These patches are part of the https://gitlab.com/samba-redhat/samba/-/tree/v4-13-redhat [PATCH 001/105] libcli:smb2: Do not leak ptext on error [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF [PATCH 004/105] param: Add 'server smb encrypt' parameter [PATCH 005/105] param: Create and use enum_smb_encryption_vals [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values [PATCH 007/105] docs-xml: Add 'client smb encrypt' [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline [PATCH 012/105] auth:creds: Remove unused credentials autoproto [PATCH 013/105] auth:creds: Add [PATCH 014/105] auth:creds: Add python bindings for [PATCH 015/105] auth:creds: Add [PATCH 016/105] auth:creds: Add python bindings for [PATCH 017/105] auth:creds: Add [PATCH 018/105] auth:creds: Add python bindings for [PATCH 019/105] auth:creds: Add python bindings for [PATCH 020/105] auth:creds: Bump library version [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API [PATCH 023/105] python: Remove unused sign argument from [PATCH 024/105] python: Set smb signing via the creds API [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC [PATCH 026/105] s3:pylibsmb: Add ipc=True support for [PATCH 027/105] python:tests: Mark libsmb connection as an IPC [PATCH 028/105] python:tests: Set smb ipc signing via the creds API [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in [PATCH 030/105] s3:client: Turn off smb signing for message op [PATCH 031/105] s3:libsmb: Remove signing_state from [PATCH 032/105] s3:libsmb: Remove signing_state from [PATCH 033/105] s3:libsmb: Add encryption support to [PATCH 034/105] python: Add a test for SMB encryption [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() [PATCH 037/105] s3:client: Remove unused smb encryption code [PATCH 038/105] s3:utils: Remove obsolete force encryption from [PATCH 039/105] s3:utils: Remove obsolete force encryption from [PATCH 040/105] s3:utils: Remove obsolete force encryption from [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from [PATCH 042/105] examples: Remove obsolete force encryption from [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() [PATCH 044/105] s4:libcli: Return NTSTATUS errors for [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() [PATCH 048/105] s4:libcli: Require signing for SMB encryption [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel [PATCH 055/105] auth:creds: Add cli_credentials_init_server() [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb [PATCH 059/105] selftest: Move enc_desired to provision to have it in [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb [PATCH 061/105] s3:client: Remove global smb_encrypt [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs [PATCH 065/105] s3:libsmb: Remove force_encrypt from [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() [PATCH 069/105] s3:libsmb: Pass cli_credentials to [PATCH 070/105] s3:client: Remove global max_protocol [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs [PATCH 074/105] s3:include: Move loadparm prototypes to own header [PATCH 075/105] s3:lib: Move interface prototypes to own header file [PATCH 076/105] idl: Add SID_SAMBA_SMB3 [PATCH 077/105] s3:smbd: Add SMB3 connection information to session [PATCH 078/105] librpc: Add dcerpc helper [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam [PATCH 084/105] python:tests: Add SAMR password change tests for fips [PATCH 085/105] python:tests: Add SAMR password change tests for fips [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test [PATCH 088/105] s3-vfs_glusterfs: always disable write-behind [PATCH 089/105] Add smb2cli_session_get_encryption_cipher() [PATCH 090/105] Add dcerpc_transport_encrypted() [PATCH 091/105] Add py binding for dcerpc_transport_encrypted [PATCH 092/105] selftest: add a test for py dce transport_encrypted [PATCH 093/105] Add CreateTrustedDomainRelax wrapper for fips mode [PATCH 094/105] Use the new CreateTrustedDomainRelax() [PATCH 095/105] selftest: add a test for the CreateTrustedDomainRelax [PATCH 096/105] Remove source4/scripting/devel/createtrust script [PATCH 097/105] s3:rpc_server: Use gnutls_cipher_decrypt() in [PATCH 098/105] s4:rpc_server: Use gnutls_cipher_decrypt() in [PATCH 099/105] s3:rpc_server: Allow to use RC4 for creating trusts [PATCH 100/105] s4:rpc_server: Allow to use RC4 for creating trusts [PATCH 101/105] sefltest: Enable the dcerpc.createtrustrelax test [PATCH 102/105] s3: spoolss: Make parameters in call to [PATCH 103/105] s3:smbd: Fix possible null pointer dereference in [PATCH 104/105] lookup_name: allow lookup names prefixed with DNS [PATCH 105/105] auth_sam: use pdb_get_domain_info to look up DNS
12615 lines
441 KiB
Diff
12615 lines
441 KiB
Diff
From 77a771be72a6084216ea848f2d851eb7192ae9b9 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Mon, 13 Jul 2020 16:15:03 +0200
|
|
Subject: [PATCH 001/105] libcli:smb2: Do not leak ptext on error
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
libcli/smb/smb2_signing.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c
|
|
index 623fc23fb18..bba80817018 100644
|
|
--- a/libcli/smb/smb2_signing.c
|
|
+++ b/libcli/smb/smb2_signing.c
|
|
@@ -522,6 +522,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key,
|
|
|
|
ctext = talloc_size(talloc_tos(), ctext_size);
|
|
if (ctext == NULL) {
|
|
+ TALLOC_FREE(ptext);
|
|
status = NT_STATUS_NO_MEMORY;
|
|
goto out;
|
|
}
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From eb5fbbd3090cbdea95b14e9ac167253fafe633f8 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Mon, 13 Jul 2020 17:23:37 +0200
|
|
Subject: [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have
|
|
a stackframe
|
|
|
|
If we execute this code from python we don't have a talloc stackframe
|
|
around and segfault with talloc_tos().
|
|
|
|
To fix the crash we use the NULL context as we take care for freeing the
|
|
memory as soon as possible.
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
libcli/smb/smb2_signing.c | 30 ++++++++++++++++++++++++++----
|
|
1 file changed, 26 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c
|
|
index bba80817018..7669b219bbe 100644
|
|
--- a/libcli/smb/smb2_signing.c
|
|
+++ b/libcli/smb/smb2_signing.c
|
|
@@ -513,14 +513,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key,
|
|
uint8_t *ctext = NULL;
|
|
size_t len = 0;
|
|
int i;
|
|
+ TALLOC_CTX *tmp_ctx = NULL;
|
|
|
|
- ptext = talloc_size(talloc_tos(), ptext_size);
|
|
+ /*
|
|
+ * If we come from python bindings, we don't have a stackframe
|
|
+ * around, so use the NULL context.
|
|
+ *
|
|
+ * This is fine as we make sure we free the memory.
|
|
+ */
|
|
+ if (talloc_stackframe_exists()) {
|
|
+ tmp_ctx = talloc_tos();
|
|
+ }
|
|
+
|
|
+ ptext = talloc_size(tmp_ctx, ptext_size);
|
|
if (ptext == NULL) {
|
|
status = NT_STATUS_NO_MEMORY;
|
|
goto out;
|
|
}
|
|
|
|
- ctext = talloc_size(talloc_tos(), ctext_size);
|
|
+ ctext = talloc_size(tmp_ctx, ctext_size);
|
|
if (ctext == NULL) {
|
|
TALLOC_FREE(ptext);
|
|
status = NT_STATUS_NO_MEMORY;
|
|
@@ -713,16 +724,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key,
|
|
uint8_t *ptext = NULL;
|
|
size_t len = 0;
|
|
int i;
|
|
+ TALLOC_CTX *tmp_ctx = NULL;
|
|
+
|
|
+ /*
|
|
+ * If we come from python bindings, we don't have a stackframe
|
|
+ * around, so use the NULL context.
|
|
+ *
|
|
+ * This is fine as we make sure we free the memory.
|
|
+ */
|
|
+ if (talloc_stackframe_exists()) {
|
|
+ tmp_ctx = talloc_tos();
|
|
+ }
|
|
|
|
/* GnuTLS doesn't have a iovec API for decryption yet */
|
|
|
|
- ptext = talloc_size(talloc_tos(), ptext_size);
|
|
+ ptext = talloc_size(tmp_ctx, ptext_size);
|
|
if (ptext == NULL) {
|
|
status = NT_STATUS_NO_MEMORY;
|
|
goto out;
|
|
}
|
|
|
|
- ctext = talloc_size(talloc_tos(), ctext_size);
|
|
+ ctext = talloc_size(tmp_ctx, ctext_size);
|
|
if (ctext == NULL) {
|
|
TALLOC_FREE(ptext);
|
|
status = NT_STATUS_NO_MEMORY;
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 66ee204aee9a4919d94003a9a3263a44c2d5b436 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Wed, 6 Nov 2019 17:37:45 +0100
|
|
Subject: [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF
|
|
|
|
We have several places where we check '> CRED_UNINITIALISED',
|
|
so we better don't use CRED_UNINITIALISED for values from
|
|
our smb.conf.
|
|
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
|
---
|
|
auth/credentials/credentials.c | 6 +++---
|
|
auth/credentials/credentials.h | 1 +
|
|
auth/credentials/pycredentials.c | 1 +
|
|
python/samba/tests/credentials.py | 4 ++--
|
|
4 files changed, 7 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
|
|
index 81f9dbb9eb3..80a31b248ae 100644
|
|
--- a/auth/credentials/credentials.c
|
|
+++ b/auth/credentials/credentials.c
|
|
@@ -902,12 +902,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
|
|
if (lpcfg_parm_is_cmdline(lp_ctx, "workgroup")) {
|
|
cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SPECIFIED);
|
|
} else {
|
|
- cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_UNINITIALISED);
|
|
+ cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SMB_CONF);
|
|
}
|
|
if (lpcfg_parm_is_cmdline(lp_ctx, "netbios name")) {
|
|
cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SPECIFIED);
|
|
} else {
|
|
- cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_UNINITIALISED);
|
|
+ cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SMB_CONF);
|
|
}
|
|
if (realm != NULL && strlen(realm) == 0) {
|
|
realm = NULL;
|
|
@@ -915,7 +915,7 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
|
|
if (lpcfg_parm_is_cmdline(lp_ctx, "realm")) {
|
|
cli_credentials_set_realm(cred, realm, CRED_SPECIFIED);
|
|
} else {
|
|
- cli_credentials_set_realm(cred, realm, CRED_UNINITIALISED);
|
|
+ cli_credentials_set_realm(cred, realm, CRED_SMB_CONF);
|
|
}
|
|
|
|
sep = lpcfg_winbind_separator(lp_ctx);
|
|
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
|
|
index 9fe6a82b1ea..7154c2a008c 100644
|
|
--- a/auth/credentials/credentials.h
|
|
+++ b/auth/credentials/credentials.h
|
|
@@ -42,6 +42,7 @@ struct db_context;
|
|
/* In order of priority */
|
|
enum credentials_obtained {
|
|
CRED_UNINITIALISED = 0, /* We don't even have a guess yet */
|
|
+ CRED_SMB_CONF, /* Current value should be used, which comes from smb.conf */
|
|
CRED_CALLBACK, /* Callback should be used to obtain value */
|
|
CRED_GUESS_ENV, /* Current value should be used, which was guessed */
|
|
CRED_GUESS_FILE, /* A guess from a file (or file pointed at in env variable) */
|
|
diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c
|
|
index a5d0f9e051c..68edc282741 100644
|
|
--- a/auth/credentials/pycredentials.c
|
|
+++ b/auth/credentials/pycredentials.c
|
|
@@ -1275,6 +1275,7 @@ MODULE_INIT_FUNC(credentials)
|
|
return NULL;
|
|
|
|
PyModule_AddObject(m, "UNINITIALISED", PyLong_FromLong(CRED_UNINITIALISED));
|
|
+ PyModule_AddObject(m, "SMB_CONF", PyLong_FromLong(CRED_SMB_CONF));
|
|
PyModule_AddObject(m, "CALLBACK", PyLong_FromLong(CRED_CALLBACK));
|
|
PyModule_AddObject(m, "GUESS_ENV", PyLong_FromLong(CRED_GUESS_ENV));
|
|
PyModule_AddObject(m, "GUESS_FILE", PyLong_FromLong(CRED_GUESS_FILE));
|
|
diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py
|
|
index d2a81506de3..6454ac9ff7c 100644
|
|
--- a/python/samba/tests/credentials.py
|
|
+++ b/python/samba/tests/credentials.py
|
|
@@ -332,7 +332,7 @@ class CredentialsTests(samba.tests.TestCaseInTempDir):
|
|
os.environ["USER"] = "env_user"
|
|
creds.guess(lp)
|
|
realm = "realm.example.com"
|
|
- creds.set_realm(realm, credentials.UNINITIALISED)
|
|
+ creds.set_realm(realm, credentials.SMB_CONF)
|
|
creds.parse_string("user")
|
|
self.assertEqual(creds.get_username(), "user")
|
|
self.assertEqual(creds.get_domain(), lp.get("workgroup").upper())
|
|
@@ -360,7 +360,7 @@ class CredentialsTests(samba.tests.TestCaseInTempDir):
|
|
os.environ["USER"] = "env_user"
|
|
creds.guess(lp)
|
|
realm = "realm.example.com"
|
|
- creds.set_realm(realm, credentials.UNINITIALISED)
|
|
+ creds.set_realm(realm, credentials.SMB_CONF)
|
|
self.assertEqual(creds.get_username(), "env_user")
|
|
self.assertEqual(creds.get_domain(), lp.get("workgroup").upper())
|
|
self.assertEqual(creds.get_realm(), realm.upper())
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 8d2d8cdc90d0455429c9d461ebd65d21a0b29b8d Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 10 Oct 2019 14:18:23 +0200
|
|
Subject: [PATCH 004/105] param: Add 'server smb encrypt' parameter
|
|
|
|
And this also makes 'smb encrypt' a synonym of that.
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
.../smbdotconf/security/serversmbencrypt.xml | 241 ++++++++++++++++++
|
|
docs-xml/smbdotconf/security/smbencrypt.xml | 241 +-----------------
|
|
source3/param/loadparm.c | 2 +-
|
|
source3/smbd/service.c | 4 +-
|
|
source3/smbd/smb2_negprot.c | 2 +-
|
|
source3/smbd/smb2_sesssetup.c | 4 +-
|
|
source3/smbd/smb2_tcon.c | 4 +-
|
|
source3/smbd/trans2.c | 2 +-
|
|
8 files changed, 257 insertions(+), 243 deletions(-)
|
|
create mode 100644 docs-xml/smbdotconf/security/serversmbencrypt.xml
|
|
|
|
diff --git a/docs-xml/smbdotconf/security/serversmbencrypt.xml b/docs-xml/smbdotconf/security/serversmbencrypt.xml
|
|
new file mode 100644
|
|
index 00000000000..714aacbf1ca
|
|
--- /dev/null
|
|
+++ b/docs-xml/smbdotconf/security/serversmbencrypt.xml
|
|
@@ -0,0 +1,241 @@
|
|
+<samba:parameter name="server smb encrypt"
|
|
+ context="S"
|
|
+ type="enum"
|
|
+ enumlist="enum_smb_signing_vals"
|
|
+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
+<description>
|
|
+ <para>
|
|
+ This parameter controls whether a remote client is allowed or required
|
|
+ to use SMB encryption. It has different effects depending on whether
|
|
+ the connection uses SMB1 or SMB2 and newer:
|
|
+ </para>
|
|
+
|
|
+ <itemizedlist>
|
|
+ <listitem>
|
|
+ <para>
|
|
+ If the connection uses SMB1, then this option controls the use
|
|
+ of a Samba-specific extension to the SMB protocol introduced in
|
|
+ Samba 3.2 that makes use of the Unix extensions.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ If the connection uses SMB2 or newer, then this option controls
|
|
+ the use of the SMB-level encryption that is supported in SMB
|
|
+ version 3.0 and above and available in Windows 8 and newer.
|
|
+ </para>
|
|
+ </listitem>
|
|
+ </itemizedlist>
|
|
+
|
|
+ <para>
|
|
+ This parameter can be set globally and on a per-share bases.
|
|
+ Possible values are
|
|
+
|
|
+ <emphasis>off</emphasis>,
|
|
+ <emphasis>if_required</emphasis>,
|
|
+ <emphasis>desired</emphasis>,
|
|
+ and
|
|
+ <emphasis>required</emphasis>.
|
|
+ A special value is <emphasis>default</emphasis> which is
|
|
+ the implicit default setting of <emphasis>if_required</emphasis>.
|
|
+ </para>
|
|
+
|
|
+ <variablelist>
|
|
+ <varlistentry>
|
|
+ <term><emphasis>Effects for SMB1</emphasis></term>
|
|
+ <listitem>
|
|
+ <para>
|
|
+ The Samba-specific encryption of SMB1 connections is an
|
|
+ extension to the SMB protocol negotiated as part of the UNIX
|
|
+ extensions. SMB encryption uses the GSSAPI (SSPI on Windows)
|
|
+ ability to encrypt and sign every request/response in a SMB
|
|
+ protocol stream. When enabled it provides a secure method of
|
|
+ SMB/CIFS communication, similar to an ssh protected session, but
|
|
+ using SMB/CIFS authentication to negotiate encryption and
|
|
+ signing keys. Currently this is only supported smbclient of by
|
|
+ Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X
|
|
+ clients. Windows clients do not support this feature.
|
|
+ </para>
|
|
+
|
|
+ <para>This may be set on a per-share
|
|
+ basis, but clients may chose to encrypt the entire session, not
|
|
+ just traffic to a specific share. If this is set to mandatory
|
|
+ then all traffic to a share <emphasis>must</emphasis>
|
|
+ be encrypted once the connection has been made to the share.
|
|
+ The server would return "access denied" to all non-encrypted
|
|
+ requests on such a share. Selecting encrypted traffic reduces
|
|
+ throughput as smaller packet sizes must be used (no huge UNIX
|
|
+ style read/writes allowed) as well as the overhead of encrypting
|
|
+ and signing all the data.
|
|
+ </para>
|
|
+
|
|
+ <para>
|
|
+ If SMB encryption is selected, Windows style SMB signing (see
|
|
+ the <smbconfoption name="server signing"/> option) is no longer
|
|
+ necessary, as the GSSAPI flags use select both signing and
|
|
+ sealing of the data.
|
|
+ </para>
|
|
+
|
|
+ <para>
|
|
+ When set to auto or default, SMB encryption is offered, but not
|
|
+ enforced. When set to mandatory, SMB encryption is required and
|
|
+ if set to disabled, SMB encryption can not be negotiated.
|
|
+ </para>
|
|
+ </listitem>
|
|
+ </varlistentry>
|
|
+
|
|
+ <varlistentry>
|
|
+ <term><emphasis>Effects for SMB2 and newer</emphasis></term>
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Native SMB transport encryption is available in SMB version 3.0
|
|
+ or newer. It is only offered by Samba if
|
|
+ <emphasis>server max protocol</emphasis> is set to
|
|
+ <emphasis>SMB3</emphasis> or newer.
|
|
+ Clients supporting this type of encryption include
|
|
+ Windows 8 and newer,
|
|
+ Windows server 2012 and newer,
|
|
+ and smbclient of Samba 4.1 and newer.
|
|
+ </para>
|
|
+
|
|
+ <para>
|
|
+ The protocol implementation offers various options:
|
|
+ </para>
|
|
+
|
|
+ <itemizedlist>
|
|
+ <listitem>
|
|
+ <para>
|
|
+ The capability to perform SMB encryption can be
|
|
+ negotiated during protocol negotiation.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Data encryption can be enabled globally. In that case,
|
|
+ an encryption-capable connection will have all traffic
|
|
+ in all its sessions encrypted. In particular all share
|
|
+ connections will be encrypted.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Data encryption can also be enabled per share if not
|
|
+ enabled globally. For an encryption-capable connection,
|
|
+ all connections to an encryption-enabled share will be
|
|
+ encrypted.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Encryption can be enforced. This means that session
|
|
+ setups will be denied on non-encryption-capable
|
|
+ connections if data encryption has been enabled
|
|
+ globally. And tree connections will be denied for
|
|
+ non-encryption capable connections to shares with data
|
|
+ encryption enabled.
|
|
+ </para>
|
|
+ </listitem>
|
|
+ </itemizedlist>
|
|
+
|
|
+ <para>
|
|
+ These features can be controlled with settings of
|
|
+ <emphasis>server smb encrypt</emphasis> as follows:
|
|
+ </para>
|
|
+
|
|
+ <itemizedlist>
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Leaving it as default, explicitly setting
|
|
+ <emphasis>default</emphasis>, or setting it to
|
|
+ <emphasis>if_required</emphasis> globally will enable
|
|
+ negotiation of encryption but will not turn on
|
|
+ data encryption globally or per share.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Setting it to <emphasis>desired</emphasis> globally
|
|
+ will enable negotiation and will turn on data encryption
|
|
+ on sessions and share connections for those clients
|
|
+ that support it.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Setting it to <emphasis>required</emphasis> globally
|
|
+ will enable negotiation and turn on data encryption
|
|
+ on sessions and share connections. Clients that do
|
|
+ not support encryption will be denied access to the
|
|
+ server.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Setting it to <emphasis>off</emphasis> globally will
|
|
+ completely disable the encryption feature for all
|
|
+ connections. Setting <parameter>server smb encrypt =
|
|
+ required</parameter> for individual shares (while it's
|
|
+ globally off) will deny access to this shares for all
|
|
+ clients.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Setting it to <emphasis>desired</emphasis> on a share
|
|
+ will turn on data encryption for this share for clients
|
|
+ that support encryption if negotiation has been
|
|
+ enabled globally.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Setting it to <emphasis>required</emphasis> on a share
|
|
+ will enforce data encryption for this share if
|
|
+ negotiation has been enabled globally. I.e. clients that
|
|
+ do not support encryption will be denied access to the
|
|
+ share.
|
|
+ </para>
|
|
+ <para>
|
|
+ Note that this allows per-share enforcing to be
|
|
+ controlled in Samba differently from Windows:
|
|
+ In Windows, <emphasis>RejectUnencryptedAccess</emphasis>
|
|
+ is a global setting, and if it is set, all shares with
|
|
+ data encryption turned on
|
|
+ are automatically enforcing encryption. In order to
|
|
+ achieve the same effect in Samba, one
|
|
+ has to globally set <emphasis>server smb encrypt</emphasis> to
|
|
+ <emphasis>if_required</emphasis>, and then set all shares
|
|
+ that should be encrypted to
|
|
+ <emphasis>required</emphasis>.
|
|
+ Additionally, it is possible in Samba to have some
|
|
+ shares with encryption <emphasis>required</emphasis>
|
|
+ and some other shares with encryption only
|
|
+ <emphasis>desired</emphasis>, which is not possible in
|
|
+ Windows.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Setting it to <emphasis>off</emphasis> or
|
|
+ <emphasis>if_required</emphasis> for a share has
|
|
+ no effect.
|
|
+ </para>
|
|
+ </listitem>
|
|
+ </itemizedlist>
|
|
+ </listitem>
|
|
+ </varlistentry>
|
|
+ </variablelist>
|
|
+</description>
|
|
+
|
|
+<value type="default">default</value>
|
|
+</samba:parameter>
|
|
diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml
|
|
index 32a22cb58f5..798e616b765 100644
|
|
--- a/docs-xml/smbdotconf/security/smbencrypt.xml
|
|
+++ b/docs-xml/smbdotconf/security/smbencrypt.xml
|
|
@@ -1,241 +1,14 @@
|
|
<samba:parameter name="smb encrypt"
|
|
- context="S"
|
|
- type="enum"
|
|
- enumlist="enum_smb_signing_vals"
|
|
- xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
+ context="S"
|
|
+ type="enum"
|
|
+ enumlist="enum_smb_signing_vals"
|
|
+ function="server_smb_encrypt"
|
|
+ synonym="1"
|
|
+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
<description>
|
|
<para>
|
|
- This parameter controls whether a remote client is allowed or required
|
|
- to use SMB encryption. It has different effects depending on whether
|
|
- the connection uses SMB1 or SMB2 and newer:
|
|
+ This is a synonym for <smbconfoption name="server smb encrypt"/>.
|
|
</para>
|
|
-
|
|
- <itemizedlist>
|
|
- <listitem>
|
|
- <para>
|
|
- If the connection uses SMB1, then this option controls the use
|
|
- of a Samba-specific extension to the SMB protocol introduced in
|
|
- Samba 3.2 that makes use of the Unix extensions.
|
|
- </para>
|
|
- </listitem>
|
|
-
|
|
- <listitem>
|
|
- <para>
|
|
- If the connection uses SMB2 or newer, then this option controls
|
|
- the use of the SMB-level encryption that is supported in SMB
|
|
- version 3.0 and above and available in Windows 8 and newer.
|
|
- </para>
|
|
- </listitem>
|
|
- </itemizedlist>
|
|
-
|
|
- <para>
|
|
- This parameter can be set globally and on a per-share bases.
|
|
- Possible values are
|
|
- <emphasis>off</emphasis> (or <emphasis>disabled</emphasis>),
|
|
- <emphasis>enabled</emphasis> (or <emphasis>auto</emphasis>, or
|
|
- <emphasis>if_required</emphasis>),
|
|
- <emphasis>desired</emphasis>,
|
|
- and
|
|
- <emphasis>required</emphasis>
|
|
- (or <emphasis>mandatory</emphasis>).
|
|
- A special value is <emphasis>default</emphasis> which is
|
|
- the implicit default setting of <emphasis>enabled</emphasis>.
|
|
- </para>
|
|
-
|
|
- <variablelist>
|
|
- <varlistentry>
|
|
- <term><emphasis>Effects for SMB1</emphasis></term>
|
|
- <listitem>
|
|
- <para>
|
|
- The Samba-specific encryption of SMB1 connections is an
|
|
- extension to the SMB protocol negotiated as part of the UNIX
|
|
- extensions. SMB encryption uses the GSSAPI (SSPI on Windows)
|
|
- ability to encrypt and sign every request/response in a SMB
|
|
- protocol stream. When enabled it provides a secure method of
|
|
- SMB/CIFS communication, similar to an ssh protected session, but
|
|
- using SMB/CIFS authentication to negotiate encryption and
|
|
- signing keys. Currently this is only supported smbclient of by
|
|
- Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X
|
|
- clients. Windows clients do not support this feature.
|
|
- </para>
|
|
-
|
|
- <para>This may be set on a per-share
|
|
- basis, but clients may chose to encrypt the entire session, not
|
|
- just traffic to a specific share. If this is set to mandatory
|
|
- then all traffic to a share <emphasis>must</emphasis>
|
|
- be encrypted once the connection has been made to the share.
|
|
- The server would return "access denied" to all non-encrypted
|
|
- requests on such a share. Selecting encrypted traffic reduces
|
|
- throughput as smaller packet sizes must be used (no huge UNIX
|
|
- style read/writes allowed) as well as the overhead of encrypting
|
|
- and signing all the data.
|
|
- </para>
|
|
-
|
|
- <para>
|
|
- If SMB encryption is selected, Windows style SMB signing (see
|
|
- the <smbconfoption name="server signing"/> option) is no longer
|
|
- necessary, as the GSSAPI flags use select both signing and
|
|
- sealing of the data.
|
|
- </para>
|
|
-
|
|
- <para>
|
|
- When set to auto or default, SMB encryption is offered, but not
|
|
- enforced. When set to mandatory, SMB encryption is required and
|
|
- if set to disabled, SMB encryption can not be negotiated.
|
|
- </para>
|
|
- </listitem>
|
|
- </varlistentry>
|
|
-
|
|
- <varlistentry>
|
|
- <term><emphasis>Effects for SMB2</emphasis></term>
|
|
- <listitem>
|
|
- <para>
|
|
- Native SMB transport encryption is available in SMB version 3.0
|
|
- or newer. It is only offered by Samba if
|
|
- <emphasis>server max protocol</emphasis> is set to
|
|
- <emphasis>SMB3</emphasis> or newer.
|
|
- Clients supporting this type of encryption include
|
|
- Windows 8 and newer,
|
|
- Windows server 2012 and newer,
|
|
- and smbclient of Samba 4.1 and newer.
|
|
- </para>
|
|
-
|
|
- <para>
|
|
- The protocol implementation offers various options:
|
|
- </para>
|
|
-
|
|
- <itemizedlist>
|
|
- <listitem>
|
|
- <para>
|
|
- The capability to perform SMB encryption can be
|
|
- negotiated during protocol negotiation.
|
|
- </para>
|
|
- </listitem>
|
|
-
|
|
- <listitem>
|
|
- <para>
|
|
- Data encryption can be enabled globally. In that case,
|
|
- an encryption-capable connection will have all traffic
|
|
- in all its sessions encrypted. In particular all share
|
|
- connections will be encrypted.
|
|
- </para>
|
|
- </listitem>
|
|
-
|
|
- <listitem>
|
|
- <para>
|
|
- Data encryption can also be enabled per share if not
|
|
- enabled globally. For an encryption-capable connection,
|
|
- all connections to an encryption-enabled share will be
|
|
- encrypted.
|
|
- </para>
|
|
- </listitem>
|
|
-
|
|
- <listitem>
|
|
- <para>
|
|
- Encryption can be enforced. This means that session
|
|
- setups will be denied on non-encryption-capable
|
|
- connections if data encryption has been enabled
|
|
- globally. And tree connections will be denied for
|
|
- non-encryption capable connections to shares with data
|
|
- encryption enabled.
|
|
- </para>
|
|
- </listitem>
|
|
- </itemizedlist>
|
|
-
|
|
- <para>
|
|
- These features can be controlled with settings of
|
|
- <emphasis>smb encrypt</emphasis> as follows:
|
|
- </para>
|
|
-
|
|
- <itemizedlist>
|
|
- <listitem>
|
|
- <para>
|
|
- Leaving it as default, explicitly setting
|
|
- <emphasis>default</emphasis>, or setting it to
|
|
- <emphasis>enabled</emphasis> globally will enable
|
|
- negotiation of encryption but will not turn on
|
|
- data encryption globally or per share.
|
|
- </para>
|
|
- </listitem>
|
|
-
|
|
- <listitem>
|
|
- <para>
|
|
- Setting it to <emphasis>desired</emphasis> globally
|
|
- will enable negotiation and will turn on data encryption
|
|
- on sessions and share connections for those clients
|
|
- that support it.
|
|
- </para>
|
|
- </listitem>
|
|
-
|
|
- <listitem>
|
|
- <para>
|
|
- Setting it to <emphasis>required</emphasis> globally
|
|
- will enable negotiation and turn on data encryption
|
|
- on sessions and share connections. Clients that do
|
|
- not support encryption will be denied access to the
|
|
- server.
|
|
- </para>
|
|
- </listitem>
|
|
-
|
|
- <listitem>
|
|
- <para>
|
|
- Setting it to <emphasis>off</emphasis> globally will
|
|
- completely disable the encryption feature for all
|
|
- connections. Setting <parameter>smb encrypt =
|
|
- required</parameter> for individual shares (while it's
|
|
- globally off) will deny access to this shares for all
|
|
- clients.
|
|
- </para>
|
|
- </listitem>
|
|
-
|
|
- <listitem>
|
|
- <para>
|
|
- Setting it to <emphasis>desired</emphasis> on a share
|
|
- will turn on data encryption for this share for clients
|
|
- that support encryption if negotiation has been
|
|
- enabled globally.
|
|
- </para>
|
|
- </listitem>
|
|
-
|
|
- <listitem>
|
|
- <para>
|
|
- Setting it to <emphasis>required</emphasis> on a share
|
|
- will enforce data encryption for this share if
|
|
- negotiation has been enabled globally. I.e. clients that
|
|
- do not support encryption will be denied access to the
|
|
- share.
|
|
- </para>
|
|
- <para>
|
|
- Note that this allows per-share enforcing to be
|
|
- controlled in Samba differently from Windows:
|
|
- In Windows, <emphasis>RejectUnencryptedAccess</emphasis>
|
|
- is a global setting, and if it is set, all shares with
|
|
- data encryption turned on
|
|
- are automatically enforcing encryption. In order to
|
|
- achieve the same effect in Samba, one
|
|
- has to globally set <emphasis>smb encrypt</emphasis> to
|
|
- <emphasis>enabled</emphasis>, and then set all shares
|
|
- that should be encrypted to
|
|
- <emphasis>required</emphasis>.
|
|
- Additionally, it is possible in Samba to have some
|
|
- shares with encryption <emphasis>required</emphasis>
|
|
- and some other shares with encryption only
|
|
- <emphasis>desired</emphasis>, which is not possible in
|
|
- Windows.
|
|
- </para>
|
|
- </listitem>
|
|
-
|
|
- <listitem>
|
|
- <para>
|
|
- Setting it to <emphasis>off</emphasis> or
|
|
- <emphasis>enabled</emphasis> for a share has
|
|
- no effect.
|
|
- </para>
|
|
- </listitem>
|
|
- </itemizedlist>
|
|
- </listitem>
|
|
- </varlistentry>
|
|
- </variablelist>
|
|
</description>
|
|
|
|
<value type="default">default</value>
|
|
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
|
|
index 6674485738a..82be31e8437 100644
|
|
--- a/source3/param/loadparm.c
|
|
+++ b/source3/param/loadparm.c
|
|
@@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault =
|
|
.aio_write_size = 1,
|
|
.map_readonly = MAP_READONLY_NO,
|
|
.directory_name_cache_size = 100,
|
|
- .smb_encrypt = SMB_SIGNING_DEFAULT,
|
|
+ .server_smb_encrypt = SMB_SIGNING_DEFAULT,
|
|
.kernel_share_modes = true,
|
|
.durable_handles = true,
|
|
.check_parent_directory_delete_on_close = false,
|
|
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
|
|
index ed38121f292..a263c33b7e2 100644
|
|
--- a/source3/smbd/service.c
|
|
+++ b/source3/smbd/service.c
|
|
@@ -567,9 +567,9 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn,
|
|
conn->case_preserve = lp_preserve_case(snum);
|
|
conn->short_case_preserve = lp_short_preserve_case(snum);
|
|
|
|
- conn->encrypt_level = lp_smb_encrypt(snum);
|
|
+ conn->encrypt_level = lp_server_smb_encrypt(snum);
|
|
if (conn->encrypt_level > SMB_SIGNING_OFF) {
|
|
- if (lp_smb_encrypt(-1) == SMB_SIGNING_OFF) {
|
|
+ if (lp_server_smb_encrypt(-1) == SMB_SIGNING_OFF) {
|
|
if (conn->encrypt_level == SMB_SIGNING_REQUIRED) {
|
|
DBG_ERR("Service [%s] requires encryption, but "
|
|
"it is disabled globally!\n",
|
|
diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c
|
|
index 4071f42b5e0..674942b71de 100644
|
|
--- a/source3/smbd/smb2_negprot.c
|
|
+++ b/source3/smbd/smb2_negprot.c
|
|
@@ -335,7 +335,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
|
|
}
|
|
|
|
if ((protocol >= PROTOCOL_SMB2_24) &&
|
|
- (lp_smb_encrypt(-1) != SMB_SIGNING_OFF) &&
|
|
+ (lp_server_smb_encrypt(-1) != SMB_SIGNING_OFF) &&
|
|
(in_capabilities & SMB2_CAP_ENCRYPTION)) {
|
|
capabilities |= SMB2_CAP_ENCRYPTION;
|
|
}
|
|
diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c
|
|
index 2b6b3a820d4..8957411e167 100644
|
|
--- a/source3/smbd/smb2_sesssetup.c
|
|
+++ b/source3/smbd/smb2_sesssetup.c
|
|
@@ -292,12 +292,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
|
|
x->global->signing_flags = SMBXSRV_SIGNING_REQUIRED;
|
|
}
|
|
|
|
- if ((lp_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) &&
|
|
+ if ((lp_server_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) &&
|
|
(xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) {
|
|
x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED;
|
|
}
|
|
|
|
- if (lp_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) {
|
|
+ if (lp_server_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) {
|
|
x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED |
|
|
SMBXSRV_ENCRYPTION_DESIRED;
|
|
}
|
|
diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c
|
|
index 76112d04889..0dd3c653b4b 100644
|
|
--- a/source3/smbd/smb2_tcon.c
|
|
+++ b/source3/smbd/smb2_tcon.c
|
|
@@ -302,13 +302,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
|
|
TALLOC_FREE(proxy);
|
|
}
|
|
|
|
- if ((lp_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) &&
|
|
+ if ((lp_server_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) &&
|
|
(conn->smb2.server.cipher != 0))
|
|
{
|
|
encryption_desired = true;
|
|
}
|
|
|
|
- if (lp_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) {
|
|
+ if (lp_server_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) {
|
|
encryption_desired = true;
|
|
encryption_required = true;
|
|
}
|
|
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
|
|
index 7acde285a90..b745e0906b1 100644
|
|
--- a/source3/smbd/trans2.c
|
|
+++ b/source3/smbd/trans2.c
|
|
@@ -4484,7 +4484,7 @@ static void call_trans2setfsinfo(connection_struct *conn,
|
|
return;
|
|
}
|
|
|
|
- if (lp_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) {
|
|
+ if (lp_server_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) {
|
|
reply_nterror(
|
|
req,
|
|
NT_STATUS_NOT_SUPPORTED);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 71b97ba1fd9260efd29e3ab3456b82d2a4f6dcc8 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 28 May 2020 10:04:19 +0200
|
|
Subject: [PATCH 005/105] param: Create and use enum_smb_encryption_vals
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
.../smbdotconf/security/serversmbencrypt.xml | 2 +-
|
|
docs-xml/smbdotconf/security/smbencrypt.xml | 2 +-
|
|
lib/param/param_table.c | 23 +++++++++++++++++++
|
|
libcli/smb/smb_constants.h | 9 ++++++++
|
|
4 files changed, 34 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/docs-xml/smbdotconf/security/serversmbencrypt.xml b/docs-xml/smbdotconf/security/serversmbencrypt.xml
|
|
index 714aacbf1ca..5f38b46419e 100644
|
|
--- a/docs-xml/smbdotconf/security/serversmbencrypt.xml
|
|
+++ b/docs-xml/smbdotconf/security/serversmbencrypt.xml
|
|
@@ -1,7 +1,7 @@
|
|
<samba:parameter name="server smb encrypt"
|
|
context="S"
|
|
type="enum"
|
|
- enumlist="enum_smb_signing_vals"
|
|
+ enumlist="enum_smb_encryption_vals"
|
|
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
<description>
|
|
<para>
|
|
diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml
|
|
index 798e616b765..60271200c0a 100644
|
|
--- a/docs-xml/smbdotconf/security/smbencrypt.xml
|
|
+++ b/docs-xml/smbdotconf/security/smbencrypt.xml
|
|
@@ -1,7 +1,7 @@
|
|
<samba:parameter name="smb encrypt"
|
|
context="S"
|
|
type="enum"
|
|
- enumlist="enum_smb_signing_vals"
|
|
+ enumlist="enum_smb_encryption_vals"
|
|
function="server_smb_encrypt"
|
|
synonym="1"
|
|
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
diff --git a/lib/param/param_table.c b/lib/param/param_table.c
|
|
index 47b85de1f87..e2f737279dc 100644
|
|
--- a/lib/param/param_table.c
|
|
+++ b/lib/param/param_table.c
|
|
@@ -138,6 +138,29 @@ static const struct enum_list enum_smb_signing_vals[] = {
|
|
{-1, NULL}
|
|
};
|
|
|
|
+static const struct enum_list enum_smb_encryption_vals[] = {
|
|
+ {SMB_ENCRYPTION_DEFAULT, "default"},
|
|
+ {SMB_ENCRYPTION_OFF, "No"},
|
|
+ {SMB_ENCRYPTION_OFF, "False"},
|
|
+ {SMB_ENCRYPTION_OFF, "0"},
|
|
+ {SMB_ENCRYPTION_OFF, "Off"},
|
|
+ {SMB_ENCRYPTION_OFF, "disabled"},
|
|
+ {SMB_ENCRYPTION_IF_REQUIRED, "if_required"},
|
|
+ {SMB_ENCRYPTION_IF_REQUIRED, "Yes"},
|
|
+ {SMB_ENCRYPTION_IF_REQUIRED, "True"},
|
|
+ {SMB_ENCRYPTION_IF_REQUIRED, "1"},
|
|
+ {SMB_ENCRYPTION_IF_REQUIRED, "On"},
|
|
+ {SMB_ENCRYPTION_IF_REQUIRED, "enabled"},
|
|
+ {SMB_ENCRYPTION_IF_REQUIRED, "auto"},
|
|
+ {SMB_ENCRYPTION_DESIRED, "desired"},
|
|
+ {SMB_ENCRYPTION_REQUIRED, "required"},
|
|
+ {SMB_ENCRYPTION_REQUIRED, "mandatory"},
|
|
+ {SMB_ENCRYPTION_REQUIRED, "force"},
|
|
+ {SMB_ENCRYPTION_REQUIRED, "forced"},
|
|
+ {SMB_ENCRYPTION_REQUIRED, "enforced"},
|
|
+ {-1, NULL}
|
|
+};
|
|
+
|
|
static const struct enum_list enum_mdns_name_values[] = {
|
|
{MDNS_NAME_NETBIOS, "netbios"},
|
|
{MDNS_NAME_MDNS, "mdns"},
|
|
diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h
|
|
index b424b13cde4..2fb1fd7189e 100644
|
|
--- a/libcli/smb/smb_constants.h
|
|
+++ b/libcli/smb/smb_constants.h
|
|
@@ -106,6 +106,15 @@ enum smb_signing_setting {
|
|
SMB_SIGNING_REQUIRED = 3,
|
|
};
|
|
|
|
+/* This MUST align with 'enum smb_signing_setting' */
|
|
+enum smb_encryption_setting {
|
|
+ SMB_ENCRYPTION_DEFAULT = SMB_SIGNING_DEFAULT,
|
|
+ SMB_ENCRYPTION_OFF = SMB_SIGNING_OFF,
|
|
+ SMB_ENCRYPTION_IF_REQUIRED = SMB_SIGNING_IF_REQUIRED,
|
|
+ SMB_ENCRYPTION_DESIRED = SMB_SIGNING_DESIRED,
|
|
+ SMB_ENCRYPTION_REQUIRED = SMB_SIGNING_REQUIRED,
|
|
+};
|
|
+
|
|
/* types of buffers in core SMB protocol */
|
|
#define SMB_DATA_BLOCK 0x1
|
|
#define SMB_ASCII4 0x4
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From ca1e10a901af67327d25765bfed404e2d1c756a5 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 26 May 2020 09:34:54 +0200
|
|
Subject: [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/param/loadparm.c | 2 +-
|
|
source3/smbd/service.c | 8 ++++----
|
|
source3/smbd/smb2_negprot.c | 2 +-
|
|
source3/smbd/smb2_sesssetup.c | 4 ++--
|
|
source3/smbd/smb2_tcon.c | 4 ++--
|
|
source3/smbd/trans2.c | 3 ++-
|
|
6 files changed, 12 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
|
|
index 82be31e8437..b305e34b252 100644
|
|
--- a/source3/param/loadparm.c
|
|
+++ b/source3/param/loadparm.c
|
|
@@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault =
|
|
.aio_write_size = 1,
|
|
.map_readonly = MAP_READONLY_NO,
|
|
.directory_name_cache_size = 100,
|
|
- .server_smb_encrypt = SMB_SIGNING_DEFAULT,
|
|
+ .server_smb_encrypt = SMB_ENCRYPTION_DEFAULT,
|
|
.kernel_share_modes = true,
|
|
.durable_handles = true,
|
|
.check_parent_directory_delete_on_close = false,
|
|
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
|
|
index a263c33b7e2..43803e721c2 100644
|
|
--- a/source3/smbd/service.c
|
|
+++ b/source3/smbd/service.c
|
|
@@ -568,16 +568,16 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn,
|
|
conn->short_case_preserve = lp_short_preserve_case(snum);
|
|
|
|
conn->encrypt_level = lp_server_smb_encrypt(snum);
|
|
- if (conn->encrypt_level > SMB_SIGNING_OFF) {
|
|
- if (lp_server_smb_encrypt(-1) == SMB_SIGNING_OFF) {
|
|
- if (conn->encrypt_level == SMB_SIGNING_REQUIRED) {
|
|
+ if (conn->encrypt_level > SMB_ENCRYPTION_OFF) {
|
|
+ if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_OFF) {
|
|
+ if (conn->encrypt_level == SMB_ENCRYPTION_REQUIRED) {
|
|
DBG_ERR("Service [%s] requires encryption, but "
|
|
"it is disabled globally!\n",
|
|
lp_const_servicename(snum));
|
|
status = NT_STATUS_ACCESS_DENIED;
|
|
goto err_root_exit;
|
|
}
|
|
- conn->encrypt_level = SMB_SIGNING_OFF;
|
|
+ conn->encrypt_level = SMB_ENCRYPTION_OFF;
|
|
}
|
|
}
|
|
|
|
diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c
|
|
index 674942b71de..99303f1b07b 100644
|
|
--- a/source3/smbd/smb2_negprot.c
|
|
+++ b/source3/smbd/smb2_negprot.c
|
|
@@ -335,7 +335,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
|
|
}
|
|
|
|
if ((protocol >= PROTOCOL_SMB2_24) &&
|
|
- (lp_server_smb_encrypt(-1) != SMB_SIGNING_OFF) &&
|
|
+ (lp_server_smb_encrypt(-1) != SMB_ENCRYPTION_OFF) &&
|
|
(in_capabilities & SMB2_CAP_ENCRYPTION)) {
|
|
capabilities |= SMB2_CAP_ENCRYPTION;
|
|
}
|
|
diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c
|
|
index 8957411e167..907dd92321e 100644
|
|
--- a/source3/smbd/smb2_sesssetup.c
|
|
+++ b/source3/smbd/smb2_sesssetup.c
|
|
@@ -292,12 +292,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
|
|
x->global->signing_flags = SMBXSRV_SIGNING_REQUIRED;
|
|
}
|
|
|
|
- if ((lp_server_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) &&
|
|
+ if ((lp_server_smb_encrypt(-1) >= SMB_ENCRYPTION_DESIRED) &&
|
|
(xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) {
|
|
x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED;
|
|
}
|
|
|
|
- if (lp_server_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) {
|
|
+ if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_REQUIRED) {
|
|
x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED |
|
|
SMBXSRV_ENCRYPTION_DESIRED;
|
|
}
|
|
diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c
|
|
index 0dd3c653b4b..d7e0cf90f47 100644
|
|
--- a/source3/smbd/smb2_tcon.c
|
|
+++ b/source3/smbd/smb2_tcon.c
|
|
@@ -302,13 +302,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
|
|
TALLOC_FREE(proxy);
|
|
}
|
|
|
|
- if ((lp_server_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) &&
|
|
+ if ((lp_server_smb_encrypt(snum) >= SMB_ENCRYPTION_DESIRED) &&
|
|
(conn->smb2.server.cipher != 0))
|
|
{
|
|
encryption_desired = true;
|
|
}
|
|
|
|
- if (lp_server_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) {
|
|
+ if (lp_server_smb_encrypt(snum) == SMB_ENCRYPTION_REQUIRED) {
|
|
encryption_desired = true;
|
|
encryption_required = true;
|
|
}
|
|
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
|
|
index b745e0906b1..2f2fdcb7260 100644
|
|
--- a/source3/smbd/trans2.c
|
|
+++ b/source3/smbd/trans2.c
|
|
@@ -4484,7 +4484,8 @@ static void call_trans2setfsinfo(connection_struct *conn,
|
|
return;
|
|
}
|
|
|
|
- if (lp_server_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) {
|
|
+ if (lp_server_smb_encrypt(SNUM(conn)) ==
|
|
+ SMB_ENCRYPTION_OFF) {
|
|
reply_nterror(
|
|
req,
|
|
NT_STATUS_NOT_SUPPORTED);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From a5630bb933393fe69ff9b7f072221b9085d6277c Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 9 Apr 2020 10:38:41 +0200
|
|
Subject: [PATCH 007/105] docs-xml: Add 'client smb encrypt'
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
.../smbdotconf/security/clientsmbencrypt.xml | 126 ++++++++++++++++++
|
|
lib/param/loadparm.c | 4 +
|
|
source3/param/loadparm.c | 2 +
|
|
3 files changed, 132 insertions(+)
|
|
create mode 100644 docs-xml/smbdotconf/security/clientsmbencrypt.xml
|
|
|
|
diff --git a/docs-xml/smbdotconf/security/clientsmbencrypt.xml b/docs-xml/smbdotconf/security/clientsmbencrypt.xml
|
|
new file mode 100644
|
|
index 00000000000..05df152e734
|
|
--- /dev/null
|
|
+++ b/docs-xml/smbdotconf/security/clientsmbencrypt.xml
|
|
@@ -0,0 +1,126 @@
|
|
+<samba:parameter name="client smb encrypt"
|
|
+ context="G"
|
|
+ type="enum"
|
|
+ enumlist="enum_smb_encryption_vals"
|
|
+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
+<description>
|
|
+ <para>
|
|
+ This parameter controls whether a client should try or is required
|
|
+ to use SMB encryption. It has different effects depending on whether
|
|
+ the connection uses SMB1 or SMB3:
|
|
+ </para>
|
|
+
|
|
+ <itemizedlist>
|
|
+ <listitem>
|
|
+ <para>
|
|
+ If the connection uses SMB1, then this option controls the use
|
|
+ of a Samba-specific extension to the SMB protocol introduced in
|
|
+ Samba 3.2 that makes use of the Unix extensions.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ If the connection uses SMB2 or newer, then this option controls
|
|
+ the use of the SMB-level encryption that is supported in SMB
|
|
+ version 3.0 and above and available in Windows 8 and newer.
