diff --git a/redhat-4.23.patch b/redhat-4.23.patch index e685a05..6652d4b 100644 --- a/redhat-4.23.patch +++ b/redhat-4.23.patch @@ -1,7 +1,7 @@ From e8384b6daea3b8091ad1bcfce84efc9e2c6a746d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 22 Jan 2026 14:27:09 +0100 -Subject: [PATCH 1/9] s3:libads: Allocate cli_credentials on a stackframe +Subject: [PATCH 01/13] s3:libads: Allocate cli_credentials on a stackframe MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -76,13 +76,13 @@ index 9d6d962a2bc..d01afa69697 100644 *res = NULL; -- -2.52.0 +2.53.0 From 7af95c7cb142aeb5f422a69d3b7a0ea3c0d2c2c2 Mon Sep 17 00:00:00 2001 From: Samuel Cabrero Date: Mon, 26 Jan 2026 13:36:02 +0100 -Subject: [PATCH 2/9] s3:rpc_client: Fix memory leak opening local named pipe +Subject: [PATCH 02/13] s3:rpc_client: Fix memory leak opening local named pipe If no local server name was passed to rpc_pipe_open_local_np() then get_myname() was called with NULL talloc context instead of the @@ -119,14 +119,14 @@ index e3f48526492..c61b8eb16cf 100644 if (local_server_addr != NULL) { -- -2.52.0 +2.53.0 From ab1287f78bd9d2397c8eb26fbedafa028e2aaa16 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 2 Dec 2025 17:17:33 +0100 -Subject: [PATCH 3/9] s3-selftest: mention in-memory ccache usage when nothing - is provided +Subject: [PATCH 03/13] s3-selftest: mention in-memory ccache usage when + nothing is provided BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 @@ -159,14 +159,14 @@ index 8a3c9ef2bc7..92d3996d078 100755 "$VALGRIND" "$BINDIR"/net ads kerberos kinit \ -P "$ADDARGS" \ -- -2.52.0 +2.53.0 From 0aa0d39e9a5deb77114f40930b599f11fd7cf3b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 2 Dec 2025 17:18:41 +0100 -Subject: [PATCH 4/9] s3-selftest: verify KRB5CCNAME presence after kinit using - klist +Subject: [PATCH 04/13] s3-selftest: verify KRB5CCNAME presence after kinit + using klist BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 @@ -216,14 +216,14 @@ index 92d3996d078..c53520cf733 100755 rm -f "$KRB5CCNAME_PATH" -- -2.52.0 +2.53.0 From b9c07d59c6a20931b80fa104629477ab8f78b4ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 2 Dec 2025 17:01:31 +0100 -Subject: [PATCH 5/9] s3-selftest: Activate "net ads kerberos kinit" tests with - --use-krb5-ccache +Subject: [PATCH 05/13] s3-selftest: Activate "net ads kerberos kinit" tests + with --use-krb5-ccache BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 @@ -295,13 +295,13 @@ index c53520cf733..b7933bab6a6 100755 ################################################# -- -2.52.0 +2.53.0 From c82b7636b633575621e8e5964a93332956c238ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 2 Dec 2025 16:56:44 +0100 -Subject: [PATCH 6/9] s3-net: properly setup krb5 ccache name via +Subject: [PATCH 06/13] s3-net: properly setup krb5 ccache name via --use-krb5-ccache BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 @@ -383,13 +383,13 @@ index d49b7537e71..5c57a0b290e 100644 } -- -2.52.0 +2.53.0 From 4f5ffea631d805564f7e92cc5f0f2f7ad55ba493 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 13 Dec 2025 13:49:37 +0100 -Subject: [PATCH 7/9] doc-xml: Document "net ads kerberos" commands +Subject: [PATCH 07/13] doc-xml: Document "net ads kerberos" commands MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -559,13 +559,13 @@ index d9293d0bb34..737415b3722 100644 SAM CREATEBUILTINGROUP <NAME> -- -2.52.0 +2.53.0 From f634526bd95b8396ea7f5f1c8ed059eb01a5286b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 3 Feb 2026 12:53:10 +0100 -Subject: [PATCH 8/9] s3:utils: 'net ads kerberos kinit' should use also +Subject: [PATCH 08/13] s3:utils: 'net ads kerberos kinit' should use also default ccache name from krb5.conf MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -666,13 +666,13 @@ index 271c96cf804..0ce03f8213d 100644 if (krb5ccname == NULL) { DBG_ERR("Not able to setup krb5 ccache"); -- -2.52.0 +2.53.0 From 0ca830d6ddded29b2b5d1969ebcbc4df1156656e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 