Fix regression with --use-kerberos=desired for smbclient
- resolves: RHEL-150820
This commit is contained in:
Pavel Filipenský
parent
5b9777a2fc
commit
22820f651b
@ -1,7 +1,7 @@
|
||||
From e8384b6daea3b8091ad1bcfce84efc9e2c6a746d Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Thu, 22 Jan 2026 14:27:09 +0100
|
||||
Subject: [PATCH 1/9] s3:libads: Allocate cli_credentials on a stackframe
|
||||
Subject: [PATCH 01/13] s3:libads: Allocate cli_credentials on a stackframe
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -76,13 +76,13 @@ index 9d6d962a2bc..d01afa69697 100644
|
||||
*res = NULL;
|
||||
|
||||
--
|
||||
2.52.0
|
||||
2.53.0
|
||||
|
||||
|
||||
From 7af95c7cb142aeb5f422a69d3b7a0ea3c0d2c2c2 Mon Sep 17 00:00:00 2001
|
||||
From: Samuel Cabrero <scabrero@samba.org>
|
||||
Date: Mon, 26 Jan 2026 13:36:02 +0100
|
||||
Subject: [PATCH 2/9] s3:rpc_client: Fix memory leak opening local named pipe
|
||||
Subject: [PATCH 02/13] s3:rpc_client: Fix memory leak opening local named pipe
|
||||
|
||||
If no local server name was passed to rpc_pipe_open_local_np() then
|
||||
get_myname() was called with NULL talloc context instead of the
|
||||
@ -119,14 +119,14 @@ index e3f48526492..c61b8eb16cf 100644
|
||||
|
||||
if (local_server_addr != NULL) {
|
||||
--
|
||||
2.52.0
|
||||
2.53.0
|
||||
|
||||
|
||||
From ab1287f78bd9d2397c8eb26fbedafa028e2aaa16 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
||||
Date: Tue, 2 Dec 2025 17:17:33 +0100
|
||||
Subject: [PATCH 3/9] s3-selftest: mention in-memory ccache usage when nothing
|
||||
is provided
|
||||
Subject: [PATCH 03/13] s3-selftest: mention in-memory ccache usage when
|
||||
nothing is provided
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840
|
||||
|
||||
@ -159,14 +159,14 @@ index 8a3c9ef2bc7..92d3996d078 100755
|
||||
"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
|
||||
-P "$ADDARGS" \
|
||||
--
|
||||
2.52.0
|
||||
2.53.0
|
||||
|
||||
|
||||
From 0aa0d39e9a5deb77114f40930b599f11fd7cf3b6 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
||||
Date: Tue, 2 Dec 2025 17:18:41 +0100
|
||||
Subject: [PATCH 4/9] s3-selftest: verify KRB5CCNAME presence after kinit using
|
||||
klist
|
||||
Subject: [PATCH 04/13] s3-selftest: verify KRB5CCNAME presence after kinit
|
||||
using klist
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840
|
||||
|
||||
@ -216,14 +216,14 @@ index 92d3996d078..c53520cf733 100755
|
||||
rm -f "$KRB5CCNAME_PATH"
|
||||
|
||||
--
|
||||
2.52.0
|
||||
2.53.0
|
||||
|
||||
|
||||
From b9c07d59c6a20931b80fa104629477ab8f78b4ad Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
||||
Date: Tue, 2 Dec 2025 17:01:31 +0100
|
||||
Subject: [PATCH 5/9] s3-selftest: Activate "net ads kerberos kinit" tests with
|
||||
--use-krb5-ccache
|
||||
Subject: [PATCH 05/13] s3-selftest: Activate "net ads kerberos kinit" tests
|
||||
with --use-krb5-ccache
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840
|
||||
|
||||
@ -295,13 +295,13 @@ index c53520cf733..b7933bab6a6 100755
|
||||
|
||||
#################################################
|
||||
--
|
||||
2.52.0
|
||||
2.53.0
|
||||
|
||||
|
||||
From c82b7636b633575621e8e5964a93332956c238ff Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
||||
Date: Tue, 2 Dec 2025 16:56:44 +0100
|
||||
Subject: [PATCH 6/9] s3-net: properly setup krb5 ccache name via
|
||||
Subject: [PATCH 06/13] s3-net: properly setup krb5 ccache name via
|
||||
--use-krb5-ccache
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840
|
||||
@ -383,13 +383,13 @@ index d49b7537e71..5c57a0b290e 100644
|
||||
}
|
||||
|
||||
--
|
||||
2.52.0
|
||||
2.53.0
|
||||
|
||||
|
||||
From 4f5ffea631d805564f7e92cc5f0f2f7ad55ba493 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
||||
Date: Sat, 13 Dec 2025 13:49:37 +0100
|
||||
Subject: [PATCH 7/9] doc-xml: Document "net ads kerberos" commands
|
||||