|
|
+ </para>
|
|
+ </listitem>
|
|
+ </itemizedlist>
|
|
+
|
|
+ <para>
|
|
+ This parameter can be set globally. Possible values are
|
|
+
|
|
+ <emphasis>off</emphasis>,
|
|
+ <emphasis>if_required</emphasis>,
|
|
+ <emphasis>desired</emphasis>,
|
|
+ and
|
|
+ <emphasis>required</emphasis>.
|
|
+ A special value is <emphasis>default</emphasis> which is
|
|
+ the implicit default setting of <emphasis>if_required</emphasis>.
|
|
+ </para>
|
|
+
|
|
+ <variablelist>
|
|
+ <varlistentry>
|
|
+ <term><emphasis>Effects for SMB1</emphasis></term>
|
|
+ <listitem>
|
|
+ <para>
|
|
+ The Samba-specific encryption of SMB1 connections is an
|
|
+ extension to the SMB protocol negotiated as part of the UNIX
|
|
+ extensions. SMB encryption uses the GSSAPI (SSPI on Windows)
|
|
+ ability to encrypt and sign every request/response in a SMB
|
|
+ protocol stream. When enabled it provides a secure method of
|
|
+ SMB/CIFS communication, similar to an ssh protected session, but
|
|
+ using SMB/CIFS authentication to negotiate encryption and
|
|
+ signing keys. Currently this is only supported smbclient of by
|
|
+ Samba 3.2 and newer. Windows does not support this feature.
|
|
+ </para>
|
|
+
|
|
+ <para>
|
|
+ When set to default, SMB encryption is probed, but not
|
|
+ enforced. When set to required, SMB encryption is required and
|
|
+ if set to disabled, SMB encryption can not be negotiated.
|
|
+ </para>
|
|
+ </listitem>
|
|
+ </varlistentry>
|
|
+
|
|
+ <varlistentry>
|
|
+ <term><emphasis>Effects for SMB3 and newer</emphasis></term>
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Native SMB transport encryption is available in SMB version 3.0
|
|
+ or newer. It is only used by Samba if
|
|
+ <emphasis>client max protocol</emphasis> is set to
|
|
+ <emphasis>SMB3</emphasis> or newer.
|
|
+ </para>
|
|
+
|
|
+ <para>
|
|
+ These features can be controlled with settings of
|
|
+ <emphasis>client smb encrypt</emphasis> as follows:
|
|
+ </para>
|
|
+
|
|
+ <itemizedlist>
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Leaving it as default, explicitly setting
|
|
+ <emphasis>default</emphasis>, or setting it to
|
|
+ <emphasis>if_required</emphasis> globally will enable
|
|
+ negotiation of encryption but will not turn on
|
|
+ data encryption globally.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Setting it to <emphasis>desired</emphasis> globally
|
|
+ will enable negotiation and will turn on data encryption
|
|
+ on sessions and share connections for those servers
|
|
+ that support it.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Setting it to <emphasis>required</emphasis> globally
|
|
+ will enable negotiation and turn on data encryption
|
|
+ on sessions and share connections. Clients that do
|
|
+ not support encryption will be denied access to the
|
|
+ server.
|
|
+ </para>
|
|
+ </listitem>
|
|
+
|
|
+ <listitem>
|
|
+ <para>
|
|
+ Setting it to <emphasis>off</emphasis> globally will
|
|
+ completely disable the encryption feature for all
|
|
+ connections.
|
|
+ </para>
|
|
+ </listitem>
|
|
+ </itemizedlist>
|
|
+ </listitem>
|
|
+ </varlistentry>
|
|
+ </variablelist>
|
|
+</description>
|
|
+
|
|
+<value type="default">default</value>
|
|
+</samba:parameter>
|
|
diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
|
|
index e041f4fb01b..e167903dbd9 100644
|
|
--- a/lib/param/loadparm.c
|
|
+++ b/lib/param/loadparm.c
|
|
@@ -3079,6 +3079,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
|
|
lpcfg_do_global_parameter(
|
|
lp_ctx, "ldap max search request size", "256000");
|
|
|
|
+ lpcfg_do_global_parameter(lp_ctx,
|
|
+ "client smb encrypt",
|
|
+ "default");
|
|
+
|
|
for (i = 0; parm_table[i].label; i++) {
|
|
if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) {
|
|
lp_ctx->flags[i] |= FLAG_DEFAULT;
|
|
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
|
|
index b305e34b252..9a2a309b781 100644
|
|
--- a/source3/param/loadparm.c
|
|
+++ b/source3/param/loadparm.c
|
|
@@ -960,6 +960,8 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)
|
|
Globals.ldap_max_authenticated_request_size = 16777216;
|
|
Globals.ldap_max_search_request_size = 256000;
|
|
|
|
+ Globals.client_smb_encrypt = SMB_ENCRYPTION_DEFAULT;
|
|
+
|
|
/* Now put back the settings that were set with lp_set_cmdline() */
|
|
apply_lp_set_cmdline();
|
|
}
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 3d826b1efb4a0e1f77875c7cbad2fcd16c3ac17b Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 22 Jul 2020 17:48:25 +0200
|
|
Subject: [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
lib/param/loadparm.c | 30 ++++++++++++++++++++++++++++++
|
|
lib/param/loadparm.h | 2 ++
|
|
2 files changed, 32 insertions(+)
|
|
|
|
diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
|
|
index e167903dbd9..952d2b49811 100644
|
|
--- a/lib/param/loadparm.c
|
|
+++ b/lib/param/loadparm.c
|
|
@@ -3674,3 +3674,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx,
|
|
raw_value,
|
|
lp_sub->private_data);
|
|
}
|
|
+
|
|
+/**
|
|
+ * @brief Parse a string value of a given parameter to its integer enum value.
|
|
+ *
|
|
+ * @param[in] param_name The parameter name (e.g. 'client smb encrypt')
|
|
+ *
|
|
+ * @param[in] param_value The parameter value (e.g. 'required').
|
|
+ *
|
|
+ * @return The integer value of the enum the param_value matches or INT32_MIN
|
|
+ * on error.
|
|
+ */
|
|
+int32_t lpcfg_parse_enum_vals(const char *param_name,
|
|
+ const char *param_value)
|
|
+{
|
|
+ struct parm_struct *parm = NULL;
|
|
+ int32_t ret = INT32_MIN;
|
|
+ bool ok;
|
|
+
|
|
+ parm = lpcfg_parm_struct(NULL, param_name);
|
|
+ if (parm == NULL) {
|
|
+ return INT32_MIN;
|
|
+ }
|
|
+
|
|
+ ok = lp_set_enum_parm(parm, param_value, &ret);
|
|
+ if (!ok) {
|
|
+ return INT32_MIN;
|
|
+ }
|
|
+
|
|
+ return ret;
|
|
+}
|
|
diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h
|
|
index 323fcf84523..e66ce2324b4 100644
|
|
--- a/lib/param/loadparm.h
|
|
+++ b/lib/param/loadparm.h
|
|
@@ -316,6 +316,8 @@ bool lp_do_section(const char *pszSectionName, void *userdata);
|
|
bool store_lp_set_cmdline(const char *pszParmName, const char *pszParmValue);
|
|
|
|
int num_parameters(void);
|
|
+int32_t lpcfg_parse_enum_vals(const char *param_name,
|
|
+ const char *param_value);
|
|
|
|
struct loadparm_substitution;
|
|
#ifdef LOADPARM_SUBSTITUTION_INTERNALS
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 2f74f9d6a5d38e6eb2ca3d32f61d5d9b1c55f3c1 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 9 Oct 2019 09:38:08 +0200
|
|
Subject: [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
libcli/smb/smb_util.h | 7 ++++
|
|
libcli/smb/test_util_translate.c | 64 ++++++++++++++++++++++++++++++++
|
|
libcli/smb/util.c | 20 ++++++++++
|
|
libcli/smb/wscript | 5 +++
|
|
selftest/tests.py | 2 +
|
|
5 files changed, 98 insertions(+)
|
|
create mode 100644 libcli/smb/test_util_translate.c
|
|
|
|
diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h
|
|
index 8861741c92f..15bdbe856d1 100644
|
|
--- a/libcli/smb/smb_util.h
|
|
+++ b/libcli/smb/smb_util.h
|
|
@@ -24,6 +24,9 @@
|
|
#include "smb_constants.h"
|
|
#include <talloc.h>
|
|
|
|
+#ifndef _SMB_UTIL_H
|
|
+#define _SMB_UTIL_H
|
|
+
|
|
const char *smb_protocol_types_string(enum protocol_types protocol);
|
|
char *attrib_string(TALLOC_CTX *mem_ctx, uint32_t attrib);
|
|
uint32_t unix_perms_to_wire(mode_t perms);
|
|
@@ -46,3 +49,7 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2,
|
|
const uint8_t *buf, size_t buf_len,
|
|
const uint8_t *position,
|
|
size_t *_consumed);
|
|
+
|
|
+enum smb_signing_setting smb_signing_setting_translate(const char *str);
|
|
+
|
|
+#endif /* _SMB_UTIL_H */
|
|
diff --git a/libcli/smb/test_util_translate.c b/libcli/smb/test_util_translate.c
|
|
new file mode 100644
|
|
index 00000000000..4b81984affa
|
|
--- /dev/null
|
|
+++ b/libcli/smb/test_util_translate.c
|
|
@@ -0,0 +1,64 @@
|
|
+/*
|
|
+ * Unix SMB/CIFS implementation.
|
|
+ *
|
|
+ * Copyright (C) 2020 Andreas Schneider <asn@samba.org>
|
|
+ *
|
|
+ * This program is free software; you can redistribute it and/or modify
|
|
+ * it under the terms of the GNU General Public License as published by
|
|
+ * the Free Software Foundation; either version 3 of the License, or
|
|
+ * (at your option) any later version.
|
|
+ *
|
|
+ * This program is distributed in the hope that it will be useful,
|
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+ * GNU General Public License for more details.
|
|
+ *
|
|
+ * You should have received a copy of the GNU General Public License
|
|
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+ */
|
|
+
|
|
+#include <stdarg.h>
|
|
+#include <stddef.h>
|
|
+#include <stdint.h>
|
|
+#include <setjmp.h>
|
|
+#include <cmocka.h>
|
|
+
|
|
+#include "lib/replace/replace.h"
|
|
+#include <talloc.h>
|
|
+
|
|
+#include "libcli/smb/util.c"
|
|
+
|
|
+static void test_smb_signing_setting_translate(void **state)
|
|
+{
|
|
+ enum smb_signing_setting signing_state;
|
|
+
|
|
+ signing_state = smb_signing_setting_translate("wurst");
|
|
+ assert_int_equal(signing_state, SMB_SIGNING_REQUIRED);
|
|
+
|
|
+ signing_state = smb_signing_setting_translate("off");
|
|
+ assert_int_equal(signing_state, SMB_SIGNING_OFF);
|
|
+
|
|
+ signing_state = smb_signing_setting_translate("if_required");
|
|
+ assert_int_equal(signing_state, SMB_SIGNING_IF_REQUIRED);
|
|
+
|
|
+ signing_state = smb_signing_setting_translate("mandatory");
|
|
+ assert_int_equal(signing_state, SMB_SIGNING_REQUIRED);
|
|
+
|
|
+}
|
|
+
|
|
+int main(int argc, char *argv[])
|
|
+{
|
|
+ int rc;
|
|
+ const struct CMUnitTest tests[] = {
|
|
+ cmocka_unit_test(test_smb_signing_setting_translate),
|
|
+ };
|
|
+
|
|
+ if (argc == 2) {
|
|
+ cmocka_set_test_filter(argv[1]);
|
|
+ }
|
|
+ cmocka_set_message_output(CM_OUTPUT_SUBUNIT);
|
|
+
|
|
+ rc = cmocka_run_group_tests(tests, NULL, NULL);
|
|
+
|
|
+ return rc;
|
|
+}
|
|
diff --git a/libcli/smb/util.c b/libcli/smb/util.c
|
|
index 6fdf35fbbf3..da0e4db2bf3 100644
|
|
--- a/libcli/smb/util.c
|
|
+++ b/libcli/smb/util.c
|
|
@@ -22,6 +22,7 @@
|
|
#include "includes.h"
|
|
#include "libcli/smb/smb_common.h"
|
|
#include "system/filesys.h"
|
|
+#include "lib/param/loadparm.h"
|
|
|
|
const char *smb_protocol_types_string(enum protocol_types protocol)
|
|
{
|
|
@@ -428,3 +429,22 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2,
|
|
return internal_bytes_pull_str(mem_ctx, _str, ucs2, true,
|
|
buf, buf_len, position, _consumed);
|
|
}
|
|
+
|
|
+/**
|
|
+ * @brief Translate SMB signing settings as string to an enum.
|
|
+ *
|
|
+ * @param[in] str The string to translate.
|
|
+ *
|
|
+ * @return A corresponding enum @smb_signing_setting tranlated from the string.
|
|
+ */
|
|
+enum smb_signing_setting smb_signing_setting_translate(const char *str)
|
|
+{
|
|
+ enum smb_signing_setting signing_state = SMB_SIGNING_REQUIRED;
|
|
+ int32_t val = lpcfg_parse_enum_vals("client signing", str);
|
|
+
|
|
+ if (val != INT32_MIN) {
|
|
+ signing_state = val;
|
|
+ }
|
|
+
|
|
+ return signing_state;
|
|
+}
|
|
diff --git a/libcli/smb/wscript b/libcli/smb/wscript
|
|
index 86e377f570b..c047fd33278 100644
|
|
--- a/libcli/smb/wscript
|
|
+++ b/libcli/smb/wscript
|
|
@@ -72,3 +72,8 @@ def build(bld):
|
|
source='test_smb1cli_session.c',
|
|
deps='cmocka cli_smb_common',
|
|
for_selftest=True)
|
|
+
|
|
+ bld.SAMBA_BINARY('test_util_translate',
|
|
+ source='test_util_translate.c',
|
|
+ deps='cmocka cli_smb_common',
|
|
+ for_selftest=True)
|
|
diff --git a/selftest/tests.py b/selftest/tests.py
|
|
index 6918e1306c3..20981754db4 100644
|
|
--- a/selftest/tests.py
|
|
+++ b/selftest/tests.py
|
|
@@ -376,6 +376,8 @@ plantestsuite("samba.unittests.lib_util_modules", "none",
|
|
|
|
plantestsuite("samba.unittests.smb1cli_session", "none",
|
|
[os.path.join(bindir(), "default/libcli/smb/test_smb1cli_session")])
|
|
+plantestsuite("samba.unittests.smb_util_translate", "none",
|
|
+ [os.path.join(bindir(), "default/libcli/smb/test_util_translate")])
|
|
|
|
plantestsuite("samba.unittests.talloc_keep_secret", "none",
|
|
[os.path.join(bindir(), "default/lib/util/test_talloc_keep_secret")])
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 912ec83bf4ec6a965ee10ace1d74036c5c6a4c92 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 26 May 2020 08:39:34 +0200
|
|
Subject: [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate()
|
|
|
|
Add encryption enum and function to avoid confusion when reading the
|
|
code.
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
libcli/smb/smb_util.h | 1 +
|
|
libcli/smb/test_util_translate.c | 19 +++++++++++++++++++
|
|
libcli/smb/util.c | 20 ++++++++++++++++++++
|
|
3 files changed, 40 insertions(+)
|
|
|
|
diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h
|
|
index 15bdbe856d1..2a727db8b6f 100644
|
|
--- a/libcli/smb/smb_util.h
|
|
+++ b/libcli/smb/smb_util.h
|
|
@@ -51,5 +51,6 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2,
|
|
size_t *_consumed);
|
|
|
|
enum smb_signing_setting smb_signing_setting_translate(const char *str);
|
|
+enum smb_encryption_setting smb_encryption_setting_translate(const char *str);
|
|
|
|
#endif /* _SMB_UTIL_H */
|
|
diff --git a/libcli/smb/test_util_translate.c b/libcli/smb/test_util_translate.c
|
|
index 4b81984affa..b300af52c09 100644
|
|
--- a/libcli/smb/test_util_translate.c
|
|
+++ b/libcli/smb/test_util_translate.c
|
|
@@ -46,11 +46,30 @@ static void test_smb_signing_setting_translate(void **state)
|
|
|
|
}
|
|
|
|
+static void test_smb_encryption_setting_translate(void **state)
|
|
+{
|
|
+ enum smb_encryption_setting encryption_state;
|
|
+
|
|
+ encryption_state = smb_encryption_setting_translate("wurst");
|
|
+ assert_int_equal(encryption_state, SMB_ENCRYPTION_REQUIRED);
|
|
+
|
|
+ encryption_state = smb_encryption_setting_translate("off");
|
|
+ assert_int_equal(encryption_state, SMB_ENCRYPTION_OFF);
|
|
+
|
|
+ encryption_state = smb_encryption_setting_translate("if_required");
|
|
+ assert_int_equal(encryption_state, SMB_ENCRYPTION_IF_REQUIRED);
|
|
+
|
|
+ encryption_state = smb_encryption_setting_translate("mandatory");
|
|
+ assert_int_equal(encryption_state, SMB_ENCRYPTION_REQUIRED);
|
|
+
|
|
+}
|
|
+
|
|
int main(int argc, char *argv[])
|
|
{
|
|
int rc;
|
|
const struct CMUnitTest tests[] = {
|
|
cmocka_unit_test(test_smb_signing_setting_translate),
|
|
+ cmocka_unit_test(test_smb_encryption_setting_translate),
|
|
};
|
|
|
|
if (argc == 2) {
|
|
diff --git a/libcli/smb/util.c b/libcli/smb/util.c
|
|
index da0e4db2bf3..ac2887ee5c4 100644
|
|
--- a/libcli/smb/util.c
|
|
+++ b/libcli/smb/util.c
|
|
@@ -448,3 +448,23 @@ enum smb_signing_setting smb_signing_setting_translate(const char *str)
|
|
|
|
return signing_state;
|
|
}
|
|
+
|
|
+/**
|
|
+ * @brief Translate SMB encryption settings as string to an enum.
|
|
+ *
|
|
+ * @param[in] str The string to translate.
|
|
+ *
|
|
+ * @return A corresponding enum @smb_encryption_setting tranlated from the
|
|
+ * string.
|
|
+ */
|
|
+enum smb_encryption_setting smb_encryption_setting_translate(const char *str)
|
|
+{
|
|
+ enum smb_encryption_setting encryption_state = SMB_ENCRYPTION_REQUIRED;
|
|
+ int32_t val = lpcfg_parse_enum_vals("client smb encrypt", str);
|
|
+
|
|
+ if (val != INT32_MIN) {
|
|
+ encryption_state = val;
|
|
+ }
|
|
+
|
|
+ return encryption_state;
|
|
+}
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 7d2c3a519805549f577b54cf72a5d95b4ae744f3 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 9 Oct 2019 09:47:59 +0200
|
|
Subject: [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline
|
|
parsing
|
|
|
|
The function will be removed soon.
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/lib/util_cmdline.c | 17 +++--------------
|
|
source3/wscript_build | 2 +-
|
|
2 files changed, 4 insertions(+), 15 deletions(-)
|
|
|
|
diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c
|
|
index 90ee67c4cb7..bc1f1c3ed25 100644
|
|
--- a/source3/lib/util_cmdline.c
|
|
+++ b/source3/lib/util_cmdline.c
|
|
@@ -28,6 +28,7 @@
|
|
#include "librpc/gen_ndr/samr.h"
|
|
#include "auth/credentials/credentials.h"
|
|
#include "auth/gensec/gensec.h"
|
|
+#include "libcli/smb/smb_util.h"
|
|
|
|
/**************************************************************************n
|
|
Code to cope with username/password auth options from the commandline.
|
|
@@ -240,20 +241,8 @@ void set_cmdline_auth_info_password(struct user_auth_info *auth_info,
|
|
bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info,
|
|
const char *arg)
|
|
{
|
|
- auth_info->signing_state = SMB_SIGNING_DEFAULT;
|
|
- if (strequal(arg, "off") || strequal(arg, "no") ||
|
|
- strequal(arg, "false")) {
|
|
- auth_info->signing_state = SMB_SIGNING_OFF;
|
|
- } else if (strequal(arg, "on") || strequal(arg, "yes") ||
|
|
- strequal(arg, "if_required") ||
|
|
- strequal(arg, "true") || strequal(arg, "auto")) {
|
|
- auth_info->signing_state = SMB_SIGNING_IF_REQUIRED;
|
|
- } else if (strequal(arg, "force") || strequal(arg, "required") ||
|
|
- strequal(arg, "forced")) {
|
|
- auth_info->signing_state = SMB_SIGNING_REQUIRED;
|
|
- } else {
|
|
- return false;
|
|
- }
|
|
+ auth_info->signing_state = smb_signing_setting_translate(arg);
|
|
+
|
|
return true;
|
|
}
|
|
|
|
diff --git a/source3/wscript_build b/source3/wscript_build
|
|
index 5a07eddac44..6a08afe4a25 100644
|
|
--- a/source3/wscript_build
|
|
+++ b/source3/wscript_build
|
|
@@ -279,7 +279,7 @@ bld.SAMBA3_LIBRARY('popt_samba3_cmdline',
|
|
|
|
bld.SAMBA3_LIBRARY('util_cmdline',
|
|
source='lib/util_cmdline.c',
|
|
- deps='secrets3 samba-credentials',
|
|
+ deps='secrets3 samba-credentials cli_smb_common',
|
|
private_library=True)
|
|
|
|
bld.SAMBA3_LIBRARY('cmdline_contexts',
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From d488762aa9468bd54890a2fe3dba3fd52582b556 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 23 Jul 2020 07:47:18 +0200
|
|
Subject: [PATCH 012/105] auth:creds: Remove unused credentials autoproto
|
|
header
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
auth/credentials/credentials_krb5.c | 1 -
|
|
auth/credentials/credentials_secrets.c | 1 -
|
|
auth/credentials/wscript_build | 1 -
|
|
source4/auth/kerberos/kerberos_util.c | 1 -
|
|
source4/auth/tests/kerberos.c | 1 -
|
|
5 files changed, 5 deletions(-)
|
|
|
|
diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
|
|
index 20e677e521a..259b35b73b0 100644
|
|
--- a/auth/credentials/credentials_krb5.c
|
|
+++ b/auth/credentials/credentials_krb5.c
|
|
@@ -27,7 +27,6 @@
|
|
#include "auth/kerberos/kerberos.h"
|
|
#include "auth/credentials/credentials.h"
|
|
#include "auth/credentials/credentials_internal.h"
|
|
-#include "auth/credentials/credentials_proto.h"
|
|
#include "auth/credentials/credentials_krb5.h"
|
|
#include "auth/kerberos/kerberos_credentials.h"
|
|
#include "auth/kerberos/kerberos_srv_keytab.h"
|
|
diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c
|
|
index 54f3ce2d078..52a89d4d5b4 100644
|
|
--- a/auth/credentials/credentials_secrets.c
|
|
+++ b/auth/credentials/credentials_secrets.c
|
|
@@ -29,7 +29,6 @@
|
|
#include "system/filesys.h"
|
|
#include "auth/credentials/credentials.h"
|
|
#include "auth/credentials/credentials_internal.h"
|
|
-#include "auth/credentials/credentials_proto.h"
|
|
#include "auth/credentials/credentials_krb5.h"
|
|
#include "auth/kerberos/kerberos_util.h"
|
|
#include "param/param.h"
|
|
diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build
|
|
index f5aba1de248..564a04fe8dd 100644
|
|
--- a/auth/credentials/wscript_build
|
|
+++ b/auth/credentials/wscript_build
|
|
@@ -2,7 +2,6 @@
|
|
|
|
bld.SAMBA_LIBRARY('samba-credentials',
|
|
source='credentials.c',
|
|
- autoproto='credentials_proto.h',
|
|
public_headers='credentials.h',
|
|
pc_files='samba-credentials.pc',
|
|
deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5',
|
|
diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
|
|
index ffef24f285c..544d9d853cc 100644
|
|
--- a/source4/auth/kerberos/kerberos_util.c
|
|
+++ b/source4/auth/kerberos/kerberos_util.c
|
|
@@ -24,7 +24,6 @@
|
|
#include "system/kerberos.h"
|
|
#include "auth/kerberos/kerberos.h"
|
|
#include "auth/credentials/credentials.h"
|
|
-#include "auth/credentials/credentials_proto.h"
|
|
#include "auth/credentials/credentials_krb5.h"
|
|
#include "auth/kerberos/kerberos_credentials.h"
|
|
#include "auth/kerberos/kerberos_util.h"
|
|
diff --git a/source4/auth/tests/kerberos.c b/source4/auth/tests/kerberos.c
|
|
index 7711eac2afa..d9be3562adb 100644
|
|
--- a/source4/auth/tests/kerberos.c
|
|
+++ b/source4/auth/tests/kerberos.c
|
|
@@ -10,7 +10,6 @@
|
|
#include "system/kerberos.h"
|
|
#include "auth/kerberos/kerberos.h"
|
|
#include "auth/credentials/credentials.h"
|
|
-#include "auth/credentials/credentials_proto.h"
|
|
#include "auth/credentials/credentials_krb5.h"
|
|
#include "auth/kerberos/kerberos_credentials.h"
|
|
#include "auth/kerberos/kerberos_util.h"
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 696d2230503dada1e4369500c7c632bd7d3e5527 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 26 May 2020 09:32:44 +0200
|
|
Subject: [PATCH 013/105] auth:creds: Add
|
|
cli_credentials_(get|set)_smb_signing()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
auth/credentials/credentials.c | 45 +++++++++++++++++++++++++
|
|
auth/credentials/credentials.h | 7 ++++
|
|
auth/credentials/credentials_internal.h | 4 +++
|
|
3 files changed, 56 insertions(+)
|
|
|
|
diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
|
|
index 80a31b248ae..365a6def7ea 100644
|
|
--- a/auth/credentials/credentials.c
|
|
+++ b/auth/credentials/credentials.c
|
|
@@ -44,6 +44,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
|
|
|
|
cred->winbind_separator = '\\';
|
|
|
|
+ cred->signing_state = SMB_SIGNING_DEFAULT;
|
|
+
|
|
return cred;
|
|
}
|
|
|
|
@@ -922,6 +924,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
|
|
if (sep != NULL && sep[0] != '\0') {
|
|
cred->winbind_separator = *lpcfg_winbind_separator(lp_ctx);
|
|
}
|
|
+
|
|
+ if (cred->signing_state_obtained <= CRED_SMB_CONF) {
|
|
+ /* Will be set to default for invalid smb.conf values */
|
|
+ cred->signing_state = lpcfg_client_signing(lp_ctx);
|
|
+ cred->signing_state_obtained = CRED_SMB_CONF;
|
|
+ }
|
|
}
|
|
|
|
/**
|
|
@@ -1304,6 +1312,43 @@ _PUBLIC_ bool cli_credentials_parse_password_fd(struct cli_credentials *credenti
|
|
return true;
|
|
}
|
|
|
|
+/**
|
|
+ * @brief Set the SMB signing state to request for a SMB connection.
|
|
+ *
|
|
+ * @param[in] creds The credentials structure to update.
|
|
+ *
|
|
+ * @param[in] signing_state The signing state to set.
|
|
+ *
|
|
+ * @param obtained This way the described signing state was specified.
|
|
+ *
|
|
+ * @return true if we could set the signing state, false otherwise.
|
|
+ */
|
|
+_PUBLIC_ bool cli_credentials_set_smb_signing(struct cli_credentials *creds,
|
|
+ enum smb_signing_setting signing_state,
|
|
+ enum credentials_obtained obtained)
|
|
+{
|
|
+ if (obtained >= creds->signing_state_obtained) {
|
|
+ creds->signing_state_obtained = obtained;
|
|
+ creds->signing_state = signing_state;
|
|
+ return true;
|
|
+ }
|
|
+
|
|
+ return false;
|
|
+}
|
|
+
|
|
+/**
|
|
+ * @brief Obtain the SMB signing state from a credentials structure.
|
|
+ *
|
|
+ * @param[in] creds The credential structure to obtain the SMB signing state
|
|
+ * from.
|
|
+ *
|
|
+ * @return The SMB singing state.
|
|
+ */
|
|
+_PUBLIC_ enum smb_signing_setting
|
|
+cli_credentials_get_smb_signing(struct cli_credentials *creds)
|
|
+{
|
|
+ return creds->signing_state;
|
|
+}
|
|
|
|
/**
|
|
* Encrypt a data blob using the session key and the negotiated encryption
|
|
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
|
|
index 7154c2a008c..422391ad585 100644
|
|
--- a/auth/credentials/credentials.h
|
|
+++ b/auth/credentials/credentials.h
|
|
@@ -38,6 +38,7 @@ struct gssapi_creds_container;
|
|
struct smb_krb5_context;
|
|
struct keytab_container;
|
|
struct db_context;
|
|
+enum smb_signing_setting;
|
|
|
|
/* In order of priority */
|
|
enum credentials_obtained {
|
|
@@ -290,6 +291,12 @@ void *_cli_credentials_callback_data(struct cli_credentials *cred);
|
|
#define cli_credentials_callback_data_void(_cred) \
|
|
_cli_credentials_callback_data(_cred)
|
|
|
|
+bool cli_credentials_set_smb_signing(struct cli_credentials *cred,
|
|
+ enum smb_signing_setting signing_state,
|
|
+ enum credentials_obtained obtained);
|
|
+enum smb_signing_setting
|
|
+cli_credentials_get_smb_signing(struct cli_credentials *cred);
|
|
+
|
|
/**
|
|
* Return attached NETLOGON credentials
|
|
*/
|
|
diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h
|
|
index 68f1f25dce1..9cde0000b5f 100644
|
|
--- a/auth/credentials/credentials_internal.h
|
|
+++ b/auth/credentials/credentials_internal.h
|
|
@@ -24,6 +24,7 @@
|
|
|
|
#include "../lib/util/data_blob.h"
|
|
#include "librpc/gen_ndr/misc.h"
|
|
+#include "libcli/smb/smb_constants.h"
|
|
|
|
struct cli_credentials {
|
|
enum credentials_obtained workstation_obtained;
|
|
@@ -36,6 +37,7 @@ struct cli_credentials {
|
|
enum credentials_obtained principal_obtained;
|
|
enum credentials_obtained keytab_obtained;
|
|
enum credentials_obtained server_gss_creds_obtained;
|
|
+ enum credentials_obtained signing_state_obtained;
|
|
|
|
/* Threshold values (essentially a MAX() over a number of the
|
|
* above) for the ccache and GSS credentials, to ensure we
|
|
@@ -117,6 +119,8 @@ struct cli_credentials {
|
|
char winbind_separator;
|
|
|
|
bool password_will_be_nt_hash;
|
|
+
|
|
+ enum smb_signing_setting signing_state;
|
|
};
|
|
|
|
#endif /* __CREDENTIALS_INTERNAL_H__ */
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 0176a9d55aed4bdb49ac6f703dcae778b2f4ac5c Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 3 Jun 2020 11:56:01 +0200
|
|
Subject: [PATCH 014/105] auth:creds: Add python bindings for
|
|
(get|set)_smb_signing
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
auth/credentials/pycredentials.c | 63 +++++++++++++++++++++++++++++++
|
|
python/samba/tests/credentials.py | 6 +++
|
|
2 files changed, 69 insertions(+)
|
|
|
|
diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c
|
|
index 68edc282741..846c418419f 100644
|
|
--- a/auth/credentials/pycredentials.c
|
|
+++ b/auth/credentials/pycredentials.c
|
|
@@ -34,6 +34,7 @@
|
|
#include "auth/credentials/credentials_internal.h"
|
|
#include "system/kerberos.h"
|
|
#include "auth/kerberos/kerberos.h"
|
|
+#include "libcli/smb/smb_constants.h"
|
|
|
|
void initcredentials(void);
|
|
|
|
@@ -929,6 +930,52 @@ static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self,
|
|
Py_RETURN_NONE;
|
|
}
|
|
|
|
+static PyObject *py_creds_get_smb_signing(PyObject *self, PyObject *unused)
|
|
+{
|
|
+ enum smb_signing_setting signing_state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+
|
|
+ creds = PyCredentials_AsCliCredentials(self);
|
|
+ if (creds == NULL) {
|
|
+ PyErr_Format(PyExc_TypeError, "Credentials expected");
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ signing_state = cli_credentials_get_smb_signing(creds);
|
|
+ return PyLong_FromLong(signing_state);
|
|
+}
|
|
+
|
|
+static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args)
|
|
+{
|
|
+ enum smb_signing_setting signing_state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+ enum credentials_obtained obt = CRED_SPECIFIED;
|
|
+
|
|
+ creds = PyCredentials_AsCliCredentials(self);
|
|
+ if (creds == NULL) {
|
|
+ PyErr_Format(PyExc_TypeError, "Credentials expected");
|
|
+ return NULL;
|
|
+ }
|
|
+ if (!PyArg_ParseTuple(args, "i|i", &signing_state, &obt)) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ switch (signing_state) {
|
|
+ case SMB_SIGNING_DEFAULT:
|
|
+ case SMB_SIGNING_OFF:
|
|
+ case SMB_SIGNING_IF_REQUIRED:
|
|
+ case SMB_SIGNING_DESIRED:
|
|
+ case SMB_SIGNING_REQUIRED:
|
|
+ break;
|
|
+ default:
|
|
+ PyErr_Format(PyExc_TypeError, "Invalid signing state value");
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ cli_credentials_set_smb_signing(creds, signing_state, obt);
|
|
+ Py_RETURN_NONE;
|
|
+}
|
|
+
|
|
static PyMethodDef py_creds_methods[] = {
|
|
{
|
|
.ml_name = "get_username",
|
|
@@ -1209,6 +1256,16 @@ static PyMethodDef py_creds_methods[] = {
|
|
"Encrypt the supplied password using the session key and\n"
|
|
"the negotiated encryption algorithm in place\n"
|
|
"i.e. it overwrites the original data"},
|
|
+ {
|
|
+ .ml_name = "get_smb_signing",
|
|
+ .ml_meth = py_creds_get_smb_signing,
|
|
+ .ml_flags = METH_NOARGS,
|
|
+ },
|
|
+ {
|
|
+ .ml_name = "set_smb_signing",
|
|
+ .ml_meth = py_creds_set_smb_signing,
|
|
+ .ml_flags = METH_VARARGS,
|
|
+ },
|
|
{ .ml_name = NULL }
|
|
};
|
|
|
|
@@ -1295,6 +1352,12 @@ MODULE_INIT_FUNC(credentials)
|
|
PyModule_AddObject(m, "CLI_CRED_NTLM_AUTH", PyLong_FromLong(CLI_CRED_NTLM_AUTH));
|
|
PyModule_AddObject(m, "CLI_CRED_CLEAR_AUTH", PyLong_FromLong(CLI_CRED_CLEAR_AUTH));
|
|
|
|
+ PyModule_AddObject(m, "SMB_SIGNING_DEFAULT", PyLong_FromLong(SMB_SIGNING_DEFAULT));
|
|
+ PyModule_AddObject(m, "SMB_SIGNING_OFF", PyLong_FromLong(SMB_SIGNING_OFF));
|
|
+ PyModule_AddObject(m, "SMB_SIGNING_IF_REQUIRED", PyLong_FromLong(SMB_SIGNING_IF_REQUIRED));
|
|
+ PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED));
|
|
+ PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED));
|
|
+
|
|
Py_INCREF(&PyCredentials);
|
|
PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials);
|
|
Py_INCREF(&PyCredentialCacheContainer);
|
|
diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py
|
|
index 6454ac9ff7c..e5f8122fa21 100644
|
|
--- a/python/samba/tests/credentials.py
|
|
+++ b/python/samba/tests/credentials.py
|
|
@@ -456,3 +456,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir):
|
|
self.assertEqual(creds.get_principal(), "user@samba.org")
|
|
self.assertEqual(creds.is_anonymous(), False)
|
|
self.assertEqual(creds.authentication_requested(), True)
|
|
+
|
|
+ def test_smb_signing(self):
|
|
+ creds = credentials.Credentials()
|
|
+ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT)
|
|
+ creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED)
|
|
+ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED)
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 96c4ce197bb62772778d822f0e5956d5a3ffe28d Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 28 May 2020 16:31:35 +0200
|
|
Subject: [PATCH 015/105] auth:creds: Add
|
|
cli_credentials_(get|set)_smb_ipc_signing()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
auth/credentials/credentials.c | 51 +++++++++++++++++++++++++
|
|
auth/credentials/credentials.h | 6 +++
|
|
auth/credentials/credentials_internal.h | 3 ++
|
|
3 files changed, 60 insertions(+)
|
|
|
|
diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
|
|
index 365a6def7ea..dc5d51f1424 100644
|
|
--- a/auth/credentials/credentials.c
|
|
+++ b/auth/credentials/credentials.c
|
|
@@ -46,6 +46,12 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
|
|
|
|
cred->signing_state = SMB_SIGNING_DEFAULT;
|
|
|
|
+ /*
|
|
+ * The default value of lpcfg_client_ipc_signing() is REQUIRED, so use
|
|
+ * the same value here.
|
|
+ */
|
|
+ cred->ipc_signing_state = SMB_SIGNING_REQUIRED;
|
|
+
|
|
return cred;
|
|
}
|
|
|
|
@@ -930,6 +936,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
|
|
cred->signing_state = lpcfg_client_signing(lp_ctx);
|
|
cred->signing_state_obtained = CRED_SMB_CONF;
|
|
}
|
|
+
|
|
+ if (cred->ipc_signing_state_obtained <= CRED_SMB_CONF) {
|
|
+ /* Will be set to required for invalid smb.conf values */
|
|
+ cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx);
|
|
+ cred->ipc_signing_state_obtained = CRED_SMB_CONF;
|
|
+ }
|
|
}
|
|
|
|
/**
|
|
@@ -1350,6 +1362,45 @@ cli_credentials_get_smb_signing(struct cli_credentials *creds)
|
|
return creds->signing_state;
|
|
}
|
|
|
|
+/**
|
|
+ * @brief Set the SMB IPC signing state to request for a SMB connection.
|
|
+ *
|
|
+ * @param[in] creds The credentials structure to update.
|
|
+ *
|
|
+ * @param[in] signing_state The signing state to set.
|
|
+ *
|
|
+ * @param obtained This way the described signing state was specified.
|
|
+ *
|
|
+ * @return true if we could set the signing state, false otherwise.
|
|
+ */
|
|
+_PUBLIC_ bool
|
|
+cli_credentials_set_smb_ipc_signing(struct cli_credentials *creds,
|
|
+ enum smb_signing_setting ipc_signing_state,
|
|
+ enum credentials_obtained obtained)
|
|
+{
|
|
+ if (obtained >= creds->ipc_signing_state_obtained) {
|
|
+ creds->ipc_signing_state_obtained = obtained;
|
|
+ creds->ipc_signing_state = ipc_signing_state;
|
|
+ return true;
|
|
+ }
|
|
+
|
|
+ return false;
|
|
+}
|
|
+
|
|
+/**
|
|
+ * @brief Obtain the SMB IPC signing state from a credentials structure.
|
|
+ *
|
|
+ * @param[in] creds The credential structure to obtain the SMB IPC signing
|
|
+ * state from.
|
|
+ *
|
|
+ * @return The SMB singing state.
|
|
+ */
|
|
+_PUBLIC_ enum smb_signing_setting
|
|
+cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds)
|
|
+{
|
|
+ return creds->ipc_signing_state;
|
|
+}
|
|
+
|
|
/**
|
|
* Encrypt a data blob using the session key and the negotiated encryption
|
|
* algorithm
|
|
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
|
|
index 422391ad585..25bec916278 100644
|
|
--- a/auth/credentials/credentials.h
|
|
+++ b/auth/credentials/credentials.h
|
|
@@ -297,6 +297,12 @@ bool cli_credentials_set_smb_signing(struct cli_credentials *cred,
|
|
enum smb_signing_setting
|
|
cli_credentials_get_smb_signing(struct cli_credentials *cred);
|
|
|
|
+bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred,
|
|
+ enum smb_signing_setting ipc_signing_state,
|
|
+ enum credentials_obtained obtained);
|
|
+enum smb_signing_setting
|
|
+cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred);
|
|
+
|
|
/**
|
|
* Return attached NETLOGON credentials
|
|
*/
|
|
diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h
|
|
index 9cde0000b5f..54e8271471f 100644
|
|
--- a/auth/credentials/credentials_internal.h
|
|
+++ b/auth/credentials/credentials_internal.h
|
|
@@ -38,6 +38,7 @@ struct cli_credentials {
|
|
enum credentials_obtained keytab_obtained;
|
|
enum credentials_obtained server_gss_creds_obtained;
|
|
enum credentials_obtained signing_state_obtained;
|
|
+ enum credentials_obtained ipc_signing_state_obtained;
|
|
|
|
/* Threshold values (essentially a MAX() over a number of the
|
|
* above) for the ccache and GSS credentials, to ensure we
|
|
@@ -121,6 +122,8 @@ struct cli_credentials {
|
|
bool password_will_be_nt_hash;
|
|
|
|
enum smb_signing_setting signing_state;
|
|
+
|
|
+ enum smb_signing_setting ipc_signing_state;
|
|
};
|
|
|
|
#endif /* __CREDENTIALS_INTERNAL_H__ */
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 301adf15736a4cb10f9dca267a906efb8f885354 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 3 Jun 2020 12:32:46 +0200
|
|
Subject: [PATCH 016/105] auth:creds: Add python bindings for
|
|
(get|set)_smb_ipc_signing
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
auth/credentials/pycredentials.c | 56 +++++++++++++++++++++++++++++++
|
|
python/samba/tests/credentials.py | 6 ++++
|
|
2 files changed, 62 insertions(+)
|
|
|
|
diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c
|
|
index 846c418419f..1a83c506088 100644
|
|
--- a/auth/credentials/pycredentials.c
|
|
+++ b/auth/credentials/pycredentials.c
|
|
@@ -976,6 +976,52 @@ static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args)
|
|
Py_RETURN_NONE;
|
|
}
|
|
|
|
+static PyObject *py_creds_get_smb_ipc_signing(PyObject *self, PyObject *unused)
|
|
+{
|
|
+ enum smb_signing_setting signing_state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+
|
|
+ creds = PyCredentials_AsCliCredentials(self);
|
|
+ if (creds == NULL) {
|
|
+ PyErr_Format(PyExc_TypeError, "Credentials expected");
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ signing_state = cli_credentials_get_smb_ipc_signing(creds);
|
|
+ return PyLong_FromLong(signing_state);
|
|
+}
|
|
+
|
|
+static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args)
|
|
+{
|
|
+ enum smb_signing_setting signing_state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+ enum credentials_obtained obt = CRED_SPECIFIED;
|
|
+
|
|
+ creds = PyCredentials_AsCliCredentials(self);
|
|
+ if (creds == NULL) {
|
|
+ PyErr_Format(PyExc_TypeError, "Credentials expected");
|
|
+ return NULL;
|
|
+ }
|
|
+ if (!PyArg_ParseTuple(args, "i|i", &signing_state, &obt)) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ switch (signing_state) {
|
|
+ case SMB_SIGNING_DEFAULT:
|
|
+ case SMB_SIGNING_OFF:
|
|
+ case SMB_SIGNING_IF_REQUIRED:
|
|
+ case SMB_SIGNING_DESIRED:
|
|
+ case SMB_SIGNING_REQUIRED:
|
|
+ break;
|
|
+ default:
|
|
+ PyErr_Format(PyExc_TypeError, "Invalid signing state value");
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ cli_credentials_set_smb_ipc_signing(creds, signing_state, obt);
|
|
+ Py_RETURN_NONE;
|
|
+}
|
|
+
|
|
static PyMethodDef py_creds_methods[] = {
|
|
{
|
|
.ml_name = "get_username",
|
|
@@ -1266,6 +1312,16 @@ static PyMethodDef py_creds_methods[] = {
|
|
.ml_meth = py_creds_set_smb_signing,
|
|
.ml_flags = METH_VARARGS,
|
|
},
|
|
+ {
|
|
+ .ml_name = "get_smb_ipc_signing",
|
|
+ .ml_meth = py_creds_get_smb_ipc_signing,
|
|
+ .ml_flags = METH_NOARGS,
|
|
+ },
|
|
+ {
|
|
+ .ml_name = "set_smb_ipc_signing",
|
|
+ .ml_meth = py_creds_set_smb_ipc_signing,
|
|
+ .ml_flags = METH_VARARGS,
|
|
+ },
|
|
{ .ml_name = NULL }
|
|
};
|
|
|
|
diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py
|
|
index e5f8122fa21..8edf13ce6ff 100644
|
|
--- a/python/samba/tests/credentials.py
|
|
+++ b/python/samba/tests/credentials.py
|
|
@@ -462,3 +462,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir):
|
|
self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT)
|
|
creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED)
|
|
self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED)
|
|
+
|
|
+ def test_smb_ipc_signing(self):
|
|
+ creds = credentials.Credentials()
|
|
+ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED)
|
|
+ creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF)
|
|
+ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF)
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From cf2cafb38dd319c01ff539a73d40dac8813f03a0 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 28 May 2020 16:10:52 +0200
|
|
Subject: [PATCH 017/105] auth:creds: Add
|
|
cli_credentials_(get|set)_smb_encryption()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
auth/credentials/credentials.c | 45 +++++++++++++++++++++++++
|
|
auth/credentials/credentials.h | 7 ++++
|
|
auth/credentials/credentials_internal.h | 3 ++
|
|
3 files changed, 55 insertions(+)
|
|
|
|
diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
|
|
index dc5d51f1424..9168b92d3ec 100644
|
|
--- a/auth/credentials/credentials.c
|
|
+++ b/auth/credentials/credentials.c
|
|
@@ -51,6 +51,7 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
|
|
* the same value here.
