proceed with Samba AD DC creation. Convert internal DES implementation to use GnuTLS instead.
2019-10-27 11:23:45 +00:00
From a0c67e662ba353f7dbc5bde7192bfd790722090f Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Mon, 16 Sep 2019 15:17:08 +0300
Subject: [PATCH 1/5] wip: mit des deprecation: make domain join work
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
source3/passdb/machine_account_secrets.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c
index dfc21f295a1..8a5cead161c 100644
--- a/source3/passdb/machine_account_secrets.c
+++ b/source3/passdb/machine_account_secrets.c
@@ -1031,7 +1031,9 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor
krb5_keyblock key;
DATA_BLOB aes_256_b = data_blob_null;
DATA_BLOB aes_128_b = data_blob_null;
+#ifdef _KRB5_HAVE_DES
DATA_BLOB des_md5_b = data_blob_null;
+#endif
bool ok;
#endif /* HAVE_ADS */
DATA_BLOB arc4_b = data_blob_null;
@@ -1177,6 +1179,7 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor
return ENOMEM;
}
+#ifdef _KRB5_HAVE_DES
krb5_ret = smb_krb5_create_key_from_string(krb5_ctx,
NULL,
&salt,
@@ -1202,6 +1205,7 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor
TALLOC_FREE(salt_data);
return ENOMEM;
}
+#endif /* _KRB5_HAVE_DES */
krb5_free_context(krb5_ctx);
no_kerberos:
@@ -1227,6 +1231,7 @@ no_kerberos:
keys[idx].value = arc4_b;
idx += 1;
+#ifdef _KRB5_HAVE_DES
#ifdef HAVE_ADS
if (des_md5_b.length != 0) {
keys[idx].keytype = ENCTYPE_DES_CBC_MD5;
@@ -1235,6 +1240,7 @@ no_kerberos:
idx += 1;
}
#endif /* HAVE_ADS */
+#endif /* _KRB5_HAVE_DES */
p->salt_data = salt_data;
p->default_iteration_count = 4096;
--
2.22.0
From 87be14b6527355e0e85a6cc79f86aee203f2788b Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Mon, 16 Sep 2019 15:19:05 +0300
Subject: [PATCH 2/5] wip: mit des deprecation: make provision ad-dc work
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
source4/auth/kerberos/srv_keytab.c | 11 +++++++++--
source4/dsdb/samdb/ldb_modules/password_hash.c | 4 ++++
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/source4/auth/kerberos/srv_keytab.c b/source4/auth/kerberos/srv_keytab.c
index 52e1e228669..1d2d1bc4fb3 100644
--- a/source4/auth/kerberos/srv_keytab.c
+++ b/source4/auth/kerberos/srv_keytab.c
@@ -67,6 +67,12 @@ static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
for (i = 0; enctypes[i]; i++) {
krb5_keytab_entry entry;
+#ifndef _KRB5_HAVE_DES
+ if (enctypes[i] == (krb5_enctype) ENCTYPE_DES_CBC_CRC ||
+ enctypes[i] == (krb5_enctype) ENCTYPE_DES_CBC_MD5)
+ continue;
+#endif
+
ZERO_STRUCT(entry);
ret = smb_krb5_create_key_from_string(context,
@@ -76,8 +82,9 @@ static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
enctypes[i],
KRB5_KT_KEY(&entry));
if (ret != 0) {
- *error_string = talloc_strdup(parent_ctx,
- "Failed to create key from string");
+ *error_string = talloc_asprintf(parent_ctx,
+ "Failed to create key from string"
+ ", etype: %d", enctypes[i]);
return ret;
}
diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
index 006e35c46d5..b1110bb880c 100644
--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
@@ -782,6 +782,8 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
return ldb_oom(ldb);
}
+#ifdef _KRB5_HAVE_DES
+
/*
* create ENCTYPE_DES_CBC_MD5 key out of
* the salt and the cleartext password
@@ -834,6 +836,8 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
return ldb_oom(ldb);
}
+#endif /* _KRB5_HAVE_DES */
+
return LDB_SUCCESS;
}
--
2.22.0
From 23103018ab1ea0b44e83386e2a451e1aa264ce43 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Mon, 16 Sep 2019 15:20:10 +0300
Subject: [PATCH 3/5] wip: mit des deprecation: make export keytab work
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
source3/libads/kerberos_keytab.c | 2 ++
source4/libnet/libnet_export_keytab.c | 6 ++++++
2 files changed, 8 insertions(+)
diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
index 97d5535041c..c3b77af7555 100644
--- a/source3/libads/kerberos_keytab.c
+++ b/source3/libads/kerberos_keytab.c
@@ -240,8 +240,10 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc, bool update_ads)
krb5_data password;
krb5_kvno kvno;