Subject: [PATCH 07/13] doc-xml: Document "net ads kerberos" commands
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -559,13 +559,13 @@ index d9293d0bb34..737415b3722 100644
|
||||
<title>SAM CREATEBUILTINGROUP <NAME></title>
|
||||
|
||||
--
|
||||
2.52.0
|
||||
2.53.0
|
||||
|
||||
|
||||
From f634526bd95b8396ea7f5f1c8ed059eb01a5286b Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Tue, 3 Feb 2026 12:53:10 +0100
|
||||
Subject: [PATCH 8/9] s3:utils: 'net ads kerberos kinit' should use also
|
||||
Subject: [PATCH 08/13] s3:utils: 'net ads kerberos kinit' should use also
|
||||
default ccache name from krb5.conf
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -666,13 +666,13 @@ index 271c96cf804..0ce03f8213d 100644
|
||||
if (krb5ccname == NULL) {
|
||||
DBG_ERR("Not able to setup krb5 ccache");
|
||||
--
|
||||
2.52.0
|
||||
2.53.0
|
||||
|
||||
|
||||
From 0ca830d6ddded29b2b5d1969ebcbc4df1156656e Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Thu, 5 Feb 2026 16:04:25 +0100
|
||||
Subject: [PATCH 9/9] manpages: Update NET ADS KERBEROS KINIT manpage
|
||||
Subject: [PATCH 09/13] manpages: Update NET ADS KERBEROS KINIT manpage
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -741,5 +741,217 @@ index 737415b3722..b793361a27f 100644
|
||||
</refsect2>
|
||||
|
||||
--
|
||||
2.52.0
|
||||
2.53.0
|
||||
|
||||
|
||||
From 44b613d80c6a3818cc6ca593d57d51cd1bc00aa5 Mon Sep 17 00:00:00 2001
|
||||
From: Noel Power <noel.power@suse.com>
|
||||
Date: Fri, 13 Feb 2026 11:54:46 +0000
|
||||
Subject: [PATCH 10/13] selftest: Update tests to use
|
||||
--use-kereros=desired|required no creds
|
||||
|
||||
Add tests to call smbclient without passing credentials to
|
||||
demonstrate failure with --use-kereros=desired
|
||||
|
||||
Also add knownfail
|
||||
|
||||
Signed-off-by: Noel Power <noel.power@suse.com>
|
||||
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||
(cherry picked from commit a22af9420965083b99b956477d1833000b7f2414)
|
||||
---
|
||||
selftest/knownfail | 2 ++
|
||||
source3/script/tests/test_smbclient_kerberos.sh | 12 ++++++++++++
|
||||
2 files changed, 14 insertions(+)
|
||||
|
||||
diff --git a/selftest/knownfail b/selftest/knownfail
|
||||
index ab2d79d7114..f0a5f7bb935 100644
|
||||
--- a/selftest/knownfail
|
||||
+++ b/selftest/knownfail
|
||||
@@ -315,6 +315,8 @@
|
||||
# ad_member don't support ntlmv1 (not even over SMB1)
|
||||
^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*ad_member
|
||||
^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*ad_member
|
||||
+# regression smbclient using --use-kerberos=desired https://bugzilla.samba.org/show_bug.cgi?id=15789
|
||||
+samba3.blackbox.smbclient.kerberos.smbclient.smb3.kerberos.desired \(no user/pass\).*
|
||||
#nt-vfs server blocks read with execute access
|
||||
^samba4.smb2.read.access
|
||||
#ntvfs server blocks copychunk with execute access on read handle
|
||||
diff --git a/source3/script/tests/test_smbclient_kerberos.sh b/source3/script/tests/test_smbclient_kerberos.sh
|
||||
index 31678d17e28..1139efd70d7 100755
|
||||
--- a/source3/script/tests/test_smbclient_kerberos.sh
|
||||
+++ b/source3/script/tests/test_smbclient_kerberos.sh
|
||||
@@ -73,6 +73,18 @@ test_smbclient "smbclient.smb3.kerberos.desired[//${SERVER}/tmp]" \
|
||||
--use-kerberos=desired -U${USERNAME}%${PASSWORD} -mSMB3 ||
|
||||
failed=$(expr $failed + 1)
|
||||
|
||||
+test_smbclient "smbclient.smb3.kerberos.desired (no user/pass) [//${SERVER}/tmp]" \
|
||||
+ "ls; quit" //${SERVER}/tmp \
|
||||
+ --use-kerberos=desired -mSMB3 ||
|
||||
+ failed=$(expr $failed + 1)
|
||||
+
|
||||
+test_smbclient "smbclient.smb3.kerberos.required (no user/pass) [//${SERVER}/tmp]" \
|
||||
+ "ls; quit" //${SERVER}/tmp \
|
||||
+ --use-kerberos=required -mSMB3 ||
|
||||
+ failed=$(expr $failed + 1)
|
||||
+
|
||||
+
|
||||
+
|
||||
$samba_kdestroy
|
||||
|
||||
rm -rf $KRB5CCNAME_PATH
|
||||
--
|
||||
2.53.0
|
||||