|
|
*/
|
|
cred->ipc_signing_state = SMB_SIGNING_REQUIRED;
|
|
+ cred->encryption_state = SMB_ENCRYPTION_DEFAULT;
|
|
|
|
return cred;
|
|
}
|
|
@@ -942,6 +943,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
|
|
cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx);
|
|
cred->ipc_signing_state_obtained = CRED_SMB_CONF;
|
|
}
|
|
+
|
|
+ if (cred->encryption_state_obtained <= CRED_SMB_CONF) {
|
|
+ /* Will be set to default for invalid smb.conf values */
|
|
+ cred->encryption_state = lpcfg_client_smb_encrypt(lp_ctx);
|
|
+ cred->encryption_state_obtained = CRED_SMB_CONF;
|
|
+ }
|
|
}
|
|
|
|
/**
|
|
@@ -1401,6 +1408,44 @@ cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds)
|
|
return creds->ipc_signing_state;
|
|
}
|
|
|
|
+/**
|
|
+ * @brief Set the SMB encryption state to request for a SMB connection.
|
|
+ *
|
|
+ * @param[in] creds The credentials structure to update.
|
|
+ *
|
|
+ * @param[in] encryption_state The encryption state to set.
|
|
+ *
|
|
+ * @param obtained This way the described encryption state was specified.
|
|
+ *
|
|
+ * @return true if we could set the encryption state, false otherwise.
|
|
+ */
|
|
+_PUBLIC_ bool cli_credentials_set_smb_encryption(struct cli_credentials *creds,
|
|
+ enum smb_encryption_setting encryption_state,
|
|
+ enum credentials_obtained obtained)
|
|
+{
|
|
+ if (obtained >= creds->encryption_state_obtained) {
|
|
+ creds->encryption_state_obtained = obtained;
|
|
+ creds->encryption_state = encryption_state;
|
|
+ return true;
|
|
+ }
|
|
+
|
|
+ return false;
|
|
+}
|
|
+
|
|
+/**
|
|
+ * @brief Obtain the SMB encryption state from a credentials structure.
|
|
+ *
|
|
+ * @param[in] creds The credential structure to obtain the SMB encryption state
|
|
+ * from.
|
|
+ *
|
|
+ * @return The SMB singing state.
|
|
+ */
|
|
+_PUBLIC_ enum smb_encryption_setting
|
|
+cli_credentials_get_smb_encryption(struct cli_credentials *creds)
|
|
+{
|
|
+ return creds->encryption_state;
|
|
+}
|
|
+
|
|
/**
|
|
* Encrypt a data blob using the session key and the negotiated encryption
|
|
* algorithm
|
|
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
|
|
index 25bec916278..7d0cf53194b 100644
|
|
--- a/auth/credentials/credentials.h
|
|
+++ b/auth/credentials/credentials.h
|
|
@@ -39,6 +39,7 @@ struct smb_krb5_context;
|
|
struct keytab_container;
|
|
struct db_context;
|
|
enum smb_signing_setting;
|
|
+enum smb_encryption_setting;
|
|
|
|
/* In order of priority */
|
|
enum credentials_obtained {
|
|
@@ -303,6 +304,12 @@ bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred,
|
|
enum smb_signing_setting
|
|
cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred);
|
|
|
|
+bool cli_credentials_set_smb_encryption(struct cli_credentials *cred,
|
|
+ enum smb_encryption_setting encryption_state,
|
|
+ enum credentials_obtained obtained);
|
|
+enum smb_encryption_setting
|
|
+cli_credentials_get_smb_encryption(struct cli_credentials *cred);
|
|
+
|
|
/**
|
|
* Return attached NETLOGON credentials
|
|
*/
|
|
diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h
|
|
index 54e8271471f..3b86b742448 100644
|
|
--- a/auth/credentials/credentials_internal.h
|
|
+++ b/auth/credentials/credentials_internal.h
|
|
@@ -39,6 +39,7 @@ struct cli_credentials {
|
|
enum credentials_obtained server_gss_creds_obtained;
|
|
enum credentials_obtained signing_state_obtained;
|
|
enum credentials_obtained ipc_signing_state_obtained;
|
|
+ enum credentials_obtained encryption_state_obtained;
|
|
|
|
/* Threshold values (essentially a MAX() over a number of the
|
|
* above) for the ccache and GSS credentials, to ensure we
|
|
@@ -124,6 +125,8 @@ struct cli_credentials {
|
|
enum smb_signing_setting signing_state;
|
|
|
|
enum smb_signing_setting ipc_signing_state;
|
|
+
|
|
+ enum smb_encryption_setting encryption_state;
|
|
};
|
|
|
|
#endif /* __CREDENTIALS_INTERNAL_H__ */
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From a25732f42cf7418789c2102f093dc0b3062543fd Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 3 Jun 2020 12:38:30 +0200
|
|
Subject: [PATCH 018/105] auth:creds: Add python bindings for
|
|
(get|set)_smb_encryption
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
auth/credentials/pycredentials.c | 62 +++++++++++++++++++++++++++++++
|
|
python/samba/tests/credentials.py | 6 +++
|
|
2 files changed, 68 insertions(+)
|
|
|
|
diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c
|
|
index 1a83c506088..628aae6500b 100644
|
|
--- a/auth/credentials/pycredentials.c
|
|
+++ b/auth/credentials/pycredentials.c
|
|
@@ -1022,6 +1022,52 @@ static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args)
|
|
Py_RETURN_NONE;
|
|
}
|
|
|
|
+static PyObject *py_creds_get_smb_encryption(PyObject *self, PyObject *unused)
|
|
+{
|
|
+ enum smb_encryption_setting encryption_state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+
|
|
+ creds = PyCredentials_AsCliCredentials(self);
|
|
+ if (creds == NULL) {
|
|
+ PyErr_Format(PyExc_TypeError, "Credentials expected");
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ encryption_state = cli_credentials_get_smb_encryption(creds);
|
|
+ return PyLong_FromLong(encryption_state);
|
|
+}
|
|
+
|
|
+static PyObject *py_creds_set_smb_encryption(PyObject *self, PyObject *args)
|
|
+{
|
|
+ enum smb_encryption_setting encryption_state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+ enum credentials_obtained obt = CRED_SPECIFIED;
|
|
+
|
|
+ creds = PyCredentials_AsCliCredentials(self);
|
|
+ if (creds == NULL) {
|
|
+ PyErr_Format(PyExc_TypeError, "Credentials expected");
|
|
+ return NULL;
|
|
+ }
|
|
+ if (!PyArg_ParseTuple(args, "i|i", &encryption_state, &obt)) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ switch (encryption_state) {
|
|
+ case SMB_ENCRYPTION_DEFAULT:
|
|
+ case SMB_ENCRYPTION_OFF:
|
|
+ case SMB_ENCRYPTION_IF_REQUIRED:
|
|
+ case SMB_ENCRYPTION_DESIRED:
|
|
+ case SMB_ENCRYPTION_REQUIRED:
|
|
+ break;
|
|
+ default:
|
|
+ PyErr_Format(PyExc_TypeError, "Invalid encryption state value");
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ cli_credentials_set_smb_encryption(creds, encryption_state, obt);
|
|
+ Py_RETURN_NONE;
|
|
+}
|
|
+
|
|
static PyMethodDef py_creds_methods[] = {
|
|
{
|
|
.ml_name = "get_username",
|
|
@@ -1322,6 +1368,16 @@ static PyMethodDef py_creds_methods[] = {
|
|
.ml_meth = py_creds_set_smb_ipc_signing,
|
|
.ml_flags = METH_VARARGS,
|
|
},
|
|
+ {
|
|
+ .ml_name = "get_smb_encryption",
|
|
+ .ml_meth = py_creds_get_smb_encryption,
|
|
+ .ml_flags = METH_NOARGS,
|
|
+ },
|
|
+ {
|
|
+ .ml_name = "set_smb_encryption",
|
|
+ .ml_meth = py_creds_set_smb_encryption,
|
|
+ .ml_flags = METH_VARARGS,
|
|
+ },
|
|
{ .ml_name = NULL }
|
|
};
|
|
|
|
@@ -1414,6 +1470,12 @@ MODULE_INIT_FUNC(credentials)
|
|
PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED));
|
|
PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED));
|
|
|
|
+ PyModule_AddObject(m, "SMB_ENCRYPTION_DEFAULT", PyLong_FromLong(SMB_ENCRYPTION_DEFAULT));
|
|
+ PyModule_AddObject(m, "SMB_ENCRYPTION_OFF", PyLong_FromLong(SMB_ENCRYPTION_OFF));
|
|
+ PyModule_AddObject(m, "SMB_ENCRYPTION_IF_REQUIRED", PyLong_FromLong(SMB_ENCRYPTION_IF_REQUIRED));
|
|
+ PyModule_AddObject(m, "SMB_ENCRYPTION_DESIRED", PyLong_FromLong(SMB_ENCRYPTION_DESIRED));
|
|
+ PyModule_AddObject(m, "SMB_ENCRYPTION_REQUIRED", PyLong_FromLong(SMB_ENCRYPTION_REQUIRED));
|
|
+
|
|
Py_INCREF(&PyCredentials);
|
|
PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials);
|
|
Py_INCREF(&PyCredentialCacheContainer);
|
|
diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py
|
|
index 8edf13ce6ff..e0a6248d37a 100644
|
|
--- a/python/samba/tests/credentials.py
|
|
+++ b/python/samba/tests/credentials.py
|
|
@@ -468,3 +468,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir):
|
|
self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED)
|
|
creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF)
|
|
self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF)
|
|
+
|
|
+ def test_smb_encryption(self):
|
|
+ creds = credentials.Credentials()
|
|
+ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT)
|
|
+ creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED)
|
|
+ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED)
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 1a1809bd260ceff97dd4ff697f78b97a63f60b48 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 4 Jun 2020 11:19:53 +0200
|
|
Subject: [PATCH 019/105] auth:creds: Add python bindings for
|
|
cli_credentials_set_conf()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
auth/credentials/pycredentials.c | 41 +++++++++++++++++++++++++++++++
|
|
python/samba/tests/credentials.py | 33 +++++++++++++++++++++++++
|
|
2 files changed, 74 insertions(+)
|
|
|
|
diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c
|
|
index 628aae6500b..17c90573f09 100644
|
|
--- a/auth/credentials/pycredentials.c
|
|
+++ b/auth/credentials/pycredentials.c
|
|
@@ -621,6 +621,42 @@ static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args)
|
|
Py_RETURN_NONE;
|
|
}
|
|
|
|
+static PyObject *py_creds_set_conf(PyObject *self, PyObject *args)
|
|
+{
|
|
+ PyObject *py_lp_ctx = Py_None;
|
|
+ struct loadparm_context *lp_ctx;
|
|
+ TALLOC_CTX *mem_ctx;
|
|
+ struct cli_credentials *creds;
|
|
+
|
|
+ creds = PyCredentials_AsCliCredentials(self);
|
|
+ if (creds == NULL) {
|
|
+ PyErr_Format(PyExc_TypeError, "Credentials expected");
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx)) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ mem_ctx = talloc_new(NULL);
|
|
+ if (mem_ctx == NULL) {
|
|
+ PyErr_NoMemory();
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
|
|
+ if (lp_ctx == NULL) {
|
|
+ talloc_free(mem_ctx);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ cli_credentials_set_conf(creds, lp_ctx);
|
|
+
|
|
+ talloc_free(mem_ctx);
|
|
+
|
|
+ Py_RETURN_NONE;
|
|
+}
|
|
+
|
|
static PyObject *py_creds_guess(PyObject *self, PyObject *args)
|
|
{
|
|
PyObject *py_lp_ctx = Py_None;
|
|
@@ -1279,6 +1315,11 @@ static PyMethodDef py_creds_methods[] = {
|
|
.ml_meth = py_creds_set_krb_forwardable,
|
|
.ml_flags = METH_VARARGS,
|
|
},
|
|
+ {
|
|
+ .ml_name = "set_conf",
|
|
+ .ml_meth = py_creds_set_conf,
|
|
+ .ml_flags = METH_VARARGS,
|
|
+ },
|
|
{
|
|
.ml_name = "guess",
|
|
.ml_meth = py_creds_guess,
|
|
diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py
|
|
index e0a6248d37a..6187bded0b6 100644
|
|
--- a/python/samba/tests/credentials.py
|
|
+++ b/python/samba/tests/credentials.py
|
|
@@ -463,14 +463,47 @@ class CredentialsTests(samba.tests.TestCaseInTempDir):
|
|
creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED)
|
|
self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED)
|
|
|
|
+ def test_smb_signing_set_conf(self):
|
|
+ lp = samba.tests.env_loadparm()
|
|
+
|
|
+ creds = credentials.Credentials()
|
|
+ creds.set_conf(lp)
|
|
+ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT)
|
|
+ creds.set_smb_signing(credentials.SMB_SIGNING_OFF)
|
|
+ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF)
|
|
+ creds.set_conf(lp)
|
|
+ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF)
|
|
+
|
|
def test_smb_ipc_signing(self):
|
|
creds = credentials.Credentials()
|
|
self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED)
|
|
creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF)
|
|
self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF)
|
|
|
|
+ def test_smb_ipc_signing_set_conf(self):
|
|
+ lp = samba.tests.env_loadparm()
|
|
+
|
|
+ creds = credentials.Credentials()
|
|
+ creds.set_conf(lp)
|
|
+ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED)
|
|
+ creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF)
|
|
+ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF)
|
|
+ creds.set_conf(lp)
|
|
+ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF)
|
|
+
|
|
def test_smb_encryption(self):
|
|
creds = credentials.Credentials()
|
|
self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT)
|
|
creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED)
|
|
self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED)
|
|
+
|
|
+ def test_smb_encryption_set_conf(self):
|
|
+ lp = samba.tests.env_loadparm()
|
|
+
|
|
+ creds = credentials.Credentials()
|
|
+ creds.set_conf(lp)
|
|
+ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT)
|
|
+ creds.set_smb_encryption(credentials.SMB_ENCRYPTION_OFF)
|
|
+ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF)
|
|
+ creds.set_conf(lp)
|
|
+ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF)
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 72b31403174eb23fe4fdf75ad918e845a740db6f Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 23 Jul 2020 08:14:23 +0200
|
|
Subject: [PATCH 020/105] auth:creds: Bump library version
|
|
|
|
We added new functions so bump the version.
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
auth/credentials/wscript_build | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build
|
|
index 564a04fe8dd..1e3302e3e48 100644
|
|
--- a/auth/credentials/wscript_build
|
|
+++ b/auth/credentials/wscript_build
|
|
@@ -5,7 +5,7 @@ bld.SAMBA_LIBRARY('samba-credentials',
|
|
public_headers='credentials.h',
|
|
pc_files='samba-credentials.pc',
|
|
deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5',
|
|
- vnum='0.0.1'
|
|
+ vnum='0.1.0'
|
|
)
|
|
|
|
bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5',
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 918b87437b9c36981049ca4e3cf0220ad56ec7c2 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 27 May 2020 11:10:30 +0200
|
|
Subject: [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/lib/util_cmdline.c | 18 ++++++++++++------
|
|
1 file changed, 12 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c
|
|
index bc1f1c3ed25..6038ec11515 100644
|
|
--- a/source3/lib/util_cmdline.c
|
|
+++ b/source3/lib/util_cmdline.c
|
|
@@ -40,7 +40,6 @@ struct user_auth_info {
|
|
struct loadparm_context *lp_ctx;
|
|
bool got_username;
|
|
bool got_pass;
|
|
- int signing_state;
|
|
bool smb_encrypt;
|
|
bool use_machine_account;
|
|
bool use_pw_nt_hash;
|
|
@@ -70,7 +69,6 @@ struct user_auth_info *user_auth_info_init(TALLOC_CTX *mem_ctx)
|
|
|
|
cli_credentials_set_conf(result->creds, result->lp_ctx);
|
|
|
|
- result->signing_state = SMB_SIGNING_DEFAULT;
|
|
return result;
|
|
}
|
|
|
|
@@ -241,15 +239,23 @@ void set_cmdline_auth_info_password(struct user_auth_info *auth_info,
|
|
bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info,
|
|
const char *arg)
|
|
{
|
|
- auth_info->signing_state = smb_signing_setting_translate(arg);
|
|
+ enum smb_signing_setting signing_state =
|
|
+ smb_signing_setting_translate(arg);
|
|
+ bool ok;
|
|
|
|
- return true;
|
|
+ ok = cli_credentials_set_smb_signing(auth_info->creds,
|
|
+ signing_state,
|
|
+ CRED_SPECIFIED);
|
|
+
|
|
+ return ok;
|
|
}
|
|
|
|
void set_cmdline_auth_info_signing_state_raw(struct user_auth_info *auth_info,
|
|
int signing_state)
|
|
{
|
|
- auth_info->signing_state = signing_state;
|
|
+ cli_credentials_set_smb_signing(auth_info->creds,
|
|
+ signing_state,
|
|
+ CRED_SPECIFIED);
|
|
}
|
|
|
|
int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info)
|
|
@@ -257,7 +263,7 @@ int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info)
|
|
if (auth_info->smb_encrypt) {
|
|
return SMB_SIGNING_REQUIRED;
|
|
}
|
|
- return auth_info->signing_state;
|
|
+ return cli_credentials_get_smb_signing(auth_info->creds);
|
|
}
|
|
|
|
void set_cmdline_auth_info_use_ccache(struct user_auth_info *auth_info, bool b)
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 22efb02d818946e4f03ebfb72ea345e9106deca8 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 10 Jun 2020 12:45:34 +0200
|
|
Subject: [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/lib/util_cmdline.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c
|
|
index 6038ec11515..9c9e2f0ac0f 100644
|
|
--- a/source3/lib/util_cmdline.c
|
|
+++ b/source3/lib/util_cmdline.c
|
|
@@ -377,6 +377,9 @@ void set_cmdline_auth_info_use_krb5_ticket(struct user_auth_info *auth_info)
|
|
/* This should only be used by lib/popt_common.c JRA */
|
|
void set_cmdline_auth_info_smb_encrypt(struct user_auth_info *auth_info)
|
|
{
|
|
+ cli_credentials_set_smb_encryption(auth_info->creds,
|
|
+ SMB_ENCRYPTION_REQUIRED,
|
|
+ CRED_SPECIFIED);
|
|
auth_info->smb_encrypt = true;
|
|
}
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 9abae48706106793f8952524ad2325bdd6a5101c Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 13 Aug 2020 10:40:23 +0200
|
|
Subject: [PATCH 023/105] python: Remove unused sign argument from
|
|
smb_connection()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
python/samba/netcmd/gpo.py | 9 ++++-----
|
|
1 file changed, 4 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py
|
|
index 1e2c2918ebe..ad60cda0690 100644
|
|
--- a/python/samba/netcmd/gpo.py
|
|
+++ b/python/samba/netcmd/gpo.py
|
|
@@ -382,13 +382,13 @@ def create_directory_hier(conn, remotedir):
|
|
if not conn.chkpath(path):
|
|
conn.mkdir(path)
|
|
|
|
-def smb_connection(dc_hostname, service, lp, creds, sign=False):
|
|
+def smb_connection(dc_hostname, service, lp, creds):
|
|
# SMB connect to DC
|
|
try:
|
|
# the SMB bindings rely on having a s3 loadparm
|
|
s3_lp = s3param.get_context()
|
|
s3_lp.load(lp.configfile)
|
|
- conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=sign)
|
|
+ conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True)
|
|
except Exception:
|
|
raise CommandError("Error connecting to '%s' using SMB" % dc_hostname)
|
|
return conn
|
|
@@ -998,7 +998,7 @@ class cmd_fetch(GPOCommand):
|
|
|
|
# SMB connect to DC
|
|
conn = smb_connection(dc_hostname, service, lp=self.lp,
|
|
- creds=self.creds, sign=True)
|
|
+ creds=self.creds)
|
|
|
|
# Copy GPT
|
|
tmpdir, gpodir = self.construct_tmpdir(tmpdir, gpo)
|
|
@@ -1629,8 +1629,7 @@ class cmd_admxload(Command):
|
|
conn = smb_connection(dc_hostname,
|
|
'sysvol',
|
|
lp=self.lp,
|
|
- creds=self.creds,
|
|
- sign=True)
|
|
+ creds=self.creds)
|
|
|
|
smb_dir = '\\'.join([self.lp.get('realm').lower(),
|
|
'Policies', 'PolicyDefinitions'])
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From e2f0f56ea6ec4f9696affdee08de89c0bdffa719 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 3 Jun 2020 14:02:37 +0200
|
|
Subject: [PATCH 024/105] python: Set smb signing via the creds API
|
|
|
|
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
python/samba/gpclass.py | 7 +++++++
|
|
python/samba/netcmd/domain_backup.py | 10 +++++++++-
|
|
python/samba/netcmd/gpo.py | 6 ++++++
|
|
3 files changed, 22 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py
|
|
index cc574e12a42..1781a55a618 100644
|
|
--- a/python/samba/gpclass.py
|
|
+++ b/python/samba/gpclass.py
|
|
@@ -38,6 +38,7 @@ from tempfile import NamedTemporaryFile
|
|
from samba.dcerpc import preg
|
|
from samba.dcerpc import misc
|
|
from samba.ndr import ndr_pack, ndr_unpack
|
|
+from samba.credentials import SMB_SIGNING_REQUIRED
|
|
|
|
try:
|
|
from enum import Enum
|
|
@@ -421,7 +422,13 @@ def check_refresh_gpo_list(dc_hostname, lp, creds, gpos):
|
|
# the SMB bindings rely on having a s3 loadparm
|
|
s3_lp = s3param.get_context()
|
|
s3_lp.load(lp.configfile)
|
|
+
|
|
+ # Force signing for the connection
|
|
+ saved_signing_state = creds.get_smb_signing()
|
|
+ creds.set_smb_signing(SMB_SIGNING_REQUIRED)
|
|
conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds, sign=True)
|
|
+ # Reset signing state
|
|
+ creds.set_smb_signing(saved_signing_state)
|
|
cache_path = lp.cache_path('gpo_cache')
|
|
for gpo in gpos:
|
|
if not gpo.file_sys_path:
|
|
diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py
|
|
index a3dc7fb454f..a9e0ba5bc67 100644
|
|
--- a/python/samba/netcmd/domain_backup.py
|
|
+++ b/python/samba/netcmd/domain_backup.py
|
|
@@ -54,6 +54,7 @@ from subprocess import CalledProcessError
|
|
from samba import sites
|
|
from samba.dsdb import _dsdb_load_udv_v2
|
|
from samba.ndr import ndr_pack
|
|
+from samba.credentials import SMB_SIGNING_REQUIRED
|
|
|
|
|
|
# work out a SID (based on a free RID) to use when the domain gets restored.
|
|
@@ -115,7 +116,14 @@ def smb_sysvol_conn(server, lp, creds):
|
|
# the SMB bindings rely on having a s3 loadparm
|
|
s3_lp = s3param.get_context()
|
|
s3_lp.load(lp.configfile)
|
|
- return libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True)
|
|
+
|
|
+ # Force signing for the connection
|
|
+ saved_signing_state = creds.get_smb_signing()
|
|
+ creds.set_smb_signing(SMB_SIGNING_REQUIRED)
|
|
+ conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True)
|
|
+ # Reset signing state
|
|
+ creds.set_smb_signing(saved_signing_state)
|
|
+ return conn
|
|
|
|
|
|
def get_timestamp():
|
|
diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py
|
|
index ad60cda0690..0f2f6520fc3 100644
|
|
--- a/python/samba/netcmd/gpo.py
|
|
+++ b/python/samba/netcmd/gpo.py
|
|
@@ -62,6 +62,7 @@ from samba.gp_parse.gp_csv import GPAuditCsvParser
|
|
from samba.gp_parse.gp_inf import GptTmplInfParser
|
|
from samba.gp_parse.gp_aas import GPAasParser
|
|
from samba import param
|
|
+from samba.credentials import SMB_SIGNING_REQUIRED
|
|
|
|
|
|
def attr_default(msg, attrname, default):
|
|
@@ -384,6 +385,9 @@ def create_directory_hier(conn, remotedir):
|
|
|
|
def smb_connection(dc_hostname, service, lp, creds):
|
|
# SMB connect to DC
|
|
+ # Force signing for the smb connection
|
|
+ saved_signing_state = creds.get_smb_signing()
|
|
+ creds.set_smb_signing(SMB_SIGNING_REQUIRED)
|
|
try:
|
|
# the SMB bindings rely on having a s3 loadparm
|
|
s3_lp = s3param.get_context()
|
|
@@ -391,6 +395,8 @@ def smb_connection(dc_hostname, service, lp, creds):
|
|
conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True)
|
|
except Exception:
|
|
raise CommandError("Error connecting to '%s' using SMB" % dc_hostname)
|
|
+ # Reset signing state
|
|
+ creds.set_smb_signing(saved_signing_state)
|
|
return conn
|
|
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 53b2d53349b8f453cd0144f01b833deca52e3626 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 28 May 2020 17:22:12 +0200
|
|
Subject: [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
examples/winexe/winexe.c | 2 +-
|
|
source3/include/client.h | 1 +
|
|
source3/libnet/libnet_join.c | 6 +++---
|
|
source3/libsmb/cliconnect.c | 3 ++-
|
|
source3/rpc_server/spoolss/srv_spoolss_nt.c | 4 +++-
|
|
source3/rpcclient/cmd_spoolss.c | 2 +-
|
|
source3/rpcclient/rpcclient.c | 2 +-
|
|
source3/utils/mdfind.c | 2 +-
|
|
source3/utils/net_ads.c | 3 ++-
|
|
source3/utils/net_util.c | 9 +++++++--
|
|
source3/utils/netlookup.c | 4 +++-
|
|
11 files changed, 25 insertions(+), 13 deletions(-)
|
|
|
|
diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c
|
|
index fc6b15f8e52..bb9c27e2e6d 100644
|
|
--- a/examples/winexe/winexe.c
|
|
+++ b/examples/winexe/winexe.c
|
|
@@ -1919,7 +1919,7 @@ int main(int argc, const char *argv[])
|
|
"IPC$",
|
|
"?????",
|
|
options.credentials,
|
|
- 0,
|
|
+ CLI_FULL_CONNECTION_IPC,
|
|
0);
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
diff --git a/source3/include/client.h b/source3/include/client.h
|
|
index 6a3b1b02ff3..19a738900b7 100644
|
|
--- a/source3/include/client.h
|
|
+++ b/source3/include/client.h
|
|
@@ -121,5 +121,6 @@ struct file_info {
|
|
#define CLI_FULL_CONNECTION_FORCE_ASCII 0x0100
|
|
#define CLI_FULL_CONNECTION_FORCE_SMB1 0x0400
|
|
#define CLI_FULL_CONNECTION_DISABLE_SMB1 0x0800
|
|
+#define CLI_FULL_CONNECTION_IPC 0x1000
|
|
|
|
#endif /* _CLIENT_H */
|
|
diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
|
|
index 34938603606..392e3eff74f 100644
|
|
--- a/source3/libnet/libnet_join.c
|
|
+++ b/source3/libnet/libnet_join.c
|
|
@@ -1068,7 +1068,7 @@ static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
|
|
bool use_ccache = false;
|
|
bool pw_nt_hash = false;
|
|
struct cli_credentials *creds = NULL;
|
|
- int flags = 0;
|
|
+ int flags = CLI_FULL_CONNECTION_IPC;
|
|
NTSTATUS status;
|
|
|
|
if (use_kerberos && pass) {
|
|
@@ -1684,7 +1684,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
|
|
struct netlogon_creds_CredentialState *creds = NULL;
|
|
uint32_t netlogon_flags = 0;
|
|
NTSTATUS status;
|
|
- int flags = 0;
|
|
+ int flags = CLI_FULL_CONNECTION_IPC;
|
|
|
|
if (!dc_name) {
|
|
TALLOC_FREE(frame);
|
|
@@ -1734,7 +1734,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
|
|
NULL, 0,
|
|
"IPC$", "IPC",
|
|
anon_creds,
|
|
- 0,
|
|
+ flags,
|
|
SMB_SIGNING_OFF);
|
|
}
|
|
|
|
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
|
|
index 1fb1f0127b9..f20146378e3 100644
|
|
--- a/source3/libsmb/cliconnect.c
|
|
+++ b/source3/libsmb/cliconnect.c
|
|
@@ -2788,7 +2788,7 @@ static struct tevent_req *cli_start_connection_send(
|
|
}
|
|
state->ev = ev;
|
|
|
|
- if (signing_state == SMB_SIGNING_IPC_DEFAULT) {
|
|
+ if (flags & CLI_FULL_CONNECTION_IPC) {
|
|
state->min_protocol = lp_client_ipc_min_protocol();
|
|
state->max_protocol = lp_client_ipc_max_protocol();
|
|
} else {
|
|
@@ -3673,6 +3673,7 @@ struct cli_state *get_ipc_connect(char *server,
|
|
uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
|
|
|
|
flags |= CLI_FULL_CONNECTION_FORCE_SMB1;
|
|
+ flags |= CLI_FULL_CONNECTION_IPC;
|
|
|
|
nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
|
|
get_cmdline_auth_info_creds(user_info),
|
|
diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
|
index 8b6a803a910..16e3ee485f0 100644
|
|
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
|
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
|
@@ -2481,7 +2481,9 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c
|
|
/* setup the connection */
|
|
ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine,
|
|
&rm_addr, 0, "IPC$", "IPC",
|
|
- anon_creds, 0, SMB_SIGNING_OFF);
|
|
+ anon_creds,
|
|
+ CLI_FULL_CONNECTION_IPC,
|
|
+ SMB_SIGNING_OFF);
|
|
TALLOC_FREE(anon_creds);
|
|
if ( !NT_STATUS_IS_OK( ret ) ) {
|
|
DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n",
|
|
diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c
|
|
index a7e0c673a65..7198a451ab7 100644
|
|
--- a/source3/rpcclient/cmd_spoolss.c
|
|
+++ b/source3/rpcclient/cmd_spoolss.c
|
|
@@ -3537,7 +3537,7 @@ static WERROR cmd_spoolss_printercmp(struct rpc_pipe_client *cli,
|
|
"IPC$", "IPC",
|
|
get_cmdline_auth_info_creds(
|
|
popt_get_cmdline_auth_info()),
|
|
- 0, /* flags */
|
|
+ CLI_FULL_CONNECTION_IPC,
|
|
get_cmdline_auth_info_signing_state(
|
|
popt_get_cmdline_auth_info()));
|
|
|
|
diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c
|
|
index 67a1066fc15..c86474d08f1 100644
|
|
--- a/source3/rpcclient/rpcclient.c
|
|
+++ b/source3/rpcclient/rpcclient.c
|
|
@@ -1019,7 +1019,7 @@ out_free:
|
|
static int opt_port = 0;
|
|
int result = 0;
|
|
TALLOC_CTX *frame = talloc_stackframe();
|
|
- uint32_t flags = 0;
|
|
+ uint32_t flags = CLI_FULL_CONNECTION_IPC;
|
|
struct dcerpc_binding *binding = NULL;
|
|
enum dcerpc_transport_t transport;
|
|
uint32_t bflags = 0;
|
|
diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c
|
|
index 2f952c29b4f..a3c879e75fb 100644
|
|
--- a/source3/utils/mdfind.c
|
|
+++ b/source3/utils/mdfind.c
|
|
@@ -70,7 +70,7 @@ int main(int argc, char **argv)
|
|
const char *mds_query = NULL;
|
|
struct cli_state *cli = NULL;
|
|
char *basepath = NULL;
|
|
- uint32_t flags = 0;
|
|
+ uint32_t flags = CLI_FULL_CONNECTION_IPC;
|
|
int signing_state = SMB_SIGNING_IPC_DEFAULT;
|
|
uint64_t *cnids = NULL;
|
|
size_t ncnids;
|
|
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
|
|
index e5db844c2f2..28ef6dc9974 100644
|
|
--- a/source3/utils/net_ads.c
|
|
+++ b/source3/utils/net_ads.c
|
|
@@ -2437,7 +2437,8 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char *
|
|
nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername,
|
|
&server_ss, 0,
|
|
"IPC$", "IPC",
|
|
- creds, 0,
|
|
+ creds,
|
|
+ CLI_FULL_CONNECTION_IPC,
|
|
SMB_SIGNING_IPC_DEFAULT);
|
|
|
|
if (NT_STATUS_IS_ERR(nt_status)) {
|
|
diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c
|
|
index c566ecc9000..d01b2d8c771 100644
|
|
--- a/source3/utils/net_util.c
|
|
+++ b/source3/utils/net_util.c
|
|
@@ -110,6 +110,7 @@ NTSTATUS connect_to_service(struct net_context *c,
|
|
NTSTATUS nt_status;
|
|
enum smb_signing_setting signing_setting = SMB_SIGNING_DEFAULT;
|
|
struct cli_credentials *creds = NULL;
|
|
+ int flags = 0;
|
|
|
|
creds = net_context_creds(c, c);
|
|
if (creds == NULL) {
|
|
@@ -119,12 +120,14 @@ NTSTATUS connect_to_service(struct net_context *c,
|
|
|
|
if (strequal(service_type, "IPC")) {
|
|
signing_setting = SMB_SIGNING_IPC_DEFAULT;
|
|
+ flags |= CLI_FULL_CONNECTION_IPC;
|
|
}
|
|
|
|
nt_status = cli_full_connection_creds(cli_ctx, NULL, server_name,
|
|
server_ss, c->opt_port,
|
|
service_name, service_type,
|
|
- creds, 0,
|
|
+ creds,
|
|
+ flags,
|
|
signing_setting);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
d_fprintf(stderr, _("Could not connect to server %s\n"),
|
|
@@ -195,7 +198,9 @@ NTSTATUS connect_to_ipc_anonymous(struct net_context *c,
|
|
nt_status = cli_full_connection_creds(cli_ctx, c->opt_requester_name,
|
|
server_name, server_ss, c->opt_port,
|
|
"IPC$", "IPC",
|
|
- anon_creds, 0, SMB_SIGNING_OFF);
|
|
+ anon_creds,
|
|
+ CLI_FULL_CONNECTION_IPC,
|
|
+ SMB_SIGNING_OFF);
|
|
|
|
if (NT_STATUS_IS_OK(nt_status)) {
|
|
return nt_status;
|
|
diff --git a/source3/utils/netlookup.c b/source3/utils/netlookup.c
|
|
index 6cea2ee306c..2241beb331f 100644
|
|
--- a/source3/utils/netlookup.c
|
|
+++ b/source3/utils/netlookup.c
|
|
@@ -98,7 +98,9 @@ static struct con_struct *create_cs(struct net_context *c,
|
|
nt_status = cli_full_connection_creds(&cs->cli, lp_netbios_name(), lp_netbios_name(),
|
|
&loopback_ss, 0,
|
|
"IPC$", "IPC",
|
|
- anon_creds, 0, SMB_SIGNING_OFF);
|
|
+ anon_creds,
|
|
+ CLI_FULL_CONNECTION_IPC,
|
|
+ SMB_SIGNING_OFF);
|
|
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status)));
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 975383e368a3891e92fb071ab20f2b5208167500 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 28 May 2020 17:29:25 +0200
|
|
Subject: [PATCH 026/105] s3:pylibsmb: Add ipc=True support for
|
|
CLI_FULL_CONNECTION_IPC
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/libsmb/pylibsmb.c | 13 +++++++++++--
|
|
1 file changed, 11 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c
|
|
index 3fcc3424a57..3579a040830 100644
|
|
--- a/source3/libsmb/pylibsmb.c
|
|
+++ b/source3/libsmb/pylibsmb.c
|
|
@@ -445,6 +445,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
int signing_state = SMB_SIGNING_DEFAULT;
|
|
PyObject *py_force_smb1 = Py_False;
|
|
bool force_smb1 = false;
|
|
+ PyObject *py_ipc = Py_False;
|
|
+ bool use_ipc = false;
|
|
struct tevent_req *req;
|
|
bool ret;
|
|
int flags = 0;
|
|
@@ -452,6 +454,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
static const char *kwlist[] = {
|
|
"host", "share", "lp", "creds",
|
|
"multi_threaded", "sign", "force_smb1",
|
|
+ "ipc",
|
|
NULL
|
|
};
|
|
|
|
@@ -462,12 +465,13 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
}
|
|
|
|
ret = ParseTupleAndKeywords(
|
|
- args, kwds, "ssO|O!OOO", kwlist,
|
|
+ args, kwds, "ssO|O!OOOO", kwlist,
|
|
&host, &share, &py_lp,
|
|
py_type_Credentials, &creds,
|
|
&py_multi_threaded,
|
|
&py_sign,
|
|
- &py_force_smb1);
|
|
+ &py_force_smb1,
|
|
+ &py_ipc);
|
|
|
|
Py_DECREF(py_type_Credentials);
|
|
|
|
@@ -493,6 +497,11 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
flags = CLI_FULL_CONNECTION_FORCE_SMB1;
|
|
}
|
|
|
|
+ use_ipc = PyObject_IsTrue(py_ipc);
|
|
+ if (use_ipc) {
|
|
+ flags |= CLI_FULL_CONNECTION_IPC;
|
|
+ }
|
|
+
|
|
if (multi_threaded) {
|
|
#ifdef HAVE_PTHREAD
|
|
ret = py_cli_state_setup_mt_ev(self);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 59831141a17195b9308d75257123134b0217489c Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 24 Jul 2020 09:47:11 +0200
|
|
Subject: [PATCH 027/105] python:tests: Mark libsmb connection as an IPC
|
|
connection
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
python/samba/tests/dcerpc/raw_testcase.py | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py
|
|
index ba7440df13b..2c028d381db 100644
|
|
--- a/python/samba/tests/dcerpc/raw_testcase.py
|
|
+++ b/python/samba/tests/dcerpc/raw_testcase.py
|
|
@@ -43,7 +43,7 @@ class smb_pipe_socket(object):
|
|
lp3 = s3param.get_context()
|
|
lp3.load(lp.configfile)
|
|
self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3,
|
|
- creds=creds, sign=True)
|
|
+ creds=creds, ipc=True, sign=True)
|
|
self.smbfid = self.smbconn.create(pipename,
|
|
DesiredAccess=0x12019f,
|
|
ShareAccess=0x7,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From b9df53c20a753bf31b8684776f2b6aaaf1583abe Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Mon, 17 Aug 2020 12:52:39 +0200
|
|
Subject: [PATCH 028/105] python:tests: Set smb ipc signing via the creds API
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
python/samba/tests/dcerpc/raw_testcase.py | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
|
|
diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py
|
|
index 2c028d381db..d6f5de7440a 100644
|
|
--- a/python/samba/tests/dcerpc/raw_testcase.py
|
|
+++ b/python/samba/tests/dcerpc/raw_testcase.py
|
|
@@ -36,14 +36,18 @@ from samba.ntstatus import (
|
|
from samba import NTSTATUSError
|
|
from samba.samba3 import param as s3param
|
|
from samba.samba3 import libsmb_samba_internal as libsmb
|
|
+from samba.credentials import SMB_SIGNING_REQUIRED
|
|
|
|
class smb_pipe_socket(object):
|
|
|
|
def __init__(self, target_hostname, pipename, creds, impersonation_level, lp):
|
|
lp3 = s3param.get_context()
|
|
lp3.load(lp.configfile)
|
|
+ saved_signing_state = creds.get_smb_ipc_signing()
|
|
+ creds.set_smb_ipc_signing(SMB_SIGNING_REQUIRED)
|
|
self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3,
|
|
creds=creds, ipc=True, sign=True)
|
|
+ creds.set_smb_ipc_signing(saved_signing_state)
|
|
self.smbfid = self.smbconn.create(pipename,
|
|
DesiredAccess=0x12019f,
|
|
ShareAccess=0x7,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From c9e88d833db2b472099e5751b7731e337342d2c4 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 28 May 2020 17:59:19 +0200
|
|
Subject: [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in
|
|
cliconnect.c
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/libsmb/cliconnect.c | 14 +++++++-------
|
|
source3/libsmb/proto.h | 10 +++++-----
|
|
2 files changed, 12 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
|
|
index f20146378e3..bb20aa59385 100644
|
|
--- a/source3/libsmb/cliconnect.c
|
|
+++ b/source3/libsmb/cliconnect.c
|
|
@@ -2631,7 +2631,7 @@ static NTSTATUS cli_connect_sock_recv(struct tevent_req *req,
|
|
|
|
struct cli_connect_nb_state {
|
|
const char *desthost;
|
|
- int signing_state;
|
|
+ enum smb_signing_setting signing_state;
|
|
int flags;
|
|
struct cli_state *cli;
|
|
};
|
|
@@ -2642,7 +2642,7 @@ static struct tevent_req *cli_connect_nb_send(
|
|
TALLOC_CTX *mem_ctx, struct tevent_context *ev,
|
|
const char *host, const struct sockaddr_storage *dest_ss,
|
|
uint16_t port, int name_type, const char *myname,
|
|
- int signing_state, int flags)
|
|
+ enum smb_signing_setting signing_state, int flags)
|
|
{
|
|
struct tevent_req *req, *subreq;
|
|
struct cli_connect_nb_state *state;
|
|
@@ -2727,7 +2727,7 @@ static NTSTATUS cli_connect_nb_recv(struct tevent_req *req,
|
|
|
|
NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss,
|
|
uint16_t port, int name_type, const char *myname,
|
|
- int signing_state, int flags, struct cli_state **pcli)
|
|
+ enum smb_signing_setting signing_state, int flags, struct cli_state **pcli)
|
|
{
|
|
struct tevent_context *ev;
|
|
struct tevent_req *req;
|
|
@@ -2776,7 +2776,7 @@ static struct tevent_req *cli_start_connection_send(
|
|
TALLOC_CTX *mem_ctx, struct tevent_context *ev,
|
|
const char *my_name, const char *dest_host,
|
|
const struct sockaddr_storage *dest_ss, int port,
|
|
- int signing_state, int flags)
|
|
+ enum smb_signing_setting signing_state, int flags)
|
|
{
|
|
struct tevent_req *req, *subreq;
|
|
struct cli_start_connection_state *state;
|
|
@@ -2881,7 +2881,7 @@ NTSTATUS cli_start_connection(struct cli_state **output_cli,
|
|
const char *my_name,
|
|
const char *dest_host,
|
|
const struct sockaddr_storage *dest_ss, int port,
|
|
- int signing_state, int flags)
|
|
+ enum smb_signing_setting signing_state, int flags)
|
|
{
|
|
struct tevent_context *ev;
|
|
struct tevent_req *req;
|
|