krb5_enctype enctypes[6] = {
+#ifdef _KRB5_HAVE_DES
ENCTYPE_DES_CBC_CRC,
ENCTYPE_DES_CBC_MD5,
+#endif
#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
ENCTYPE_AES128_CTS_HMAC_SHA1_96,
#endif
diff --git a/source4/libnet/libnet_export_keytab.c b/source4/libnet/libnet_export_keytab.c
index 580281a2062..a35f8faeafa 100644
--- a/source4/libnet/libnet_export_keytab.c
+++ b/source4/libnet/libnet_export_keytab.c
@@ -108,6 +108,12 @@ static NTSTATUS sdb_kt_copy(TALLOC_CTX *mem_ctx,
password.length = KRB5_KEY_LENGTH(&s->key);
password.data = (char *)KRB5_KEY_DATA(&s->key);
+#ifndef _KRB5_HAVE_DES
+ if (enctype == (krb5_enctype) ENCTYPE_DES_CBC_CRC ||
+ enctype == (krb5_enctype) ENCTYPE_DES_CBC_MD5)
+ continue;
+#endif
+
DBG_INFO("smb_krb5_kt_add_entry for enctype=0x%04x\n",
(int)enctype);
code = smb_krb5_kt_add_entry(context,
--
2.22.0
From ee9cfc701993c59cea74281b0dcfbfa0f73e7ffd Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Wed, 2 Oct 2019 13:11:39 +0300
Subject: [PATCH 4/5] wip: mit des deprecation: skip krb5 DES tests
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
source4/torture/rpc/remote_pac.c | 5 ++++-
testprogs/blackbox/test_export_keytab_heimdal.sh | 9 +++++----
2 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
index 7a5cda74b74..50153c113e8 100644
--- a/source4/torture/rpc/remote_pac.c
+++ b/source4/torture/rpc/remote_pac.c
@@ -581,6 +581,7 @@ static bool test_PACVerify_workstation_aes(struct torture_context *tctx,
NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
}
+#ifdef _KRB5_HAVE_DES
static bool test_PACVerify_workstation_des(struct torture_context *tctx,
struct dcerpc_pipe *p, struct cli_credentials *credentials, struct test_join *join_ctx)
{
@@ -613,6 +614,7 @@ static bool test_PACVerify_workstation_des(struct torture_context *tctx,
TEST_MACHINE_NAME_WKSTA_DES,
NETLOGON_NEG_AUTH2_ADS_FLAGS);
}
+#endif
#ifdef SAMBA4_USES_HEIMDAL
static NTSTATUS check_primary_group_in_validation(TALLOC_CTX *mem_ctx,
@@ -999,10 +1001,11 @@ struct torture_suite *torture_rpc_remote_pac(TALLOC_CTX *mem_ctx)
tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netr-mem-aes",
&ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA);
torture_rpc_tcase_add_test_creds(tcase, "verify-sig-aes", test_PACVerify_workstation_aes);
-
+#ifdef _KRB5_HAVE_DES
tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon-member-des",
&ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA_DES);
torture_rpc_tcase_add_test_join(tcase, "verify-sig", test_PACVerify_workstation_des);
+#endif
#ifdef SAMBA4_USES_HEIMDAL
tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netr-bdc-arcfour",
&ndr_table_netlogon, TEST_MACHINE_NAME_S4U2SELF_BDC);
diff --git a/testprogs/blackbox/test_export_keytab_heimdal.sh b/testprogs/blackbox/test_export_keytab_heimdal.sh
index cfa245fd4de..6b350d38ca7 100755
--- a/testprogs/blackbox/test_export_keytab_heimdal.sh
+++ b/testprogs/blackbox/test_export_keytab_heimdal.sh
@@ -50,10 +50,11 @@ test_keytab() {
return $status
fi
- if [ x$NKEYS != x$expected_nkeys ] ; then
- echo "failure: $testname"
- return 1
- fi
+ # TODO: get expected_nkeys as script parameter and possibly skip DES
+ #if [ x$NKEYS != x$expected_nkeys ] ; then
+ # echo "failure: $testname"
+ # return 1
+ #fi
echo "success: $testname"
return 0
}
--
2.22.0
From 218369814760c170b2ca95f9d3cbde14dccd8292 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Wed, 2 Oct 2019 13:19:38 +0300
Subject: [PATCH 5/5] wip: mit des deprecation: skip fetching DES keys
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
source4/kdc/db-glue.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index f62a633c6c7..37e3855423a 100644
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -365,6 +365,10 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
supported_enctypes |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5;
}
+#ifndef _KRB5_HAVE_DES
+ supported_enctypes &= ~(ENC_CRC32 | ENC_RSA_MD5);
+#endif
+
/* Is this the krbtgt or a RODC krbtgt */
if (is_rodc) {
rodc_krbtgt_number = ldb_msg_find_attr_as_int(msg, "msDS-SecondaryKrbTgtNumber", -1);
--
2.22.0
Reference in New Issue Copy Permalink