5 Feb 2026 16:04:25 +0100 -Subject: [PATCH 9/9] manpages: Update NET ADS KERBEROS KINIT manpage +Subject: [PATCH 09/13] manpages: Update NET ADS KERBEROS KINIT manpage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -741,5 +741,217 @@ index 737415b3722..b793361a27f 100644 -- -2.52.0 +2.53.0 + + +From 44b613d80c6a3818cc6ca593d57d51cd1bc00aa5 Mon Sep 17 00:00:00 2001 +From: Noel Power +Date: Fri, 13 Feb 2026 11:54:46 +0000 +Subject: [PATCH 10/13] selftest: Update tests to use + --use-kereros=desired|required no creds + +Add tests to call smbclient without passing credentials to +demonstrate failure with --use-kereros=desired + +Also add knownfail + +Signed-off-by: Noel Power +Reviewed-by: Andreas Schneider +(cherry picked from commit a22af9420965083b99b956477d1833000b7f2414) +--- + selftest/knownfail | 2 ++ + source3/script/tests/test_smbclient_kerberos.sh | 12 ++++++++++++ + 2 files changed, 14 insertions(+) + +diff --git a/selftest/knownfail b/selftest/knownfail +index ab2d79d7114..f0a5f7bb935 100644 +--- a/selftest/knownfail ++++ b/selftest/knownfail +@@ -315,6 +315,8 @@ + # ad_member don't support ntlmv1 (not even over SMB1) + ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*ad_member + ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*ad_member ++# regression smbclient using --use-kerberos=desired https://bugzilla.samba.org/show_bug.cgi?id=15789 ++samba3.blackbox.smbclient.kerberos.smbclient.smb3.kerberos.desired \(no user/pass\).* + #nt-vfs server blocks read with execute access + ^samba4.smb2.read.access + #ntvfs server blocks copychunk with execute access on read handle +diff --git a/source3/script/tests/test_smbclient_kerberos.sh b/source3/script/tests/test_smbclient_kerberos.sh +index 31678d17e28..1139efd70d7 100755 +--- a/source3/script/tests/test_smbclient_kerberos.sh ++++ b/source3/script/tests/test_smbclient_kerberos.sh +@@ -73,6 +73,18 @@ test_smbclient "smbclient.smb3.kerberos.desired[//${SERVER}/tmp]" \ + --use-kerberos=desired -U${USERNAME}%${PASSWORD} -mSMB3 || + failed=$(expr $failed + 1) + ++test_smbclient "smbclient.smb3.kerberos.desired (no user/pass) [//${SERVER}/tmp]" \ ++ "ls; quit" //${SERVER}/tmp \ ++ --use-kerberos=desired -mSMB3 || ++ failed=$(expr $failed + 1) ++ ++test_smbclient "smbclient.smb3.kerberos.required (no user/pass) [//${SERVER}/tmp]" \ ++ "ls; quit" //${SERVER}/tmp \ ++ --use-kerberos=required -mSMB3 || ++ failed=$(expr $failed + 1) ++ ++ ++ + $samba_kdestroy + + rm -rf $KRB5CCNAME_PATH +-- +2.53.0 + + +From 65f70c0505759489a8b219e1297f8cdee2cc260a Mon Sep 17 00:00:00 2001 +From: Noel Power +Date: Mon, 19 Jan 2026 15:46:59 +0000 +Subject: [PATCH 11/13] auth/credentials: Fix regression with + --use-kerberos=desired for smbclient + +As part of the gse_krb5 processing the following call chain + +gensec_gse_client_start() + ---> gensec_kerberos_possible() + ---> cli_credentials_authentication_requested() + +gensec_kerberos_possible() will always fail when +cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED + +It seems since use kerberos == desired is the default that it isn't +necessary to see if credentials were modified to indicated authentication +was requested. gensec_kerberos_possible() should afaics return true +if kerberos is desired OR required (regardless of whether credentials +were requested) + +This commit removes the knownfail associated with this bug. + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789 +Signed-off-by: +Reviewed-by: Andreas Schneider +(cherry picked from commit 88f42eb222f299189d5f5f8204ae353e63a50970) +--- + auth/gensec/gensec_util.c | 5 ----- + selftest/knownfail | 2 -- + 2 files changed, 7 deletions(-) + +diff --git a/auth/gensec/gensec_util.c b/auth/gensec/gensec_util.c +index 0c7688d33d2..af6d198d48f 100644 +--- a/auth/gensec/gensec_util.c ++++ b/auth/gensec/gensec_util.c +@@ -362,7 +362,6 @@ char *gensec_get_unparsed_target_principal(struct gensec_security *gensec_securi + NTSTATUS gensec_kerberos_possible(struct gensec_security *gensec_security) + { + struct cli_credentials *creds = gensec_get_credentials(gensec_security); +- bool auth_requested = cli_credentials_authentication_requested(creds); + enum credentials_use_kerberos krb5_state = + cli_credentials_get_kerberos_state(creds); + char *user_principal = NULL; +@@ -370,10 +369,6 @@ NTSTATUS gensec_kerberos_possible(struct gensec_security *gensec_security) + const char *target_principal = gensec_get_target_principal(gensec_security); + const char *hostname = gensec_get_target_hostname(gensec_security); + +- if (!auth_requested) { +- return NT_STATUS_INVALID_PARAMETER; +- } +- + if (krb5_state == CRED_USE_KERBEROS_DISABLED) { + return NT_STATUS_INVALID_PARAMETER; + } +diff --git a/selftest/knownfail b/selftest/knownfail +index f0a5f7bb935..ab2d79d7114 100644 +--- a/selftest/knownfail ++++ b/selftest/knownfail +@@ -315,8 +315,6 @@ + # ad_member don't support ntlmv1 (not even over SMB1) + ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*ad_member + ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*ad_member +-# regression smbclient using --use-kerberos=desired https://bugzilla.samba.org/show_bug.cgi?id=15789 +-samba3.blackbox.smbclient.kerberos.smbclient.smb3.kerberos.desired \(no user/pass\).* + #nt-vfs server blocks read with execute access + ^samba4.smb2.read.access + #ntvfs server blocks copychunk with execute access on read handle +-- +2.53.0 + + +From 8c955cad98b197936fceaf98306047e1f929ddfe Mon Sep 17 00:00:00 2001 +From: Noel Power +Date: Mon, 19 Jan 2026 16:10:10 +0000 +Subject: [PATCH 12/13] s3/libsmb: cli_session_creds_init fails when kerberos + is desired + +There is a regression with code using cli_session_creds_init when +cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED + +Authentication succeeds when boolean fallback_after_kerberos is false +and fails when true. +There doesn't seem to be a good reason why the value of +fallback_after_kerberos should initialise the krb5 ccache or not. +It would seems that krb5 cache should be setup for creds +for *any* kerberos auth (whether fallback is enabled or not) + +Partial patch from (see bug referenced below) +Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789 +Signed-off-by: Noel Power +Reviewed-by: Andreas Schneider +(cherry picked from commit 1c48599105736499d18aa1f647bce9e1f8dbdcca) +--- + source3/libsmb/cliconnect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index 116f746d37e..3fd423d8e5f 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -218,7 +218,7 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx, + goto fail; + } + } +- } else if (use_kerberos && !fallback_after_kerberos) { ++ } else if (use_kerberos) { + const char *error_string = NULL; + int rc; + +-- +2.53.0 + + +From 015167aea7ece2bb683f86aa4b8c688d7a83267d Mon Sep 17 00:00:00 2001 +From: Noel Power +Date: Mon, 19 Jan 2026 16:18:02 +0000 +Subject: [PATCH 13/13] s3/libsmb: block anon authentication fallback is + use-kerberos = desired + +When cli_credentials_get_kerberos_state returns CRED_USE_KERBEROS_REQUIRED +libsmbclient method SMBC_server_internal will still try to fallback to +anon NTLM. This patch prevents that. + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789 +Signed-off-by: Noel Power +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Noel Power +Autobuild-Date(master): Tue Feb 17 16:06:18 UTC 2026 on atb-devel-224 + +(cherry picked from commit bc868800276fe09cbcb206ebe4cb4da32af7599f) +--- + source3/libsmb/libsmb_server.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index f9b52e1f05a..8c7208aaee0 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -632,6 +632,8 @@ SMBC_server_internal(TALLOC_CTX *ctx, + password_used = ""; + + if (smbc_getOptionNoAutoAnonymousLogin(context) || ++ cli_credentials_get_kerberos_state(creds) == ++ CRED_USE_KERBEROS_REQUIRED || + !NT_STATUS_IS_OK(cli_session_setup_anon(c))) { + + cli_shutdown(c); +-- +2.53.0