@@ -3361,7 +3361,7 @@ struct tevent_req *cli_full_connection_creds_send(
|
|
const struct sockaddr_storage *dest_ss, int port,
|
|
const char *service, const char *service_type,
|
|
struct cli_credentials *creds,
|
|
- int flags, int signing_state)
|
|
+ int flags, enum smb_signing_setting signing_state)
|
|
{
|
|
struct tevent_req *req, *subreq;
|
|
struct cli_full_connection_creds_state *state;
|
|
@@ -3520,7 +3520,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli,
|
|
const char *service, const char *service_type,
|
|
struct cli_credentials *creds,
|
|
int flags,
|
|
- int signing_state)
|
|
+ enum smb_signing_setting signing_state)
|
|
{
|
|
struct tevent_context *ev;
|
|
struct tevent_req *req;
|
|
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
|
|
index d214cdabca4..995187e21b4 100644
|
|
--- a/source3/libsmb/proto.h
|
|
+++ b/source3/libsmb/proto.h
|
|
@@ -86,12 +86,12 @@ NTSTATUS cli_tree_connect(struct cli_state *cli, const char *share,
|
|
NTSTATUS cli_tdis(struct cli_state *cli);
|
|
NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss,
|
|
uint16_t port, int name_type, const char *myname,
|
|
- int signing_state, int flags, struct cli_state **pcli);
|
|
+ enum smb_signing_setting signing_state, int flags, struct cli_state **pcli);
|
|
NTSTATUS cli_start_connection(struct cli_state **output_cli,
|
|
const char *my_name,
|
|
const char *dest_host,
|
|
const struct sockaddr_storage *dest_ss, int port,
|
|
- int signing_state, int flags);
|
|
+ enum smb_signing_setting signing_state, int flags);
|
|
NTSTATUS cli_smb1_setup_encryption(struct cli_state *cli,
|
|
struct cli_credentials *creds);
|
|
struct tevent_req *cli_full_connection_creds_send(
|
|
@@ -100,7 +100,7 @@ struct tevent_req *cli_full_connection_creds_send(
|
|
const struct sockaddr_storage *dest_ss, int port,
|
|
const char *service, const char *service_type,
|
|
struct cli_credentials *creds,
|
|
- int flags, int signing_state);
|
|
+ int flags, enum smb_signing_setting signing_state);
|
|
NTSTATUS cli_full_connection_creds_recv(struct tevent_req *req,
|
|
struct cli_state **output_cli);
|
|
NTSTATUS cli_full_connection_creds(struct cli_state **output_cli,
|
|
@@ -110,7 +110,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli,
|
|
const char *service, const char *service_type,
|
|
struct cli_credentials *creds,
|
|
int flags,
|
|
- int signing_state);
|
|
+ enum smb_signing_setting signing_state);
|
|
NTSTATUS cli_raw_tcon(struct cli_state *cli,
|
|
const char *service, const char *pass, const char *dev,
|
|
uint16_t *max_xmit, uint16_t *tid);
|
|
@@ -177,7 +177,7 @@ extern struct GUID cli_state_client_guid;
|
|
struct cli_state *cli_state_create(TALLOC_CTX *mem_ctx,
|
|
int fd,
|
|
const char *remote_name,
|
|
- int signing_state,
|
|
+ enum smb_signing_setting signing_state,
|
|
int flags);
|
|
void cli_nt_pipes_close(struct cli_state *cli);
|
|
void cli_shutdown(struct cli_state *cli);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 40c201c4d1b4621e823485e3082d0ca5799a6237 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 28 May 2020 18:11:31 +0200
|
|
Subject: [PATCH 030/105] s3:client: Turn off smb signing for message op
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
python/samba/gpclass.py | 2 +-
|
|
python/samba/netcmd/domain_backup.py | 2 +-
|
|
python/samba/netcmd/gpo.py | 2 +-
|
|
python/samba/tests/dcerpc/raw_testcase.py | 2 +-
|
|
source3/client/client.c | 5 ++++-
|
|
source3/libsmb/pylibsmb.c | 20 +++++++++-----------
|
|
6 files changed, 17 insertions(+), 16 deletions(-)
|
|
|
|
diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py
|
|
index 1781a55a618..2c00f5349a0 100644
|
|
--- a/python/samba/gpclass.py
|
|
+++ b/python/samba/gpclass.py
|
|
@@ -426,7 +426,7 @@ def check_refresh_gpo_list(dc_hostname, lp, creds, gpos):
|
|
# Force signing for the connection
|
|
saved_signing_state = creds.get_smb_signing()
|
|
creds.set_smb_signing(SMB_SIGNING_REQUIRED)
|
|
- conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds, sign=True)
|
|
+ conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds)
|
|
# Reset signing state
|
|
creds.set_smb_signing(saved_signing_state)
|
|
cache_path = lp.cache_path('gpo_cache')
|
|
diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py
|
|
index a9e0ba5bc67..2977b071ec3 100644
|
|
--- a/python/samba/netcmd/domain_backup.py
|
|
+++ b/python/samba/netcmd/domain_backup.py
|
|
@@ -120,7 +120,7 @@ def smb_sysvol_conn(server, lp, creds):
|
|
# Force signing for the connection
|
|
saved_signing_state = creds.get_smb_signing()
|
|
creds.set_smb_signing(SMB_SIGNING_REQUIRED)
|
|
- conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True)
|
|
+ conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds)
|
|
# Reset signing state
|
|
creds.set_smb_signing(saved_signing_state)
|
|
return conn
|
|
diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py
|
|
index 0f2f6520fc3..bbaa0c17881 100644
|
|
--- a/python/samba/netcmd/gpo.py
|
|
+++ b/python/samba/netcmd/gpo.py
|
|
@@ -392,7 +392,7 @@ def smb_connection(dc_hostname, service, lp, creds):
|
|
# the SMB bindings rely on having a s3 loadparm
|
|
s3_lp = s3param.get_context()
|
|
s3_lp.load(lp.configfile)
|
|
- conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True)
|
|
+ conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds)
|
|
except Exception:
|
|
raise CommandError("Error connecting to '%s' using SMB" % dc_hostname)
|
|
# Reset signing state
|
|
diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py
|
|
index d6f5de7440a..34785e2a2a7 100644
|
|
--- a/python/samba/tests/dcerpc/raw_testcase.py
|
|
+++ b/python/samba/tests/dcerpc/raw_testcase.py
|
|
@@ -46,7 +46,7 @@ class smb_pipe_socket(object):
|
|
saved_signing_state = creds.get_smb_ipc_signing()
|
|
creds.set_smb_ipc_signing(SMB_SIGNING_REQUIRED)
|
|
self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3,
|
|
- creds=creds, ipc=True, sign=True)
|
|
+ creds=creds, ipc=True)
|
|
creds.set_smb_ipc_signing(saved_signing_state)
|
|
self.smbfid = self.smbconn.create(pipename,
|
|
DesiredAccess=0x12019f,
|
|
diff --git a/source3/client/client.c b/source3/client/client.c
|
|
index f65293849d0..30287ffd253 100644
|
|
--- a/source3/client/client.c
|
|
+++ b/source3/client/client.c
|
|
@@ -6228,7 +6228,10 @@ static int do_message_op(struct user_auth_info *a_info)
|
|
|
|
status = cli_connect_nb(desthost, have_ip ? &dest_ss : NULL,
|
|
port ? port : NBT_SMB_PORT, name_type,
|
|
- lp_netbios_name(), SMB_SIGNING_DEFAULT, 0, &cli);
|
|
+ lp_netbios_name(),
|
|
+ SMB_SIGNING_OFF,
|
|
+ 0,
|
|
+ &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Connection to %s failed. Error %s\n", desthost, nt_errstr(status));
|
|
return 1;
|
|
diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c
|
|
index 3579a040830..f8a4d56cf53 100644
|
|
--- a/source3/libsmb/pylibsmb.c
|
|
+++ b/source3/libsmb/pylibsmb.c
|
|
@@ -440,9 +440,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
PyObject *py_lp = Py_None;
|
|
PyObject *py_multi_threaded = Py_False;
|
|
bool multi_threaded = false;
|
|
- PyObject *py_sign = Py_False;
|
|
- bool sign = false;
|
|
- int signing_state = SMB_SIGNING_DEFAULT;
|
|
+ enum smb_signing_setting signing_state = SMB_SIGNING_DEFAULT;
|
|
PyObject *py_force_smb1 = Py_False;
|
|
bool force_smb1 = false;
|
|
PyObject *py_ipc = Py_False;
|
|
@@ -453,7 +451,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
|
|
static const char *kwlist[] = {
|
|
"host", "share", "lp", "creds",
|
|
- "multi_threaded", "sign", "force_smb1",
|
|
+ "multi_threaded", "force_smb1",
|
|
"ipc",
|
|
NULL
|
|
};
|
|
@@ -465,11 +463,10 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
}
|
|
|
|
ret = ParseTupleAndKeywords(
|
|
- args, kwds, "ssO|O!OOOO", kwlist,
|
|
+ args, kwds, "ssO|O!OOO", kwlist,
|
|
&host, &share, &py_lp,
|
|
py_type_Credentials, &creds,
|
|
&py_multi_threaded,
|
|
- &py_sign,
|
|
&py_force_smb1,
|
|
&py_ipc);
|
|
|
|
@@ -480,13 +477,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
}
|
|
|
|
multi_threaded = PyObject_IsTrue(py_multi_threaded);
|
|
- sign = PyObject_IsTrue(py_sign);
|
|
force_smb1 = PyObject_IsTrue(py_force_smb1);
|
|
|
|
- if (sign) {
|
|
- signing_state = SMB_SIGNING_REQUIRED;
|
|
- }
|
|
-
|
|
if (force_smb1) {
|
|
/*
|
|
* As most of the cli_*_send() function
|
|
@@ -532,6 +524,12 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
cli_creds = PyCredentials_AsCliCredentials(creds);
|
|
}
|
|
|
|
+ if (use_ipc) {
|
|
+ signing_state = cli_credentials_get_smb_ipc_signing(cli_creds);
|
|
+ } else {
|
|
+ signing_state = cli_credentials_get_smb_signing(cli_creds);
|
|
+ }
|
|
+
|
|
req = cli_full_connection_creds_send(
|
|
NULL, self->ev, "myname", host, NULL, 0, share, "?????",
|
|
cli_creds, flags, signing_state);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 639de1d5ddf200d03f51b0436789f5dde4cd083b Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 28 May 2020 18:20:02 +0200
|
|
Subject: [PATCH 031/105] s3:libsmb: Remove signing_state from
|
|
cli_full_connection_creds_send()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/libsmb/cliconnect.c | 11 +++++++++--
|
|
source3/libsmb/proto.h | 2 +-
|
|
source3/libsmb/pylibsmb.c | 9 +--------
|
|
3 files changed, 11 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
|
|
index bb20aa59385..0ff9c283e39 100644
|
|
--- a/source3/libsmb/cliconnect.c
|
|
+++ b/source3/libsmb/cliconnect.c
|
|
@@ -3361,10 +3361,11 @@ struct tevent_req *cli_full_connection_creds_send(
|
|
const struct sockaddr_storage *dest_ss, int port,
|
|
const char *service, const char *service_type,
|
|
struct cli_credentials *creds,
|
|
- int flags, enum smb_signing_setting signing_state)
|
|
+ int flags)
|
|
{
|
|
struct tevent_req *req, *subreq;
|
|
struct cli_full_connection_creds_state *state;
|
|
+ enum smb_signing_setting signing_state;
|
|
|
|
req = tevent_req_create(mem_ctx, &state,
|
|
struct cli_full_connection_creds_state);
|
|
@@ -3379,6 +3380,12 @@ struct tevent_req *cli_full_connection_creds_send(
|
|
state->creds = creds;
|
|
state->flags = flags;
|
|
|
|
+ if (flags & CLI_FULL_CONNECTION_IPC) {
|
|
+ signing_state = cli_credentials_get_smb_ipc_signing(creds);
|
|
+ } else {
|
|
+ signing_state = cli_credentials_get_smb_signing(creds);
|
|
+ }
|
|
+
|
|
subreq = cli_start_connection_send(
|
|
state, ev, my_name, dest_host, dest_ss, port,
|
|
signing_state, flags);
|
|
@@ -3532,7 +3539,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli,
|
|
}
|
|
req = cli_full_connection_creds_send(
|
|
ev, ev, my_name, dest_host, dest_ss, port, service,
|
|
- service_type, creds, flags, signing_state);
|
|
+ service_type, creds, flags);
|
|
if (req == NULL) {
|
|
goto fail;
|
|
}
|
|
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
|
|
index 995187e21b4..bef04d32638 100644
|
|
--- a/source3/libsmb/proto.h
|
|
+++ b/source3/libsmb/proto.h
|
|
@@ -100,7 +100,7 @@ struct tevent_req *cli_full_connection_creds_send(
|
|
const struct sockaddr_storage *dest_ss, int port,
|
|
const char *service, const char *service_type,
|
|
struct cli_credentials *creds,
|
|
- int flags, enum smb_signing_setting signing_state);
|
|
+ int flags);
|
|
NTSTATUS cli_full_connection_creds_recv(struct tevent_req *req,
|
|
struct cli_state **output_cli);
|
|
NTSTATUS cli_full_connection_creds(struct cli_state **output_cli,
|
|
diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c
|
|
index f8a4d56cf53..c7a2d73afcb 100644
|
|
--- a/source3/libsmb/pylibsmb.c
|
|
+++ b/source3/libsmb/pylibsmb.c
|
|
@@ -440,7 +440,6 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
PyObject *py_lp = Py_None;
|
|
PyObject *py_multi_threaded = Py_False;
|
|
bool multi_threaded = false;
|
|
- enum smb_signing_setting signing_state = SMB_SIGNING_DEFAULT;
|
|
PyObject *py_force_smb1 = Py_False;
|
|
bool force_smb1 = false;
|
|
PyObject *py_ipc = Py_False;
|
|
@@ -524,15 +523,9 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args,
|
|
cli_creds = PyCredentials_AsCliCredentials(creds);
|
|
}
|
|
|
|
- if (use_ipc) {
|
|
- signing_state = cli_credentials_get_smb_ipc_signing(cli_creds);
|
|
- } else {
|
|
- signing_state = cli_credentials_get_smb_signing(cli_creds);
|
|
- }
|
|
-
|
|
req = cli_full_connection_creds_send(
|
|
NULL, self->ev, "myname", host, NULL, 0, share, "?????",
|
|
- cli_creds, flags, signing_state);
|
|
+ cli_creds, flags);
|
|
if (!py_tevent_req_wait_exc(self, req)) {
|
|
return -1;
|
|
}
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 57336e07f2e23dade5fcd0b8f0d002202cda223d Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 4 Jun 2020 14:59:14 +0200
|
|
Subject: [PATCH 032/105] s3:libsmb: Remove signing_state from
|
|
cli_full_connection_creds()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
examples/fuse/smb2mount.c | 3 +--
|
|
examples/winexe/winexe.c | 4 +---
|
|
source3/libnet/libnet_join.c | 9 +++------
|
|
source3/libsmb/cliconnect.c | 6 ++----
|
|
source3/libsmb/libsmb_server.c | 8 +-------
|
|
source3/libsmb/proto.h | 3 +--
|
|
source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 +--
|
|
source3/rpcclient/cmd_spoolss.c | 5 +----
|
|
source3/rpcclient/rpcclient.c | 3 +--
|
|
source3/torture/locktest2.c | 11 +++++++++--
|
|
source3/torture/torture.c | 6 ++----
|
|
source3/utils/mdfind.c | 3 +--
|
|
source3/utils/net_ads.c | 3 +--
|
|
source3/utils/net_util.c | 8 ++------
|
|
source3/utils/netlookup.c | 3 +--
|
|
source3/utils/smbcacls.c | 3 +--
|
|
source3/utils/smbcquotas.c | 4 +---
|
|
17 files changed, 30 insertions(+), 55 deletions(-)
|
|
|
|
diff --git a/examples/fuse/smb2mount.c b/examples/fuse/smb2mount.c
|
|
index ea1d9a11e0b..6206c3a9701 100644
|
|
--- a/examples/fuse/smb2mount.c
|
|
+++ b/examples/fuse/smb2mount.c
|
|
@@ -37,8 +37,7 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info,
|
|
NULL, port,
|
|
share, "?????",
|
|
get_cmdline_auth_info_creds(auth_info),
|
|
- flags,
|
|
- get_cmdline_auth_info_signing_state(auth_info));
|
|
+ flags);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DBG_ERR("cli_full_connection failed! (%s)\n",
|
|
nt_errstr(nt_status));
|
|
diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c
|
|
index bb9c27e2e6d..03e7ec85198 100644
|
|
--- a/examples/winexe/winexe.c
|
|
+++ b/examples/winexe/winexe.c
|
|
@@ -360,7 +360,6 @@ static NTSTATUS winexe_svc_upload(
|
|
"ADMIN$",
|
|
"?????",
|
|
credentials,
|
|
- 0,
|
|
0);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
DBG_WARNING("cli_full_connection_creds failed: %s\n",
|
|
@@ -1919,8 +1918,7 @@ int main(int argc, const char *argv[])
|
|
"IPC$",
|
|
"?????",
|
|
options.credentials,
|
|
- CLI_FULL_CONNECTION_IPC,
|
|
- 0);
|
|
+ CLI_FULL_CONNECTION_IPC);
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
DBG_WARNING("cli_full_connection_creds failed: %s\n",
|
|
diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
|
|
index 392e3eff74f..f3bf27e6c00 100644
|
|
--- a/source3/libnet/libnet_join.c
|
|
+++ b/source3/libnet/libnet_join.c
|
|
@@ -1095,8 +1095,7 @@ static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
|
|
NULL, 0,
|
|
"IPC$", "IPC",
|
|
creds,
|
|
- flags,
|
|
- SMB_SIGNING_IPC_DEFAULT);
|
|
+ flags);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
TALLOC_FREE(frame);
|
|
return status;
|
|
@@ -1716,8 +1715,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
|
|
NULL, 0,
|
|
"IPC$", "IPC",
|
|
cli_creds,
|
|
- flags,
|
|
- SMB_SIGNING_IPC_DEFAULT);
|
|
+ flags);
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
struct cli_credentials *anon_creds = NULL;
|
|
@@ -1734,8 +1732,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
|
|
NULL, 0,
|
|
"IPC$", "IPC",
|
|
anon_creds,
|
|
- flags,
|
|
- SMB_SIGNING_OFF);
|
|
+ flags);
|
|
}
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
|
|
index 0ff9c283e39..b24743d789b 100644
|
|
--- a/source3/libsmb/cliconnect.c
|
|
+++ b/source3/libsmb/cliconnect.c
|
|
@@ -3526,8 +3526,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli,
|
|
const struct sockaddr_storage *dest_ss, int port,
|
|
const char *service, const char *service_type,
|
|
struct cli_credentials *creds,
|
|
- int flags,
|
|
- enum smb_signing_setting signing_state)
|
|
+ int flags)
|
|
{
|
|
struct tevent_context *ev;
|
|
struct tevent_req *req;
|
|
@@ -3684,8 +3683,7 @@ struct cli_state *get_ipc_connect(char *server,
|
|
|
|
nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
|
|
get_cmdline_auth_info_creds(user_info),
|
|
- flags,
|
|
- SMB_SIGNING_DEFAULT);
|
|
+ flags);
|
|
|
|
if (NT_STATUS_IS_OK(nt_status)) {
|
|
return cli;
|
|
diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c
|
|
index 3d1cd602f6c..33dc8419deb 100644
|
|
--- a/source3/libsmb/libsmb_server.c
|
|
+++ b/source3/libsmb/libsmb_server.c
|
|
@@ -785,7 +785,6 @@ SMBC_attr_server(TALLOC_CTX *ctx,
|
|
pp_workgroup, pp_username, pp_password);
|
|
if (!ipc_srv) {
|
|
struct cli_credentials *creds = NULL;
|
|
- int signing_state = SMB_SIGNING_DEFAULT;
|
|
|
|
/* We didn't find a cached connection. Get the password */
|
|
if (!*pp_password || (*pp_password)[0] == '\0') {
|
|
@@ -812,16 +811,11 @@ SMBC_attr_server(TALLOC_CTX *ctx,
|
|
return NULL;
|
|
}
|
|
|
|
- if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) {
|
|
- signing_state = SMB_SIGNING_REQUIRED;
|
|
- }
|
|
-
|
|
nt_status = cli_full_connection_creds(&ipc_cli,
|
|
lp_netbios_name(), server,
|
|
NULL, 0, "IPC$", "?????",
|
|
creds,
|
|
- flags,
|
|
- signing_state);
|
|
+ flags);
|
|
if (! NT_STATUS_IS_OK(nt_status)) {
|
|
TALLOC_FREE(creds);
|
|
DEBUG(1,("cli_full_connection failed! (%s)\n",
|
|
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
|
|
index bef04d32638..850cf12c8a6 100644
|
|
--- a/source3/libsmb/proto.h
|
|
+++ b/source3/libsmb/proto.h
|
|
@@ -109,8 +109,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli,
|
|
const struct sockaddr_storage *dest_ss, int port,
|
|
const char *service, const char *service_type,
|
|
struct cli_credentials *creds,
|
|
- int flags,
|
|
- enum smb_signing_setting signing_state);
|
|
+ int flags);
|
|
NTSTATUS cli_raw_tcon(struct cli_state *cli,
|
|
const char *service, const char *pass, const char *dev,
|
|
uint16_t *max_xmit, uint16_t *tid);
|
|
diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
|
index 16e3ee485f0..e98401a4365 100644
|
|
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
|
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
|
@@ -2482,8 +2482,7 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c
|
|
ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine,
|
|
&rm_addr, 0, "IPC$", "IPC",
|
|
anon_creds,
|
|
- CLI_FULL_CONNECTION_IPC,
|
|
- SMB_SIGNING_OFF);
|
|
+ CLI_FULL_CONNECTION_IPC);
|
|
TALLOC_FREE(anon_creds);
|
|
if ( !NT_STATUS_IS_OK( ret ) ) {
|
|
DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n",
|
|
diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c
|
|
index 7198a451ab7..02889a0a666 100644
|
|
--- a/source3/rpcclient/cmd_spoolss.c
|
|
+++ b/source3/rpcclient/cmd_spoolss.c
|
|
@@ -3537,10 +3537,7 @@ static WERROR cmd_spoolss_printercmp(struct rpc_pipe_client *cli,
|
|
"IPC$", "IPC",
|
|
get_cmdline_auth_info_creds(
|
|
popt_get_cmdline_auth_info()),
|
|
- CLI_FULL_CONNECTION_IPC,
|
|
- get_cmdline_auth_info_signing_state(
|
|
- popt_get_cmdline_auth_info()));
|
|
-
|
|
+ CLI_FULL_CONNECTION_IPC);
|
|
if ( !NT_STATUS_IS_OK(nt_status) )
|
|
return WERR_GEN_FAILURE;
|
|
|
|
diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c
|
|
index c86474d08f1..2ead6cc7ba5 100644
|
|
--- a/source3/rpcclient/rpcclient.c
|
|
+++ b/source3/rpcclient/rpcclient.c
|
|
@@ -1206,8 +1206,7 @@ out_free:
|
|
"IPC$", "IPC",
|
|
get_cmdline_auth_info_creds(
|
|
popt_get_cmdline_auth_info()),
|
|
- flags,
|
|
- SMB_SIGNING_IPC_DEFAULT);
|
|
+ flags);
|
|
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(0,("Cannot connect to server. Error was %s\n", nt_errstr(nt_status)));
|
|
diff --git a/source3/torture/locktest2.c b/source3/torture/locktest2.c
|
|
index 84c335f959f..92ddb7629b9 100644
|
|
--- a/source3/torture/locktest2.c
|
|
+++ b/source3/torture/locktest2.c
|
|
@@ -217,8 +217,15 @@ static struct cli_state *connect_one(char *share)
|
|
|
|
slprintf(myname,sizeof(myname), "lock-%lu-%u", (unsigned long)getpid(), count++);
|
|
|
|
- nt_status = cli_full_connection_creds(&c, myname, server_n, NULL, 0, share, "?????",
|
|
- creds, 0, SMB_SIGNING_DEFAULT);
|
|
+ nt_status = cli_full_connection_creds(&c,
|
|
+ myname,
|
|
+ server_n,
|
|
+ NULL,
|
|
+ 0,
|
|
+ share,
|
|
+ "?????",
|
|
+ creds,
|
|
+ 0);
|
|
TALLOC_FREE(creds);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(0, ("cli_full_connection failed with error %s\n", nt_errstr(nt_status)));
|
|
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
|
|
index 2a3133373e9..a4edeefd628 100644
|
|
--- a/source3/torture/torture.c
|
|
+++ b/source3/torture/torture.c
|
|
@@ -345,8 +345,7 @@ static bool torture_open_connection_share(struct cli_state **c,
|
|
sharename,
|
|
"?????",
|
|
torture_creds,
|
|
- flags,
|
|
- signing_state);
|
|
+ flags);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
printf("failed to open share connection: //%s/%s port:%d - %s\n",
|
|
hostname, sharename, port_to_use, nt_errstr(status));
|
|
@@ -1523,8 +1522,7 @@ static bool run_tcon_devtype_test(int dummy)
|
|
NULL, /* service */
|
|
NULL, /* service_type */
|
|
torture_creds,
|
|
- flags,
|
|
- signing_state);
|
|
+ flags);
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
printf("could not open connection\n");
|
|
diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c
|
|
index a3c879e75fb..2ac4fde7daf 100644
|
|
--- a/source3/utils/mdfind.c
|
|
+++ b/source3/utils/mdfind.c
|
|
@@ -153,8 +153,7 @@ int main(int argc, char **argv)
|
|
"IPC$",
|
|
"IPC",
|
|
creds,
|
|
- flags,
|
|
- SMB_SIGNING_IPC_DEFAULT);
|
|
+ flags);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
DBG_ERR("Cannot connect to server: %s\n", nt_errstr(status));
|
|
goto fail;
|
|
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
|
|
index 28ef6dc9974..7f5b9c3a440 100644
|
|
--- a/source3/utils/net_ads.c
|
|
+++ b/source3/utils/net_ads.c
|
|
@@ -2438,8 +2438,7 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char *
|
|
&server_ss, 0,
|
|
"IPC$", "IPC",
|
|
creds,
|
|
- CLI_FULL_CONNECTION_IPC,
|
|
- SMB_SIGNING_IPC_DEFAULT);
|
|
+ CLI_FULL_CONNECTION_IPC);
|
|
|
|
if (NT_STATUS_IS_ERR(nt_status)) {
|
|
d_fprintf(stderr, _("Unable to open a connection to %s to "
|
|
diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c
|
|
index d01b2d8c771..b139fb2d0da 100644
|
|
--- a/source3/utils/net_util.c
|
|
+++ b/source3/utils/net_util.c
|
|
@@ -108,7 +108,6 @@ NTSTATUS connect_to_service(struct net_context *c,
|
|
const char *service_type)
|
|
{
|
|
NTSTATUS nt_status;
|
|
- enum smb_signing_setting signing_setting = SMB_SIGNING_DEFAULT;
|
|
struct cli_credentials *creds = NULL;
|
|
int flags = 0;
|
|
|
|
@@ -119,7 +118,6 @@ NTSTATUS connect_to_service(struct net_context *c,
|
|
}
|
|
|
|
if (strequal(service_type, "IPC")) {
|
|
- signing_setting = SMB_SIGNING_IPC_DEFAULT;
|
|
flags |= CLI_FULL_CONNECTION_IPC;
|
|
}
|
|
|
|
@@ -127,8 +125,7 @@ NTSTATUS connect_to_service(struct net_context *c,
|
|
server_ss, c->opt_port,
|
|
service_name, service_type,
|
|
creds,
|
|
- flags,
|
|
- signing_setting);
|
|
+ flags);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
d_fprintf(stderr, _("Could not connect to server %s\n"),
|
|
server_name);
|
|
@@ -199,8 +196,7 @@ NTSTATUS connect_to_ipc_anonymous(struct net_context *c,
|
|
server_name, server_ss, c->opt_port,
|
|
"IPC$", "IPC",
|
|
anon_creds,
|
|
- CLI_FULL_CONNECTION_IPC,
|
|
- SMB_SIGNING_OFF);
|
|
+ CLI_FULL_CONNECTION_IPC);
|
|
|
|
if (NT_STATUS_IS_OK(nt_status)) {
|
|
return nt_status;
|
|
diff --git a/source3/utils/netlookup.c b/source3/utils/netlookup.c
|
|
index 2241beb331f..aaf78b0977a 100644
|
|
--- a/source3/utils/netlookup.c
|
|
+++ b/source3/utils/netlookup.c
|
|
@@ -99,8 +99,7 @@ static struct con_struct *create_cs(struct net_context *c,
|
|
&loopback_ss, 0,
|
|
"IPC$", "IPC",
|
|
anon_creds,
|
|
- CLI_FULL_CONNECTION_IPC,
|
|
- SMB_SIGNING_OFF);
|
|
+ CLI_FULL_CONNECTION_IPC);
|
|
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status)));
|
|
diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
|
|
index f3209c31877..5983ebbd0a5 100644
|
|
--- a/source3/utils/smbcacls.c
|
|
+++ b/source3/utils/smbcacls.c
|
|
@@ -778,8 +778,7 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info,
|
|
NULL, 0,
|
|
share, "?????",
|
|
get_cmdline_auth_info_creds(auth_info),
|
|
- flags,
|
|
- get_cmdline_auth_info_signing_state(auth_info));
|
|
+ flags);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));
|
|
return NULL;
|
|
diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c
|
|
index 954d6eba804..fea066ce468 100644
|
|
--- a/source3/utils/smbcquotas.c
|
|
+++ b/source3/utils/smbcquotas.c
|
|
@@ -527,9 +527,7 @@ static struct cli_state *connect_one(const char *share)
|
|
share, "?????",
|
|
get_cmdline_auth_info_creds(
|
|
popt_get_cmdline_auth_info()),
|
|
- flags,
|
|
- get_cmdline_auth_info_signing_state(
|
|
- popt_get_cmdline_auth_info()));
|
|
+ flags);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));
|
|
return NULL;
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 6752c123f20d46aa68725971e09548a47b7c7457 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Mon, 8 Jun 2020 08:04:24 +0200
|
|
Subject: [PATCH 033/105] s3:libsmb: Add encryption support to
|
|
cli_full_connection_creds*()
|
|
|
|
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
|
---
|
|
source3/libsmb/cliconnect.c | 166 ++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 166 insertions(+)
|
|
|
|
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
|
|
index b24743d789b..abfd18bfaf1 100644
|
|
--- a/source3/libsmb/cliconnect.c
|
|
+++ b/source3/libsmb/cliconnect.c
|
|
@@ -3352,6 +3352,10 @@ static int cli_full_connection_creds_state_destructor(
|
|
static void cli_full_connection_creds_conn_done(struct tevent_req *subreq);
|
|
static void cli_full_connection_creds_sess_start(struct tevent_req *req);
|
|
static void cli_full_connection_creds_sess_done(struct tevent_req *subreq);
|
|
+static void cli_full_connection_creds_enc_start(struct tevent_req *req);
|
|
+static void cli_full_connection_creds_enc_tcon(struct tevent_req *subreq);
|
|
+static void cli_full_connection_creds_enc_ver(struct tevent_req *subreq);
|
|
+static void cli_full_connection_creds_enc_done(struct tevent_req *subreq);
|
|
static void cli_full_connection_creds_tcon_start(struct tevent_req *req);
|
|
static void cli_full_connection_creds_tcon_done(struct tevent_req *subreq);
|
|
|
|
@@ -3366,6 +3370,8 @@ struct tevent_req *cli_full_connection_creds_send(
|
|
struct tevent_req *req, *subreq;
|
|
struct cli_full_connection_creds_state *state;
|
|
enum smb_signing_setting signing_state;
|
|
+ enum smb_encryption_setting encryption_state =
|
|
+ cli_credentials_get_smb_encryption(creds);
|
|
|
|
req = tevent_req_create(mem_ctx, &state,
|
|
struct cli_full_connection_creds_state);
|
|
@@ -3386,6 +3392,16 @@ struct tevent_req *cli_full_connection_creds_send(
|
|
signing_state = cli_credentials_get_smb_signing(creds);
|
|
}
|
|
|
|
+ if (encryption_state == SMB_ENCRYPTION_REQUIRED) {
|
|
+ if (flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK) {
|
|
+ encryption_state = SMB_ENCRYPTION_DESIRED;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ if (encryption_state >= SMB_ENCRYPTION_DESIRED) {
|
|
+ signing_state = SMB_SIGNING_REQUIRED;
|
|
+ }
|
|
+
|
|
subreq = cli_start_connection_send(
|
|
state, ev, my_name, dest_host, dest_ss, port,
|
|
signing_state, flags);
|
|
@@ -3460,6 +3476,156 @@ static void cli_full_connection_creds_sess_done(struct tevent_req *subreq)
|
|
return;
|
|
}
|
|
|
|
+ cli_full_connection_creds_enc_start(req);
|
|
+}
|
|
+
|
|
+static void cli_full_connection_creds_enc_start(struct tevent_req *req)
|
|
+{
|
|
+ struct cli_full_connection_creds_state *state = tevent_req_data(
|
|
+ req, struct cli_full_connection_creds_state);
|
|
+ enum smb_encryption_setting encryption_state =
|
|
+ cli_credentials_get_smb_encryption(state->creds);
|
|
+ struct tevent_req *subreq = NULL;
|
|
+ NTSTATUS status;
|
|
+
|
|
+ if (encryption_state < SMB_ENCRYPTION_DESIRED) {
|
|
+ cli_full_connection_creds_tcon_start(req);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
|
|
+ status = smb2cli_session_encryption_on(state->cli->smb2.session);
|
|
+ if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
|
|
+ if (encryption_state < SMB_ENCRYPTION_REQUIRED) {
|
|
+ cli_full_connection_creds_tcon_start(req);
|
|
+ return;
|
|
+ }
|
|
+ d_printf("Encryption required and "
|
|
+ "server doesn't support "
|
|
+ "SMB3 encryption - failing connect\n");
|
|
+ tevent_req_nterror(req, status);
|
|
+ return;
|
|
+ } else if (!NT_STATUS_IS_OK(status)) {
|
|
+ d_printf("Encryption required and "
|
|
+ "setup failed with error %s.\n",
|
|
+ nt_errstr(status));
|
|
+ tevent_req_nterror(req, status);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ cli_full_connection_creds_tcon_start(req);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ if (!SERVER_HAS_UNIX_CIFS(state->cli)) {
|
|
+ if (encryption_state < SMB_ENCRYPTION_REQUIRED) {
|
|
+ cli_full_connection_creds_tcon_start(req);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ status = NT_STATUS_NOT_SUPPORTED;
|
|
+ d_printf("Encryption required and "
|
|
+ "server doesn't support "
|
|
+ "SMB1 Unix Extensions - failing connect\n");
|
|
+ tevent_req_nterror(req, status);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ /*
|
|
+ * We do a tcon on IPC$ just to setup the encryption,
|
|
+ * the real tcon will be encrypted then.
|
|
+ */
|
|
+ subreq = cli_tree_connect_send(state, state->ev, state->cli,
|
|
+ "IPC$", "IPC", NULL);
|
|
+ if (tevent_req_nomem(subreq, req)) {
|
|
+ return;
|
|
+ }
|
|
+ tevent_req_set_callback(subreq, cli_full_connection_creds_enc_tcon, req);
|
|
+}
|
|
+
|
|
+static void cli_full_connection_creds_enc_tcon(struct tevent_req *subreq)
|
|
+{
|
|
+ struct tevent_req *req = tevent_req_callback_data(
|
|
+ subreq, struct tevent_req);
|
|
+ struct cli_full_connection_creds_state *state = tevent_req_data(
|
|
+ req, struct cli_full_connection_creds_state);
|
|
+ NTSTATUS status;
|
|
+
|
|
+ status = cli_tree_connect_recv(subreq);
|
|
+ TALLOC_FREE(subreq);
|
|
+ if (tevent_req_nterror(req, status)) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ subreq = cli_unix_extensions_version_send(state, state->ev, state->cli);
|
|
+ if (tevent_req_nomem(subreq, req)) {
|
|
+ return;
|
|
+ }
|
|
+ tevent_req_set_callback(subreq, cli_full_connection_creds_enc_ver, req);
|
|
+}
|
|
+
|
|
+static void cli_full_connection_creds_enc_ver(struct tevent_req *subreq)
|
|
+{
|
|
+ struct tevent_req *req = tevent_req_callback_data(
|
|
+ subreq, struct tevent_req);
|
|
+ struct cli_full_connection_creds_state *state = tevent_req_data(
|
|
+ req, struct cli_full_connection_creds_state);
|
|
+ enum smb_encryption_setting encryption_state =
|
|
+ cli_credentials_get_smb_encryption(state->creds);
|
|
+ uint16_t major, minor;
|
|
+ uint32_t caplow, caphigh;
|
|
+ NTSTATUS status;
|
|
+
|
|
+ status = cli_unix_extensions_version_recv(subreq,
|
|
+ &major, &minor,
|
|
+ &caplow,
|
|
+ &caphigh);
|
|
+ TALLOC_FREE(subreq);
|
|
+ if (!NT_STATUS_IS_OK(status)) {
|
|
+ if (encryption_state < SMB_ENCRYPTION_REQUIRED) {
|
|
+ cli_full_connection_creds_tcon_start(req);
|
|
+ return;
|
|
+ }
|
|
+ DEBUG(10, ("%s: cli_unix_extensions_version "
|
|
+ "returned %s\n", __func__, nt_errstr(status)));
|
|
+ tevent_req_nterror(req, NT_STATUS_UNKNOWN_REVISION);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ if (!(caplow & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)) {
|
|
+ if (encryption_state < SMB_ENCRYPTION_REQUIRED) {
|
|
+ cli_full_connection_creds_tcon_start(req);
|
|
+ return;
|
|
+ }
|
|
+ DEBUG(10, ("%s: CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP "
|
|
+ "not supported\n", __func__));
|
|
+ tevent_req_nterror(req, NT_STATUS_UNSUPPORTED_COMPRESSION);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ subreq = cli_smb1_setup_encryption_send(state, state->ev,
|
|
+ state->cli,
|
|
+ state->creds);
|
|
+ if (tevent_req_nomem(subreq, req)) {
|
|
+ return;
|
|
+ }
|
|
+ tevent_req_set_callback(subreq,
|
|
+ cli_full_connection_creds_enc_done,
|
|
+ req);
|
|
+}
|
|
+
|
|
+static void cli_full_connection_creds_enc_done(struct tevent_req *subreq)
|
|
+{
|
|
+ struct tevent_req *req = tevent_req_callback_data(
|
|
+ subreq, struct tevent_req);
|
|
+ NTSTATUS status;
|
|
+
|
|
+ status = cli_smb1_setup_encryption_recv(subreq);
|
|
+ TALLOC_FREE(subreq);
|
|
+ if (tevent_req_nterror(req, status)) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
cli_full_connection_creds_tcon_start(req);
|
|
}
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From bdb894ebb29820b97dba3721a517a61d96fac152 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 10 Jun 2020 11:26:00 +0200
|
|
Subject: [PATCH 034/105] python: Add a test for SMB encryption
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
python/samba/tests/libsmb.py | 37 ++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 37 insertions(+)
|
|
|
|
diff --git a/python/samba/tests/libsmb.py b/python/samba/tests/libsmb.py
|
|
index e8f8e7fe94d..81d4e482644 100644
|
|
--- a/python/samba/tests/libsmb.py
|
|
+++ b/python/samba/tests/libsmb.py
|
|
@@ -21,10 +21,12 @@ from samba.samba3 import libsmb_samba_internal as libsmb
|
|
from samba.dcerpc import security
|
|
from samba.samba3 import param as s3param
|
|
from samba import credentials
|
|
+from samba.credentials import SMB_ENCRYPTION_REQUIRED
|
|
import samba.tests
|
|
import threading
|
|
import sys
|
|
import os
|
|
+import random
|
|
|
|
|
|
class LibsmbTestCase(samba.tests.TestCase):
|
|
@@ -77,6 +79,41 @@ class LibsmbTestCase(samba.tests.TestCase):
|
|
if t.exc:
|
|
raise t.exc[0](t.exc[1])
|
|
|
|
+ def test_SMB3EncryptionRequired(self):
|
|
+ test_dir = 'testing_%d' % random.randint(0, 0xFFFF)
|
|
+
|
|
+ lp = s3param.get_context()
|
|
+ lp.load(os.getenv("SMB_CONF_PATH"))
|
|
+
|
|
+ creds = credentials.Credentials()
|
|
+ creds.guess(lp)
|
|
+ creds.set_username(os.getenv("USERNAME"))
|
|
+ creds.set_password(os.getenv("PASSWORD"))
|
|
+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED)
|
|
+
|
|
+ c = libsmb.Conn(os.getenv("SERVER_IP"), "tmp",
|
|
+ lp, creds)
|
|
+
|
|
+ c.mkdir(test_dir)
|
|
+ c.rmdir(test_dir)
|
|
+
|
|
+ def test_SMB1EncryptionRequired(self):
|
|
+ test_dir = 'testing_%d' % random.randint(0, 0xFFFF)
|
|
+
|
|
+ lp = s3param.get_context()
|
|
+ lp.load(os.getenv("SMB_CONF_PATH"))
|
|
+
|
|
+ creds = credentials.Credentials()
|
|
+ creds.guess(lp)
|
|
+ creds.set_username(os.getenv("USERNAME"))
|
|
+ creds.set_password(os.getenv("PASSWORD"))
|
|
+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED)
|
|
+
|
|
+ c = libsmb.Conn(os.getenv("SERVER_IP"), "tmp",
|
|
+ lp, creds, force_smb1=True)
|
|
+
|
|
+ c.mkdir(test_dir)
|
|
+ c.rmdir(test_dir)
|
|
|
|
if __name__ == "__main__":
|
|
import unittest
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From d26afd8352435db71c542388220e951184adcdde Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 10 Jun 2020 12:31:02 +0200
|
|
Subject: [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/utils/net_util.c | 16 ++++++----------
|
|
1 file changed, 6 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c
|
|
index b139fb2d0da..5829d891075 100644
|
|
--- a/source3/utils/net_util.c
|
|
+++ b/source3/utils/net_util.c
|
|
@@ -148,16 +148,6 @@ NTSTATUS connect_to_service(struct net_context *c,
|
|
return nt_status;
|
|
}
|
|
|
|
- if (c->smb_encrypt) {
|
|
- nt_status = cli_cm_force_encryption_creds(*cli_ctx,
|
|
- creds,
|
|
- service_name);
|
|
- if (!NT_STATUS_IS_OK(nt_status)) {
|
|
- cli_shutdown(*cli_ctx);
|
|
- *cli_ctx = NULL;
|
|
- }
|
|
- }
|
|
-
|
|
return nt_status;
|
|
}
|
|
|
|
@@ -577,6 +567,12 @@ struct cli_credentials *net_context_creds(struct net_context *c,
|
|
CRED_SPECIFIED);
|
|
}
|
|
|
|
+ if (c->smb_encrypt) {
|
|
+ cli_credentials_set_smb_encryption(creds,
|
|
+ SMB_ENCRYPTION_REQUIRED,
|
|
+ CRED_SPECIFIED);
|
|
+ }
|
|
+
|
|
return creds;
|
|
}
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From c228933e88c6b615fa49402d2e826a5ec14b9f85 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 10 Jun 2020 12:40:13 +0200
|
|
Subject: [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption()
|
|
|
|
This also adds a SMBC_ENCRYPTLEVEL_DEFAULT to 'enum
|
|
smbc_smb_encrypt_level' in order to use the smb.conf default value.
