rpms/samba
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Do not allow DES encryption when using Kerberos

Browse Source 
MIT Kerberos did remove support for DES. Without removing DES from the
default encryption types list we cannot proceed with Samba AD DC
creation.

Convert internal DES implementation to use GnuTLS instead.
This commit is contained in:
Alexander Bokovoy 2019-10-27 13:23:45 +02:00
parent e5c09f56c5
commit e9627e790b
3 changed files with 642 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

371
0000-use-gnutls-for-des-cbc.patch Normal file
View File

@ -0,0 +1,371 @@
From 21073bff847fbc41d3dab0a649fa400d8188fa16 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Sat, 19 Oct 2019 23:48:19 +0300
Subject: [PATCH 1/2] smbdes: add des_crypt56_gnutls() using use DES-CBC with
zeroed IV
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
libcli/auth/smbdes.c | 47 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 47 insertions(+)
diff --git a/libcli/auth/smbdes.c b/libcli/auth/smbdes.c
index 6d9a6dc2ce8..37ede91ad22 100644
--- a/libcli/auth/smbdes.c
+++ b/libcli/auth/smbdes.c
@@ -23,6 +23,9 @@
#include "includes.h"
#include "libcli/auth/libcli_auth.h"
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
+
/* NOTES:
This code makes no attempt to be fast! In fact, it is a very
@@ -273,6 +276,50 @@ static void str_to_key(const uint8_t *str,uint8_t *key)
}
}
+static int des_crypt56_gnutls(uint8_t out[8], const uint8_t in[8],
+ const uint8_t key_in[7], bool enc)
+{
+ static uint8_t iv8[8];
+ gnutls_datum_t iv = { iv8, 8 };
+ gnutls_datum_t key;
+ gnutls_cipher_hd_t ctx;
+ uint8_t key2[8];
+ uint8_t outb[8];
+ int ret;
+
+ memset(out, 0, 8);
+
+ str_to_key(key_in, key2);
+
+ key.data = key2;
+ key.size = 8;
+
+ ret = gnutls_global_init();
+ if (ret != 0) {
+ return ret;
+ }
+
+ ret = gnutls_cipher_init(&ctx, GNUTLS_CIPHER_DES_CBC, &key, &iv);
+ if (ret != 0) {
+ return ret;
+ }
+
+ memcpy(outb, in, 8);
+ if (enc) {
+ ret = gnutls_cipher_encrypt(ctx, outb, 8);
+ } else {
+ ret = gnutls_cipher_decrypt(ctx, outb, 8);
+ }
+
+ if (ret == 0) {
+ memcpy(out, outb, 8);
+ }
+
+ gnutls_cipher_deinit(ctx);
+
+ return ret;
+}
+
/*
basic des crypt using a 56 bit (7 byte) key
*/
--
2.22.0
From 6d6651213f391840e3004ec3b055f8f25be9b360 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Mon, 21 Oct 2019 20:03:04 +0300
Subject: [PATCH 2/2] smbdes: use the new des_crypt56_gnutls()
and remove builtin DES crypto.
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
libcli/auth/smbdes.c | 258 +------------------------------------------
1 file changed, 1 insertion(+), 257 deletions(-)
diff --git a/libcli/auth/smbdes.c b/libcli/auth/smbdes.c
index 37ede91ad22..7de05b75303 100644
--- a/libcli/auth/smbdes.c
+++ b/libcli/auth/smbdes.c
@@ -26,239 +26,6 @@
#include <gnutls/gnutls.h>
#include <gnutls/crypto.h>
-/* NOTES:
-
- This code makes no attempt to be fast! In fact, it is a very
- slow implementation
-
- This code is NOT a complete DES implementation. It implements only
- the minimum necessary for SMB authentication, as used by all SMB
- products (including every copy of Microsoft Windows95 ever sold)
-
- In particular, it can only do a unchained forward DES pass. This
- means it is not possible to use this code for encryption/decryption
- of data, instead it is only useful as a "hash" algorithm.
-
- There is no entry point into this code that allows normal DES operation.