|
||||
|
||||
From 65f70c0505759489a8b219e1297f8cdee2cc260a Mon Sep 17 00:00:00 2001
|
||||
From: Noel Power <noel.power@suse.com>
|
||||
Date: Mon, 19 Jan 2026 15:46:59 +0000
|
||||
Subject: [PATCH 11/13] auth/credentials: Fix regression with
|
||||
--use-kerberos=desired for smbclient
|
||||
|
||||
As part of the gse_krb5 processing the following call chain
|
||||
|
||||
gensec_gse_client_start()
|
||||
---> gensec_kerberos_possible()
|
||||
---> cli_credentials_authentication_requested()
|
||||
|
||||
gensec_kerberos_possible() will always fail when
|
||||
cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED
|
||||
|
||||
It seems since use kerberos == desired is the default that it isn't
|
||||
necessary to see if credentials were modified to indicated authentication
|
||||
was requested. gensec_kerberos_possible() should afaics return true
|
||||
if kerberos is desired OR required (regardless of whether credentials
|
||||
were requested)
|
||||
|
||||
This commit removes the knownfail associated with this bug.
|
||||
|
||||
Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789
|
||||
Signed-off-by: <noel.power@suse.com>
|
||||
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||
(cherry picked from commit 88f42eb222f299189d5f5f8204ae353e63a50970)
|
||||
---
|
||||
auth/gensec/gensec_util.c | 5 -----
|
||||
selftest/knownfail | 2 --
|
||||
2 files changed, 7 deletions(-)
|
||||
|
||||
diff --git a/auth/gensec/gensec_util.c b/auth/gensec/gensec_util.c
|
||||
index 0c7688d33d2..af6d198d48f 100644
|
||||
--- a/auth/gensec/gensec_util.c
|
||||
+++ b/auth/gensec/gensec_util.c
|
||||
@@ -362,7 +362,6 @@ char *gensec_get_unparsed_target_principal(struct gensec_security *gensec_securi
|
||||
NTSTATUS gensec_kerberos_possible(struct gensec_security *gensec_security)
|
||||
{
|
||||
struct cli_credentials *creds = gensec_get_credentials(gensec_security);
|
||||
- bool auth_requested = cli_credentials_authentication_requested(creds);
|
||||
enum credentials_use_kerberos krb5_state =
|
||||
cli_credentials_get_kerberos_state(creds);
|
||||
char *user_principal = NULL;
|
||||
@@ -370,10 +369,6 @@ NTSTATUS gensec_kerberos_possible(struct gensec_security *gensec_security)
|
||||
const char *target_principal = gensec_get_target_principal(gensec_security);
|
||||
const char *hostname = gensec_get_target_hostname(gensec_security);
|
||||
|
||||
- if (!auth_requested) {
|
||||
- return NT_STATUS_INVALID_PARAMETER;
|
||||
- }
|
||||
-
|
||||
if (krb5_state == CRED_USE_KERBEROS_DISABLED) {
|
||||
return NT_STATUS_INVALID_PARAMETER;
|
||||
}
|
||||
diff --git a/selftest/knownfail b/selftest/knownfail
|
||||
index f0a5f7bb935..ab2d79d7114 100644
|
||||
--- a/selftest/knownfail
|
||||
+++ b/selftest/knownfail
|
||||
@@ -315,8 +315,6 @@
|
||||
# ad_member don't support ntlmv1 (not even over SMB1)
|
||||
^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*ad_member
|
||||
^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*ad_member
|
||||
-# regression smbclient using --use-kerberos=desired https://bugzilla.samba.org/show_bug.cgi?id=15789
|
||||
-samba3.blackbox.smbclient.kerberos.smbclient.smb3.kerberos.desired \(no user/pass\).*
|
||||
#nt-vfs server blocks read with execute access
|
||||
^samba4.smb2.read.access
|
||||
#ntvfs server blocks copychunk with execute access on read handle
|
||||
--
|
||||
2.53.0
|
||||
|
||||
|
||||
From 8c955cad98b197936fceaf98306047e1f929ddfe Mon Sep 17 00:00:00 2001
|
||||
From: Noel Power <noel.power@suse.com>
|
||||
Date: Mon, 19 Jan 2026 16:10:10 +0000
|
||||
Subject: [PATCH 12/13] s3/libsmb: cli_session_creds_init fails when kerberos
|
||||
is desired
|
||||
|
||||
There is a regression with code using cli_session_creds_init when
|
||||
cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED
|
||||
|
||||
Authentication succeeds when boolean fallback_after_kerberos is false
|
||||
and fails when true.