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/include/libsmbclient.h | 1 +
|
|
source3/libsmb/ABI/smbclient-0.7.0.sigs | 188 ++++++++++++++++++++++++
|
|
source3/libsmb/libsmb_context.c | 4 +-
|
|
source3/libsmb/libsmb_server.c | 72 +++------
|
|
source3/libsmb/wscript | 2 +-
|
|
5 files changed, 216 insertions(+), 51 deletions(-)
|
|
create mode 100644 source3/libsmb/ABI/smbclient-0.7.0.sigs
|
|
|
|
diff --git a/source3/include/libsmbclient.h b/source3/include/libsmbclient.h
|
|
index c47e7c2a872..84c98089251 100644
|
|
--- a/source3/include/libsmbclient.h
|
|
+++ b/source3/include/libsmbclient.h
|
|
@@ -225,6 +225,7 @@ typedef enum smbc_share_mode
|
|
*/
|
|
typedef enum smbc_smb_encrypt_level
|
|
{
|
|
+ SMBC_ENCRYPTLEVEL_DEFAULT = -1,
|
|
SMBC_ENCRYPTLEVEL_NONE = 0,
|
|
SMBC_ENCRYPTLEVEL_REQUEST = 1,
|
|
SMBC_ENCRYPTLEVEL_REQUIRE = 2
|
|
diff --git a/source3/libsmb/ABI/smbclient-0.7.0.sigs b/source3/libsmb/ABI/smbclient-0.7.0.sigs
|
|
new file mode 100644
|
|
index 00000000000..ee758e21b50
|
|
--- /dev/null
|
|
+++ b/source3/libsmb/ABI/smbclient-0.7.0.sigs
|
|
@@ -0,0 +1,188 @@
|
|
+smbc_chmod: int (const char *, mode_t)
|
|
+smbc_close: int (int)
|
|
+smbc_closedir: int (int)
|
|
+smbc_creat: int (const char *, mode_t)
|
|
+smbc_fgetxattr: int (int, const char *, const void *, size_t)
|
|
+smbc_flistxattr: int (int, char *, size_t)
|
|
+smbc_free_context: int (SMBCCTX *, int)
|
|
+smbc_fremovexattr: int (int, const char *)
|
|
+smbc_fsetxattr: int (int, const char *, const void *, size_t, int)
|
|
+smbc_fstat: int (int, struct stat *)
|
|
+smbc_fstatvfs: int (int, struct statvfs *)
|
|
+smbc_ftruncate: int (int, off_t)
|
|
+smbc_getDebug: int (SMBCCTX *)
|
|
+smbc_getFunctionAddCachedServer: smbc_add_cached_srv_fn (SMBCCTX *)
|
|
+smbc_getFunctionAuthData: smbc_get_auth_data_fn (SMBCCTX *)
|
|
+smbc_getFunctionAuthDataWithContext: smbc_get_auth_data_with_context_fn (SMBCCTX *)
|
|
+smbc_getFunctionCheckServer: smbc_check_server_fn (SMBCCTX *)
|
|
+smbc_getFunctionChmod: smbc_chmod_fn (SMBCCTX *)
|
|
+smbc_getFunctionClose: smbc_close_fn (SMBCCTX *)
|
|
+smbc_getFunctionClosedir: smbc_closedir_fn (SMBCCTX *)
|
|
+smbc_getFunctionCreat: smbc_creat_fn (SMBCCTX *)
|
|
+smbc_getFunctionFstat: smbc_fstat_fn (SMBCCTX *)
|
|
+smbc_getFunctionFstatVFS: smbc_fstatvfs_fn (SMBCCTX *)
|
|
+smbc_getFunctionFstatdir: smbc_fstatdir_fn (SMBCCTX *)
|
|
+smbc_getFunctionFtruncate: smbc_ftruncate_fn (SMBCCTX *)
|
|
+smbc_getFunctionGetCachedServer: smbc_get_cached_srv_fn (SMBCCTX *)
|
|
+smbc_getFunctionGetdents: smbc_getdents_fn (SMBCCTX *)
|
|
+smbc_getFunctionGetxattr: smbc_getxattr_fn (SMBCCTX *)
|
|
+smbc_getFunctionListPrintJobs: smbc_list_print_jobs_fn (SMBCCTX *)
|
|
+smbc_getFunctionListxattr: smbc_listxattr_fn (SMBCCTX *)
|
|
+smbc_getFunctionLseek: smbc_lseek_fn (SMBCCTX *)
|
|
+smbc_getFunctionLseekdir: smbc_lseekdir_fn (SMBCCTX *)
|
|
+smbc_getFunctionMkdir: smbc_mkdir_fn (SMBCCTX *)
|
|
+smbc_getFunctionNotify: smbc_notify_fn (SMBCCTX *)
|
|
+smbc_getFunctionOpen: smbc_open_fn (SMBCCTX *)
|
|
+smbc_getFunctionOpenPrintJob: smbc_open_print_job_fn (SMBCCTX *)
|
|
+smbc_getFunctionOpendir: smbc_opendir_fn (SMBCCTX *)
|
|
+smbc_getFunctionPrintFile: smbc_print_file_fn (SMBCCTX *)
|
|
+smbc_getFunctionPurgeCachedServers: smbc_purge_cached_fn (SMBCCTX *)
|
|
+smbc_getFunctionRead: smbc_read_fn (SMBCCTX *)
|
|
+smbc_getFunctionReaddir: smbc_readdir_fn (SMBCCTX *)
|
|
+smbc_getFunctionReaddirPlus: smbc_readdirplus_fn (SMBCCTX *)
|
|
+smbc_getFunctionReaddirPlus2: smbc_readdirplus2_fn (SMBCCTX *)
|
|
+smbc_getFunctionRemoveCachedServer: smbc_remove_cached_srv_fn (SMBCCTX *)
|
|
+smbc_getFunctionRemoveUnusedServer: smbc_remove_unused_server_fn (SMBCCTX *)
|
|
+smbc_getFunctionRemovexattr: smbc_removexattr_fn (SMBCCTX *)
|
|
+smbc_getFunctionRename: smbc_rename_fn (SMBCCTX *)
|
|
+smbc_getFunctionRmdir: smbc_rmdir_fn (SMBCCTX *)
|
|
+smbc_getFunctionSetxattr: smbc_setxattr_fn (SMBCCTX *)
|
|
+smbc_getFunctionSplice: smbc_splice_fn (SMBCCTX *)
|
|
+smbc_getFunctionStat: smbc_stat_fn (SMBCCTX *)
|
|
+smbc_getFunctionStatVFS: smbc_statvfs_fn (SMBCCTX *)
|
|
+smbc_getFunctionTelldir: smbc_telldir_fn (SMBCCTX *)
|
|
+smbc_getFunctionUnlink: smbc_unlink_fn (SMBCCTX *)
|
|
+smbc_getFunctionUnlinkPrintJob: smbc_unlink_print_job_fn (SMBCCTX *)
|
|
+smbc_getFunctionUtimes: smbc_utimes_fn (SMBCCTX *)
|
|
+smbc_getFunctionWrite: smbc_write_fn (SMBCCTX *)
|
|
+smbc_getNetbiosName: const char *(SMBCCTX *)
|
|
+smbc_getOptionBrowseMaxLmbCount: int (SMBCCTX *)
|
|
+smbc_getOptionCaseSensitive: smbc_bool (SMBCCTX *)
|
|
+smbc_getOptionDebugToStderr: smbc_bool (SMBCCTX *)
|
|
+smbc_getOptionFallbackAfterKerberos: smbc_bool (SMBCCTX *)
|
|
+smbc_getOptionFullTimeNames: smbc_bool (SMBCCTX *)
|
|
+smbc_getOptionNoAutoAnonymousLogin: smbc_bool (SMBCCTX *)
|
|
+smbc_getOptionOneSharePerServer: smbc_bool (SMBCCTX *)
|
|
+smbc_getOptionOpenShareMode: smbc_share_mode (SMBCCTX *)
|
|
+smbc_getOptionSmbEncryptionLevel: smbc_smb_encrypt_level (SMBCCTX *)
|
|
+smbc_getOptionUrlEncodeReaddirEntries: smbc_bool (SMBCCTX *)
|
|
+smbc_getOptionUseCCache: smbc_bool (SMBCCTX *)
|
|
+smbc_getOptionUseKerberos: smbc_bool (SMBCCTX *)
|
|
+smbc_getOptionUseNTHash: smbc_bool (SMBCCTX *)
|
|
+smbc_getOptionUserData: void *(SMBCCTX *)
|
|
+smbc_getPort: uint16_t (SMBCCTX *)
|
|
+smbc_getServerCacheData: struct smbc_server_cache *(SMBCCTX *)
|
|
+smbc_getTimeout: int (SMBCCTX *)
|
|
+smbc_getUser: const char *(SMBCCTX *)
|
|
+smbc_getWorkgroup: const char *(SMBCCTX *)
|
|
+smbc_getdents: int (unsigned int, struct smbc_dirent *, int)
|
|
+smbc_getxattr: int (const char *, const char *, const void *, size_t)
|
|
+smbc_init: int (smbc_get_auth_data_fn, int)
|
|
+smbc_init_context: SMBCCTX *(SMBCCTX *)
|
|
+smbc_lgetxattr: int (const char *, const char *, const void *, size_t)
|
|
+smbc_list_print_jobs: int (const char *, smbc_list_print_job_fn)
|
|
+smbc_listxattr: int (const char *, char *, size_t)
|
|
+smbc_llistxattr: int (const char *, char *, size_t)
|
|
+smbc_lremovexattr: int (const char *, const char *)
|
|
+smbc_lseek: off_t (int, off_t, int)
|
|
+smbc_lseekdir: int (int, off_t)
|
|
+smbc_lsetxattr: int (const char *, const char *, const void *, size_t, int)
|
|
+smbc_mkdir: int (const char *, mode_t)
|
|
+smbc_new_context: SMBCCTX *(void)
|
|
+smbc_notify: int (int, smbc_bool, uint32_t, unsigned int, smbc_notify_callback_fn, void *)
|
|
+smbc_open: int (const char *, int, mode_t)
|
|
+smbc_open_print_job: int (const char *)
|
|
+smbc_opendir: int (const char *)
|
|
+smbc_option_get: void *(SMBCCTX *, char *)
|
|
+smbc_option_set: void (SMBCCTX *, char *, ...)
|
|
+smbc_print_file: int (const char *, const char *)
|
|
+smbc_read: ssize_t (int, void *, size_t)
|
|
+smbc_readdir: struct smbc_dirent *(unsigned int)
|
|
+smbc_readdirplus: const struct libsmb_file_info *(unsigned int)
|
|
+smbc_readdirplus2: const struct libsmb_file_info *(unsigned int, struct stat *)
|
|
+smbc_removexattr: int (const char *, const char *)
|
|
+smbc_rename: int (const char *, const char *)
|
|
+smbc_rmdir: int (const char *)
|
|
+smbc_setConfiguration: int (SMBCCTX *, const char *)
|
|
+smbc_setDebug: void (SMBCCTX *, int)
|
|
+smbc_setFunctionAddCachedServer: void (SMBCCTX *, smbc_add_cached_srv_fn)
|
|
+smbc_setFunctionAuthData: void (SMBCCTX *, smbc_get_auth_data_fn)
|
|
+smbc_setFunctionAuthDataWithContext: void (SMBCCTX *, smbc_get_auth_data_with_context_fn)
|
|
+smbc_setFunctionCheckServer: void (SMBCCTX *, smbc_check_server_fn)
|
|
+smbc_setFunctionChmod: void (SMBCCTX *, smbc_chmod_fn)
|
|
+smbc_setFunctionClose: void (SMBCCTX *, smbc_close_fn)
|
|
+smbc_setFunctionClosedir: void (SMBCCTX *, smbc_closedir_fn)
|
|
+smbc_setFunctionCreat: void (SMBCCTX *, smbc_creat_fn)
|
|
+smbc_setFunctionFstat: void (SMBCCTX *, smbc_fstat_fn)
|
|
+smbc_setFunctionFstatVFS: void (SMBCCTX *, smbc_fstatvfs_fn)
|
|
+smbc_setFunctionFstatdir: void (SMBCCTX *, smbc_fstatdir_fn)
|
|
+smbc_setFunctionFtruncate: void (SMBCCTX *, smbc_ftruncate_fn)
|
|
+smbc_setFunctionGetCachedServer: void (SMBCCTX *, smbc_get_cached_srv_fn)
|
|
+smbc_setFunctionGetdents: void (SMBCCTX *, smbc_getdents_fn)
|
|
+smbc_setFunctionGetxattr: void (SMBCCTX *, smbc_getxattr_fn)
|
|
+smbc_setFunctionListPrintJobs: void (SMBCCTX *, smbc_list_print_jobs_fn)
|
|
+smbc_setFunctionListxattr: void (SMBCCTX *, smbc_listxattr_fn)
|
|
+smbc_setFunctionLseek: void (SMBCCTX *, smbc_lseek_fn)
|
|
+smbc_setFunctionLseekdir: void (SMBCCTX *, smbc_lseekdir_fn)
|
|
+smbc_setFunctionMkdir: void (SMBCCTX *, smbc_mkdir_fn)
|
|
+smbc_setFunctionNotify: void (SMBCCTX *, smbc_notify_fn)
|
|
+smbc_setFunctionOpen: void (SMBCCTX *, smbc_open_fn)
|
|
+smbc_setFunctionOpenPrintJob: void (SMBCCTX *, smbc_open_print_job_fn)
|
|
+smbc_setFunctionOpendir: void (SMBCCTX *, smbc_opendir_fn)
|
|
+smbc_setFunctionPrintFile: void (SMBCCTX *, smbc_print_file_fn)
|
|
+smbc_setFunctionPurgeCachedServers: void (SMBCCTX *, smbc_purge_cached_fn)
|
|
+smbc_setFunctionRead: void (SMBCCTX *, smbc_read_fn)
|
|
+smbc_setFunctionReaddir: void (SMBCCTX *, smbc_readdir_fn)
|
|
+smbc_setFunctionReaddirPlus: void (SMBCCTX *, smbc_readdirplus_fn)
|
|
+smbc_setFunctionReaddirPlus2: void (SMBCCTX *, smbc_readdirplus2_fn)
|
|
+smbc_setFunctionRemoveCachedServer: void (SMBCCTX *, smbc_remove_cached_srv_fn)
|
|
+smbc_setFunctionRemoveUnusedServer: void (SMBCCTX *, smbc_remove_unused_server_fn)
|
|
+smbc_setFunctionRemovexattr: void (SMBCCTX *, smbc_removexattr_fn)
|
|
+smbc_setFunctionRename: void (SMBCCTX *, smbc_rename_fn)
|
|
+smbc_setFunctionRmdir: void (SMBCCTX *, smbc_rmdir_fn)
|
|
+smbc_setFunctionSetxattr: void (SMBCCTX *, smbc_setxattr_fn)
|
|
+smbc_setFunctionSplice: void (SMBCCTX *, smbc_splice_fn)
|
|
+smbc_setFunctionStat: void (SMBCCTX *, smbc_stat_fn)
|
|
+smbc_setFunctionStatVFS: void (SMBCCTX *, smbc_statvfs_fn)
|
|
+smbc_setFunctionTelldir: void (SMBCCTX *, smbc_telldir_fn)
|
|
+smbc_setFunctionUnlink: void (SMBCCTX *, smbc_unlink_fn)
|
|
+smbc_setFunctionUnlinkPrintJob: void (SMBCCTX *, smbc_unlink_print_job_fn)
|
|
+smbc_setFunctionUtimes: void (SMBCCTX *, smbc_utimes_fn)
|
|
+smbc_setFunctionWrite: void (SMBCCTX *, smbc_write_fn)
|
|
+smbc_setLogCallback: void (SMBCCTX *, void *, smbc_debug_callback_fn)
|
|
+smbc_setNetbiosName: void (SMBCCTX *, const char *)
|
|
+smbc_setOptionBrowseMaxLmbCount: void (SMBCCTX *, int)
|
|
+smbc_setOptionCaseSensitive: void (SMBCCTX *, smbc_bool)
|
|
+smbc_setOptionDebugToStderr: void (SMBCCTX *, smbc_bool)
|
|
+smbc_setOptionFallbackAfterKerberos: void (SMBCCTX *, smbc_bool)
|
|
+smbc_setOptionFullTimeNames: void (SMBCCTX *, smbc_bool)
|
|
+smbc_setOptionNoAutoAnonymousLogin: void (SMBCCTX *, smbc_bool)
|
|
+smbc_setOptionOneSharePerServer: void (SMBCCTX *, smbc_bool)
|
|
+smbc_setOptionOpenShareMode: void (SMBCCTX *, smbc_share_mode)
|
|
+smbc_setOptionProtocols: smbc_bool (SMBCCTX *, const char *, const char *)
|
|
+smbc_setOptionSmbEncryptionLevel: void (SMBCCTX *, smbc_smb_encrypt_level)
|
|
+smbc_setOptionUrlEncodeReaddirEntries: void (SMBCCTX *, smbc_bool)
|
|
+smbc_setOptionUseCCache: void (SMBCCTX *, smbc_bool)
|
|
+smbc_setOptionUseKerberos: void (SMBCCTX *, smbc_bool)
|
|
+smbc_setOptionUseNTHash: void (SMBCCTX *, smbc_bool)
|
|
+smbc_setOptionUserData: void (SMBCCTX *, void *)
|
|
+smbc_setPort: void (SMBCCTX *, uint16_t)
|
|
+smbc_setServerCacheData: void (SMBCCTX *, struct smbc_server_cache *)
|
|
+smbc_setTimeout: void (SMBCCTX *, int)
|
|
+smbc_setUser: void (SMBCCTX *, const char *)
|
|
+smbc_setWorkgroup: void (SMBCCTX *, const char *)
|
|
+smbc_set_context: SMBCCTX *(SMBCCTX *)
|
|
+smbc_set_credentials: void (const char *, const char *, const char *, smbc_bool, const char *)
|
|
+smbc_set_credentials_with_fallback: void (SMBCCTX *, const char *, const char *, const char *)
|
|
+smbc_setxattr: int (const char *, const char *, const void *, size_t, int)
|
|
+smbc_stat: int (const char *, struct stat *)
|
|
+smbc_statvfs: int (char *, struct statvfs *)
|
|
+smbc_telldir: off_t (int)
|
|
+smbc_unlink: int (const char *)
|
|
+smbc_unlink_print_job: int (const char *, int)
|
|
+smbc_urldecode: int (char *, char *, size_t)
|
|
+smbc_urlencode: int (char *, char *, int)
|
|
+smbc_utime: int (const char *, struct utimbuf *)
|
|
+smbc_utimes: int (const char *, struct timeval *)
|
|
+smbc_version: const char *(void)
|
|
+smbc_write: ssize_t (int, const void *, size_t)
|
|
diff --git a/source3/libsmb/libsmb_context.c b/source3/libsmb/libsmb_context.c
|
|
index eaa0cdeca93..ea741f41c7d 100644
|
|
--- a/source3/libsmb/libsmb_context.c
|
|
+++ b/source3/libsmb/libsmb_context.c
|
|
@@ -171,7 +171,7 @@ smbc_new_context(void)
|
|
|
|
smbc_setOptionFullTimeNames(context, False);
|
|
smbc_setOptionOpenShareMode(context, SMBC_SHAREMODE_DENY_NONE);
|
|
- smbc_setOptionSmbEncryptionLevel(context, SMBC_ENCRYPTLEVEL_NONE);
|
|
+ smbc_setOptionSmbEncryptionLevel(context, SMBC_ENCRYPTLEVEL_DEFAULT);
|
|
smbc_setOptionUseCCache(context, True);
|
|
smbc_setOptionCaseSensitive(context, False);
|
|
smbc_setOptionBrowseMaxLmbCount(context, 3); /* # LMBs to query */
|
|
@@ -474,6 +474,8 @@ smbc_option_get(SMBCCTX *context,
|
|
} else if (strcmp(option_name, "smb_encrypt_level") == 0) {
|
|
switch(smbc_getOptionSmbEncryptionLevel(context))
|
|
{
|
|
+ case SMBC_ENCRYPTLEVEL_DEFAULT:
|
|
+ return discard_const_p(void, "default");
|
|
case 0:
|
|
return discard_const_p(void, "none");
|
|
case 1:
|
|
diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c
|
|
index 33dc8419deb..eb58d7c6ac9 100644
|
|
--- a/source3/libsmb/libsmb_server.c
|
|
+++ b/source3/libsmb/libsmb_server.c
|
|
@@ -284,6 +284,29 @@ static struct cli_credentials *SMBC_auth_credentials(TALLOC_CTX *mem_ctx,
|
|
return NULL;
|
|
}
|
|
|
|
+ switch (context->internal->smb_encryption_level) {
|
|
+ case SMBC_ENCRYPTLEVEL_DEFAULT:
|
|
+ /* Use the config option */
|
|
+ break;
|
|
+ case SMBC_ENCRYPTLEVEL_NONE:
|
|
+ cli_credentials_set_smb_encryption(creds,
|
|
+ SMB_ENCRYPTION_OFF,
|
|
+ CRED_SPECIFIED);
|
|
+ break;
|
|
+ case SMBC_ENCRYPTLEVEL_REQUEST:
|
|
+ cli_credentials_set_smb_encryption(creds,
|
|
+ SMB_ENCRYPTION_DESIRED,
|
|
+ CRED_SPECIFIED);
|
|
+ break;
|
|
+ case SMBC_ENCRYPTLEVEL_REQUIRE:
|
|
+ default:
|
|
+ cli_credentials_set_smb_encryption(creds,
|
|
+ SMB_ENCRYPTION_REQUIRED,
|
|
+ CRED_SPECIFIED);
|
|
+ break;
|
|
+ }
|
|
+
|
|
+
|
|
return creds;
|
|
}
|
|
|
|
@@ -625,30 +648,6 @@ SMBC_server_internal(TALLOC_CTX *ctx,
|
|
smbXcli_tcon_set_fs_attributes(tcon, fs_attrs);
|
|
}
|
|
|
|
- if (context->internal->smb_encryption_level) {
|
|
- /* Attempt encryption. */
|
|
- status = cli_cm_force_encryption_creds(c,
|
|
- creds,
|
|
- share);
|
|
- if (!NT_STATUS_IS_OK(status)) {
|
|
-
|
|
- /*
|
|
- * context->smb_encryption_level == 1
|
|
- * means don't fail if encryption can't be negotiated,
|
|
- * == 2 means fail if encryption can't be negotiated.
|
|
- */
|
|
-
|
|
- DEBUG(4,(" SMB encrypt failed\n"));
|
|
-
|
|
- if (context->internal->smb_encryption_level == 2) {
|
|
- cli_shutdown(c);
|
|
- errno = EPERM;
|
|
- return NULL;
|
|
- }
|
|
- }
|
|
- DEBUG(4,(" SMB encrypt ok\n"));
|
|
- }
|
|
-
|
|
/*
|
|
* Ok, we have got a nice connection
|
|
* Let's allocate a server structure.
|
|
@@ -825,31 +824,6 @@ SMBC_attr_server(TALLOC_CTX *ctx,
|
|
}
|
|
talloc_steal(ipc_cli, creds);
|
|
|
|
- if (context->internal->smb_encryption_level) {
|
|
- /* Attempt encryption. */
|
|
- nt_status = cli_cm_force_encryption_creds(ipc_cli,
|
|
- creds,
|
|
- "IPC$");
|
|
- if (!NT_STATUS_IS_OK(nt_status)) {
|
|
-
|
|
- /*
|
|
- * context->smb_encryption_level ==
|
|
- * 1 means don't fail if encryption can't be
|
|
- * negotiated, == 2 means fail if encryption
|
|
- * can't be negotiated.
|
|
- */
|
|
-
|
|
- DEBUG(4,(" SMB encrypt failed on IPC$\n"));
|
|
-
|
|
- if (context->internal->smb_encryption_level == 2) {
|
|
- cli_shutdown(ipc_cli);
|
|
- errno = EPERM;
|
|
- return NULL;
|
|
- }
|
|
- }
|
|
- DEBUG(4,(" SMB encrypt ok on IPC$\n"));
|
|
- }
|
|
-
|
|
ipc_srv = SMB_MALLOC_P(SMBCSRV);
|
|
if (!ipc_srv) {
|
|
errno = ENOMEM;
|
|
diff --git a/source3/libsmb/wscript b/source3/libsmb/wscript
|
|
index ec4a516b2ee..61503d0a98b 100644
|
|
--- a/source3/libsmb/wscript
|
|
+++ b/source3/libsmb/wscript
|
|
@@ -26,5 +26,5 @@ def build(bld):
|
|
public_headers='../include/libsmbclient.h',
|
|
abi_directory='ABI',
|
|
abi_match='smbc_*',
|
|
- vnum='0.6.0',
|
|
+ vnum='0.7.0',
|
|
pc_files='smbclient.pc')
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 76dc706e6449161c27a5f117bc45922ab467dbfc Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 10 Jun 2020 12:43:33 +0200
|
|
Subject: [PATCH 037/105] s3:client: Remove unused smb encryption code
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/client/smbspool.c | 10 ----------
|
|
1 file changed, 10 deletions(-)
|
|
|
|
diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c
|
|
index f56dc323b6e..16a8d44c069 100644
|
|
--- a/source3/client/smbspool.c
|
|
+++ b/source3/client/smbspool.c
|
|
@@ -584,16 +584,6 @@ smb_complete_connection(struct cli_state **output_cli,
|
|
|
|
return nt_status;
|
|
}
|
|
-#if 0
|
|
- /* Need to work out how to specify this on the URL. */
|
|
- if (smb_encrypt) {
|
|
- if (!cli_cm_force_encryption_creds(cli, creds, share)) {
|
|
- fprintf(stderr, "ERROR: encryption setup failed\n");
|
|
- cli_shutdown(cli);
|
|
- return NULL;
|
|
- }
|
|
- }
|
|
-#endif
|
|
|
|
*output_cli = cli;
|
|
return NT_STATUS_OK;
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From a444688a6ed50c8443a778fbddb4dbd8a39d49d4 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 10 Jun 2020 12:47:05 +0200
|
|
Subject: [PATCH 038/105] s3:utils: Remove obsolete force encryption from
|
|
smbacls
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/utils/smbcacls.c | 10 ----------
|
|
1 file changed, 10 deletions(-)
|
|
|
|
diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
|
|
index 5983ebbd0a5..8fd9fcc5780 100644
|
|
--- a/source3/utils/smbcacls.c
|
|
+++ b/source3/utils/smbcacls.c
|
|
@@ -784,16 +784,6 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info,
|
|
return NULL;
|
|
}
|
|
|
|
- if (get_cmdline_auth_info_smb_encrypt(auth_info)) {
|
|
- nt_status = cli_cm_force_encryption_creds(c,
|
|
- get_cmdline_auth_info_creds(auth_info),
|
|
- share);
|
|
- if (!NT_STATUS_IS_OK(nt_status)) {
|
|
- cli_shutdown(c);
|
|
- c = NULL;
|
|
- }
|
|
- }
|
|
-
|
|
return c;
|
|
}
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 21b72b6107cd849b9da77e17520e658745fb897a Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 10 Jun 2020 12:48:18 +0200
|
|
Subject: [PATCH 039/105] s3:utils: Remove obsolete force encryption from
|
|
mdfind
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/utils/mdfind.c | 7 -------
|
|
1 file changed, 7 deletions(-)
|
|
|
|
diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c
|
|
index 2ac4fde7daf..ef2657e4fa5 100644
|
|
--- a/source3/utils/mdfind.c
|
|
+++ b/source3/utils/mdfind.c
|
|
@@ -159,13 +159,6 @@ int main(int argc, char **argv)
|
|
goto fail;
|
|
}
|
|
|
|
- if (get_cmdline_auth_info_smb_encrypt(auth)) {
|
|
- status = cli_cm_force_encryption_creds(cli, creds, "IPC$");
|
|
- if (!NT_STATUS_IS_OK(status)) {
|
|
- goto fail;
|
|
- }
|
|
- }
|
|
-
|
|
status = cli_rpc_pipe_open_noauth_transport(cli,
|
|
NCACN_NP,
|
|
&ndr_table_mdssvc,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 842c3c1346cba54c92d6ba2d462818875403a394 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 10 Jun 2020 12:49:28 +0200
|
|
Subject: [PATCH 040/105] s3:utils: Remove obsolete force encryption from
|
|
smbcquotas
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/utils/smbcquotas.c | 11 -----------
|
|
1 file changed, 11 deletions(-)
|
|
|
|
diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c
|
|
index fea066ce468..4ceac7b3ab0 100644
|
|
--- a/source3/utils/smbcquotas.c
|
|
+++ b/source3/utils/smbcquotas.c
|
|
@@ -533,17 +533,6 @@ static struct cli_state *connect_one(const char *share)
|
|
return NULL;
|
|
}
|
|
|
|
- if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) {
|
|
- nt_status = cli_cm_force_encryption_creds(c,
|
|
- get_cmdline_auth_info_creds(
|
|
- popt_get_cmdline_auth_info()),
|
|
- share);
|
|
- if (!NT_STATUS_IS_OK(nt_status)) {
|
|
- cli_shutdown(c);
|
|
- return NULL;
|
|
- }
|
|
- }
|
|
-
|
|
return c;
|
|
}
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From be36aec550d817bbcfdea88b433e31b44886ba19 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 10 Jun 2020 12:51:18 +0200
|
|
Subject: [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from
|
|
rpcclient
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/rpcclient/rpcclient.c | 11 -----------
|
|
1 file changed, 11 deletions(-)
|
|
|
|
diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c
|
|
index 2ead6cc7ba5..575a42ebf70 100644
|
|
--- a/source3/rpcclient/rpcclient.c
|
|
+++ b/source3/rpcclient/rpcclient.c
|
|
@@ -1214,17 +1214,6 @@ out_free:
|
|
goto done;
|
|
}
|
|
|
|
- if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) {
|
|
- nt_status = cli_cm_force_encryption_creds(cli,
|
|
- get_cmdline_auth_info_creds(
|
|
- popt_get_cmdline_auth_info()),
|
|
- "IPC$");
|
|
- if (!NT_STATUS_IS_OK(nt_status)) {
|
|
- result = 1;
|
|
- goto done;
|
|
- }
|
|
- }
|
|
-
|
|
#if 0 /* COMMENT OUT FOR TESTING */
|
|
memset(cmdline_auth_info.password,'X',sizeof(cmdline_auth_info.password));
|
|
#endif
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 8e2de7801238eb7f1090a9307dc4b05885b3dda2 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Mon, 6 Jul 2020 10:58:36 +0200
|
|
Subject: [PATCH 042/105] examples: Remove obsolete force encryption from
|
|
smb2mount
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
examples/fuse/smb2mount.c | 11 -----------
|
|
1 file changed, 11 deletions(-)
|
|
|
|
diff --git a/examples/fuse/smb2mount.c b/examples/fuse/smb2mount.c
|
|
index 6206c3a9701..c64be573462 100644
|
|
--- a/examples/fuse/smb2mount.c
|
|
+++ b/examples/fuse/smb2mount.c
|
|
@@ -44,17 +44,6 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info,
|
|
return NULL;
|
|
}
|
|
|
|
- if (get_cmdline_auth_info_smb_encrypt(auth_info)) {
|
|
- nt_status = cli_cm_force_encryption_creds(
|
|
- c,
|
|
- get_cmdline_auth_info_creds(auth_info),
|
|
- share);
|
|
- if (!NT_STATUS_IS_OK(nt_status)) {
|
|
- cli_shutdown(c);
|
|
- c = NULL;
|
|
- }
|
|
- }
|
|
-
|
|
return c;
|
|
}
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 8c9a31cc180c674925919771ccdce1bb6895c1a3 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Mon, 6 Jul 2020 11:05:59 +0200
|
|
Subject: [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds()
|
|
static
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source3/libsmb/clidfs.c | 6 +++---
|
|
source3/libsmb/proto.h | 3 ---
|
|
2 files changed, 3 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index 4495a027830..aff998f6187 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -43,9 +43,9 @@
|
|
Ensure a connection is encrypted.
|
|
********************************************************************/
|
|
|
|
-NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c,
|
|
- struct cli_credentials *creds,
|
|
- const char *sharename)
|
|
+static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c,
|
|
+ struct cli_credentials *creds,
|
|
+ const char *sharename)
|
|
{
|
|
uint16_t major, minor;
|
|
uint32_t caplow, caphigh;
|
|
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
|
|
index 850cf12c8a6..eeabcaa7463 100644
|
|
--- a/source3/libsmb/proto.h
|
|
+++ b/source3/libsmb/proto.h
|
|
@@ -123,9 +123,6 @@ struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
|
|
|
|
/* The following definitions come from libsmb/clidfs.c */
|
|
|
|
-NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c,
|
|
- struct cli_credentials *creds,
|
|
- const char *sharename);
|
|
NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
struct cli_state *referring_cli,
|
|
const char *server,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 6e2a7196c424edd2c447cfd4377e38e5b51ee675 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 13 Aug 2020 16:16:55 +0200
|
|
Subject: [PATCH 044/105] s4:libcli: Return NTSTATUS errors for
|
|
smb_composite_connect_send()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source4/libcli/smb_composite/connect.c | 40 +++++++++++++++++++-------
|
|
1 file changed, 29 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/source4/libcli/smb_composite/connect.c b/source4/libcli/smb_composite/connect.c
|
|
index 582d43ef173..ad50ae0ac81 100644
|
|
--- a/source4/libcli/smb_composite/connect.c
|
|
+++ b/source4/libcli/smb_composite/connect.c
|
|
@@ -420,15 +420,25 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec
|
|
struct connect_state *state;
|
|
|
|
c = talloc_zero(mem_ctx, struct composite_context);
|
|
- if (c == NULL) goto failed;
|
|
-
|
|
- c->event_ctx = event_ctx;
|
|
- if (c->event_ctx == NULL) goto failed;
|
|
+ if (c == NULL) {
|
|
+ goto nomem;
|
|
+ }
|
|
|
|
state = talloc_zero(c, struct connect_state);
|
|
- if (state == NULL) goto failed;
|
|
+ if (state == NULL) {
|
|
+ goto nomem;
|
|
+ }
|
|
+
|
|
+ c->event_ctx = event_ctx;
|
|
+ if (c->event_ctx == NULL) {
|
|
+ composite_error(c, NT_STATUS_INVALID_PARAMETER_MIX);
|
|
+ return c;
|
|
+ }
|
|
|
|
- if (io->in.gensec_settings == NULL) goto failed;
|
|
+ if (io->in.gensec_settings == NULL) {
|
|
+ composite_error(c, NT_STATUS_INVALID_PARAMETER_MIX);
|
|
+ return c;
|
|
+ }
|
|
state->io = io;
|
|
|
|
c->state = COMPOSITE_STATE_IN_PROGRESS;
|
|
@@ -449,12 +459,14 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec
|
|
&io->in.options,
|
|
&state->transport);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
- goto failed;
|
|
+ composite_error(c, status);
|
|
+ return c;
|
|
}
|
|
|
|
status = connect_send_session(c, io);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
- goto failed;
|
|
+ composite_error(c, status);
|
|
+ return c;
|
|
}
|
|
|
|
return c;
|
|
@@ -468,15 +480,18 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec
|
|
io->in.socket_options,
|
|
&state->calling,
|
|
&state->called);
|
|
- if (state->creq == NULL) goto failed;
|
|
+ if (state->creq == NULL) {
|
|
+ composite_error(c, NT_STATUS_NO_MEMORY);
|
|
+ return c;
|
|
+ }
|
|
|
|
state->stage = CONNECT_SOCKET;
|
|
state->creq->async.private_data = c;
|
|
state->creq->async.fn = composite_handler;
|
|
|
|
return c;
|
|
-failed:
|
|
- talloc_free(c);
|
|
+nomem:
|
|
+ TALLOC_FREE(c);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -506,5 +521,8 @@ NTSTATUS smb_composite_connect(struct smb_composite_connect *io, TALLOC_CTX *mem
|
|
struct tevent_context *ev)
|
|
{
|
|
struct composite_context *c = smb_composite_connect_send(io, mem_ctx, resolve_ctx, ev);
|
|
+ if (c == NULL) {
|
|
+ return NT_STATUS_NO_MEMORY;
|
|
+ }
|
|
return smb_composite_connect_recv(c, mem_ctx);
|
|
}
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From cf89573a78556993d7ecb43257d347edc6c61151 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 7 Jul 2020 12:54:26 +0200
|
|
Subject: [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source4/libcli/smb_composite/sesssetup.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c
|
|
index 6ee4929e8d7..51e121bdce6 100644
|
|
--- a/source4/libcli/smb_composite/sesssetup.c
|
|
+++ b/source4/libcli/smb_composite/sesssetup.c
|
|
@@ -620,10 +620,17 @@ struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *se
|
|
struct composite_context *c;
|
|
struct sesssetup_state *state;
|
|
NTSTATUS status;
|
|
+ enum smb_encryption_setting encryption_state =
|
|
+ cli_credentials_get_smb_encryption(io->in.credentials);
|
|
|
|
c = composite_create(session, session->transport->ev);
|
|
if (c == NULL) return NULL;
|
|
|
|
+ if (encryption_state > SMB_ENCRYPTION_DESIRED) {
|
|
+ composite_error(c, NT_STATUS_PROTOCOL_NOT_SUPPORTED);
|
|
+ return c;
|
|
+ }
|
|
+
|
|
state = talloc_zero(c, struct sesssetup_state);
|
|
if (composite_nomem(state, c)) return c;
|
|
c->private_data = state;
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 05914c4f85f71c7d1df884e33b8c0b8f5062ee3b Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 7 Jul 2020 12:29:39 +0200
|
|
Subject: [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source4/libcli/smb2/connect.c | 13 ++++++++++++-
|
|
1 file changed, 12 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c
|
|
index 6fc3993a4e8..95ff05eac8f 100644
|
|
--- a/source4/libcli/smb2/connect.c
|
|
+++ b/source4/libcli/smb2/connect.c
|
|
@@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req)
|
|
tevent_req_set_callback(subreq, smb2_connect_session_done, req);
|
|
}
|
|
|
|
+static void smb2_connect_tcon_start(struct tevent_req *req);
|
|
static void smb2_connect_tcon_done(struct tevent_req *subreq);
|
|
|
|
static void smb2_connect_session_done(struct tevent_req *subreq)
|
|
@@ -248,7 +249,6 @@ static void smb2_connect_session_done(struct tevent_req *subreq)
|
|
tevent_req_data(req,
|
|
struct smb2_connect_state);
|
|
NTSTATUS status;
|
|
- uint32_t timeout_msec;
|
|
|
|
status = smb2_session_setup_spnego_recv(subreq);
|
|
TALLOC_FREE(subreq);
|
|
@@ -289,6 +289,17 @@ static void smb2_connect_session_done(struct tevent_req *subreq)
|
|
return;
|
|
}
|
|
|
|
+ smb2_connect_tcon_start(req);
|
|
+}
|
|
+
|
|
+static void smb2_connect_tcon_start(struct tevent_req *req)
|
|
+{
|
|
+ struct smb2_connect_state *state =
|
|
+ tevent_req_data(req,
|
|
+ struct smb2_connect_state);
|
|
+ struct tevent_req *subreq = NULL;
|
|
+ uint32_t timeout_msec;
|
|
+
|
|
timeout_msec = state->transport->options.request_timeout * 1000;
|
|
|
|
subreq = smb2cli_tcon_send(state, state->ev,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 63b0086d8ffdfca44134c09ff0db76d7a9ae8f6c Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 7 Jul 2020 12:44:26 +0200
|
|
Subject: [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source4/libcli/smb2/connect.c | 38 +++++++++++++++++++++++++++++++++++
|
|
1 file changed, 38 insertions(+)
|
|
|
|
diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c
|
|
index 95ff05eac8f..3a3ecdf20e8 100644
|
|
--- a/source4/libcli/smb2/connect.c
|
|
+++ b/source4/libcli/smb2/connect.c
|
|
@@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req)
|
|
tevent_req_set_callback(subreq, smb2_connect_session_done, req);
|
|
}
|
|
|
|
+static void smb2_connect_enc_start(struct tevent_req *req);
|
|
static void smb2_connect_tcon_start(struct tevent_req *req);
|
|
static void smb2_connect_tcon_done(struct tevent_req *subreq);
|
|
|
|
@@ -289,6 +290,43 @@ static void smb2_connect_session_done(struct tevent_req *subreq)
|
|
return;
|
|
}
|
|
|
|
+ smb2_connect_enc_start(req);
|
|
+}
|
|
+
|
|
+static void smb2_connect_enc_start(struct tevent_req *req)
|
|
+{
|
|
+ struct smb2_connect_state *state =
|
|
+ tevent_req_data(req,
|
|
+ struct smb2_connect_state);
|
|
+ enum smb_encryption_setting encryption_state =
|
|
+ cli_credentials_get_smb_encryption(state->credentials);
|
|
+ NTSTATUS status;
|
|
+
|
|
+ if (encryption_state < SMB_ENCRYPTION_DESIRED) {
|
|
+ smb2_connect_tcon_start(req);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ status = smb2cli_session_encryption_on(state->session->smbXcli);
|
|
+ if (!NT_STATUS_IS_OK(status)) {
|
|
+ if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
|
|
+ if (encryption_state < SMB_ENCRYPTION_REQUIRED) {
|
|
+ smb2_connect_tcon_start(req);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ DBG_ERR("Encryption required and server doesn't support "
|
|
+ "SMB3 encryption - failing connect\n");
|
|
+ tevent_req_nterror(req, status);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ DBG_ERR("Encryption required and setup failed with error %s.\n",
|
|
+ nt_errstr(status));
|
|
+ tevent_req_nterror(req, NT_STATUS_PROTOCOL_NOT_SUPPORTED);
|
|
+ return;
|
|
+ }
|
|
+
|
|
smb2_connect_tcon_start(req);
|
|
}
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 8bc1b5f884d1e6a88e1ac403d9bc64c3b77e9428 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 24 Jul 2020 10:18:52 +0200
|
|
Subject: [PATCH 048/105] s4:libcli: Require signing for SMB encryption
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
---
|
|
source4/libcli/smb2/connect.c | 9 ++++++++-
|
|
1 file changed, 8 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c
|
|
index 3a3ecdf20e8..9540704491e 100644
|
|
--- a/source4/libcli/smb2/connect.c
|
|
+++ b/source4/libcli/smb2/connect.c
|
|
@@ -31,6 +31,7 @@
|
|
#include "param/param.h"
|
|
#include "auth/credentials/credentials.h"
|
|
#include "../libcli/smb/smbXcli_base.h"
|
|
+#include "smb2_constants.h"
|
|
|
|
struct smb2_connect_state {
|
|
struct tevent_context *ev;
|
|
@@ -76,6 +77,8 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx,
|
|
struct smb2_connect_state *state;
|
|
struct composite_context *creq;
|
|
static const char *default_ports[] = { "445", "139", NULL };
|
|
+ enum smb_encryption_setting encryption_state =
|
|
+ cli_credentials_get_smb_encryption(credentials);
|
|
|
|
req = tevent_req_create(mem_ctx, &state,
|
|
struct smb2_connect_state);
|
|
@@ -99,6 +102,10 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx,
|
|
state->ports = default_ports;
|
|
}
|
|
|
|
+ if (encryption_state >= SMB_ENCRYPTION_DESIRED) {
|
|
+ state->options.signing = SMB_SIGNING_REQUIRED;
|
|
+ }
|
|
+
|
|
make_nbt_name_client(&state->calling,
|
|
cli_credentials_get_workstation(credentials));
|
|
|
|
@@ -116,7 +123,7 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx,
|
|
|
|
status = smb2_transport_raw_init(state, ev,
|
|
existing_conn,
|
|
- options,
|
|
+ &state->options,
|
|
&state->transport);
|
|
if (tevent_req_nterror(req, status)) {
|
|
return tevent_req_post(req, ev);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 5cc8a0bc7381444804cde992afdc7aa0c0b70074 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 7 Jul 2020 14:27:07 +0200
|
|
Subject: [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC
|
|
connection
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
|
|
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
|
|
Autobuild-Date(master): Wed Aug 19 17:46:28 UTC 2020 on sn-devel-184
|
|
---
|
|
python/samba/tests/dcerpc/binding.py | 82 ++++++++++++++++++++++++++++
|
|
selftest/tests.py | 1 +
|
|
2 files changed, 83 insertions(+)
|
|
create mode 100644 python/samba/tests/dcerpc/binding.py
|
|
|
|
diff --git a/python/samba/tests/dcerpc/binding.py b/python/samba/tests/dcerpc/binding.py
|
|
new file mode 100644
|
|
index 00000000000..8e0d6a5ef0a
|
|
--- /dev/null
|
|
+++ b/python/samba/tests/dcerpc/binding.py
|
|
@@ -0,0 +1,82 @@
|
|
+#
|
|
+# Unix SMB/CIFS implementation.
|
|
+# Copyright (c) 2020 Andreas Schneider <asn@samba.org>
|
|
+#
|
|
+# This program is free software; you can redistribute it and/or modify
|
|
+# it under the terms of the GNU General Public License as published by
|
|
+# the Free Software Foundation; either version 3 of the License, or
|
|
+# (at your option) any later version.
|
|
+#
|
|
+# This program is distributed in the hope that it will be useful,
|
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+# GNU General Public License for more details.
|
|
+#
|
|
+# You should have received a copy of the GNU General Public License
|
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+#
|
|
+
|
|
+"""Tests for samba.dcerpc., credentials and binding strings"""
|
|
+
|
|
+import samba.tests
|
|
+from samba.tests import RpcInterfaceTestCase, TestCase
|
|
+from samba.dcerpc import lsa
|
|
+import samba.dcerpc.security as security
|
|
+from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED
|
|
+from samba import NTSTATUSError
|
|
+
|
|
+class RpcBindingTests(RpcInterfaceTestCase):
|
|
+ def setUp(self):
|
|
+ super(RpcBindingTests, self).setUp()
|
|
+
|
|
+ def get_user_creds(self):
|
|
+ c = Credentials()
|
|
+ c.guess()
|
|
+ domain = samba.tests.env_get_var_value('DOMAIN')
|
|
+ username = samba.tests.env_get_var_value('USERNAME')
|
|
+ password = samba.tests.env_get_var_value('PASSWORD')
|
|
+ c.set_domain(domain)
|
|
+ c.set_username(username)
|
|
+ c.set_password(password)
|
|
+ return c
|
|
+
|
|
+ def test_smb3_dcerpc_encryption(self):
|
|
+ creds = self.get_user_creds()
|
|
+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED)
|
|
+
|
|
+ lp = self.get_loadparm()
|
|
+ lp.set('client ipc max protocol', 'SMB3')
|
|
+ lp.set('client ipc min protocol', 'SMB3')
|
|
+
|
|
+ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER')))
|
|
+ lsa_conn = lsa.lsarpc(binding_string, lp, creds)
|
|
+
|
|
+ objectAttr = lsa.ObjectAttribute()
|
|
+ objectAttr.sec_qos = lsa.QosInfo()
|
|
+
|
|
+ pol_handle = lsa_conn.OpenPolicy2('',
|
|
+ objectAttr,
|
|
+ security.SEC_FLAG_MAXIMUM_ALLOWED)
|
|
+ self.assertIsNotNone(pol_handle)
|
|
+
|
|
+ def test_smb2_dcerpc_encryption(self):
|
|
+ creds = self.get_user_creds()
|
|
+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED)
|
|
+
|
|
+ lp = self.get_loadparm()
|
|
+ lp.set('client ipc max protocol', 'SMB2')
|
|
+ lp.set('client ipc min protocol', 'SMB2')
|
|
+
|
|
+ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER')))
|
|
+ self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds)
|
|
+
|
|
+ def test_smb1_dcerpc_encryption(self):
|
|
+ creds = self.get_user_creds()
|
|
+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED)
|
|
+
|
|
+ lp = self.get_loadparm()
|
|
+ lp.set('client ipc max protocol', 'NT1')
|
|
+ lp.set('client ipc min protocol', 'NT1')
|
|
+
|
|
+ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER')))
|
|
+ self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds)
|
|
diff --git a/selftest/tests.py b/selftest/tests.py
|
|
index 20981754db4..adcb5b53189 100644
|
|
--- a/selftest/tests.py
|
|
+++ b/selftest/tests.py
|
|
@@ -92,6 +92,7 @@ planpythontestsuite(
|
|
extra_path=[os.path.join(samba4srcdir, "..", "buildtools"),
|
|
os.path.join(samba4srcdir, "..", "third_party", "waf")])
|
|
planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest")
|
|
+planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding")
|
|
|
|
|
|
def cmdline(script, *args):
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 546ecfae4f11e0625de86e47e90a98a7aafa0453 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Fri, 4 Sep 2020 10:47:54 +0200
|
|
Subject: [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names()
|
|
|
|
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
(cherry picked from commit b34e8dc8982b625d946e2ac8794ee41311bc41c2)
|
|
---
|
|
auth/gensec/gensec.h | 2 +
|
|
auth/gensec/gensec_start.c | 87 ++++++++++++++++++++++++++++++++++++++
|
|
2 files changed, 89 insertions(+)
|
|
|
|
diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h
|
|
index d424067d02c..fe26fff171a 100644
|
|
--- a/auth/gensec/gensec.h
|
|
+++ b/auth/gensec/gensec.h
|
|
@@ -308,6 +308,8 @@ const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx
|
|
|
|
NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
|
|
const char *sasl_name);
|
|
+const char **gensec_security_sasl_names(struct gensec_security *gensec_security,
|
|
+ TALLOC_CTX *mem_ctx);
|
|
|
|
int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value);
|
|
bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value);
|
|
diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c
|
|
index d2d62d6652e..4eb45643714 100644
|
|
--- a/auth/gensec/gensec_start.c
|
|
+++ b/auth/gensec/gensec_start.c
|
|
@@ -299,6 +299,93 @@ const struct gensec_security_ops *gensec_security_by_name(struct gensec_security
|
|
return NULL;
|
|
}
|
|
|
|
+static const char **gensec_security_sasl_names_from_ops(
|
|
+ struct gensec_security *gensec_security,
|
|
+ TALLOC_CTX *mem_ctx,
|
|
+ const struct gensec_security_ops * const *ops)
|
|
+{
|
|
+ const char **sasl_names = NULL;
|
|
+ size_t i, sasl_names_count = 0;
|
|
+
|
|
+ if (ops == NULL) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ sasl_names = talloc_array(mem_ctx, const char *, 1);
|
|
+ if (sasl_names == NULL) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ for (i = 0; ops[i] != NULL; i++) {
|
|
+ enum gensec_role role = GENSEC_SERVER;
|
|
+ const char **tmp = NULL;
|
|
+
|
|
+ if (ops[i]->sasl_name == NULL) {
|
|
+ continue;
|
|
+ }
|
|
+
|
|
+ if (gensec_security != NULL) {
|
|
+ if (!gensec_security_ops_enabled(ops[i],
|
|
+ gensec_security)) {
|
|
+ continue;
|
|
+ }
|
|
+
|
|
+ role = gensec_security->gensec_role;
|
|
+ }
|
|
+
|
|
+ switch (role) {
|
|
+ case GENSEC_CLIENT:
|
|
+ if (ops[i]->client_start == NULL) {
|
|
+ continue;
|
|
+ }
|
|
+ break;
|
|
+ case GENSEC_SERVER:
|
|
+ if (ops[i]->server_start == NULL) {
|
|
+ continue;
|
|
+ }
|
|
+ break;
|
|
+ }
|
|
+
|
|
+ tmp = talloc_realloc(mem_ctx,
|
|
+ sasl_names,
|
|
+ const char *,
|
|
+ sasl_names_count + 2);
|
|
+ if (tmp == NULL) {
|
|
+ TALLOC_FREE(sasl_names);
|
|
+ return NULL;
|
|
+ }
|
|
+ sasl_names = tmp;
|
|
+
|
|
+ sasl_names[sasl_names_count] = ops[i]->sasl_name;
|
|
+ sasl_names_count++;
|
|
+ }
|
|
+ sasl_names[sasl_names_count] = NULL;
|
|
+
|
|
+ return sasl_names;
|
|
+}
|
|
+
|
|
+/**
|
|
+ * @brief Get the sasl names from the gensec security context.
|
|
+ *
|
|
+ * @param[in] gensec_security The gensec security context.
|
|
+ *
|
|
+ * @param[in] mem_ctx The memory context to allocate memory on.
|
|
+ *
|
|
+ * @return An allocated array with sasl names, NULL on error.
|
|
+ */
|
|
+_PUBLIC_
|
|
+const char **gensec_security_sasl_names(struct gensec_security *gensec_security,
|
|
+ TALLOC_CTX *mem_ctx)
|
|
+{
|
|
+ const struct gensec_security_ops **ops = NULL;
|
|
+
|
|
+ ops = gensec_security_mechs(gensec_security, mem_ctx);
|
|
+
|
|
+ return gensec_security_sasl_names_from_ops(gensec_security,
|
|
+ mem_ctx,
|
|
+ ops);
|
|
+}
|
|
+
|
|
/**
|
|
* Return a unique list of security subsystems from those specified in
|
|
* the list of SASL names.