-
- I believe this means that this code does not come under ITAR
- regulations but this is NOT a legal opinion. If you are concerned
- about the applicability of ITAR regulations to this code then you
- should confirm it for yourself (and maybe let me know if you come
- up with a different answer to the one above)
-*/
-
-
-static const uint8_t perm1[56] = {57, 49, 41, 33, 25, 17, 9,
- 1, 58, 50, 42, 34, 26, 18,
- 10, 2, 59, 51, 43, 35, 27,
- 19, 11, 3, 60, 52, 44, 36,
- 63, 55, 47, 39, 31, 23, 15,
- 7, 62, 54, 46, 38, 30, 22,
- 14, 6, 61, 53, 45, 37, 29,
- 21, 13, 5, 28, 20, 12, 4};
-
-static const uint8_t perm2[48] = {14, 17, 11, 24, 1, 5,
- 3, 28, 15, 6, 21, 10,
- 23, 19, 12, 4, 26, 8,
- 16, 7, 27, 20, 13, 2,
- 41, 52, 31, 37, 47, 55,
- 30, 40, 51, 45, 33, 48,
- 44, 49, 39, 56, 34, 53,
- 46, 42, 50, 36, 29, 32};
-
-static const uint8_t perm3[64] = {58, 50, 42, 34, 26, 18, 10, 2,
- 60, 52, 44, 36, 28, 20, 12, 4,
- 62, 54, 46, 38, 30, 22, 14, 6,
- 64, 56, 48, 40, 32, 24, 16, 8,
- 57, 49, 41, 33, 25, 17, 9, 1,
- 59, 51, 43, 35, 27, 19, 11, 3,
- 61, 53, 45, 37, 29, 21, 13, 5,
- 63, 55, 47, 39, 31, 23, 15, 7};
-
-static const uint8_t perm4[48] = { 32, 1, 2, 3, 4, 5,
- 4, 5, 6, 7, 8, 9,
- 8, 9, 10, 11, 12, 13,
- 12, 13, 14, 15, 16, 17,
- 16, 17, 18, 19, 20, 21,
- 20, 21, 22, 23, 24, 25,
- 24, 25, 26, 27, 28, 29,
- 28, 29, 30, 31, 32, 1};
-
-static const uint8_t perm5[32] = { 16, 7, 20, 21,
- 29, 12, 28, 17,
- 1, 15, 23, 26,
- 5, 18, 31, 10,
- 2, 8, 24, 14,
- 32, 27, 3, 9,
- 19, 13, 30, 6,
- 22, 11, 4, 25};
-
-
-static const uint8_t perm6[64] ={ 40, 8, 48, 16, 56, 24, 64, 32,
- 39, 7, 47, 15, 55, 23, 63, 31,
- 38, 6, 46, 14, 54, 22, 62, 30,
- 37, 5, 45, 13, 53, 21, 61, 29,
- 36, 4, 44, 12, 52, 20, 60, 28,
- 35, 3, 43, 11, 51, 19, 59, 27,
- 34, 2, 42, 10, 50, 18, 58, 26,
- 33, 1, 41, 9, 49, 17, 57, 25};
-
-
-static const uint8_t sc[16] = {1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1};
-
-static const uint8_t sbox[8][4][16] = {
- {{14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7},
- {0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8},
- {4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0},
- {15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13}},
-
- {{15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10},
- {3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5},
- {0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15},
- {13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9}},
-
- {{10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8},
- {13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1},
- {13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7},
- {1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12}},
-
- {{7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15},
- {13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9},
- {10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4},
- {3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14}},
-
- {{2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9},
- {14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6},
- {4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14},
- {11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3}},
-
- {{12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11},
- {10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8},
- {9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6},
- {4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13}},
-
- {{4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1},
- {13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6},
- {1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2},
- {6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12}},
-
- {{13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7},