|
||||
There doesn't seem to be a good reason why the value of
|
||||
fallback_after_kerberos should initialise the krb5 ccache or not.
|
||||
It would seems that krb5 cache should be setup for creds
|
||||
for *any* kerberos auth (whether fallback is enabled or not)
|
||||
|
||||
Partial patch from <will69@gmx.de> (see bug referenced below)
|
||||
Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789
|
||||
Signed-off-by: Noel Power <noel.power@suse.com>
|
||||
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||
(cherry picked from commit 1c48599105736499d18aa1f647bce9e1f8dbdcca)
|
||||
---
|
||||
source3/libsmb/cliconnect.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
|
||||
index 116f746d37e..3fd423d8e5f 100644
|
||||
--- a/source3/libsmb/cliconnect.c
|
||||
+++ b/source3/libsmb/cliconnect.c
|
||||
@@ -218,7 +218,7 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx,
|
||||
goto fail;
|
||||
}
|
||||
}
|
||||
- } else if (use_kerberos && !fallback_after_kerberos) {
|
||||
+ } else if (use_kerberos) {
|
||||
const char *error_string = NULL;
|
||||
int rc;
|
||||
|
||||
--
|
||||
2.53.0
|
||||
|
||||
|
||||
From 015167aea7ece2bb683f86aa4b8c688d7a83267d Mon Sep 17 00:00:00 2001
|
||||
From: Noel Power <noel.power@suse.com>
|
||||
Date: Mon, 19 Jan 2026 16:18:02 +0000
|
||||
Subject: [PATCH 13/13] s3/libsmb: block anon authentication fallback is
|
||||
use-kerberos = desired
|
||||
|
||||
When cli_credentials_get_kerberos_state returns CRED_USE_KERBEROS_REQUIRED
|
||||
libsmbclient method SMBC_server_internal will still try to fallback to
|
||||
anon NTLM. This patch prevents that.
|
||||
|
||||
Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789
|
||||
Signed-off-by: Noel Power <noel.power@suse.com>
|
||||
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||
|
||||
Autobuild-User(master): Noel Power <npower@samba.org>
|
||||
Autobuild-Date(master): Tue Feb 17 16:06:18 UTC 2026 on atb-devel-224
|
||||
|
||||
(cherry picked from commit bc868800276fe09cbcb206ebe4cb4da32af7599f)
|
||||
---
|
||||
source3/libsmb/libsmb_server.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c
|
||||
index f9b52e1f05a..8c7208aaee0 100644
|
||||
--- a/source3/libsmb/libsmb_server.c
|
||||
+++ b/source3/libsmb/libsmb_server.c
|
||||
@@ -632,6 +632,8 @@ SMBC_server_internal(TALLOC_CTX *ctx,
|
||||
password_used = "";
|
||||
|
||||
if (smbc_getOptionNoAutoAnonymousLogin(context) ||
|
||||
+ cli_credentials_get_kerberos_state(creds) ==
|
||||
+ CRED_USE_KERBEROS_REQUIRED ||
|
||||
!NT_STATUS_IS_OK(cli_session_setup_anon(c))) {
|
||||
|
||||
cli_shutdown(c);
|
||||
--
|
||||
2.53.0
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user