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From ec079d88720a99a5bc5e6b5efd03f87342364f15 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Fri, 4 Sep 2020 10:48:27 +0200
|
|
Subject: [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in
|
|
ldapsrv_backend_Init()
|
|
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
|
(cherry picked from commit 5e3363e0b82193700f91a9bae5080aae0b744e5c)
|
|
---
|
|
source4/dsdb/samdb/ldb_modules/rootdse.c | 4 +-
|
|
source4/ldap_server/ldap_backend.c | 49 +++++++++++-------------
|
|
2 files changed, 25 insertions(+), 28 deletions(-)
|
|
|
|
diff --git a/source4/dsdb/samdb/ldb_modules/rootdse.c b/source4/dsdb/samdb/ldb_modules/rootdse.c
|
|
index 55340fa4f1e..4be9550747c 100644
|
|
--- a/source4/dsdb/samdb/ldb_modules/rootdse.c
|
|
+++ b/source4/dsdb/samdb/ldb_modules/rootdse.c
|
|
@@ -230,7 +230,7 @@ static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *m
|
|
struct ldb_context *ldb;
|
|
struct rootdse_private_data *priv = talloc_get_type(ldb_module_get_private(ac->module), struct rootdse_private_data);
|
|
const char * const *attrs = ac->req->op.search.attrs;
|
|
- char **server_sasl;
|
|
+ const char **server_sasl = NULL;
|
|
const struct dsdb_schema *schema;
|
|
int *val;
|
|
struct ldb_control *edn_control;
|
|
@@ -341,7 +341,7 @@ static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *m
|
|
}
|
|
|
|
server_sasl = talloc_get_type(ldb_get_opaque(ldb, "supportedSASLMechanisms"),
|
|
- char *);
|
|
+ const char *);
|
|
if (server_sasl && do_attribute(attrs, "supportedSASLMechanisms")) {
|
|
for (i = 0; server_sasl && server_sasl[i]; i++) {
|
|
char *sasl_name = talloc_strdup(msg, server_sasl[i]);
|
|
diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c
|
|
index 2839082daef..915d9b94f9b 100644
|
|
--- a/source4/ldap_server/ldap_backend.c
|
|
+++ b/source4/ldap_server/ldap_backend.c
|
|
@@ -33,6 +33,7 @@
|
|
#include "ldb_wrap.h"
|
|
#include "lib/tsocket/tsocket.h"
|
|
#include "libcli/ldap/ldap_proto.h"
|
|
+#include "source4/auth/auth.h"
|
|
|
|
static int map_ldb_error(TALLOC_CTX *mem_ctx, int ldb_err,
|
|
const char *add_err_string, const char **errstring)
|
|
@@ -199,37 +200,33 @@ int ldapsrv_backend_Init(struct ldapsrv_connection *conn,
|
|
}
|
|
|
|
if (conn->server_credentials) {
|
|
- char **sasl_mechs = NULL;
|
|
- const struct gensec_security_ops * const *backends = gensec_security_all();
|
|
- const struct gensec_security_ops **ops
|
|
- = gensec_use_kerberos_mechs(conn, backends, conn->server_credentials);
|
|
- unsigned int i, j = 0;
|
|
- for (i = 0; ops && ops[i]; i++) {
|
|
- if (!lpcfg_parm_bool(conn->lp_ctx, NULL, "gensec", ops[i]->name, ops[i]->enabled))
|
|
- continue;
|
|
-
|
|
- if (ops[i]->sasl_name && ops[i]->server_start) {
|
|
- char *sasl_name = talloc_strdup(conn, ops[i]->sasl_name);
|
|
-
|
|
- if (!sasl_name) {
|
|
- return LDB_ERR_OPERATIONS_ERROR;
|
|
- }
|
|
- sasl_mechs = talloc_realloc(conn, sasl_mechs, char *, j + 2);
|
|
- if (!sasl_mechs) {
|
|
- return LDB_ERR_OPERATIONS_ERROR;
|
|
- }
|
|
- sasl_mechs[j] = sasl_name;
|
|
- talloc_steal(sasl_mechs, sasl_name);
|
|
- sasl_mechs[j+1] = NULL;
|
|
- j++;
|
|
- }
|
|
+ struct gensec_security *gensec_security = NULL;
|
|
+ const char **sasl_mechs = NULL;
|
|
+ NTSTATUS status;
|
|
+
|
|
+ status = samba_server_gensec_start(conn,
|
|
+ conn->connection->event.ctx,
|
|
+ conn->connection->msg_ctx,
|
|
+ conn->lp_ctx,
|
|
+ conn->server_credentials,
|
|
+ "ldap",
|
|
+ &gensec_security);
|
|
+ if (!NT_STATUS_IS_OK(status)) {
|
|
+ DBG_ERR("samba_server_gensec_start failed: %s\n",
|
|
+ nt_errstr(status));
|
|
+ return LDB_ERR_OPERATIONS_ERROR;
|
|
}
|
|
- talloc_unlink(conn, ops);
|
|
|
|
/* ldb can have a different lifetime to conn, so we
|
|
need to ensure that sasl_mechs lives as long as the
|
|
ldb does */
|
|
- talloc_steal(conn->ldb, sasl_mechs);
|
|
+ sasl_mechs = gensec_security_sasl_names(gensec_security,
|
|
+ conn->ldb);
|
|
+ TALLOC_FREE(gensec_security);
|
|
+ if (sasl_mechs == NULL) {
|
|
+ DBG_ERR("Failed to get sasl mechs!\n");
|
|
+ return LDB_ERR_OPERATIONS_ERROR;
|
|
+ }
|
|
|
|
ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs);
|
|
}
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From bc128ea1ea455a3a63e0ce3dc8777a7482c356f8 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Fri, 4 Sep 2020 14:39:15 +0200
|
|
Subject: [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a
|
|
static function
|
|
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
|
(cherry picked from commit 2186d4131ad4c7961d0c830bf9d48f3d06d27924)
|
|
---
|
|
auth/gensec/gensec.h | 3 ---
|
|
auth/gensec/gensec_start.c | 7 ++++---
|
|
2 files changed, 4 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h
|
|
index fe26fff171a..8bece3c3458 100644
|
|
--- a/auth/gensec/gensec.h
|
|
+++ b/auth/gensec/gensec.h
|
|
@@ -302,9 +302,6 @@ NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
|
|
|
|
const struct gensec_security_ops * const *gensec_security_all(void);
|
|
bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct gensec_security *security);
|
|
-const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx,
|
|
- const struct gensec_security_ops * const *old_gensec_list,
|
|
- struct cli_credentials *creds);
|
|
|
|
NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
|
|
const char *sasl_name);
|
|
diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c
|
|
index 4eb45643714..ebcab76999a 100644
|
|
--- a/auth/gensec/gensec_start.c
|
|
+++ b/auth/gensec/gensec_start.c
|
|
@@ -83,9 +83,10 @@ bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct g
|
|
* more compplex.
|
|
*/
|
|
|
|
-_PUBLIC_ const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx,
|
|
- const struct gensec_security_ops * const *old_gensec_list,
|
|
- struct cli_credentials *creds)
|
|
+static const struct gensec_security_ops **gensec_use_kerberos_mechs(
|
|
+ TALLOC_CTX *mem_ctx,
|
|
+ const struct gensec_security_ops * const *old_gensec_list,
|
|
+ struct cli_credentials *creds)
|
|
{
|
|
const struct gensec_security_ops **new_gensec_list;
|
|
int i, j, num_mechs_in;
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 37b7016fba1eae75fc4a87c9c5aebbbb47b7ff39 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Fri, 4 Sep 2020 14:41:43 +0200
|
|
Subject: [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to
|
|
gensec_use_kerberos_mechs()
|
|
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
|
(cherry picked from commit a33a40bbc848e5691869cf264009d23a03128f31)
|
|
---
|
|
auth/gensec/gensec_start.c | 26 ++++++++++++++------------
|
|
1 file changed, 14 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c
|
|
index ebcab76999a..8d1b41fec74 100644
|
|
--- a/auth/gensec/gensec_start.c
|
|
+++ b/auth/gensec/gensec_start.c
|
|
@@ -86,19 +86,11 @@ bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct g
|
|
static const struct gensec_security_ops **gensec_use_kerberos_mechs(
|
|
TALLOC_CTX *mem_ctx,
|
|
const struct gensec_security_ops * const *old_gensec_list,
|
|
- struct cli_credentials *creds)
|
|
+ enum credentials_use_kerberos use_kerberos,
|
|
+ bool keep_schannel)
|
|
{
|
|
const struct gensec_security_ops **new_gensec_list;
|
|
int i, j, num_mechs_in;
|
|
- enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS;
|
|
- bool keep_schannel = false;
|
|
-
|
|
- if (creds) {
|
|
- use_kerberos = cli_credentials_get_kerberos_state(creds);
|
|
- if (cli_credentials_get_netlogon_creds(creds) != NULL) {
|
|
- keep_schannel = true;
|
|
- }
|
|
- }
|
|
|
|
for (num_mechs_in=0; old_gensec_list && old_gensec_list[num_mechs_in]; num_mechs_in++) {
|
|
/* noop */
|
|
@@ -163,18 +155,28 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs(
|
|
struct gensec_security *gensec_security,
|
|
TALLOC_CTX *mem_ctx)
|
|
{
|
|
- struct cli_credentials *creds = NULL;
|
|
const struct gensec_security_ops * const *backends = gensec_security_all();
|
|
+ enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS;
|
|
+ bool keep_schannel = false;
|
|
|
|
if (gensec_security != NULL) {
|
|
+ struct cli_credentials *creds = NULL;
|
|
+
|
|
creds = gensec_get_credentials(gensec_security);
|
|
+ if (creds != NULL) {
|
|
+ use_kerberos = cli_credentials_get_kerberos_state(creds);
|
|
+ if (cli_credentials_get_netlogon_creds(creds) != NULL) {
|
|
+ keep_schannel = true;
|
|
+ }
|
|
+ }
|
|
|
|
if (gensec_security->settings->backends) {
|
|
backends = gensec_security->settings->backends;
|
|
}
|
|
}
|
|
|
|
- return gensec_use_kerberos_mechs(mem_ctx, backends, creds);
|
|
+ return gensec_use_kerberos_mechs(mem_ctx, backends,
|
|
+ use_kerberos, keep_schannel);
|
|
|
|
}
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 0579dbd6faa5a828cff42cd797f78c51316324b0 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Fri, 4 Sep 2020 17:00:45 +0200
|
|
Subject: [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel
|
|
for machine account auth
|
|
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
(cherry picked from commit 515cffb1f20eacb041ff7b3d43f8a122a82ddfbd)
|
|
---
|
|
auth/gensec/gensec_start.c | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c
|
|
index 8d1b41fec74..3f42d611140 100644
|
|
--- a/auth/gensec/gensec_start.c
|
|
+++ b/auth/gensec/gensec_start.c
|
|
@@ -168,6 +168,15 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs(
|
|
if (cli_credentials_get_netlogon_creds(creds) != NULL) {
|
|
keep_schannel = true;
|
|
}
|
|
+
|
|
+ /*
|
|
+ * Even if Kerberos is set to REQUIRED, keep the
|
|
+ * schannel auth mechanism that machine accounts are
|
|
+ * able to authenticate via netlogon.
|
|
+ */
|
|
+ if (gensec_security->gensec_role == GENSEC_SERVER) {
|
|
+ keep_schannel = true;
|
|
+ }
|
|
}
|
|
|
|
if (gensec_security->settings->backends) {
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 0f3676f4f84184b5bf83101e0b1eca0bb05a5079 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 4 Sep 2020 12:21:21 +0200
|
|
Subject: [PATCH 055/105] auth:creds: Add cli_credentials_init_server()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
(cherry picked from commit 2c00bea2aefdcc69608dffdafa7ce581d31f9354)
|
|
---
|
|
auth/credentials/credentials.c | 25 +++++++++++++++++++++++++
|
|
auth/credentials/credentials.h | 2 ++
|
|
2 files changed, 27 insertions(+)
|
|
|
|
diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
|
|
index 9168b92d3ec..77c35dd104b 100644
|
|
--- a/auth/credentials/credentials.c
|
|
+++ b/auth/credentials/credentials.c
|
|
@@ -56,6 +56,31 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
|
|
return cred;
|
|
}
|
|
|
|
+_PUBLIC_
|
|
+struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx,
|
|
+ struct loadparm_context *lp_ctx)
|
|
+{
|
|
+ struct cli_credentials *server_creds = NULL;
|
|
+ NTSTATUS status;
|
|
+
|
|
+ server_creds = cli_credentials_init(mem_ctx);
|
|
+ if (server_creds == NULL) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ cli_credentials_set_conf(server_creds, lp_ctx);
|
|
+
|
|
+ status = cli_credentials_set_machine_account(server_creds, lp_ctx);
|
|
+ if (!NT_STATUS_IS_OK(status)) {
|
|
+ DEBUG(1, ("Failed to obtain server credentials: %s\n",
|
|
+ nt_errstr(status)));
|
|
+ TALLOC_FREE(server_creds);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ return server_creds;
|
|
+}
|
|
+
|
|
_PUBLIC_ void cli_credentials_set_callback_data(struct cli_credentials *cred,
|
|
void *callback_data)
|
|
{
|
|
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
|
|
index 7d0cf53194b..438bcdce232 100644
|
|
--- a/auth/credentials/credentials.h
|
|
+++ b/auth/credentials/credentials.h
|
|
@@ -76,6 +76,8 @@ bool cli_credentials_set_workstation(struct cli_credentials *cred,
|
|
enum credentials_obtained obtained);
|
|
bool cli_credentials_is_anonymous(struct cli_credentials *cred);
|
|
struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx);
|
|
+struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx,
|
|
+ struct loadparm_context *lp_ctx);
|
|
void cli_credentials_set_anonymous(struct cli_credentials *cred);
|
|
bool cli_credentials_wrong_password(struct cli_credentials *cred);
|
|
const char *cli_credentials_get_password(struct cli_credentials *cred);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From e1d566c2962ebd5596638df6f81fd120aaf32fcd Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 4 Sep 2020 12:21:36 +0200
|
|
Subject: [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
(cherry picked from commit 6c94ebf77fdb7383be2042f5e20ba2ef598cd4a4)
|
|
---
|
|
source4/rpc_server/dcerpc_server.c | 17 +++--------------
|
|
1 file changed, 3 insertions(+), 14 deletions(-)
|
|
|
|
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
|
|
index 084857a44bf..e64148ef788 100644
|
|
--- a/source4/rpc_server/dcerpc_server.c
|
|
+++ b/source4/rpc_server/dcerpc_server.c
|
|
@@ -673,25 +673,14 @@ NTSTATUS dcesrv_gensec_prepare(TALLOC_CTX *mem_ctx,
|
|
struct cli_credentials *server_creds = NULL;
|
|
struct imessaging_context *imsg_ctx =
|
|
dcesrv_imessaging_context(call->conn);
|
|
- NTSTATUS status;
|
|
|
|
- server_creds = cli_credentials_init(call->auth_state);
|
|
- if (!server_creds) {
|
|
+ server_creds = cli_credentials_init_server(call->auth_state,
|
|
+ call->conn->dce_ctx->lp_ctx);
|
|
+ if (server_creds == NULL) {
|
|
DEBUG(1, ("Failed to init server credentials\n"));
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
- cli_credentials_set_conf(server_creds, call->conn->dce_ctx->lp_ctx);
|
|
-
|
|
- status = cli_credentials_set_machine_account(server_creds,
|
|
- call->conn->dce_ctx->lp_ctx);
|
|
- if (!NT_STATUS_IS_OK(status)) {
|
|
- DEBUG(1, ("Failed to obtain server credentials: %s\n",
|
|
- nt_errstr(status)));
|
|
- talloc_free(server_creds);
|
|
- return status;
|
|
- }
|
|
-
|
|
return samba_server_gensec_start(mem_ctx,
|
|
call->event_ctx,
|
|
imsg_ctx,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 694e1d1ca62372baba69818acf25a2eec8847115 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Mon, 7 Sep 2020 09:19:43 +0200
|
|
Subject: [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for
|
|
negprot
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
|
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
|
|
Autobuild-Date(master): Mon Sep 7 13:22:26 UTC 2020 on sn-devel-184
|
|
|
|
(cherry picked from commit 0b742ec6a0558397d5cf01b99a401f8e2bc0e2e0)
|
|
---
|
|
source4/smb_server/smb/negprot.c | 28 ++++++++++++++--------------
|
|
source4/smb_server/smb2/negprot.c | 25 +++++++++++++------------
|
|
2 files changed, 27 insertions(+), 26 deletions(-)
|
|
|
|
diff --git a/source4/smb_server/smb/negprot.c b/source4/smb_server/smb/negprot.c
|
|
index a6177a72019..04b69dd9883 100644
|
|
--- a/source4/smb_server/smb/negprot.c
|
|
+++ b/source4/smb_server/smb/negprot.c
|
|
@@ -374,22 +374,22 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice)
|
|
DATA_BLOB blob = data_blob_null;
|
|
const char *oid;
|
|
NTSTATUS nt_status;
|
|
-
|
|
- server_credentials
|
|
- = cli_credentials_init(req);
|
|
- if (!server_credentials) {
|
|
- smbsrv_terminate_connection(req->smb_conn, "Failed to init server credentials\n");
|
|
- return;
|
|
- }
|
|
-
|
|
- cli_credentials_set_conf(server_credentials, req->smb_conn->lp_ctx);
|
|
- nt_status = cli_credentials_set_machine_account(server_credentials, req->smb_conn->lp_ctx);
|
|
- if (!NT_STATUS_IS_OK(nt_status)) {
|
|
- DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status)));
|
|
+
|
|
+ server_credentials =
|
|
+ cli_credentials_init_server(req, req->smb_conn->lp_ctx);
|
|
+ if (server_credentials == NULL) {
|
|
+ DBG_DEBUG("Failed to obtain server credentials, "
|
|
+ "perhaps a standalone server?\n");
|
|
/*
|
|
- * We keep the server_credentials as anonymous
|
|
- * this is required for the spoolss.notify test
|
|
+ * Create anon server credentials for for the
|
|
+ * spoolss.notify test.
|
|
*/
|
|
+ server_credentials = cli_credentials_init_anon(req);
|
|
+ if (server_credentials == NULL) {
|
|
+ smbsrv_terminate_connection(req->smb_conn,
|
|
+ "Failed to init server credentials\n");
|
|
+ return;
|
|
+ }
|
|
}
|
|
|
|
nt_status = samba_server_gensec_start(req,
|
|
diff --git a/source4/smb_server/smb2/negprot.c b/source4/smb_server/smb2/negprot.c
|
|
index 4aaaf46793b..c433eb194bd 100644
|
|
--- a/source4/smb_server/smb2/negprot.c
|
|
+++ b/source4/smb_server/smb2/negprot.c
|
|
@@ -39,20 +39,21 @@ static NTSTATUS smb2srv_negprot_secblob(struct smb2srv_request *req, DATA_BLOB *
|
|
NTSTATUS nt_status;
|
|
struct cli_credentials *server_credentials;
|
|
|
|
- server_credentials = cli_credentials_init(req);
|
|
- if (!server_credentials) {
|
|
- smbsrv_terminate_connection(req->smb_conn, "Failed to init server credentials\n");
|
|
- return NT_STATUS_NO_MEMORY;
|
|
- }
|
|
-
|
|
- cli_credentials_set_conf(server_credentials, req->smb_conn->lp_ctx);
|
|
- nt_status = cli_credentials_set_machine_account(server_credentials, req->smb_conn->lp_ctx);
|
|
- if (!NT_STATUS_IS_OK(nt_status)) {
|
|
- DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status)));
|
|
+ server_credentials =
|
|
+ cli_credentials_init_server(req, req->smb_conn->lp_ctx);
|
|
+ if (server_credentials == NULL) {
|
|
+ DBG_DEBUG("Failed to obtain server credentials, "
|
|
+ "perhaps a standalone server?\n");
|
|
/*
|
|
- * We keep the server_credentials as anonymous
|
|
- * this is required for the spoolss.notify test
|
|
+ * Create anon server credentials for for the
|
|
+ * spoolss.notify test.
|
|
*/
|
|
+ server_credentials = cli_credentials_init_anon(req);
|
|
+ if (server_credentials == NULL) {
|
|
+ smbsrv_terminate_connection(req->smb_conn,
|
|
+ "Failed to init server credentials\n");
|
|
+ return NT_STATUS_NO_MEMORY;
|
|
+ }
|
|
}
|
|
|
|
req->smb_conn->negotiate.server_credentials = talloc_steal(req->smb_conn, server_credentials);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From c3b277172554d1d3155c3a1b4ad76685985273df Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 8 Sep 2020 10:15:22 +0200
|
|
Subject: [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb
|
|
encrypt'
|
|
|
|
This makes it more clear what we want. 'smb encrypt' is a synonym for
|
|
'server smb encrypt'.
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit c75e8ff47b4d79b37240f9461ddae10a4f03c892)
|
|
---
|
|
selftest/target/Samba3.pm | 6 +++---
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
|
|
index 0a8cefa811d..a31165b372d 100755
|
|
--- a/selftest/target/Samba3.pm
|
|
+++ b/selftest/target/Samba3.pm
|
|
@@ -1178,7 +1178,7 @@ sub setup_simpleserver
|
|
ntlm auth = yes
|
|
vfs objects = xattr_tdb streams_depot
|
|
change notify = no
|
|
- smb encrypt = off
|
|
+ server smb encrypt = off
|
|
|
|
[vfs_aio_pthread]
|
|
path = $prefix_abs/share
|
|
@@ -1245,7 +1245,7 @@ sub setup_simpleserver
|
|
[enc_desired]
|
|
path = $prefix_abs/share
|
|
vfs objects =
|
|
- smb encrypt = desired
|
|
+ server smb encrypt = desired
|
|
|
|
[hidenewfiles]
|
|
path = $prefix_abs/share
|
|
@@ -2340,7 +2340,7 @@ sub provision($$)
|
|
[tmpenc]
|
|
path = $shrdir
|
|
comment = encrypt smb username is [%U]
|
|
- smb encrypt = required
|
|
+ server smb encrypt = required
|
|
vfs objects = dirsort
|
|
[tmpguest]
|
|
path = $shrdir
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 355afa22953cf8838dc83210315bc2557e764082 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 8 Sep 2020 12:30:08 +0200
|
|
Subject: [PATCH 059/105] selftest: Move enc_desired to provision to have it in
|
|
'fileserver' too
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit 1b67943f938ae774360dc3db73db940f9982243b)
|
|
---
|
|
selftest/target/Samba3.pm | 11 ++++++-----
|
|
1 file changed, 6 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
|
|
index a31165b372d..eda2c428793 100755
|
|
--- a/selftest/target/Samba3.pm
|
|
+++ b/selftest/target/Samba3.pm
|
|
@@ -1242,11 +1242,6 @@ sub setup_simpleserver
|
|
hide files = /hidefile/
|
|
hide dot files = yes
|
|
|
|
-[enc_desired]
|
|
- path = $prefix_abs/share
|
|
- vfs objects =
|
|
- server smb encrypt = desired
|
|
-
|
|
[hidenewfiles]
|
|
path = $prefix_abs/share
|
|
hide new files timeout = 5
|
|
@@ -2822,7 +2817,13 @@ sub provision($$)
|
|
[delete_readonly]
|
|
path = $prefix_abs/share
|
|
delete readonly = yes
|
|
+
|
|
+[enc_desired]
|
|
+ path = $prefix_abs/share
|
|
+ vfs objects =
|
|
+ server smb encrypt = desired
|
|
";
|
|
+
|
|
close(CONF);
|
|
|
|
my $net = Samba::bindir_path($self, "net");
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 2a8b98850f61219a1c97da9151e55d0e21a4265b Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 8 Sep 2020 10:15:20 +0200
|
|
Subject: [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb
|
|
encrypt'
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit e7577ab6cbc83b496ac091c3e425c7c7fea29cdb)
|
|
---
|
|
selftest/knownfail.d/smbclient-encryption | 2 +
|
|
selftest/target/Samba3.pm | 5 ++
|
|
.../script/tests/test_smbclient_encryption.sh | 72 +++++++++++++++++++
|
|
source3/selftest/tests.py | 6 ++
|
|
4 files changed, 85 insertions(+)
|
|
create mode 100644 selftest/knownfail.d/smbclient-encryption
|
|
create mode 100755 source3/script/tests/test_smbclient_encryption.sh
|
|
|
|
diff --git a/selftest/knownfail.d/smbclient-encryption b/selftest/knownfail.d/smbclient-encryption
|
|
new file mode 100644
|
|
index 00000000000..972096bdc8b
|
|
--- /dev/null
|
|
+++ b/selftest/knownfail.d/smbclient-encryption
|
|
@@ -0,0 +1,2 @@
|
|
+^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver
|
|
+^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver
|
|
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
|
|
index eda2c428793..9f86f2b59cf 100755
|
|
--- a/selftest/target/Samba3.pm
|
|
+++ b/selftest/target/Samba3.pm
|
|
@@ -2822,6 +2822,11 @@ sub provision($$)
|
|
path = $prefix_abs/share
|
|
vfs objects =
|
|
server smb encrypt = desired
|
|
+
|
|
+[enc_off]
|
|
+ path = $prefix_abs/share
|
|
+ vfs objects =
|
|
+ server smb encrypt = off
|
|
";
|
|
|
|
close(CONF);
|
|
diff --git a/source3/script/tests/test_smbclient_encryption.sh b/source3/script/tests/test_smbclient_encryption.sh
|
|
new file mode 100755
|
|
index 00000000000..9a717cdac4f
|
|
--- /dev/null
|
|
+++ b/source3/script/tests/test_smbclient_encryption.sh
|
|
@@ -0,0 +1,72 @@
|
|
+#!/bin/sh
|
|
+
|
|
+if [ $# -lt 5 ]; then
|
|
+cat <<EOF
|
|
+Usage: test_smbclient_encryption.sh USERNAME PASSWORD SERVER SMBCLIENT TARGET
|
|
+EOF
|
|
+exit 1;
|
|
+fi
|
|
+
|
|
+USERNAME="$1"
|
|
+PASSWORD="$2"
|
|
+SERVER="$3"
|
|
+SMBCLIENT="$VALGRIND $4"
|
|
+TARGET="$5"
|
|
+shift 5
|
|
+
|
|
+incdir=`dirname $0`/../../../testprogs/blackbox
|
|
+. $incdir/subunit.sh
|
|
+
|
|
+failed=0
|
|
+
|
|
+#
|
|
+# Server configuration for fileserver:
|
|
+#
|
|
+# global: 'server smb encrypt = default'
|
|
+# enc_desired: 'server smb encrypt = desired'
|
|
+# tmpenc: 'server smb encrypt = required'
|
|
+# tmp: has the global default 'server smb encrypt'
|
|
+#
|
|
+# Server configuration for simpleserver:
|
|
+#
|
|
+# global: 'server smb encrypt = off'
|
|
+# enc_desired: 'server smb encrypt = desired'
|
|
+# tmpenc: 'server smb encrypt = required'
|
|
+# tmp: has the global default 'server smb encrypt'
|
|
+#
|
|
+
|
|
+testit "smbclient.smb3.client.encrypt.desired[//$SERVER/enc_desired]" $SMBCLIENT //$SERVER/enc_desired -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=desired -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+if [ "$TARGET" = "fileserver" ]; then
|
|
+ testit "smbclient.smb3.client.encrypt.desired[//$SERVER/tmpenc]" $SMBCLIENT //$SERVER/tmpenc -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=desired -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+elif [ "$TARGET" = "simpleserver" ]; then # Encryption is globally disabled
|
|
+ testit_expect_failure "smbclient.smb3.client.encrypt.desired[//$SERVER/tmpenc]" $SMBCLIENT //$SERVER/tmpenc -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=desired -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+fi
|
|
+testit "smbclient.smb3.client.encrypt.desired[//$SERVER/tmp]" $SMBCLIENT //$SERVER/tmp -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=desired -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+
|
|
+testit "smbclient.smb3.client.encrypt.if_required[//$SERVER/enc_desired]" $SMBCLIENT //$SERVER/enc_desired -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=if_required -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+if [ "$TARGET" = "fileserver" ]; then
|
|
+ testit "smbclient.smb3.client.encrypt.if_required[//$SERVER/tmpenc]" $SMBCLIENT //$SERVER/tmpenc -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=if_required -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+elif [ "$TARGET" = "simpleserver" ]; then # Encryption is globally disabled
|
|
+ testit_expect_failure "smbclient.smb3.client.encrypt.if_required[//$SERVER/tmpenc]" $SMBCLIENT //$SERVER/tmpenc -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=if_required -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+fi
|
|
+testit "smbclient.smb3.client.encrypt.if_required[//$SERVER/tmp]" $SMBCLIENT //$SERVER/tmp -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=if_required -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+
|
|
+if [ "$TARGET" = "fileserver" ]; then
|
|
+ testit "smbclient.smb3.client.encrypt.required[//$SERVER/enc_desired]" $SMBCLIENT //$SERVER/enc_desired -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=required -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+ testit "smbclient.smb3.client.encrypt.required[//$SERVER/tmpenc]" $SMBCLIENT //$SERVER/tmpenc -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=required -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+ testit "smbclient.smb3.client.encrypt.required[//$SERVER/tmp]" $SMBCLIENT //$SERVER/tmp -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=required -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+elif [ "$TARGET" = "simpleserver" ]; then # Encryption is globally disabled
|
|
+ testit_expect_failure "smbclient.smb3.client.encrypt.required[//$SERVER/enc_desired]" $SMBCLIENT //$SERVER/enc_desired -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=required -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+ testit_expect_failure "smbclient.smb3.client.encrypt.required[//$SERVER/tmpenc]" $SMBCLIENT //$SERVER/tmpenc -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=required -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+ testit_expect_failure "smbclient.smb3.client.encrypt.required[//$SERVER/tmp]" $SMBCLIENT //$SERVER/tmp -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=required -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+fi
|
|
+
|
|
+testit "smbclient.smb3.client.encrypt.off[//$SERVER/enc_desired]" $SMBCLIENT //$SERVER/enc_desired -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=off -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+if [ "$TARGET" = "fileserver" ]; then
|
|
+ testit "smbclient.smb3.client.encrypt.off[//$SERVER/tmpenc]" $SMBCLIENT //$SERVER/tmpenc -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=off -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+elif [ "$TARGET" = "simpleserver" ]; then # Encryption is globally disabled
|
|
+ testit_expect_failure "smbclient.smb3.client.encrypt.off[//$SERVER/tmpenc]" $SMBCLIENT //$SERVER/tmpenc -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=off -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+fi
|
|
+testit "smbclient.smb3.client.encrypt.off[//$SERVER/tmp]" $SMBCLIENT //$SERVER/tmp -U$USERNAME%$PASSWORD -mSMB3 --option=clientsmbencrypt=off -c 'ls; quit' || failed=`expr $failed + 1`
|
|
+
|
|
+testok $0 $failed
|
|
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
|
|
index d05de6bd08c..ec967caea2e 100755
|
|
--- a/source3/selftest/tests.py
|
|
+++ b/source3/selftest/tests.py
|
|
@@ -1040,6 +1040,12 @@ plantestsuite("samba3.blackbox.smbclient.encryption_off", "simpleserver",
|
|
"$USERNAME", "$PASSWORD", "$SERVER",
|
|
smbclient3])
|
|
|
|
+for env in ['fileserver', 'simpleserver']:
|
|
+ plantestsuite("samba3.blackbox.smbclient.encryption", env,
|
|
+ [os.path.join(samba3srcdir, "script/tests/test_smbclient_encryption.sh"),
|
|
+ "$USERNAME", "$PASSWORD", "$SERVER",
|
|
+ smbclient3, env])
|
|
+
|
|
plantestsuite("samba3.blackbox.rpcclient_netsessenum", "ad_member",
|
|
[os.path.join(samba3srcdir,
|
|
"script/tests/test_rpcclient_netsessenum.sh"),
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 45ebf91c66a23488c0835ba038eca345db984106 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 27 Aug 2020 15:19:27 +0200
|
|
Subject: [PATCH 061/105] s3:client: Remove global smb_encrypt
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit 1189b20cb7ea09cfed5c246cf977442a51ef72cb)
|
|
---
|
|
source3/client/client.c | 25 ++++++++++++++++---------
|
|
1 file changed, 16 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/source3/client/client.c b/source3/client/client.c
|
|
index 30287ffd253..e1128bf4a8c 100644
|
|
--- a/source3/client/client.c
|
|
+++ b/source3/client/client.c
|
|
@@ -98,9 +98,6 @@ static unsigned int put_total_time_ms = 0;
|
|
/* totals globals */
|
|
static double dir_total;
|
|
|
|
-/* encrypted state. */
|
|
-static bool smb_encrypt;
|
|
-
|
|
/* root cli_state connection */
|
|
|
|
struct cli_state *cli;
|
|
@@ -2822,7 +2819,7 @@ static int cmd_posix_encrypt(void)
|
|
d_printf("posix_encrypt failed with error %s\n", nt_errstr(status));
|
|
} else {
|
|
d_printf("encryption on\n");
|
|
- smb_encrypt = true;
|
|
+ set_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info());
|
|
}
|
|
|
|
return 0;
|
|
@@ -5347,6 +5344,9 @@ int cmd_iosize(void)
|
|
TALLOC_CTX *ctx = talloc_tos();
|
|
char *buf;
|
|
int iosize;
|
|
+ bool smb_encrypt =
|
|
+ get_cmdline_auth_info_smb_encrypt(
|
|
+ popt_get_cmdline_auth_info());
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) {
|
|
if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_SMB2_02) {
|
|
@@ -5610,6 +5610,9 @@ static int process_command_string(const char *cmd_in)
|
|
TALLOC_CTX *ctx = talloc_tos();
|
|
char *cmd = talloc_strdup(ctx, cmd_in);
|
|
int rc = 0;
|
|
+ bool smb_encrypt =
|
|
+ get_cmdline_auth_info_smb_encrypt(
|
|
+ popt_get_cmdline_auth_info());
|
|
|
|
if (!cmd) {
|
|
return 1;
|
|
@@ -6063,6 +6066,9 @@ static int process(const char *base_directory)
|
|
{
|
|
int rc = 0;
|
|
NTSTATUS status;
|
|
+ bool smb_encrypt =
|
|
+ get_cmdline_auth_info_smb_encrypt(
|
|
+ popt_get_cmdline_auth_info());
|
|
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
desthost,
|
|
@@ -6101,6 +6107,9 @@ static int process(const char *base_directory)
|
|
static int do_host_query(const char *query_host)
|
|
{
|
|
NTSTATUS status;
|
|
+ bool smb_encrypt =
|
|
+ get_cmdline_auth_info_smb_encrypt(
|
|
+ popt_get_cmdline_auth_info());
|
|
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
query_host,
|
|
@@ -6178,6 +6187,9 @@ static int do_tar_op(const char *base_directory)
|
|
{
|
|
struct tar *tar_ctx = tar_get_ctx();
|
|
int ret = 0;
|
|
+ bool smb_encrypt =
|
|
+ get_cmdline_auth_info_smb_encrypt(
|
|
+ popt_get_cmdline_auth_info());
|
|
|
|
/* do we already have a connection? */
|
|
if (!cli) {
|
|
@@ -6523,9 +6535,6 @@ int main(int argc,char *argv[])
|
|
case 'q':
|
|
quiet=true;
|
|
break;
|
|
- case 'e':
|
|
- smb_encrypt=true;
|
|
- break;
|
|
case 'B':
|
|
return(do_smb_browse());
|
|
|
|
@@ -6595,8 +6604,6 @@ int main(int argc,char *argv[])
|
|
|
|
/* Ensure we have a password (or equivalent). */
|
|
popt_common_credentials_post();
|
|
- smb_encrypt = get_cmdline_auth_info_smb_encrypt(
|
|
- popt_get_cmdline_auth_info());
|
|
|
|
max_protocol = lp_client_max_protocol();
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 088473e47bcb30fe3b179133265da9ea6b8ec684 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 27 Aug 2020 15:24:27 +0200
|
|
Subject: [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit a9fbc8dae878ddfa54153e91cc1128c307816b76)
|
|
---
|
|
source3/client/client.c | 21 ++++-----------------
|
|
source3/lib/netapi/cm.c | 1 -
|
|
source3/libsmb/clidfs.c | 4 ++--
|
|
source3/libsmb/proto.h | 1 -
|
|
4 files changed, 6 insertions(+), 21 deletions(-)
|
|
|
|
diff --git a/source3/client/client.c b/source3/client/client.c
|
|
index e1128bf4a8c..1f18024b798 100644
|
|
--- a/source3/client/client.c
|
|
+++ b/source3/client/client.c
|
|
@@ -5610,9 +5610,6 @@ static int process_command_string(const char *cmd_in)
|
|
TALLOC_CTX *ctx = talloc_tos();
|
|
char *cmd = talloc_strdup(ctx, cmd_in);
|
|
int rc = 0;
|
|
- bool smb_encrypt =
|
|
- get_cmdline_auth_info_smb_encrypt(
|
|
- popt_get_cmdline_auth_info());
|
|
|
|
if (!cmd) {
|
|
return 1;
|
|
@@ -5625,7 +5622,6 @@ static int process_command_string(const char *cmd_in)
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
desthost,
|
|
service, popt_get_cmdline_auth_info(),
|
|
- smb_encrypt,
|
|
max_protocol,
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type,
|
|
@@ -6066,14 +6062,11 @@ static int process(const char *base_directory)
|
|
{
|
|
int rc = 0;
|
|
NTSTATUS status;
|
|
- bool smb_encrypt =
|
|
- get_cmdline_auth_info_smb_encrypt(
|
|
- popt_get_cmdline_auth_info());
|
|
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
desthost,
|
|
service, popt_get_cmdline_auth_info(),
|
|
- smb_encrypt, max_protocol,
|
|
+ max_protocol,
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -6107,14 +6100,11 @@ static int process(const char *base_directory)
|
|
static int do_host_query(const char *query_host)
|
|
{
|
|
NTSTATUS status;
|
|
- bool smb_encrypt =
|
|
- get_cmdline_auth_info_smb_encrypt(
|
|
- popt_get_cmdline_auth_info());
|
|
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
query_host,
|
|
"IPC$", popt_get_cmdline_auth_info(),
|
|
- smb_encrypt, max_protocol,
|
|
+ max_protocol,
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -6161,7 +6151,7 @@ static int do_host_query(const char *query_host)
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
query_host,
|
|
"IPC$", popt_get_cmdline_auth_info(),
|
|
- smb_encrypt, max_proto,
|
|
+ max_proto,
|
|
have_ip ? &dest_ss : NULL, NBT_SMB_PORT,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -6187,9 +6177,6 @@ static int do_tar_op(const char *base_directory)
|
|
{
|
|
struct tar *tar_ctx = tar_get_ctx();
|
|
int ret = 0;
|
|
- bool smb_encrypt =
|
|
- get_cmdline_auth_info_smb_encrypt(
|
|
- popt_get_cmdline_auth_info());
|
|
|
|
/* do we already have a connection? */
|
|
if (!cli) {
|
|
@@ -6198,7 +6185,7 @@ static int do_tar_op(const char *base_directory)
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
desthost,
|
|
service, popt_get_cmdline_auth_info(),
|
|
- smb_encrypt, max_protocol,
|
|
+ max_protocol,
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c
|
|
index 1b8f2a4e97a..0fd31ef3d5a 100644
|
|
--- a/source3/lib/netapi/cm.c
|
|
+++ b/source3/lib/netapi/cm.c
|
|
@@ -110,7 +110,6 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx,
|
|
status = cli_cm_open(ctx, NULL,
|
|
server_name, "IPC$",
|
|
auth_info,
|
|
- false,
|
|
lp_client_ipc_max_protocol(),
|
|
NULL, 0, 0x20, &cli_ipc);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index aff998f6187..4825b8f3fae 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -383,7 +383,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
const char *server,
|
|
const char *share,
|
|
const struct user_auth_info *auth_info,
|
|
- bool force_encrypt,
|
|
int max_protocol,
|
|
const struct sockaddr_storage *dest_ss,
|
|
int port,
|
|
@@ -393,6 +392,8 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
/* Try to reuse an existing connection in this list. */
|
|
struct cli_state *c = cli_cm_find(referring_cli, server, share);
|
|
NTSTATUS status;
|
|
+ bool force_encrypt =
|
|
+ get_cmdline_auth_info_smb_encrypt(auth_info);
|
|
|
|
if (c) {
|
|
*pcli = c;
|
|
@@ -962,7 +963,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
smbXcli_conn_remote_name(rootcli->conn),
|
|
"IPC$",
|
|
dfs_auth_info,
|
|
- cli_state_is_encryption_on(rootcli),
|
|
smbXcli_conn_protocol(rootcli->conn),
|
|
NULL, /* dest_ss not needed, we reuse the transport */
|
|
0,
|
|
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
|
|
index eeabcaa7463..bb3e9e6874e 100644
|
|
--- a/source3/libsmb/proto.h
|
|
+++ b/source3/libsmb/proto.h
|
|
@@ -128,7 +128,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
const char *server,
|
|
const char *share,
|
|
const struct user_auth_info *auth_info,
|
|
- bool force_encrypt,
|
|
int max_protocol,
|
|
const struct sockaddr_storage *dest_ss,
|
|
int port,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 0291ff12056c914b3f9429a5bba48190897fe6c1 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 27 Aug 2020 15:26:39 +0200
|
|
Subject: [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit d27e237cf37fb254646d94827935d9c302c379ff)
|
|
---
|
|
source3/libsmb/clidfs.c | 7 ++-----
|
|
1 file changed, 2 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index 4825b8f3fae..b0032005398 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -287,7 +287,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx,
|
|
const char *server,
|
|
const char *share,
|
|
const struct user_auth_info *auth_info,
|
|
- bool force_encrypt,
|
|
int max_protocol,
|
|
const struct sockaddr_storage *dest_ss,
|
|
int port,
|
|
@@ -296,6 +295,8 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx,
|
|
{
|
|
struct cli_state *cli = NULL;
|
|
NTSTATUS status;
|
|
+ bool force_encrypt =
|
|
+ get_cmdline_auth_info_smb_encrypt(auth_info);
|
|
|
|
status = do_connect(ctx, server, share,
|
|
auth_info,
|
|
@@ -392,8 +393,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
/* Try to reuse an existing connection in this list. */
|
|
struct cli_state *c = cli_cm_find(referring_cli, server, share);
|
|
NTSTATUS status;
|
|
- bool force_encrypt =
|
|
- get_cmdline_auth_info_smb_encrypt(auth_info);
|
|
|
|
if (c) {
|
|
*pcli = c;
|
|
@@ -414,7 +413,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
server,
|
|
share,
|
|
auth_info,
|
|
- force_encrypt,
|
|
max_protocol,
|
|
dest_ss,
|
|
port,
|
|
@@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
dfs_refs[count].server,
|
|
dfs_refs[count].share,
|
|
dfs_auth_info,
|
|
- cli_state_is_encryption_on(rootcli),
|
|
smbXcli_conn_protocol(rootcli->conn),
|
|
NULL, /* dest_ss */
|
|
0, /* port */
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 32f7fd016ecbeb3b24ad93d593ba06e8292dd02f Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 27 Aug 2020 15:28:28 +0200
|
|
Subject: [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs
|
|
do_connect()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit 615a9a68166bdeb0ab7dbacf395c6125ec70f288)
|
|
---
|
|
source3/libsmb/clidfs.c | 9 ++++-----
|
|
1 file changed, 4 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index b0032005398..5503506de97 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
const char *server,
|
|
const char *share,
|
|
const struct user_auth_info *auth_info,
|
|
- bool force_encrypt,
|
|
int max_protocol,
|
|
const struct sockaddr_storage *dest_ss,
|
|
int port,
|
|
@@ -123,6 +122,8 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
enum protocol_types protocol = PROTOCOL_NONE;
|
|
int signing_state = get_cmdline_auth_info_signing_state(auth_info);
|
|
struct cli_credentials *creds = NULL;
|
|
+ bool force_encrypt =
|
|
+ get_cmdline_auth_info_smb_encrypt(auth_info);
|
|
|
|
if (force_encrypt) {
|
|
signing_state = SMB_SIGNING_REQUIRED;
|
|
@@ -233,7 +234,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
cli_shutdown(c);
|
|
return do_connect(ctx, newserver,
|
|
newshare, auth_info,
|
|
- force_encrypt, max_protocol,
|
|
+ max_protocol,
|
|
NULL, port, name_type, pcli);
|
|
}
|
|
|
|
@@ -295,12 +296,10 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx,
|
|
{
|
|
struct cli_state *cli = NULL;
|
|
NTSTATUS status;
|
|
- bool force_encrypt =
|
|
- get_cmdline_auth_info_smb_encrypt(auth_info);
|
|
|
|
status = do_connect(ctx, server, share,
|
|
auth_info,
|
|
- force_encrypt, max_protocol,
|
|
+ max_protocol,
|
|
dest_ss, port, name_type, &cli);
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 4afc92a55aa63557db2b4e2a9b0bbe5bc7d12c55 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 27 Aug 2020 15:52:11 +0200
|
|
Subject: [PATCH 065/105] s3:libsmb: Remove force_encrypt from
|
|
cli_check_msdfs_proxy()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit 4ddec1ca257fff418847c5d1e83a3fb7cb5ade1a)
|
|
---
|
|
source3/libsmb/clidfs.c | 17 ++++++++++++-----
|
|
source3/libsmb/libsmb_server.c | 4 ----
|
|
source3/libsmb/proto.h | 1 -
|
|
3 files changed, 12 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index 5503506de97..736c565a7a8 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -230,7 +230,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
if (smbXcli_conn_dfs_supported(c->conn) &&
|
|
cli_check_msdfs_proxy(ctx, c, sharename,
|
|
&newserver, &newshare,
|
|
- force_encrypt, creds)) {
|
|
+ creds)) {
|
|
cli_shutdown(c);
|
|
return do_connect(ctx, newserver,
|
|
newshare, auth_info,
|
|
@@ -1176,7 +1176,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx,
|
|
const char *sharename,
|
|
char **pp_newserver,
|
|
char **pp_newshare,
|
|
- bool force_encrypt,
|
|
struct cli_credentials *creds)
|
|
{
|
|
struct client_dfs_referral *refs = NULL;
|
|
@@ -1188,6 +1187,8 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx,
|
|
char *newextrapath = NULL;
|
|
NTSTATUS status;
|
|
const char *remote_name;
|
|
+ enum smb_encryption_setting encryption_state =
|
|
+ cli_credentials_get_smb_encryption(creds);
|
|
|
|
if (!cli || !sharename) {
|
|
return false;
|
|
@@ -1223,11 +1224,17 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx,
|
|
return false;
|
|
}
|
|
|
|
- if (force_encrypt) {
|
|
+ if (encryption_state >= SMB_ENCRYPTION_DESIRED) {
|
|
status = cli_cm_force_encryption_creds(cli, creds, "IPC$");
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
- cli_state_restore_tcon(cli, orig_tcon);
|
|
- return false;
|
|
+ switch (encryption_state) {
|
|
+ case SMB_ENCRYPTION_DESIRED:
|
|
+ break;
|
|
+ case SMB_ENCRYPTION_REQUIRED:
|
|
+ default:
|
|
+ cli_state_restore_tcon(cli, orig_tcon);
|
|
+ return false;
|
|
+ }
|
|
}
|
|
}
|
|
|
|
diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c
|
|
index eb58d7c6ac9..5a1055ba773 100644
|
|
--- a/source3/libsmb/libsmb_server.c
|
|
+++ b/source3/libsmb/libsmb_server.c
|
|
@@ -587,10 +587,6 @@ SMBC_server_internal(TALLOC_CTX *ctx,
|
|
if (smbXcli_conn_dfs_supported(c->conn) &&
|
|
cli_check_msdfs_proxy(ctx, c, share,
|
|
&newserver, &newshare,
|
|
- /* FIXME: cli_check_msdfs_proxy() does
|
|
- not support smbc_smb_encrypt_level type */
|
|
- context->internal->smb_encryption_level ?