- {1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2},
- {7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8},
- {2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11}}};
-
-static void permute(char *out, const char *in, const uint8_t *p, int n)
-{
- int i;
- for (i=0;i<n;i++)
- out[i] = in[p[i]-1];
-}
-
-static void lshift(char *d, int count, int n)
-{
- char out[64];
- int i;
- for (i=0;i<n;i++)
- out[i] = d[(i+count)%n];
- for (i=0;i<n;i++)
- d[i] = out[i];
-}
-
-static void concat(char *out, char *in1, char *in2, int l1, int l2)
-{
- while (l1--)
- *out++ = *in1++;
- while (l2--)
- *out++ = *in2++;
-}
-
-static void xor(char *out, char *in1, char *in2, int n)
-{
- int i;
- for (i=0;i<n;i++)
- out[i] = in1[i] ^ in2[i];
-}
-
-static void dohash(char *out, char *in, char *key, int forw)
-{
- int i, j, k;
- char pk1[56];
- char c[28];
- char d[28];
- char cd[56];
- char ki[16][48];
- char pd1[64];
- char l[32], r[32];
- char rl[64];
-
- permute(pk1, key, perm1, 56);
-
- for (i=0;i<28;i++)
- c[i] = pk1[i];
- for (i=0;i<28;i++)
- d[i] = pk1[i+28];
-
- for (i=0;i<16;i++) {
- lshift(c, sc[i], 28);
- lshift(d, sc[i], 28);
-
- concat(cd, c, d, 28, 28);
- permute(ki[i], cd, perm2, 48);
- }
-
- permute(pd1, in, perm3, 64);
-
- for (j=0;j<32;j++) {
- l[j] = pd1[j];
- r[j] = pd1[j+32];
- }
-
- for (i=0;i<16;i++) {
- char er[48];
- char erk[48];
- char b[8][6];
- char cb[32];
- char pcb[32];
- char r2[32];
-
- permute(er, r, perm4, 48);
-
- xor(erk, er, ki[forw ? i : 15 - i], 48);
-
- for (j=0;j<8;j++)
- for (k=0;k<6;k++)
- b[j][k] = erk[j*6 + k];
-
- for (j=0;j<8;j++) {
- int m, n;
- m = (b[j][0]<<1) | b[j][5];
-
- n = (b[j][1]<<3) | (b[j][2]<<2) | (b[j][3]<<1) | b[j][4];
-
- for (k=0;k<4;k++)
- b[j][k] = (sbox[j][m][n] & (1<<(3-k)))?1:0;
- }
-
- for (j=0;j<8;j++)
- for (k=0;k<4;k++)
- cb[j*4+k] = b[j][k];
- permute(pcb, cb, perm5, 32);
-
- xor(r2, l, pcb, 32);
-
- for (j=0;j<32;j++)
- l[j] = r[j];
-
- for (j=0;j<32;j++)
- r[j] = r2[j];
- }
-
- concat(rl, r, l, 32, 32);
-
- permute(out, rl, perm6, 64);
-}
-
static void str_to_key(const uint8_t *str,uint8_t *key)
{
int i;
@@ -325,30 +92,7 @@ static int des_crypt56_gnutls(uint8_t out[8], const uint8_t in[8],
*/
void des_crypt56(uint8_t out[8], const uint8_t in[8], const uint8_t key[7], int forw)
{
- int i;
- char outb[64];
- char inb[64];
- char keyb[64];
- uint8_t key2[8];
-
- str_to_key(key, key2);
-
- for (i=0;i<64;i++) {
- inb[i] = (in[i/8] & (1<<(7-(i%8)))) ? 1 : 0;
- keyb[i] = (key2[i/8] & (1<<(7-(i%8)))) ? 1 : 0;
- outb[i] = 0;
- }
-
- dohash(outb, inb, keyb, forw);
-
- for (i=0;i<8;i++) {
- out[i] = 0;
- }
-
- for (i=0;i<64;i++) {
- if (outb[i])
- out[i/8] |= (1<<(7-(i%8)));
- }
+ (void)des_crypt56_gnutls(out, in, key, forw);
}
void E_P16(const uint8_t *p14,uint8_t *p16)
--
2.22.0

269
0001-handle-removal-des-enctypes-from-krb5.patch Normal file
View File

@ -0,0 +1,269 @@
From a0c67e662ba353f7dbc5bde7192bfd790722090f Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Mon, 16 Sep 2019 15:17:08 +0300
Subject: [PATCH 1/5] wip: mit des deprecation: make domain join work
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
source3/passdb/machine_account_secrets.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c
index dfc21f295a1..8a5cead161c 100644
--- a/source3/passdb/machine_account_secrets.c
+++ b/source3/passdb/machine_account_secrets.c
@@ -1031,7 +1031,9 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor
krb5_keyblock key;
DATA_BLOB aes_256_b = data_blob_null;
DATA_BLOB aes_128_b = data_blob_null;
+#ifdef _KRB5_HAVE_DES
DATA_BLOB des_md5_b = data_blob_null;
+#endif
bool ok;
#endif /* HAVE_ADS */
DATA_BLOB arc4_b = data_blob_null;
@@ -1177,6 +1179,7 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor
return ENOMEM;
}
+#ifdef _KRB5_HAVE_DES
krb5_ret = smb_krb5_create_key_from_string(krb5_ctx,
NULL,
&salt,
@@ -1202,6 +1205,7 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor
TALLOC_FREE(salt_data);
return ENOMEM;
}
+#endif /* _KRB5_HAVE_DES */
krb5_free_context(krb5_ctx);
no_kerberos:
@@ -1227,6 +1231,7 @@ no_kerberos:
keys[idx].value = arc4_b;
idx += 1;
+#ifdef _KRB5_HAVE_DES
#ifdef HAVE_ADS
if (des_md5_b.length != 0) {
keys[idx].keytype = ENCTYPE_DES_CBC_MD5;
@@ -1235,6 +1240,7 @@ no_kerberos:
idx += 1;
}
#endif /* HAVE_ADS */
+#endif /* _KRB5_HAVE_DES */
p->salt_data = salt_data;
p->default_iteration_count = 4096;
--
2.22.0
From 87be14b6527355e0e85a6cc79f86aee203f2788b Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Mon, 16 Sep 2019 15:19:05 +0300
Subject: [PATCH 2/5] wip: mit des deprecation: make provision ad-dc work
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
source4/auth/kerberos/srv_keytab.c | 11 +++++++++--
source4/dsdb/samdb/ldb_modules/password_hash.c | 4 ++++
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/source4/auth/kerberos/srv_keytab.c b/source4/auth/kerberos/srv_keytab.c
index 52e1e228669..1d2d1bc4fb3 100644
--- a/source4/auth/kerberos/srv_keytab.c
+++ b/source4/auth/kerberos/srv_keytab.c
@@ -67,6 +67,12 @@ static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
for (i = 0; enctypes[i]; i++) {
krb5_keytab_entry entry;
+#ifndef _KRB5_HAVE_DES
+ if (enctypes[i] == (krb5_enctype) ENCTYPE_DES_CBC_CRC ||
+ enctypes[i] == (krb5_enctype) ENCTYPE_DES_CBC_MD5)
+ continue;
+#endif
+
ZERO_STRUCT(entry);
ret = smb_krb5_create_key_from_string(context,
@@ -76,8 +82,9 @@ static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
enctypes[i],
KRB5_KT_KEY(&entry));
if (ret != 0) {
- *error_string = talloc_strdup(parent_ctx,
- "Failed to create key from string");
+ *error_string = talloc_asprintf(parent_ctx,
+ "Failed to create key from string"
+ ", etype: %d", enctypes[i]);
return ret;
}
diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
index 006e35c46d5..b1110bb880c 100644
--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
@@ -782,6 +782,8 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
return ldb_oom(ldb);
}
+#ifdef _KRB5_HAVE_DES
+
/*
* create ENCTYPE_DES_CBC_MD5 key out of
* the salt and the cleartext password
@@ -834,6 +836,8 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
return ldb_oom(ldb);
}
+#endif /* _KRB5_HAVE_DES */
+
return LDB_SUCCESS;
}
--
2.22.0
From 23103018ab1ea0b44e83386e2a451e1aa264ce43 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Mon, 16 Sep 2019 15:20:10 +0300
Subject: [PATCH 3/5] wip: mit des deprecation: make export keytab work
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
source3/libads/kerberos_keytab.c | 2 ++
source4/libnet/libnet_export_keytab.c | 6 ++++++
2 files changed, 8 insertions(+)
diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
index 97d5535041c..c3b77af7555 100644
--- a/source3/libads/kerberos_keytab.c
+++ b/source3/libads/kerberos_keytab.c
@@ -240,8 +240,10 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc, bool update_ads)
krb5_data password;
krb5_kvno kvno;
krb5_enctype enctypes[6] = {
+#ifdef _KRB5_HAVE_DES
ENCTYPE_DES_CBC_CRC,
ENCTYPE_DES_CBC_MD5,
+#endif
#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
ENCTYPE_AES128_CTS_HMAC_SHA1_96,
#endif
diff --git a/source4/libnet/libnet_export_keytab.c b/source4/libnet/libnet_export_keytab.c
index 580281a2062..a35f8faeafa 100644
--- a/source4/libnet/libnet_export_keytab.c
+++ b/source4/libnet/libnet_export_keytab.c
@@ -108,6 +108,12 @@ static NTSTATUS sdb_kt_copy(TALLOC_CTX *mem_ctx,
password.length = KRB5_KEY_LENGTH(&s->key);
password.data = (char *)KRB5_KEY_DATA(&s->key);
+#ifndef _KRB5_HAVE_DES