|
|
- true : false,
|
|
creds)) {
|
|
cli_shutdown(c);
|
|
srv = SMBC_server_internal(ctx, context, connect_if_not_found,
|
|
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
|
|
index bb3e9e6874e..f2b0a8c5ff8 100644
|
|
--- a/source3/libsmb/proto.h
|
|
+++ b/source3/libsmb/proto.h
|
|
@@ -161,7 +161,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx,
|
|
const char *sharename,
|
|
char **pp_newserver,
|
|
char **pp_newshare,
|
|
- bool force_encrypt,
|
|
struct cli_credentials *creds);
|
|
|
|
/* The following definitions come from libsmb/clientgen.c */
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 2c50d0ba7eec6d37943b7afdf426b114c9e1f292 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 18 Aug 2020 17:15:09 +0200
|
|
Subject: [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs
|
|
do_connect()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit 276563de06f2071ec2ed9a8b73f92215ab621bba)
|
|
---
|
|
selftest/knownfail.d/smbclient-encryption | 2 --
|
|
source3/libsmb/clidfs.c | 34 +++++++++++++----------
|
|
2 files changed, 20 insertions(+), 16 deletions(-)
|
|
delete mode 100644 selftest/knownfail.d/smbclient-encryption
|
|
|
|
diff --git a/selftest/knownfail.d/smbclient-encryption b/selftest/knownfail.d/smbclient-encryption
|
|
deleted file mode 100644
|
|
index 972096bdc8b..00000000000
|
|
--- a/selftest/knownfail.d/smbclient-encryption
|
|
+++ /dev/null
|
|
@@ -1,2 +0,0 @@
|
|
-^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver
|
|
-^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index 736c565a7a8..d536e0597af 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -106,7 +106,7 @@ static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c,
|
|
static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
const char *server,
|
|
const char *share,
|
|
- const struct user_auth_info *auth_info,
|
|
+ struct cli_credentials *creds,
|
|
int max_protocol,
|
|
const struct sockaddr_storage *dest_ss,
|
|
int port,
|
|
@@ -120,12 +120,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
NTSTATUS status;
|
|
int flags = 0;
|
|
enum protocol_types protocol = PROTOCOL_NONE;
|
|
- int signing_state = get_cmdline_auth_info_signing_state(auth_info);
|
|
- struct cli_credentials *creds = NULL;
|
|
- bool force_encrypt =
|
|
- get_cmdline_auth_info_smb_encrypt(auth_info);
|
|
+ enum smb_signing_setting signing_state =
|
|
+ cli_credentials_get_smb_signing(creds);
|
|
+ enum smb_encryption_setting encryption_state =
|
|
+ cli_credentials_get_smb_encryption(creds);
|
|
|
|
- if (force_encrypt) {
|
|
+ if (encryption_state >= SMB_ENCRYPTION_DESIRED) {
|
|
signing_state = SMB_SIGNING_REQUIRED;
|
|
}
|
|
|
|
@@ -192,13 +192,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
smb2cli_conn_set_max_credits(c->conn, DEFAULT_SMB2_MAX_CREDITS);
|
|
}
|
|
|
|
- creds = get_cmdline_auth_info_creds(auth_info);
|
|
-
|
|
status = cli_session_setup_creds(c, creds);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
/* If a password was not supplied then
|
|
* try again with a null username. */
|
|
- if (force_encrypt || smbXcli_conn_signing_mandatory(c->conn) ||
|
|
+ if (encryption_state == SMB_ENCRYPTION_REQUIRED ||
|
|
+ smbXcli_conn_signing_mandatory(c->conn) ||
|
|
cli_credentials_authentication_requested(creds) ||
|
|
cli_credentials_is_anonymous(creds) ||
|
|
!NT_STATUS_IS_OK(status = cli_session_setup_anon(c)))
|
|
@@ -233,7 +232,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
creds)) {
|
|
cli_shutdown(c);
|
|
return do_connect(ctx, newserver,
|
|
- newshare, auth_info,
|
|
+ newshare, creds,
|
|
max_protocol,
|
|
NULL, port, name_type, pcli);
|
|
}
|
|
@@ -247,13 +246,19 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
return status;
|
|
}
|
|
|
|
- if (force_encrypt) {
|
|
+ if (encryption_state >= SMB_ENCRYPTION_DESIRED) {
|
|
status = cli_cm_force_encryption_creds(c,
|
|
creds,
|
|
sharename);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
- cli_shutdown(c);
|
|
- return status;
|
|
+ switch (encryption_state) {
|
|
+ case SMB_ENCRYPTION_DESIRED:
|
|
+ break;
|
|
+ case SMB_ENCRYPTION_REQUIRED:
|
|
+ default:
|
|
+ cli_shutdown(c);
|
|
+ return status;
|
|
+ }
|
|
}
|
|
}
|
|
|
|
@@ -295,10 +300,11 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx,
|
|
struct cli_state **pcli)
|
|
{
|
|
struct cli_state *cli = NULL;
|
|
+ struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info);
|
|
NTSTATUS status;
|
|
|
|
status = do_connect(ctx, server, share,
|
|
- auth_info,
|
|
+ creds,
|
|
max_protocol,
|
|
dest_ss, port, name_type, &cli);
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 608c0b87761f75e539b2e1e7599ceb981770b647 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 18 Aug 2020 17:18:16 +0200
|
|
Subject: [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit c8349111243fec81a2b95484e56a6d6bebaba80e)
|
|
---
|
|
source3/libsmb/clidfs.c | 9 +++++----
|
|
1 file changed, 5 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index d536e0597af..a2c6f5fe5ec 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -292,7 +292,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx,
|
|
struct cli_state *referring_cli,
|
|
const char *server,
|
|
const char *share,
|
|
- const struct user_auth_info *auth_info,
|
|
+ struct cli_credentials *creds,
|
|
int max_protocol,
|
|
const struct sockaddr_storage *dest_ss,
|
|
int port,
|
|
@@ -300,7 +300,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx,
|
|
struct cli_state **pcli)
|
|
{
|
|
struct cli_state *cli = NULL;
|
|
- struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info);
|
|
NTSTATUS status;
|
|
|
|
status = do_connect(ctx, server, share,
|
|
@@ -397,6 +396,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
{
|
|
/* Try to reuse an existing connection in this list. */
|
|
struct cli_state *c = cli_cm_find(referring_cli, server, share);
|
|
+ struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info);
|
|
NTSTATUS status;
|
|
|
|
if (c) {
|
|
@@ -417,7 +417,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
referring_cli,
|
|
server,
|
|
share,
|
|
- auth_info,
|
|
+ creds,
|
|
max_protocol,
|
|
dest_ss,
|
|
port,
|
|
@@ -886,6 +886,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
struct smbXcli_tcon *root_tcon = NULL;
|
|
struct smbXcli_tcon *target_tcon = NULL;
|
|
struct cli_dfs_path_split *dfs_refs = NULL;
|
|
+ struct cli_credentials *creds = get_cmdline_auth_info_creds(dfs_auth_info);
|
|
|
|
if ( !rootcli || !path || !targetcli ) {
|
|
return NT_STATUS_INVALID_PARAMETER;
|
|
@@ -1022,7 +1023,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
status = cli_cm_connect(ctx, rootcli,
|
|
dfs_refs[count].server,
|
|
dfs_refs[count].share,
|
|
- dfs_auth_info,
|
|
+ creds,
|
|
smbXcli_conn_protocol(rootcli->conn),
|
|
NULL, /* dest_ss */
|
|
0, /* port */
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From d6d5da0e28c3879280e1139f51bfe2ef03bc450e Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 18 Aug 2020 17:26:54 +0200
|
|
Subject: [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit df1623abd7267916696e2e60c146ef8fa6c9dfc9)
|
|
---
|
|
source3/client/client.c | 23 ++++++++++++++++++-----
|
|
source3/lib/netapi/cm.c | 4 +++-
|
|
source3/libsmb/clidfs.c | 25 ++++++++++++-------------
|
|
source3/libsmb/proto.h | 18 +++++++++---------
|
|
4 files changed, 42 insertions(+), 28 deletions(-)
|
|
|
|
diff --git a/source3/client/client.c b/source3/client/client.c
|
|
index 1f18024b798..35bc3a7c5c3 100644
|
|
--- a/source3/client/client.c
|
|
+++ b/source3/client/client.c
|
|
@@ -5610,6 +5610,8 @@ static int process_command_string(const char *cmd_in)
|
|
TALLOC_CTX *ctx = talloc_tos();
|
|
char *cmd = talloc_strdup(ctx, cmd_in);
|
|
int rc = 0;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
|
|
if (!cmd) {
|
|
return 1;
|
|
@@ -5621,7 +5623,8 @@ static int process_command_string(const char *cmd_in)
|
|
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
desthost,
|
|
- service, popt_get_cmdline_auth_info(),
|
|
+ service,
|
|
+ creds,
|
|
max_protocol,
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type,
|
|
@@ -6062,10 +6065,13 @@ static int process(const char *base_directory)
|
|
{
|
|
int rc = 0;
|
|
NTSTATUS status;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
desthost,
|
|
- service, popt_get_cmdline_auth_info(),
|
|
+ service,
|
|
+ creds,
|
|
max_protocol,
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
@@ -6100,10 +6106,13 @@ static int process(const char *base_directory)
|
|
static int do_host_query(const char *query_host)
|
|
{
|
|
NTSTATUS status;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
query_host,
|
|
- "IPC$", popt_get_cmdline_auth_info(),
|
|
+ "IPC$",
|
|
+ creds,
|
|
max_protocol,
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
@@ -6150,7 +6159,8 @@ static int do_host_query(const char *query_host)
|
|
d_printf("Reconnecting with SMB1 for workgroup listing.\n");
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
query_host,
|
|
- "IPC$", popt_get_cmdline_auth_info(),
|
|
+ "IPC$",
|
|
+ creds,
|
|
max_proto,
|
|
have_ip ? &dest_ss : NULL, NBT_SMB_PORT,
|
|
name_type, &cli);
|
|
@@ -6177,6 +6187,8 @@ static int do_tar_op(const char *base_directory)
|
|
{
|
|
struct tar *tar_ctx = tar_get_ctx();
|
|
int ret = 0;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
|
|
/* do we already have a connection? */
|
|
if (!cli) {
|
|
@@ -6184,7 +6196,8 @@ static int do_tar_op(const char *base_directory)
|
|
|
|
status = cli_cm_open(talloc_tos(), NULL,
|
|
desthost,
|
|
- service, popt_get_cmdline_auth_info(),
|
|
+ service,
|
|
+ creds,
|
|
max_protocol,
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c
|
|
index 0fd31ef3d5a..943f7498e8c 100644
|
|
--- a/source3/lib/netapi/cm.c
|
|
+++ b/source3/lib/netapi/cm.c
|
|
@@ -71,6 +71,7 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx,
|
|
struct cli_state *cli_ipc = NULL;
|
|
struct client_ipc_connection *p;
|
|
NTSTATUS status;
|
|
+ struct cli_credentials *creds = NULL;
|
|
|
|
if (!ctx || !pp || !server_name) {
|
|
return WERR_INVALID_PARAMETER;
|
|
@@ -106,10 +107,11 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx,
|
|
if (ctx->use_ccache) {
|
|
set_cmdline_auth_info_use_ccache(auth_info, true);
|
|
}
|
|
+ creds = get_cmdline_auth_info_creds(auth_info);
|
|
|
|
status = cli_cm_open(ctx, NULL,
|
|
server_name, "IPC$",
|
|
- auth_info,
|
|
+ creds,
|
|
lp_client_ipc_max_protocol(),
|
|
NULL, 0, 0x20, &cli_ipc);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index a2c6f5fe5ec..ef75fb36a45 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -384,19 +384,18 @@ static struct cli_state *cli_cm_find(struct cli_state *cli,
|
|
****************************************************************************/
|
|
|
|
NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
- struct cli_state *referring_cli,
|
|
- const char *server,
|
|
- const char *share,
|
|
- const struct user_auth_info *auth_info,
|
|
- int max_protocol,
|
|
- const struct sockaddr_storage *dest_ss,
|
|
- int port,
|
|
- int name_type,
|
|
- struct cli_state **pcli)
|
|
+ struct cli_state *referring_cli,
|
|
+ const char *server,
|
|
+ const char *share,
|
|
+ struct cli_credentials *creds,
|
|
+ int max_protocol,
|
|
+ const struct sockaddr_storage *dest_ss,
|
|
+ int port,
|
|
+ int name_type,
|
|
+ struct cli_state **pcli)
|
|
{
|
|
/* Try to reuse an existing connection in this list. */
|
|
struct cli_state *c = cli_cm_find(referring_cli, server, share);
|
|
- struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info);
|
|
NTSTATUS status;
|
|
|
|
if (c) {
|
|
@@ -404,11 +403,11 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
- if (auth_info == NULL) {
|
|
+ if (creds == NULL) {
|
|
/* Can't do a new connection
|
|
* without auth info. */
|
|
d_printf("cli_cm_open() Unable to open connection [\\%s\\%s] "
|
|
- "without auth info\n",
|
|
+ "without client credentials\n",
|
|
server, share );
|
|
return NT_STATUS_INVALID_PARAMETER;
|
|
}
|
|
@@ -966,7 +965,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
rootcli,
|
|
smbXcli_conn_remote_name(rootcli->conn),
|
|
"IPC$",
|
|
- dfs_auth_info,
|
|
+ creds,
|
|
smbXcli_conn_protocol(rootcli->conn),
|
|
NULL, /* dest_ss not needed, we reuse the transport */
|
|
0,
|
|
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
|
|
index f2b0a8c5ff8..0b8cf2a6036 100644
|
|
--- a/source3/libsmb/proto.h
|
|
+++ b/source3/libsmb/proto.h
|
|
@@ -124,15 +124,15 @@ struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
|
|
/* The following definitions come from libsmb/clidfs.c */
|
|
|
|
NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
- struct cli_state *referring_cli,
|
|
- const char *server,
|
|
- const char *share,
|
|
- const struct user_auth_info *auth_info,
|
|
- int max_protocol,
|
|
- const struct sockaddr_storage *dest_ss,
|
|
- int port,
|
|
- int name_type,
|
|
- struct cli_state **pcli);
|
|
+ struct cli_state *referring_cli,
|
|
+ const char *server,
|
|
+ const char *share,
|
|
+ struct cli_credentials *creds,
|
|
+ int max_protocol,
|
|
+ const struct sockaddr_storage *dest_ss,
|
|
+ int port,
|
|
+ int name_type,
|
|
+ struct cli_state **pcli);
|
|
void cli_cm_display(struct cli_state *c);
|
|
struct client_dfs_referral;
|
|
NTSTATUS cli_dfs_get_referral_ex(TALLOC_CTX *ctx,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 1c07abb4b9690b62b2ae7841134d7a71e4771bb9 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 18 Aug 2020 17:42:25 +0200
|
|
Subject: [PATCH 069/105] s3:libsmb: Pass cli_credentials to
|
|
cli_resolve_path(), using helper variables.
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Signed-off-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit 5245ab3c4dacc88d5cbe3bb1e3e339e4fb77a4db)
|
|
---
|
|
source3/client/client.c | 148 +++++++++++++++++++++++++++-------
|
|
source3/libsmb/clidfs.c | 5 +-
|
|
source3/libsmb/libsmb_dir.c | 43 ++++++++--
|
|
source3/libsmb/libsmb_file.c | 13 ++-
|
|
source3/libsmb/libsmb_stat.c | 6 +-
|
|
source3/libsmb/libsmb_xattr.c | 13 ++-
|
|
source3/libsmb/proto.h | 2 +-
|
|
source3/utils/smbcacls.c | 5 +-
|
|
8 files changed, 188 insertions(+), 47 deletions(-)
|
|
|
|
diff --git a/source3/client/client.c b/source3/client/client.c
|
|
index 35bc3a7c5c3..23de5befee3 100644
|
|
--- a/source3/client/client.c
|
|
+++ b/source3/client/client.c
|
|
@@ -300,9 +300,14 @@ static int do_dskattr(void)
|
|
struct cli_state *targetcli = NULL;
|
|
char *targetpath = NULL;
|
|
TALLOC_CTX *ctx = talloc_tos();
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), cli,
|
|
+ status = cli_resolve_path(ctx,
|
|
+ "",
|
|
+ creds,
|
|
+ cli,
|
|
client_get_cur_dir(), &targetcli,
|
|
&targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -392,6 +397,8 @@ static int do_cd(const char *new_dir)
|
|
uint32_t attributes;
|
|
int ret = 1;
|
|
TALLOC_CTX *ctx = talloc_stackframe();
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
newdir = talloc_strdup(ctx, new_dir);
|
|
@@ -434,7 +441,8 @@ static int do_cd(const char *new_dir)
|
|
new_cd = client_clean_name(ctx, new_cd);
|
|
client_set_cur_dir(new_cd);
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, new_cd, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("cd %s: %s\n", new_cd, nt_errstr(status));
|
|
@@ -811,6 +819,8 @@ NTSTATUS do_list(const char *mask,
|
|
TALLOC_CTX *ctx = talloc_tos();
|
|
struct cli_state *targetcli = NULL;
|
|
char *targetpath = NULL;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS ret_status = NT_STATUS_OK;
|
|
NTSTATUS status = NT_STATUS_OK;
|
|
|
|
@@ -834,7 +844,7 @@ NTSTATUS do_list(const char *mask,
|
|
/* check for dfs */
|
|
|
|
status = cli_resolve_path(ctx, "",
|
|
- popt_get_cmdline_auth_info(),
|
|
+ creds,
|
|
cli, head, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("do_list: [%s] %s\n", head,
|
|
@@ -1044,6 +1054,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget)
|
|
struct cli_state *targetcli = NULL;
|
|
char *targetname = NULL;
|
|
char *lname = NULL;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
lname = talloc_strdup(ctx, lname_in);
|
|
@@ -1058,7 +1070,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget)
|
|
}
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, rname, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Failed to open %s: %s\n", rname, nt_errstr(status));
|
|
@@ -1477,9 +1490,12 @@ static bool do_mkdir(const char *name)
|
|
TALLOC_CTX *ctx = talloc_tos();
|
|
struct cli_state *targetcli;
|
|
char *targetname = NULL;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, name, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("mkdir %s: %s\n", name, nt_errstr(status));
|
|
@@ -1538,6 +1554,8 @@ static int cmd_mkdir(void)
|
|
TALLOC_CTX *ctx = talloc_tos();
|
|
char *mask = NULL;
|
|
char *buf = NULL;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
mask = talloc_strdup(ctx, client_get_cur_dir());
|
|
@@ -1574,7 +1592,8 @@ static int cmd_mkdir(void)
|
|
}
|
|
|
|
status = cli_resolve_path(ctx, "",
|
|
- popt_get_cmdline_auth_info(), cli, mask,
|
|
+ creds,
|
|
+ cli, mask,
|
|
&targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return 1;
|
|
@@ -1888,9 +1907,12 @@ static int do_put(const char *rname, const char *lname, bool reput)
|
|
struct cli_state *targetcli;
|
|
char *targetname = NULL;
|
|
struct push_state state;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, rname, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Failed to open %s: %s\n", rname, nt_errstr(status));
|
|
@@ -2665,6 +2687,8 @@ static int cmd_wdel(void)
|
|
uint32_t attribute;
|
|
struct cli_state *targetcli;
|
|
char *targetname = NULL;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) {
|
|
@@ -2690,7 +2714,8 @@ static int cmd_wdel(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, mask, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("cmd_wdel %s: %s\n", mask, nt_errstr(status));
|
|
@@ -2716,6 +2741,8 @@ static int cmd_open(void)
|
|
char *targetname = NULL;
|
|
struct cli_state *targetcli;
|
|
uint16_t fnum = (uint16_t)-1;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) {
|
|
@@ -2735,7 +2762,8 @@ static int cmd_open(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, mask, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("open %s: %s\n", mask, nt_errstr(status));
|
|
@@ -2837,6 +2865,8 @@ static int cmd_posix_open(void)
|
|
struct cli_state *targetcli;
|
|
mode_t mode;
|
|
uint16_t fnum;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) {
|
|
@@ -2861,7 +2891,8 @@ static int cmd_posix_open(void)
|
|
}
|
|
mode = (mode_t)strtol(buf, (char **)NULL, 8);
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, mask, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("posix_open %s: %s\n", mask, nt_errstr(status));
|
|
@@ -2896,6 +2927,8 @@ static int cmd_posix_mkdir(void)
|
|
char *targetname = NULL;
|
|
struct cli_state *targetcli;
|
|
mode_t mode;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) {
|
|
@@ -2920,7 +2953,8 @@ static int cmd_posix_mkdir(void)
|
|
}
|
|
mode = (mode_t)strtol(buf, (char **)NULL, 8);
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, mask, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("posix_mkdir %s: %s\n", mask, nt_errstr(status));
|
|
@@ -2944,6 +2978,8 @@ static int cmd_posix_unlink(void)
|
|
char *buf = NULL;
|
|
char *targetname = NULL;
|
|
struct cli_state *targetcli;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) {
|
|
@@ -2962,7 +2998,8 @@ static int cmd_posix_unlink(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, mask, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("posix_unlink %s: %s\n", mask, nt_errstr(status));
|
|
@@ -2987,6 +3024,8 @@ static int cmd_posix_rmdir(void)
|
|
char *buf = NULL;
|
|
char *targetname = NULL;
|
|
struct cli_state *targetcli;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) {
|
|
@@ -3005,7 +3044,8 @@ static int cmd_posix_rmdir(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, mask, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("posix_rmdir %s: %s\n", mask, nt_errstr(status));
|
|
@@ -3294,6 +3334,8 @@ static int cmd_rmdir(void)
|
|
char *buf = NULL;
|
|
char *targetname = NULL;
|
|
struct cli_state *targetcli;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) {
|
|
@@ -3312,7 +3354,8 @@ static int cmd_rmdir(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, mask, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("rmdir %s: %s\n", mask, nt_errstr(status));
|
|
@@ -3341,6 +3384,8 @@ static int cmd_link(void)
|
|
char *buf2 = NULL;
|
|
char *targetname = NULL;
|
|
struct cli_state *targetcli;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) ||
|
|
@@ -3371,7 +3416,8 @@ static int cmd_link(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, oldname, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("link %s: %s\n", oldname, nt_errstr(status));
|
|
@@ -3404,6 +3450,8 @@ static int cmd_readlink(void)
|
|
char *targetname = NULL;
|
|
char *linkname = NULL;
|
|
struct cli_state *targetcli;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) {
|
|
@@ -3422,7 +3470,8 @@ static int cmd_readlink(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, name, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("readlink %s: %s\n", name, nt_errstr(status));
|
|
@@ -3461,6 +3510,8 @@ static int cmd_symlink(void)
|
|
char *buf = NULL;
|
|
char *buf2 = NULL;
|
|
struct cli_state *newcli;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) ||
|
|
@@ -3483,7 +3534,8 @@ static int cmd_symlink(void)
|
|
}
|
|
/* New name must be present in share namespace. */
|
|
status = cli_resolve_path(ctx, "",
|
|
- popt_get_cmdline_auth_info(), cli, newname,
|
|
+ creds,
|
|
+ cli, newname,
|
|
&newcli, &newname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("link %s: %s\n", newname,
|
|
@@ -3519,6 +3571,8 @@ static int cmd_chmod(void)
|
|
char *targetname = NULL;
|
|
struct cli_state *targetcli;
|
|
mode_t mode;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) ||
|
|
@@ -3540,7 +3594,8 @@ static int cmd_chmod(void)
|
|
|
|
mode = (mode_t)strtol(buf, NULL, 8);
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, src, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("chmod %s: %s\n", src, nt_errstr(status));
|
|
@@ -3684,6 +3739,8 @@ static int cmd_getfacl(void)
|
|
size_t num_dir_acls = 0;
|
|
size_t expected_buflen;
|
|
uint16_t i;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) {
|
|
@@ -3702,7 +3759,8 @@ static int cmd_getfacl(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, src, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("stat %s: %s\n", src, nt_errstr(status));
|
|
@@ -3867,6 +3925,8 @@ static int cmd_geteas(void)
|
|
NTSTATUS status;
|
|
size_t i, num_eas;
|
|
struct ea_struct *eas;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) {
|
|
d_printf("geteas filename\n");
|
|
@@ -3884,7 +3944,8 @@ static int cmd_geteas(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, src, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("stat %s: %s\n", src, nt_errstr(status));
|
|
@@ -3923,6 +3984,8 @@ static int cmd_setea(void)
|
|
char *eavalue = NULL;
|
|
char *targetname = NULL;
|
|
struct cli_state *targetcli;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr, &name, NULL)
|
|
@@ -3945,7 +4008,8 @@ static int cmd_setea(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, src, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("stat %s: %s\n", src, nt_errstr(status));
|
|
@@ -3977,6 +4041,8 @@ static int cmd_stat(void)
|
|
SMB_STRUCT_STAT sbuf;
|
|
struct tm *lt;
|
|
time_t tmp_time;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) {
|
|
@@ -3995,7 +4061,8 @@ static int cmd_stat(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, src, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("stat %s: %s\n", src, nt_errstr(status));
|
|
@@ -4084,6 +4151,8 @@ static int cmd_chown(void)
|
|
char *buf, *buf2, *buf3;
|
|
struct cli_state *targetcli;
|
|
char *targetname = NULL;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) ||
|
|
@@ -4107,7 +4176,8 @@ static int cmd_chown(void)
|
|
if (src == NULL) {
|
|
return 1;
|
|
}
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, src, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("chown %s: %s\n", src, nt_errstr(status));
|
|
@@ -4141,6 +4211,8 @@ static int cmd_rename(void)
|
|
struct cli_state *targetcli;
|
|
char *targetsrc;
|
|
char *targetdest;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
bool replace = false;
|
|
|
|
@@ -4179,14 +4251,16 @@ static int cmd_rename(void)
|
|
replace = true;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, src, &targetcli, &targetsrc);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("rename %s: %s\n", src, nt_errstr(status));
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, dest, &targetcli, &targetdest);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("rename %s: %s\n", dest, nt_errstr(status));
|
|
@@ -4243,6 +4317,8 @@ static int cmd_scopy(void)
|
|
off_t written = 0;
|
|
struct scopy_timing st;
|
|
int rc = 0;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) ||
|
|
@@ -4275,14 +4351,16 @@ static int cmd_scopy(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, src, &targetcli, &targetsrc);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("scopy %s: %s\n", src, nt_errstr(status));
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, dest, &targetcli, &targetdest);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("scopy %s: %s\n", dest, nt_errstr(status));
|
|
@@ -4381,6 +4459,8 @@ static int cmd_hardlink(void)
|
|
char *buf, *buf2;
|
|
struct cli_state *targetcli;
|
|
char *targetname;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) ||
|
|
@@ -4413,7 +4493,8 @@ static int cmd_hardlink(void)
|
|
return 1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, src, &targetcli, &targetname);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("hardlink %s: %s\n", src, nt_errstr(status));
|
|
@@ -5087,9 +5168,13 @@ static int cmd_show_connect( void )
|
|
TALLOC_CTX *ctx = talloc_tos();
|
|
struct cli_state *targetcli;
|
|
char *targetpath;
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), cli,
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
+ cli,
|
|
client_get_cur_dir(), &targetcli,
|
|
&targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -5749,6 +5834,8 @@ static char **remote_completion(const char *text, int len)
|
|
struct cli_state *targetcli = NULL;
|
|
int i;
|
|
struct completion_remote info = { NULL, NULL, 1, 0, NULL, 0 };
|
|
+ struct cli_credentials *creds =
|
|
+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info());
|
|
NTSTATUS status;
|
|
|
|
/* can't have non-static initialisation on Sun CC, so do it
|
|
@@ -5809,7 +5896,8 @@ static char **remote_completion(const char *text, int len)
|
|
goto cleanup;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(),
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, dirmask, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto cleanup;
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index ef75fb36a45..e6695159a96 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -859,7 +859,7 @@ struct cli_dfs_path_split {
|
|
|
|
NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
const char *mountpt,
|
|
- const struct user_auth_info *dfs_auth_info,
|
|
+ struct cli_credentials *creds,
|
|
struct cli_state *rootcli,
|
|
const char *path,
|
|
struct cli_state **targetcli,
|
|
@@ -885,7 +885,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
struct smbXcli_tcon *root_tcon = NULL;
|
|
struct smbXcli_tcon *target_tcon = NULL;
|
|
struct cli_dfs_path_split *dfs_refs = NULL;
|
|
- struct cli_credentials *creds = get_cmdline_auth_info_creds(dfs_auth_info);
|
|
|
|
if ( !rootcli || !path || !targetcli ) {
|
|
return NT_STATUS_INVALID_PARAMETER;
|
|
@@ -1130,7 +1129,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
if (!strequal(*pp_targetpath, "\\") && !strequal(*pp_targetpath, "/")) {
|
|
status = cli_resolve_path(ctx,
|
|
newmount,
|
|
- dfs_auth_info,
|
|
+ creds,
|
|
*targetcli,
|
|
*pp_targetpath,
|
|
&newcli,
|
|
diff --git a/source3/libsmb/libsmb_dir.c b/source3/libsmb/libsmb_dir.c
|
|
index 12abb734c2d..0326f27125b 100644
|
|
--- a/source3/libsmb/libsmb_dir.c
|
|
+++ b/source3/libsmb/libsmb_dir.c
|
|
@@ -911,6 +911,7 @@ SMBC_opendir_ctx(SMBCCTX *context,
|
|
*/
|
|
char *targetpath;
|
|
struct cli_state *targetcli;
|
|
+ struct cli_credentials *creds = NULL;
|
|
NTSTATUS status;
|
|
|
|
/* We connect to the server and list the directory */
|
|
@@ -943,8 +944,12 @@ SMBC_opendir_ctx(SMBCCTX *context,
|
|
return NULL;
|
|
}
|
|
|
|
+ creds = get_cmdline_auth_info_creds(
|
|
+ context->internal->auth_info);
|
|
+
|
|
status = cli_resolve_path(
|
|
- frame, "", context->internal->auth_info,
|
|
+ frame, "",
|
|
+ creds,
|
|
srv->cli, path, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Could not resolve %s\n", path);
|
|
@@ -1543,6 +1548,7 @@ SMBC_mkdir_ctx(SMBCCTX *context,
|
|
char *targetpath = NULL;
|
|
uint16_t port = 0;
|
|
struct cli_state *targetcli = NULL;
|
|
+ struct cli_credentials *creds = NULL;
|
|
TALLOC_CTX *frame = talloc_stackframe();
|
|
NTSTATUS status;
|
|
|
|
@@ -1595,8 +1601,11 @@ SMBC_mkdir_ctx(SMBCCTX *context,
|
|
|
|
}
|
|
|
|
+ creds = get_cmdline_auth_info_creds(context->internal->auth_info);
|
|
+
|
|
/*d_printf(">>>mkdir: resolving %s\n", path);*/
|
|
- status = cli_resolve_path(frame, "", context->internal->auth_info,
|
|
+ status = cli_resolve_path(frame, "",
|
|
+ creds,
|
|
srv->cli, path, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Could not resolve %s\n", path);
|
|
@@ -1654,6 +1663,7 @@ SMBC_rmdir_ctx(SMBCCTX *context,
|
|
char *targetpath = NULL;
|
|
uint16_t port = 0;
|
|
struct cli_state *targetcli = NULL;
|
|
+ struct cli_credentials *creds = NULL;
|
|
TALLOC_CTX *frame = talloc_stackframe();
|
|
NTSTATUS status;
|
|
|
|
@@ -1706,8 +1716,11 @@ SMBC_rmdir_ctx(SMBCCTX *context,
|
|
|
|
}
|
|
|
|
+ creds = get_cmdline_auth_info_creds(context->internal->auth_info),
|
|
+
|
|
/*d_printf(">>>rmdir: resolving %s\n", path);*/
|
|
- status = cli_resolve_path(frame, "", context->internal->auth_info,
|
|
+ status = cli_resolve_path(frame, "",
|
|
+ creds,
|
|
srv->cli, path, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Could not resolve %s\n", path);
|
|
@@ -1959,6 +1972,7 @@ SMBC_chmod_ctx(SMBCCTX *context,
|
|
char *path = NULL;
|
|
uint32_t attr;
|
|
uint16_t port = 0;
|
|
+ struct cli_credentials *creds = NULL;
|
|
TALLOC_CTX *frame = talloc_stackframe();
|
|
NTSTATUS status;
|
|
|
|
@@ -2010,8 +2024,11 @@ SMBC_chmod_ctx(SMBCCTX *context,
|
|
return -1; /* errno set by SMBC_server */
|
|
}
|
|
|
|
+ creds = get_cmdline_auth_info_creds(context->internal->auth_info);
|
|
+
|
|
/*d_printf(">>>unlink: resolving %s\n", path);*/
|
|
- status = cli_resolve_path(frame, "", context->internal->auth_info,
|
|
+ status = cli_resolve_path(frame, "",
|
|
+ creds,
|
|
srv->cli, path, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Could not resolve %s\n", path);
|
|
@@ -2152,6 +2169,7 @@ SMBC_unlink_ctx(SMBCCTX *context,
|
|
uint16_t port = 0;
|
|
struct cli_state *targetcli = NULL;
|
|
SMBCSRV *srv = NULL;
|
|
+ struct cli_credentials *creds = NULL;
|
|
TALLOC_CTX *frame = talloc_stackframe();
|
|
NTSTATUS status;
|
|
|
|
@@ -2204,8 +2222,11 @@ SMBC_unlink_ctx(SMBCCTX *context,
|
|
|
|
}
|
|
|
|
+ creds = get_cmdline_auth_info_creds(context->internal->auth_info);
|
|
+
|
|
/*d_printf(">>>unlink: resolving %s\n", path);*/
|
|
- status = cli_resolve_path(frame, "", context->internal->auth_info,
|
|
+ status = cli_resolve_path(frame, "",
|
|
+ creds,
|
|
srv->cli, path, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Could not resolve %s\n", path);
|
|
@@ -2282,6 +2303,8 @@ SMBC_rename_ctx(SMBCCTX *ocontext,
|
|
SMBCSRV *srv = NULL;
|
|
uint16_t port1 = 0;
|
|
uint16_t port2 = 0;
|
|
+ struct cli_credentials *ocreds = NULL;
|
|
+ struct cli_credentials *ncreds = NULL;
|
|
TALLOC_CTX *frame = talloc_stackframe();
|
|
NTSTATUS status;
|
|
|
|
@@ -2375,7 +2398,10 @@ SMBC_rename_ctx(SMBCCTX *ocontext,
|
|
password1);
|
|
|
|
/*d_printf(">>>rename: resolving %s\n", path1);*/
|
|
- status = cli_resolve_path(frame, "", ocontext->internal->auth_info,
|
|
+ ocreds = get_cmdline_auth_info_creds(ocontext->internal->auth_info);
|
|
+
|
|
+ status = cli_resolve_path(frame, "",
|
|
+ ocreds,
|
|
srv->cli, path1, &targetcli1, &targetpath1);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Could not resolve %s\n", path1);
|
|
@@ -2392,7 +2418,10 @@ SMBC_rename_ctx(SMBCCTX *ocontext,
|
|
|
|
/*d_printf(">>>rename: resolved path as %s\n", targetpath1);*/
|
|
/*d_printf(">>>rename: resolving %s\n", path2);*/
|
|
- status = cli_resolve_path(frame, "", ncontext->internal->auth_info,
|
|
+ ncreds = get_cmdline_auth_info_creds(ncontext->internal->auth_info);
|
|
+
|
|
+ status = cli_resolve_path(frame, "",
|
|
+ ncreds,
|
|
srv->cli, path2, &targetcli2, &targetpath2);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Could not resolve %s\n", path2);
|
|
diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c
|
|
index 0791df36690..a44925e0e0e 100644
|
|
--- a/source3/libsmb/libsmb_file.c
|
|
+++ b/source3/libsmb/libsmb_file.c
|
|
@@ -103,6 +103,8 @@ SMBC_open_ctx(SMBCCTX *context,
|
|
if (strlen(path) > 0 && path[strlen(path) - 1] == '\\') {
|
|
status = NT_STATUS_OBJECT_PATH_INVALID;
|
|
} else {
|
|
+ struct cli_credentials *creds = NULL;
|
|
+
|
|
file = SMB_MALLOC_P(SMBCFILE);
|
|
if (!file) {
|
|
errno = ENOMEM;
|
|
@@ -112,9 +114,12 @@ SMBC_open_ctx(SMBCCTX *context,
|
|
|
|
ZERO_STRUCTP(file);
|
|
|
|
+ creds = get_cmdline_auth_info_creds(
|
|
+ context->internal->auth_info);
|
|
/*d_printf(">>>open: resolving %s\n", path);*/
|
|
status = cli_resolve_path(
|
|
- frame, "", context->internal->auth_info,
|
|
+ frame, "",
|
|
+ creds,
|
|
srv->cli, path, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("Could not resolve %s\n", path);
|
|
@@ -461,6 +466,7 @@ SMBC_getatr(SMBCCTX * context,
|
|
struct timespec change_time_ts = {0};
|
|
time_t write_time = 0;
|
|
SMB_INO_T ino = 0;
|
|
+ struct cli_credentials *creds = NULL;
|
|
TALLOC_CTX *frame = talloc_stackframe();
|
|
NTSTATUS status;
|
|
|
|
@@ -490,7 +496,10 @@ SMBC_getatr(SMBCCTX * context,
|
|
}
|
|
DEBUG(4,("SMBC_getatr: sending qpathinfo\n"));
|
|
|
|
- status = cli_resolve_path(frame, "", context->internal->auth_info,
|
|
+ creds = get_cmdline_auth_info_creds(context->internal->auth_info);
|
|
+
|
|
+ status = cli_resolve_path(frame, "",
|
|
+ creds,
|
|
srv->cli, fixedpath,
|
|
&targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
diff --git a/source3/libsmb/libsmb_stat.c b/source3/libsmb/libsmb_stat.c
|
|
index 790934bd565..1260928d0ff 100644
|
|
--- a/source3/libsmb/libsmb_stat.c
|
|
+++ b/source3/libsmb/libsmb_stat.c
|
|
@@ -242,6 +242,7 @@ SMBC_fstat_ctx(SMBCCTX *context,
|
|
struct cli_state *targetcli = NULL;
|
|
SMB_INO_T ino = 0;
|
|
uint16_t port = 0;
|
|
+ struct cli_credentials *creds = NULL;
|
|
TALLOC_CTX *frame = talloc_stackframe();
|
|
NTSTATUS status;
|
|
|
|
@@ -279,8 +280,11 @@ SMBC_fstat_ctx(SMBCCTX *context,
|
|
return -1;
|
|
}
|
|
|
|
+ creds = get_cmdline_auth_info_creds(context->internal->auth_info);
|
|
+
|
|
/*d_printf(">>>fstat: resolving %s\n", path);*/
|
|
- status = cli_resolve_path(frame, "", context->internal->auth_info,
|
|
+ status = cli_resolve_path(frame, "",
|
|
+ creds,
|
|
file->srv->cli, path,
|
|
&targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
diff --git a/source3/libsmb/libsmb_xattr.c b/source3/libsmb/libsmb_xattr.c
|
|
index d1b6548eb90..8b74d0a39e3 100644
|
|
--- a/source3/libsmb/libsmb_xattr.c
|
|
+++ b/source3/libsmb/libsmb_xattr.c
|
|
@@ -860,13 +860,18 @@ cacl_get(SMBCCTX *context,
|
|
if (ipc_cli && (all || some_nt || all_nt_acls)) {
|
|
char *targetpath = NULL;
|
|
struct cli_state *targetcli = NULL;
|
|
+ struct cli_credentials *creds = NULL;
|
|
NTSTATUS status;
|
|
|
|
/* Point to the portion after "system.nt_sec_desc." */
|
|
name += 19; /* if (all) this will be invalid but unused */
|
|
|
|
+ creds = get_cmdline_auth_info_creds(
|
|
+ context->internal->auth_info);
|
|
+
|
|
status = cli_resolve_path(
|
|
- ctx, "", context->internal->auth_info,
|
|
+ ctx, "",
|
|
+ creds,
|
|
cli, filename, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
DEBUG(5, ("cacl_get Could not resolve %s\n",
|
|
@@ -1511,6 +1516,7 @@ cacl_set(SMBCCTX *context,
|
|
bool numeric = True;
|
|
char *targetpath = NULL;
|
|
struct cli_state *targetcli = NULL;
|
|
+ struct cli_credentials *creds = NULL;
|
|
NTSTATUS status;
|
|
|
|
/* the_acl will be null for REMOVE_ALL operations */
|
|
@@ -1540,7 +1546,10 @@ cacl_set(SMBCCTX *context,
|
|
return -1;
|
|
}
|
|
|
|
- status = cli_resolve_path(ctx, "", context->internal->auth_info,
|
|
+ creds = get_cmdline_auth_info_creds(context->internal->auth_info);
|
|
+
|
|
+ status = cli_resolve_path(ctx, "",
|
|
+ creds,
|
|
cli, filename, &targetcli, &targetpath);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
DEBUG(5,("cacl_set: Could not resolve %s\n", filename));
|
|
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
|
|
index 0b8cf2a6036..517738dbcd7 100644
|
|
--- a/source3/libsmb/proto.h
|
|
+++ b/source3/libsmb/proto.h
|
|
@@ -150,7 +150,7 @@ NTSTATUS cli_dfs_get_referral(TALLOC_CTX *ctx,
|
|
size_t *consumed);
|
|
NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
const char *mountpt,
|
|
- const struct user_auth_info *dfs_auth_info,
|
|
+ struct cli_credentials *creds,
|
|
struct cli_state *rootcli,
|
|
const char *path,
|
|
struct cli_state **targetcli,
|
|
diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
|
|
index 8fd9fcc5780..4989ec633c3 100644
|
|
--- a/source3/utils/smbcacls.c
|
|
+++ b/source3/utils/smbcacls.c
|
|
@@ -806,6 +806,7 @@ int main(int argc, char *argv[])
|
|
than going via LSA calls to resolve them */
|
|
int numeric = 0;
|
|
struct cli_state *targetcli = NULL;
|
|
+ struct cli_credentials *creds = NULL;
|
|
char *targetfile = NULL;
|
|
NTSTATUS status;
|
|
|
|
@@ -1069,9 +1070,11 @@ int main(int argc, char *argv[])
|
|
}
|
|
}
|
|
|
|
+ creds = get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()),
|
|
+
|
|
status = cli_resolve_path(frame,
|
|
"",
|
|
- popt_get_cmdline_auth_info(),
|
|
+ creds,
|
|
cli,
|
|
filename,
|
|
&targetcli,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 100dad122572d927889f4c03b19f169a3bf61df4 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 27 Aug 2020 16:40:49 +0200
|
|
Subject: [PATCH 070/105] s3:client: Remove global max_protocol
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit d07f28645f37c1f976017d5b89864791a18d1943)
|
|
---
|
|
source3/client/client.c | 13 +++++--------
|
|
1 file changed, 5 insertions(+), 8 deletions(-)
|
|
|
|
diff --git a/source3/client/client.c b/source3/client/client.c
|
|
index 23de5befee3..329463795e0 100644
|
|
--- a/source3/client/client.c
|
|
+++ b/source3/client/client.c
|
|
@@ -61,7 +61,6 @@ static int io_bufsize = 0; /* we use the default size */
|
|
static int io_timeout = (CLIENT_TIMEOUT/1000); /* Per operation timeout (in seconds). */
|
|
|
|
static int name_type = 0x20;
|
|
-static int max_protocol = -1;
|
|
|
|
static int process_tok(char *tok);
|
|
static int cmd_help(void);
|
|
@@ -5710,7 +5709,7 @@ static int process_command_string(const char *cmd_in)
|
|
desthost,
|
|
service,
|
|
creds,
|
|
- max_protocol,
|
|
+ lp_client_max_protocol(),
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type,
|
|
&cli);
|
|
@@ -6160,7 +6159,7 @@ static int process(const char *base_directory)
|
|
desthost,
|
|
service,
|
|
creds,
|
|
- max_protocol,
|
|
+ lp_client_max_protocol(),
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -6201,7 +6200,7 @@ static int do_host_query(const char *query_host)
|
|
query_host,
|
|
"IPC$",
|
|
creds,
|
|
- max_protocol,
|
|
+ lp_client_max_protocol(),
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -6236,7 +6235,7 @@ static int do_host_query(const char *query_host)
|
|
if (port != NBT_SMB_PORT ||
|
|
smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1)
|
|
{
|
|
- int max_proto = MIN(max_protocol, PROTOCOL_NT1);
|
|
+ int max_proto = MIN(lp_client_max_protocol(), PROTOCOL_NT1);
|
|
|
|
/*
|
|
* Workgroups simply don't make sense over anything
|
|
@@ -6286,7 +6285,7 @@ static int do_tar_op(const char *base_directory)
|
|
desthost,
|
|
service,
|
|
creds,
|
|
- max_protocol,
|
|
+ lp_client_max_protocol(),
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -6693,8 +6692,6 @@ int main(int argc,char *argv[])
|
|
/* Ensure we have a password (or equivalent). */
|
|
popt_common_credentials_post();
|
|
|
|
- max_protocol = lp_client_max_protocol();
|
|
-
|
|
if (tar_to_process(tar_ctx)) {
|
|
if (cmdstr)
|
|
process_command_string(cmdstr);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From fecf06bd00bc8ff23634bded86d649e432431957 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 27 Aug 2020 16:43:46 +0200
|
|
Subject: [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit 4aac9daf095e7c2de6a27697a13385ee87a4b634)
|
|
---
|
|
source3/client/client.c | 7 -------
|
|
source3/lib/netapi/cm.c | 1 -
|
|
source3/libsmb/clidfs.c | 4 +---
|
|
source3/libsmb/proto.h | 1 -
|
|
4 files changed, 1 insertion(+), 12 deletions(-)
|
|
|
|
diff --git a/source3/client/client.c b/source3/client/client.c
|
|
index 329463795e0..e9e6cb1ac2c 100644
|
|
--- a/source3/client/client.c
|
|
+++ b/source3/client/client.c
|
|
@@ -5709,7 +5709,6 @@ static int process_command_string(const char *cmd_in)
|
|
desthost,
|
|
service,
|
|
creds,
|
|
- lp_client_max_protocol(),
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type,
|
|
&cli);
|
|
@@ -6159,7 +6158,6 @@ static int process(const char *base_directory)
|
|
desthost,
|
|
service,
|
|
creds,
|
|
- lp_client_max_protocol(),
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -6200,7 +6198,6 @@ static int do_host_query(const char *query_host)
|
|
query_host,
|
|
"IPC$",
|
|
creds,
|
|
- lp_client_max_protocol(),
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -6235,8 +6232,6 @@ static int do_host_query(const char *query_host)
|
|
if (port != NBT_SMB_PORT ||
|
|
smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1)
|
|
{
|
|
- int max_proto = MIN(lp_client_max_protocol(), PROTOCOL_NT1);
|
|
-
|
|
/*
|
|
* Workgroups simply don't make sense over anything
|
|
* else but port 139 and SMB1.
|
|
@@ -6248,7 +6243,6 @@ static int do_host_query(const char *query_host)
|
|
query_host,
|
|
"IPC$",
|
|
creds,
|
|
- max_proto,
|
|
have_ip ? &dest_ss : NULL, NBT_SMB_PORT,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -6285,7 +6279,6 @@ static int do_tar_op(const char *base_directory)
|
|
desthost,
|
|
service,
|
|
creds,
|
|
- lp_client_max_protocol(),
|
|
have_ip ? &dest_ss : NULL, port,
|
|
name_type, &cli);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c
|
|
index 943f7498e8c..3f4e188b396 100644
|
|
--- a/source3/lib/netapi/cm.c
|
|
+++ b/source3/lib/netapi/cm.c
|
|
@@ -112,7 +112,6 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx,
|
|
status = cli_cm_open(ctx, NULL,
|
|
server_name, "IPC$",
|
|
creds,
|
|
- lp_client_ipc_max_protocol(),
|
|
NULL, 0, 0x20, &cli_ipc);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
cli_ipc = NULL;
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index e6695159a96..fb1a0c72e6d 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -388,7 +388,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
const char *server,
|
|
const char *share,
|
|
struct cli_credentials *creds,
|
|
- int max_protocol,
|
|
const struct sockaddr_storage *dest_ss,
|
|
int port,
|
|
int name_type,
|
|
@@ -417,7 +416,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
server,
|
|
share,
|
|
creds,
|
|
- max_protocol,
|
|
+ lp_client_max_protocol(),
|
|
dest_ss,
|
|
port,
|
|
name_type,
|
|
@@ -965,7 +964,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
smbXcli_conn_remote_name(rootcli->conn),
|
|
"IPC$",
|
|
creds,
|
|
- smbXcli_conn_protocol(rootcli->conn),
|
|
NULL, /* dest_ss not needed, we reuse the transport */
|
|
0,
|
|
0x20,
|
|
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
|
|
index 517738dbcd7..8aaaff2cb1e 100644
|
|
--- a/source3/libsmb/proto.h
|
|
+++ b/source3/libsmb/proto.h
|
|
@@ -128,7 +128,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
const char *server,
|
|
const char *share,
|
|
struct cli_credentials *creds,
|
|
- int max_protocol,
|
|
const struct sockaddr_storage *dest_ss,
|
|
int port,
|
|
int name_type,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 2af136fd7c1ecae9cc06bc2cf26a7feac16cb279 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 27 Aug 2020 16:45:12 +0200
|
|
Subject: [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit 2159582610ecc932047b85a77ec321b3d3ac806f)
|
|
---
|
|
source3/libsmb/clidfs.c | 5 +----
|
|
1 file changed, 1 insertion(+), 4 deletions(-)
|
|
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index fb1a0c72e6d..023dd4d2757 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -293,7 +293,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx,
|
|
const char *server,
|
|
const char *share,
|
|
struct cli_credentials *creds,
|
|
- int max_protocol,
|
|
const struct sockaddr_storage *dest_ss,
|
|
int port,
|
|
int name_type,
|
|
@@ -304,7 +303,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx,
|
|
|
|
status = do_connect(ctx, server, share,
|
|
creds,
|
|
- max_protocol,
|
|
+ lp_client_max_protocol(),
|
|
dest_ss, port, name_type, &cli);
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -416,7 +415,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
|
|
server,
|
|
share,
|
|
creds,
|
|
- lp_client_max_protocol(),
|
|
dest_ss,
|
|
port,
|
|
name_type,
|
|
@@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
dfs_refs[count].server,
|
|
dfs_refs[count].share,
|
|
creds,
|
|
- smbXcli_conn_protocol(rootcli->conn),
|
|
NULL, /* dest_ss */
|
|
0, /* port */
|
|
0x20,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From dc8cfd9551afa10b0610c6663cb28bfb1ec5888a Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 27 Aug 2020 16:46:29 +0200
|
|
Subject: [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs
|
|
do_connect()
|
|
|
|
The if check for max_protocol == 0 is part of lp_client_max_protocol().