+ if (enctype == (krb5_enctype) ENCTYPE_DES_CBC_CRC ||
+ enctype == (krb5_enctype) ENCTYPE_DES_CBC_MD5)
+ continue;
+#endif
+
DBG_INFO("smb_krb5_kt_add_entry for enctype=0x%04x\n",
(int)enctype);
code = smb_krb5_kt_add_entry(context,
--
2.22.0
From ee9cfc701993c59cea74281b0dcfbfa0f73e7ffd Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Wed, 2 Oct 2019 13:11:39 +0300
Subject: [PATCH 4/5] wip: mit des deprecation: skip krb5 DES tests
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
source4/torture/rpc/remote_pac.c | 5 ++++-
testprogs/blackbox/test_export_keytab_heimdal.sh | 9 +++++----
2 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
index 7a5cda74b74..50153c113e8 100644
--- a/source4/torture/rpc/remote_pac.c
+++ b/source4/torture/rpc/remote_pac.c
@@ -581,6 +581,7 @@ static bool test_PACVerify_workstation_aes(struct torture_context *tctx,
NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
}
+#ifdef _KRB5_HAVE_DES
static bool test_PACVerify_workstation_des(struct torture_context *tctx,
struct dcerpc_pipe *p, struct cli_credentials *credentials, struct test_join *join_ctx)
{
@@ -613,6 +614,7 @@ static bool test_PACVerify_workstation_des(struct torture_context *tctx,
TEST_MACHINE_NAME_WKSTA_DES,
NETLOGON_NEG_AUTH2_ADS_FLAGS);
}
+#endif
#ifdef SAMBA4_USES_HEIMDAL
static NTSTATUS check_primary_group_in_validation(TALLOC_CTX *mem_ctx,
@@ -999,10 +1001,11 @@ struct torture_suite *torture_rpc_remote_pac(TALLOC_CTX *mem_ctx)
tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netr-mem-aes",
&ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA);
torture_rpc_tcase_add_test_creds(tcase, "verify-sig-aes", test_PACVerify_workstation_aes);
-
+#ifdef _KRB5_HAVE_DES
tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon-member-des",
&ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA_DES);
torture_rpc_tcase_add_test_join(tcase, "verify-sig", test_PACVerify_workstation_des);
+#endif
#ifdef SAMBA4_USES_HEIMDAL
tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netr-bdc-arcfour",
&ndr_table_netlogon, TEST_MACHINE_NAME_S4U2SELF_BDC);
diff --git a/testprogs/blackbox/test_export_keytab_heimdal.sh b/testprogs/blackbox/test_export_keytab_heimdal.sh
index cfa245fd4de..6b350d38ca7 100755
--- a/testprogs/blackbox/test_export_keytab_heimdal.sh
+++ b/testprogs/blackbox/test_export_keytab_heimdal.sh
@@ -50,10 +50,11 @@ test_keytab() {
return $status
fi
- if [ x$NKEYS != x$expected_nkeys ] ; then
- echo "failure: $testname"
- return 1
- fi
+ # TODO: get expected_nkeys as script parameter and possibly skip DES
+ #if [ x$NKEYS != x$expected_nkeys ] ; then
+ # echo "failure: $testname"
+ # return 1
+ #fi
echo "success: $testname"
return 0
}
--
2.22.0
From 218369814760c170b2ca95f9d3cbde14dccd8292 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Wed, 2 Oct 2019 13:19:38 +0300
Subject: [PATCH 5/5] wip: mit des deprecation: skip fetching DES keys
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
---
source4/kdc/db-glue.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index f62a633c6c7..37e3855423a 100644
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -365,6 +365,10 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
supported_enctypes |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5;
}
+#ifndef _KRB5_HAVE_DES
+ supported_enctypes &= ~(ENC_CRC32 | ENC_RSA_MD5);
+#endif
+
/* Is this the krbtgt or a RODC krbtgt */
if (is_rodc) {
rodc_krbtgt_number = ldb_msg_find_attr_as_int(msg, "msDS-SecondaryKrbTgtNumber", -1);
--
2.22.0

2
samba.spec
View File

@ -119,6 +119,8 @@ Source14: samba.pamd
Source201: README.downgrade
Patch0: pidl.patch
Patch100: 0000-use-gnutls-for-des-cbc.patch
Patch101: 0001-handle-removal-des-enctypes-from-krb5.patch
Requires(pre): /usr/sbin/groupadd
Requires(post): systemd