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit 50b59b4c28bc816094a4ca97f64450860e2495b2)
|
|
---
|
|
source3/libsmb/clidfs.c | 8 +-------
|
|
1 file changed, 1 insertion(+), 7 deletions(-)
|
|
|
|
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
index 023dd4d2757..ee5becf76a6 100644
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
const char *server,
|
|
const char *share,
|
|
struct cli_credentials *creds,
|
|
- int max_protocol,
|
|
const struct sockaddr_storage *dest_ss,
|
|
int port,
|
|
int name_type,
|
|
@@ -167,14 +166,11 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
return status;
|
|
}
|
|
|
|
- if (max_protocol == 0) {
|
|
- max_protocol = PROTOCOL_LATEST;
|
|
- }
|
|
DEBUG(4,(" session request ok\n"));
|
|
|
|
status = smbXcli_negprot(c->conn, c->timeout,
|
|
lp_client_min_protocol(),
|
|
- max_protocol);
|
|
+ lp_client_max_protocol());
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
d_printf("protocol negotiation failed: %s\n",
|
|
@@ -233,7 +229,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx,
|
|
cli_shutdown(c);
|
|
return do_connect(ctx, newserver,
|
|
newshare, creds,
|
|
- max_protocol,
|
|
NULL, port, name_type, pcli);
|
|
}
|
|
|
|
@@ -303,7 +298,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx,
|
|
|
|
status = do_connect(ctx, server, share,
|
|
creds,
|
|
- lp_client_max_protocol(),
|
|
dest_ss, port, name_type, &cli);
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 3a99225868e079e108968552f43b937b5b9b702f Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Mon, 10 Aug 2020 15:47:35 +0200
|
|
Subject: [PATCH 074/105] s3:include: Move loadparm prototypes to own header
|
|
file
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
(cherry picked from commit d4d8218b9618dd289f54b41f13d7015f1b3994fd)
|
|
---
|
|
source3/include/includes.h | 3 +
|
|
source3/include/proto.h | 167 -------------------------------
|
|
source3/param/loadparm.h | 200 +++++++++++++++++++++++++++++++++++++
|
|
3 files changed, 203 insertions(+), 167 deletions(-)
|
|
create mode 100644 source3/param/loadparm.h
|
|
|
|
diff --git a/source3/include/includes.h b/source3/include/includes.h
|
|
index 8fa65cc3122..c94f919ed59 100644
|
|
--- a/source3/include/includes.h
|
|
+++ b/source3/include/includes.h
|
|
@@ -293,6 +293,9 @@ typedef char fstring[FSTRING_LEN];
|
|
#endif
|
|
|
|
#include "lib/param/loadparm.h"
|
|
+#include "source3/param/loadparm.h"
|
|
+/* Automatically generated by generate_param.py. */
|
|
+#include "source3/param/param_proto.h"
|
|
|
|
/* String routines */
|
|
|
|
diff --git a/source3/include/proto.h b/source3/include/proto.h
|
|
index 12aa392abae..b9a6cb7f116 100644
|
|
--- a/source3/include/proto.h
|
|
+++ b/source3/include/proto.h
|
|
@@ -739,173 +739,6 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context,
|
|
const char *dcname,
|
|
bool force);
|
|
|
|
-/* The following definitions come from param/loadparm.c */
|
|
-
|
|
-const struct loadparm_substitution *loadparm_s3_global_substitution(void);
|
|
-
|
|
-char *lp_parm_substituted_string(TALLOC_CTX *mem_ctx,
|
|
- const struct loadparm_substitution *lp_sub,
|
|
- int snum,
|
|
- const char *type,
|
|
- const char *option,
|
|
- const char *def);
|
|
-
|
|
-#include "source3/param/param_proto.h"
|
|
-
|
|
-char *lp_servicename(TALLOC_CTX *ctx, const struct loadparm_substitution *, int);
|
|
-const char *lp_const_servicename(int);
|
|
-bool lp_autoloaded(int);
|
|
-const char *lp_dnsdomain(void);
|
|
-int lp_winbind_max_domain_connections(void);
|
|
-bool lp_idmap_range(const char *domain_name, uint32_t *low, uint32_t *high);
|
|
-bool lp_idmap_default_range(uint32_t *low, uint32_t *high);
|
|
-const char *lp_idmap_backend(const char *domain_name);
|
|
-const char *lp_idmap_default_backend (void);
|
|
-int lp_security(void);
|
|
-int lp_client_max_protocol(void);
|
|
-int lp_client_ipc_min_protocol(void);
|
|
-int lp_client_ipc_max_protocol(void);
|
|
-int lp_client_ipc_signing(void);
|
|
-int lp_smb2_max_credits(void);
|
|
-int lp_cups_encrypt(void);
|
|
-bool lp_widelinks(int );
|
|
-int lp_rpc_low_port(void);
|
|
-int lp_rpc_high_port(void);
|
|
-bool lp_lanman_auth(void);
|
|
-enum samba_weak_crypto lp_weak_crypto(void);
|
|
-
|
|
-int lp_wi_scan_global_parametrics(
|
|
- const char *regex, size_t max_matches,
|
|
- bool (*cb)(const char *string, regmatch_t matches[],
|
|
- void *private_data),
|
|
- void *private_data);
|
|
-
|
|
-const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def);
|
|
-struct loadparm_service;
|
|
-const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type,
|
|
- const char *option, const char *def);
|
|
-const char **lp_parm_string_list(int snum, const char *type, const char *option, const char **def);
|
|
-int lp_parm_int(int snum, const char *type, const char *option, int def);
|
|
-unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsigned long def);
|
|
-unsigned long long lp_parm_ulonglong(int snum, const char *type,
|
|
- const char *option,
|
|
- unsigned long long def);
|
|
-bool lp_parm_bool(int snum, const char *type, const char *option, bool def);
|
|
-struct enum_list;
|
|
-int lp_parm_enum(int snum, const char *type, const char *option,
|
|
- const struct enum_list *_enum, int def);
|
|
-char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src);
|
|
-bool lp_add_home(const char *pszHomename, int iDefaultService,
|
|
- const char *user, const char *pszHomedir);
|
|
-int lp_add_service(const char *pszService, int iDefaultService);
|
|
-bool lp_add_printer(const char *pszPrintername, int iDefaultService);
|
|
-bool lp_parameter_is_valid(const char *pszParmName);
|
|
-bool lp_parameter_is_global(const char *pszParmName);
|
|
-bool lp_canonicalize_parameter(const char *parm_name, const char **canon_parm,
|
|
- bool *inverse);
|
|
-bool lp_canonicalize_parameter_with_value(const char *parm_name,
|
|
- const char *val,
|
|
- const char **canon_parm,
|
|
- const char **canon_val);
|
|
-void show_parameter_list(void);
|
|
-bool lp_invert_boolean(const char *str, const char **inverse_str);
|
|
-bool lp_canonicalize_boolean(const char *str, const char**canon_str);
|
|
-bool process_registry_service(const char *service_name);
|
|
-bool process_registry_shares(void);
|
|
-bool lp_config_backend_is_registry(void);
|
|
-bool lp_config_backend_is_file(void);
|
|
-bool lp_file_list_changed(void);
|
|
-const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx);
|
|
-const char *lp_ldap_user_suffix(TALLOC_CTX *ctx);
|
|
-const char *lp_ldap_group_suffix(TALLOC_CTX *ctx);
|
|
-const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx);
|
|
-struct parm_struct;
|
|
-/* Return a pointer to a service by name. */
|
|
-struct loadparm_service *lp_service(const char *pszServiceName);
|
|
-struct loadparm_service *lp_servicebynum(int snum);
|
|
-struct loadparm_service *lp_default_loadparm_service(void);
|
|
-void *lp_parm_ptr(struct loadparm_service *service, struct parm_struct *parm);
|
|
-void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm);
|
|
-bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue);
|
|
-bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue);
|
|
-bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal);
|
|
-bool lp_snum_ok(int iService);
|
|
-void lp_add_one_printer(const char *name, const char *comment,
|
|
- const char *location, void *pdata);
|
|
-bool lp_loaded(void);
|
|
-void lp_killunused(struct smbd_server_connection *sconn,
|
|
- bool (*snumused) (struct smbd_server_connection *, int));
|
|
-void lp_kill_all_services(void);
|
|
-void lp_killservice(int iServiceIn);
|
|
-const char* server_role_str(uint32_t role);
|
|
-enum usershare_err parse_usershare_file(TALLOC_CTX *ctx,
|
|
- SMB_STRUCT_STAT *psbuf,
|
|
- const char *servicename,
|
|
- int snum,
|
|
- char **lines,
|
|
- int numlines,
|
|
- char **pp_sharepath,
|
|
- char **pp_comment,
|
|
- char **pp_cp_share_name,
|
|
- struct security_descriptor **ppsd,
|
|
- bool *pallow_guest);
|
|
-int load_usershare_service(const char *servicename);
|
|
-int load_usershare_shares(struct smbd_server_connection *sconn,
|
|
- bool (*snumused) (struct smbd_server_connection *, int));
|
|
-void gfree_loadparm(void);
|
|
-bool lp_load_initial_only(const char *pszFname);
|
|
-bool lp_load_global(const char *file_name);
|
|
-bool lp_load_with_shares(const char *file_name);
|
|
-bool lp_load_client(const char *file_name);
|
|
-bool lp_load_global_no_reinit(const char *file_name);
|
|
-bool lp_load_no_reinit(const char *file_name);
|
|
-bool lp_load_client_no_reinit(const char *file_name);
|
|
-bool lp_load_with_registry_shares(const char *pszFname);
|
|
-int lp_numservices(void);
|
|
-void lp_dump(FILE *f, bool show_defaults, int maxtoprint);
|
|
-void lp_dump_one(FILE * f, bool show_defaults, int snum);
|
|
-int lp_servicenumber(const char *pszServiceName);
|
|
-const char *volume_label(TALLOC_CTX *ctx, int snum);
|
|
-bool lp_domain_master(void);
|
|
-bool lp_preferred_master(void);
|
|
-void lp_remove_service(int snum);
|
|
-void lp_copy_service(int snum, const char *new_name);
|
|
-int lp_default_server_announce(void);
|
|
-const char *lp_printername(TALLOC_CTX *ctx,
|
|
- const struct loadparm_substitution *lp_sub,
|
|
- int snum);
|
|
-void lp_set_logfile(const char *name);
|
|
-int lp_maxprintjobs(int snum);
|
|
-const char *lp_printcapname(void);
|
|
-bool lp_disable_spoolss( void );
|
|
-void lp_set_spoolss_state( uint32_t state );
|
|
-uint32_t lp_get_spoolss_state( void );
|
|
-struct smb_signing_state;
|
|
-void set_use_sendfile(int snum, bool val);
|
|
-void lp_set_mangling_method(const char *new_method);
|
|
-bool lp_posix_pathnames(void);
|
|
-void lp_set_posix_pathnames(void);
|
|
-enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp);
|
|
-void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val);
|
|
-int lp_min_receive_file_size(void);
|
|
-void widelinks_warning(int snum);
|
|
-const char *lp_ncalrpc_dir(void);
|
|
-void _lp_set_server_role(int server_role);
|
|
-
|
|
-/* The following definitions come from param/loadparm_ctx.c */
|
|
-
|
|
-const struct loadparm_s3_helpers *loadparm_s3_helpers(void);
|
|
-
|
|
-/* The following definitions come from param/loadparm_server_role.c */
|
|
-
|
|
-int lp_server_role(void);
|
|
-void set_server_role(void);
|
|
-
|
|
-/* The following definitions come from param/util.c */
|
|
-
|
|
-uint32_t get_int_param( const char* param );
|
|
-char* get_string_param( const char* param );
|
|
-
|
|
/* The following definitions come from lib/server_contexts.c */
|
|
struct tevent_context *global_event_context(void);
|
|
void global_event_context_free(void);
|
|
diff --git a/source3/param/loadparm.h b/source3/param/loadparm.h
|
|
new file mode 100644
|
|
index 00000000000..7686877ccf1
|
|
--- /dev/null
|
|
+++ b/source3/param/loadparm.h
|
|
@@ -0,0 +1,200 @@
|
|
+/*
|
|
+ *
|
|
+ * Unix SMB/CIFS implementation.
|
|
+ *
|
|
+ * Type definitions for loadparm
|
|
+ *
|
|
+ * Copyright (c) 2020 Andreas Schneider <asn@samba.org>
|
|
+ * This program is free software: you can redistribute it and/or modify
|
|
+ * it under the terms of the GNU General Public License as published by
|
|
+ * the Free Software Foundation, either version 3 of the License, or
|
|
+ * (at your option) any later version.
|
|
+ *
|
|
+ * This program is distributed in the hope that it will be useful,
|
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+ * GNU General Public License for more details.
|
|
+ *
|
|
+ * You should have received a copy of the GNU General Public License
|
|
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+ */
|
|
+
|
|
+#ifndef _S3_LOADPARM_H
|
|
+#define _S3_LOADPARM_H
|
|
+
|
|
+#include <talloc.h>
|
|
+#include <regex.h>
|
|
+
|
|
+/* Forward declarations */
|
|
+typedef struct stat_ex SMB_STRUCT_STAT;
|
|
+typedef struct files_struct files_struct;
|
|
+struct smbd_server_connection;
|
|
+struct security_descriptor;
|
|
+
|
|
+/* The following definitions come from param/loadparm.c */
|
|
+
|
|
+const struct loadparm_substitution *loadparm_s3_global_substitution(void);
|
|
+
|
|
+char *lp_parm_substituted_string(TALLOC_CTX *mem_ctx,
|
|
+ const struct loadparm_substitution *lp_sub,
|
|
+ int snum,
|
|
+ const char *type,
|
|
+ const char *option,
|
|
+ const char *def);
|
|
+
|
|
+char *lp_servicename(TALLOC_CTX *ctx, const struct loadparm_substitution *, int);
|
|
+const char *lp_const_servicename(int);
|
|
+bool lp_autoloaded(int);
|
|
+const char *lp_dnsdomain(void);
|
|
+int lp_winbind_max_domain_connections(void);
|
|
+bool lp_idmap_range(const char *domain_name, uint32_t *low, uint32_t *high);
|
|
+bool lp_idmap_default_range(uint32_t *low, uint32_t *high);
|
|
+const char *lp_idmap_backend(const char *domain_name);
|
|
+const char *lp_idmap_default_backend (void);
|
|
+int lp_security(void);
|
|
+int lp_client_max_protocol(void);
|
|
+int lp_client_ipc_min_protocol(void);
|
|
+int lp_client_ipc_max_protocol(void);
|
|
+int lp_client_ipc_signing(void);
|
|
+int lp_smb2_max_credits(void);
|
|
+int lp_cups_encrypt(void);
|
|
+bool lp_widelinks(int );
|
|
+int lp_rpc_low_port(void);
|
|
+int lp_rpc_high_port(void);
|
|
+bool lp_lanman_auth(void);
|
|
+enum samba_weak_crypto lp_weak_crypto(void);
|
|
+
|
|
+int lp_wi_scan_global_parametrics(
|
|
+ const char *regex, size_t max_matches,
|
|
+ bool (*cb)(const char *string, regmatch_t matches[],
|
|
+ void *private_data),
|
|
+ void *private_data);
|
|
+
|
|
+const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def);
|
|
+struct loadparm_service;
|
|
+const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type,
|
|
+ const char *option, const char *def);
|
|
+const char **lp_parm_string_list(int snum, const char *type, const char *option, const char **def);
|
|
+int lp_parm_int(int snum, const char *type, const char *option, int def);
|
|
+unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsigned long def);
|
|
+unsigned long long lp_parm_ulonglong(int snum, const char *type,
|
|
+ const char *option,
|
|
+ unsigned long long def);
|
|
+bool lp_parm_bool(int snum, const char *type, const char *option, bool def);
|
|
+struct enum_list;
|
|
+int lp_parm_enum(int snum, const char *type, const char *option,
|
|
+ const struct enum_list *_enum, int def);
|
|
+char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src);
|
|
+bool lp_add_home(const char *pszHomename, int iDefaultService,
|
|
+ const char *user, const char *pszHomedir);
|
|
+int lp_add_service(const char *pszService, int iDefaultService);
|
|
+bool lp_add_printer(const char *pszPrintername, int iDefaultService);
|
|
+bool lp_parameter_is_valid(const char *pszParmName);
|
|
+bool lp_parameter_is_global(const char *pszParmName);
|
|
+bool lp_canonicalize_parameter(const char *parm_name, const char **canon_parm,
|
|
+ bool *inverse);
|
|
+bool lp_canonicalize_parameter_with_value(const char *parm_name,
|
|
+ const char *val,
|
|
+ const char **canon_parm,
|
|
+ const char **canon_val);
|
|
+void show_parameter_list(void);
|
|
+bool lp_invert_boolean(const char *str, const char **inverse_str);
|
|
+bool lp_canonicalize_boolean(const char *str, const char**canon_str);
|
|
+bool process_registry_service(const char *service_name);
|
|
+bool process_registry_shares(void);
|
|
+bool lp_config_backend_is_registry(void);
|
|
+bool lp_config_backend_is_file(void);
|
|
+bool lp_file_list_changed(void);
|
|
+const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx);
|
|
+const char *lp_ldap_user_suffix(TALLOC_CTX *ctx);
|
|
+const char *lp_ldap_group_suffix(TALLOC_CTX *ctx);
|
|
+const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx);
|
|
+struct parm_struct;
|
|
+/* Return a pointer to a service by name. */
|
|
+struct loadparm_service *lp_service(const char *pszServiceName);
|
|
+struct loadparm_service *lp_servicebynum(int snum);
|
|
+struct loadparm_service *lp_default_loadparm_service(void);
|
|
+void *lp_parm_ptr(struct loadparm_service *service, struct parm_struct *parm);
|
|
+void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm);
|
|
+bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue);
|
|
+bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue);
|
|
+bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal);
|
|
+bool lp_snum_ok(int iService);
|
|
+void lp_add_one_printer(const char *name, const char *comment,
|
|
+ const char *location, void *pdata);
|
|
+bool lp_loaded(void);
|
|
+void lp_killunused(struct smbd_server_connection *sconn,
|
|
+ bool (*snumused) (struct smbd_server_connection *, int));
|
|
+void lp_kill_all_services(void);
|
|
+void lp_killservice(int iServiceIn);
|
|
+const char* server_role_str(uint32_t role);
|
|
+enum usershare_err parse_usershare_file(TALLOC_CTX *ctx,
|
|
+ SMB_STRUCT_STAT *psbuf,
|
|
+ const char *servicename,
|
|
+ int snum,
|
|
+ char **lines,
|
|
+ int numlines,
|
|
+ char **pp_sharepath,
|
|
+ char **pp_comment,
|
|
+ char **pp_cp_share_name,
|
|
+ struct security_descriptor **ppsd,
|
|
+ bool *pallow_guest);
|
|
+int load_usershare_service(const char *servicename);
|
|
+int load_usershare_shares(struct smbd_server_connection *sconn,
|
|
+ bool (*snumused) (struct smbd_server_connection *, int));
|
|
+void gfree_loadparm(void);
|
|
+bool lp_load_initial_only(const char *pszFname);
|
|
+bool lp_load_global(const char *file_name);
|
|
+bool lp_load_with_shares(const char *file_name);
|
|
+bool lp_load_client(const char *file_name);
|
|
+bool lp_load_global_no_reinit(const char *file_name);
|
|
+bool lp_load_no_reinit(const char *file_name);
|
|
+bool lp_load_client_no_reinit(const char *file_name);
|
|
+bool lp_load_with_registry_shares(const char *pszFname);
|
|
+int lp_numservices(void);
|
|
+void lp_dump(FILE *f, bool show_defaults, int maxtoprint);
|
|
+void lp_dump_one(FILE * f, bool show_defaults, int snum);
|
|
+int lp_servicenumber(const char *pszServiceName);
|
|
+const char *volume_label(TALLOC_CTX *ctx, int snum);
|
|
+bool lp_domain_master(void);
|
|
+bool lp_preferred_master(void);
|
|
+void lp_remove_service(int snum);
|
|
+void lp_copy_service(int snum, const char *new_name);
|
|
+int lp_default_server_announce(void);
|
|
+const char *lp_printername(TALLOC_CTX *ctx,
|
|
+ const struct loadparm_substitution *lp_sub,
|
|
+ int snum);
|
|
+void lp_set_logfile(const char *name);
|
|
+int lp_maxprintjobs(int snum);
|
|
+const char *lp_printcapname(void);
|
|
+bool lp_disable_spoolss( void );
|
|
+void lp_set_spoolss_state( uint32_t state );
|
|
+uint32_t lp_get_spoolss_state( void );
|
|
+struct smb_signing_state;
|
|
+void set_use_sendfile(int snum, bool val);
|
|
+void lp_set_mangling_method(const char *new_method);
|
|
+bool lp_posix_pathnames(void);
|
|
+void lp_set_posix_pathnames(void);
|
|
+enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp);
|
|
+void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val);
|
|
+int lp_min_receive_file_size(void);
|
|
+void widelinks_warning(int snum);
|
|
+const char *lp_ncalrpc_dir(void);
|
|
+void _lp_set_server_role(int server_role);
|
|
+uint32_t lp_get_async_dns_timeout(void);
|
|
+
|
|
+/* The following definitions come from param/loadparm_ctx.c */
|
|
+
|
|
+const struct loadparm_s3_helpers *loadparm_s3_helpers(void);
|
|
+
|
|
+/* The following definitions come from param/loadparm_server_role.c */
|
|
+
|
|
+int lp_server_role(void);
|
|
+void set_server_role(void);
|
|
+
|
|
+/* The following definitions come from param/util.c */
|
|
+
|
|
+uint32_t get_int_param( const char* param );
|
|
+char *get_string_param( const char* param );
|
|
+
|
|
+#endif /* _S3_LOADPARM_H */
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 076e6929c3c8d1dc161e7dacfc7fb7aeceb588bd Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 11 Aug 2020 10:41:07 +0200
|
|
Subject: [PATCH 075/105] s3:lib: Move interface prototypes to own header file
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
|
|
Autobuild-User(master): Jeremy Allison <jra@samba.org>
|
|
Autobuild-Date(master): Fri Oct 9 20:36:13 UTC 2020 on sn-devel-184
|
|
|
|
(cherry picked from commit 925cc9aafbe17cb2cbd89f468fac70f96ae89475)
|
|
---
|
|
source3/include/proto.h | 21 +------------------
|
|
source3/lib/interface.h | 46 +++++++++++++++++++++++++++++++++++++++++
|
|
2 files changed, 47 insertions(+), 20 deletions(-)
|
|
create mode 100644 source3/lib/interface.h
|
|
|
|
diff --git a/source3/include/proto.h b/source3/include/proto.h
|
|
index b9a6cb7f116..1bbd8e9d526 100644
|
|
--- a/source3/include/proto.h
|
|
+++ b/source3/include/proto.h
|
|
@@ -84,26 +84,7 @@ NTSTATUS vfs_at_fspcwd(TALLOC_CTX *mem_ctx,
|
|
struct connection_struct *conn,
|
|
struct files_struct **_fsp);
|
|
|
|
-/* The following definitions come from lib/interface.c */
|
|
-
|
|
-bool ismyaddr(const struct sockaddr *ip);
|
|
-bool ismyip_v4(struct in_addr ip);
|
|
-bool is_local_net(const struct sockaddr *from);
|
|
-void setup_linklocal_scope_id(struct sockaddr *pss);
|
|
-bool is_local_net_v4(struct in_addr from);
|
|
-int iface_count(void);
|
|
-int iface_count_v4_nl(void);
|
|
-const struct in_addr *first_ipv4_iface(void);
|
|
-struct interface *get_interface(int n);
|
|
-const struct sockaddr_storage *iface_n_sockaddr_storage(int n);
|
|
-const struct in_addr *iface_n_ip_v4(int n);
|
|
-const struct in_addr *iface_n_bcast_v4(int n);
|
|
-const struct sockaddr_storage *iface_n_bcast(int n);
|
|
-const struct sockaddr_storage *iface_ip(const struct sockaddr *ip);
|
|
-bool iface_local(const struct sockaddr *ip);
|
|
-void load_interfaces(void);
|
|
-void gfree_interfaces(void);
|
|
-bool interfaces_changed(void);
|
|
+#include "source3/lib/interface.h"
|
|
|
|
/* The following definitions come from lib/ldap_debug_handler.c */
|
|
|
|
diff --git a/source3/lib/interface.h b/source3/lib/interface.h
|
|
new file mode 100644
|
|
index 00000000000..f45435b4a81
|
|
--- /dev/null
|
|
+++ b/source3/lib/interface.h
|
|
@@ -0,0 +1,46 @@
|
|
+/*
|
|
+ *
|
|
+ * Unix SMB/CIFS implementation.
|
|
+ *
|
|
+ * Type definitions for interfaces
|
|
+ *
|
|
+ * Copyright (c) 2020 Andreas Schneider <asn@samba.org>
|
|
+ * This program is free software: you can redistribute it and/or modify
|
|
+ * it under the terms of the GNU General Public License as published by
|
|
+ * the Free Software Foundation, either version 3 of the License, or
|
|
+ * (at your option) any later version.
|
|
+ *
|
|
+ * This program is distributed in the hope that it will be useful,
|
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+ * GNU General Public License for more details.
|
|
+ *
|
|
+ * You should have received a copy of the GNU General Public License
|
|
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+ */
|
|
+
|
|
+#ifndef _INTERFACE_H
|
|
+#define _INTERFACE_H
|
|
+
|
|
+#include <system/network.h>
|
|
+
|
|
+bool ismyaddr(const struct sockaddr *ip);
|
|
+bool ismyip_v4(struct in_addr ip);
|
|
+bool is_local_net(const struct sockaddr *from);
|
|
+void setup_linklocal_scope_id(struct sockaddr *pss);
|
|
+bool is_local_net_v4(struct in_addr from);
|
|
+int iface_count(void);
|
|
+int iface_count_v4_nl(void);
|
|
+const struct in_addr *first_ipv4_iface(void);
|
|
+struct interface *get_interface(int n);
|
|
+const struct sockaddr_storage *iface_n_sockaddr_storage(int n);
|
|
+const struct in_addr *iface_n_ip_v4(int n);
|
|
+const struct in_addr *iface_n_bcast_v4(int n);
|
|
+const struct sockaddr_storage *iface_n_bcast(int n);
|
|
+const struct sockaddr_storage *iface_ip(const struct sockaddr *ip);
|
|
+bool iface_local(const struct sockaddr *ip);
|
|
+void load_interfaces(void);
|
|
+void gfree_interfaces(void);
|
|
+bool interfaces_changed(void);
|
|
+
|
|
+#endif /* _INTERFACE_H */
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From b6d36e462fe41f7b88bbf120831c3765c40ef326 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 7 Feb 2020 16:48:16 +0100
|
|
Subject: [PATCH 076/105] idl: Add SID_SAMBA_SMB3
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 56879ec5876625346df89110f62d52e3fd5b8934)
|
|
---
|
|
librpc/idl/security.idl | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/librpc/idl/security.idl b/librpc/idl/security.idl
|
|
index a92e8f1518e..06bf7449a70 100644
|
|
--- a/librpc/idl/security.idl
|
|
+++ b/librpc/idl/security.idl
|
|
@@ -282,6 +282,9 @@ interface security
|
|
const string SID_SAMBA_UNIX_USER_OWNER = "S-1-22-1";
|
|
const string SID_SAMBA_UNIX_GROUP_OWNER = "S-1-22-2";
|
|
|
|
+ /* Information passing via security token */
|
|
+ const string SID_SAMBA_SMB3 = "S-1-22-1397571891";
|
|
+
|
|
/* SECURITY_NT_SERVICE */
|
|
const string NAME_NT_SERVICE = "NT SERVICE";
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 3128ed8c26c13ccc068b5e50ae52604f5ffc9241 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 7 Feb 2020 16:48:29 +0100
|
|
Subject: [PATCH 077/105] s3:smbd: Add SMB3 connection information to session
|
|
info
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 905c2b9722a64ee57f3fbcff51e6bb591c6e3edc)
|
|
---
|
|
source3/include/vfs.h | 1 +
|
|
source3/smbd/pipes.c | 82 +++++++++++++++++++++++++++++++++++++-
|
|
source3/smbd/smb2_server.c | 5 +++
|
|
3 files changed, 87 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/source3/include/vfs.h b/source3/include/vfs.h
|
|
index d527f850628..c0d60636c31 100644
|
|
--- a/source3/include/vfs.h
|
|
+++ b/source3/include/vfs.h
|
|
@@ -411,6 +411,7 @@ typedef struct files_struct {
|
|
bool use_ofd_locks : 1;
|
|
bool closing : 1;
|
|
bool lock_failure_seen : 1;
|
|
+ bool encryption_required : 1;
|
|
} fsp_flags;
|
|
|
|
struct tevent_timer *update_write_time_event;
|
|
diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c
|
|
index 2dd38bb7ab3..d51a3de9497 100644
|
|
--- a/source3/smbd/pipes.c
|
|
+++ b/source3/smbd/pipes.c
|
|
@@ -30,13 +30,16 @@
|
|
#include "smbd/globals.h"
|
|
#include "libcli/security/security.h"
|
|
#include "rpc_server/srv_pipe_hnd.h"
|
|
+#include "auth/auth_util.h"
|
|
|
|
NTSTATUS open_np_file(struct smb_request *smb_req, const char *name,
|
|
struct files_struct **pfsp)
|
|
{
|
|
+ struct smbXsrv_connection *xconn = smb_req->xconn;
|
|
struct connection_struct *conn = smb_req->conn;
|
|
struct files_struct *fsp;
|
|
struct smb_filename *smb_fname = NULL;
|
|
+ struct auth_session_info *session_info = conn->session_info;
|
|
NTSTATUS status;
|
|
|
|
status = file_new(smb_req, conn, &fsp);
|
|
@@ -68,10 +71,87 @@ NTSTATUS open_np_file(struct smb_request *smb_req, const char *name,
|
|
return status;
|
|
}
|
|
|
|
+ if (smb_req->smb2req != NULL && smb_req->smb2req->was_encrypted) {
|
|
+ struct security_token *security_token = NULL;
|
|
+ uint16_t dialect = xconn->smb2.server.dialect;
|
|
+ uint16_t srv_smb_encrypt = 0x0002;
|
|
+ uint16_t cipher = xconn->smb2.server.cipher;
|
|
+ char smb3_sid_str[SID_MAX_SIZE];
|
|
+ struct dom_sid smb3_dom_sid;
|
|
+ struct dom_sid smb3_sid;
|
|
+ uint32_t i;
|
|
+ bool ok;
|
|
+ int rc;
|
|
+
|
|
+ session_info = copy_session_info(fsp, conn->session_info);
|
|
+ if (session_info == NULL) {
|
|
+ DBG_ERR("Failed to copy session info\n");
|
|
+ file_free(smb_req, fsp);
|
|
+ return NT_STATUS_NO_MEMORY;
|
|
+ }
|
|
+ security_token = session_info->security_token;
|
|
+
|
|
+ ok = dom_sid_parse(SID_SAMBA_SMB3, &smb3_dom_sid);
|
|
+ if (!ok) {
|
|
+ file_free(smb_req, fsp);
|
|
+ return NT_STATUS_BUFFER_TOO_SMALL;
|
|
+ }
|
|
+
|
|
+ /*
|
|
+ * Security check:
|
|
+ *
|
|
+ * Make sure we don't have a SMB3 SID in the security token!
|
|
+ */
|
|
+ for (i = 0; i < security_token->num_sids; i++) {
|
|
+ int cmp;
|
|
+
|
|
+ cmp = dom_sid_compare_domain(&security_token->sids[i],
|
|
+ &smb3_dom_sid);
|
|
+ if (cmp == 0) {
|
|
+ DBG_ERR("ERROR: An SMB3 SID has already been "
|
|
+ "detected in the security token!\n");
|
|
+ file_free(smb_req, fsp);
|
|
+ return NT_STATUS_ACCESS_DENIED;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ rc = snprintf(smb3_sid_str,
|
|
+ sizeof(smb3_sid_str),
|
|
+ "%s-%u-%u-%u",
|
|
+ SID_SAMBA_SMB3,
|
|
+ dialect,
|
|
+ srv_smb_encrypt,
|
|
+ cipher);
|
|
+ if (rc < 0) {
|
|
+ DBG_ERR("Buffer too small\n");
|
|
+ file_free(smb_req, fsp);
|
|
+ return NT_STATUS_BUFFER_TOO_SMALL;
|
|
+ }
|
|
+
|
|
+ ok = dom_sid_parse(smb3_sid_str, &smb3_sid);
|
|
+ if (!ok) {
|
|
+ DBG_ERR("Failed to parse SMB3 SID\n");
|
|
+ file_free(smb_req, fsp);
|
|
+ return NT_STATUS_INVALID_PARAMETER;
|
|
+ }
|
|
+
|
|
+ status = add_sid_to_array_unique(security_token,
|
|
+ &smb3_sid,
|
|
+ &security_token->sids,
|
|
+ &security_token->num_sids);
|
|
+ if (!NT_STATUS_IS_OK(status)) {
|
|
+ DBG_ERR("Failed to add SMB3 SID to security token\n");
|
|
+ file_free(smb_req, fsp);
|
|
+ return status;
|
|
+ }
|
|
+
|
|
+ fsp->fsp_flags.encryption_required = true;
|
|
+ }
|
|
+
|
|
status = np_open(fsp, name,
|
|
conn->sconn->remote_address,
|
|
conn->sconn->local_address,
|
|
- conn->session_info,
|
|
+ session_info,
|
|
conn->sconn->ev_ctx,
|
|
conn->sconn->msg_ctx,
|
|
conn->sconn->dce_ctx,
|
|
diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
|
|
index cf9de185c1f..cd24b7d2ed5 100644
|
|
--- a/source3/smbd/smb2_server.c
|
|
+++ b/source3/smbd/smb2_server.c
|
|
@@ -3232,6 +3232,11 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
|
|
return smbd_smb2_request_error(req,
|
|
NT_STATUS_FILE_CLOSED);
|
|
}
|
|
+ } else {
|
|
+ if (fsp->fsp_flags.encryption_required && !req->was_encrypted) {
|
|
+ return smbd_smb2_request_error(req,
|
|
+ NT_STATUS_ACCESS_DENIED);
|
|
+ }
|
|
}
|
|
}
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 333ae30e7f8238c684d2a1aec2b0516369068a7e Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 12 Mar 2020 14:11:56 +0100
|
|
Subject: [PATCH 078/105] librpc: Add dcerpc helper
|
|
dcerpc_is_transport_encrypted()
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 8bbe5c8c94aaf75d715f558c363e5b2de49f7bf9)
|
|
---
|
|
librpc/rpc/dcerpc_helper.c | 137 +++++++++++++++++++++++++++++++++++++
|
|
librpc/rpc/dcerpc_helper.h | 26 +++++++
|
|
librpc/wscript_build | 9 +++
|
|
3 files changed, 172 insertions(+)
|
|
create mode 100644 librpc/rpc/dcerpc_helper.c
|
|
create mode 100644 librpc/rpc/dcerpc_helper.h
|
|
|
|
diff --git a/librpc/rpc/dcerpc_helper.c b/librpc/rpc/dcerpc_helper.c
|
|
new file mode 100644
|
|
index 00000000000..c5443764628
|
|
--- /dev/null
|
|
+++ b/librpc/rpc/dcerpc_helper.c
|
|
@@ -0,0 +1,137 @@
|
|
+/*
|
|
+ * Copyright (c) 2020 Andreas Schneider <asn@samba.org>
|
|
+ *
|
|
+ * This program is free software: you can redistribute it and/or modify
|
|
+ * it under the terms of the GNU General Public License as published by
|
|
+ * the Free Software Foundation, either version 3 of the License, or
|
|
+ * (at your option) any later version.
|
|
+ *
|
|
+ * This program is distributed in the hope that it will be useful,
|
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+ * GNU General Public License for more details.
|
|
+ *
|
|
+ * You should have received a copy of the GNU General Public License
|
|
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+ */
|
|
+
|
|
+#include "includes.h"
|
|
+#include "librpc/gen_ndr/security.h"
|
|
+#include "librpc/gen_ndr/auth.h"
|
|
+#include "lib/crypto/gnutls_helpers.h"
|
|
+#include "libcli/security/dom_sid.h"
|
|
+#include "libcli/smb/smb2_constants.h"
|
|
+
|
|
+#include "dcerpc_helper.h"
|
|
+
|
|
+static bool smb3_sid_parse(const struct dom_sid *sid,
|
|
+ uint16_t *pdialect,
|
|
+ uint16_t *pencrypt,
|
|
+ uint16_t *pcipher)
|
|
+{
|
|
+ uint16_t dialect;
|
|
+ uint16_t encrypt;
|
|
+ uint16_t cipher;
|
|
+
|
|
+ if (sid->sub_auths[0] != 1397571891) {
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ dialect = sid->sub_auths[1];
|
|
+ if (dialect > 0x03ff) {
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ encrypt = sid->sub_auths[2];
|
|
+ if (encrypt > 0x0002) {
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ cipher = sid->sub_auths[3];
|
|
+ if (cipher > SMB2_ENCRYPTION_AES128_GCM) {
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ if (pdialect != NULL) {
|
|
+ *pdialect = dialect;
|
|
+ }
|
|
+
|
|
+ if (pencrypt != NULL) {
|
|
+ *pencrypt = encrypt;
|
|
+ }
|
|
+
|
|
+ if (pcipher != NULL) {
|
|
+ *pcipher = cipher;
|
|
+ }
|
|
+
|
|
+ return true;
|
|
+}
|
|
+
|
|
+bool dcerpc_is_transport_encrypted(struct auth_session_info *session_info)
|
|
+{
|
|
+ struct security_token *token = session_info->security_token;
|
|
+ struct dom_sid smb3_dom_sid;
|
|
+ const struct dom_sid *smb3_sid = NULL;
|
|
+ uint16_t dialect = 0;
|
|
+ uint16_t encrypt = 0;
|
|
+ uint16_t cipher = 0;
|
|
+ uint32_t i;
|
|
+ bool ok;
|
|
+
|
|
+ ok = dom_sid_parse(SID_SAMBA_SMB3, &smb3_dom_sid);
|
|
+ if (!ok) {
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ for (i = 0; i < token->num_sids; i++) {
|
|
+ int cmp;
|
|
+
|
|
+ /* There is only one SMB3 SID allowed! */
|
|
+ cmp = dom_sid_compare_domain(&token->sids[i], &smb3_dom_sid);
|
|
+ if (cmp == 0) {
|
|
+ if (smb3_sid == NULL) {
|
|
+ smb3_sid = &token->sids[i];
|
|
+ } else {
|
|
+ DBG_ERR("ERROR: The SMB3 SID has been detected "
|
|
+ "multiple times\n");
|
|
+ return false;
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+
|
|
+ if (smb3_sid == NULL) {
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ ok = smb3_sid_parse(smb3_sid, &dialect, &encrypt, &cipher);
|
|
+ if (!ok) {
|
|
+ DBG_ERR("Failed to parse SMB3 SID!\n");
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ DBG_DEBUG("SMB SID - dialect: %#04x, encrypt: %#04x, cipher: %#04x\n",
|
|
+ dialect,
|
|
+ encrypt,
|
|
+ cipher);
|
|
+
|
|
+ if (dialect < SMB3_DIALECT_REVISION_300) {
|
|
+ DBG_DEBUG("Invalid SMB3 dialect!\n");
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ if (encrypt != DCERPC_SMB_ENCRYPTION_REQUIRED) {
|
|
+ DBG_DEBUG("Invalid SMB3 encryption!\n");
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ switch (cipher) {
|
|
+ case SMB2_ENCRYPTION_AES128_CCM:
|
|
+ case SMB2_ENCRYPTION_AES128_GCM:
|
|
+ break;
|
|
+ default:
|
|
+ DBG_DEBUG("Invalid SMB3 cipher!\n");
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ return true;
|
|
+}
|
|
diff --git a/librpc/rpc/dcerpc_helper.h b/librpc/rpc/dcerpc_helper.h
|
|
new file mode 100644
|
|
index 00000000000..c0f09ee494e
|
|
--- /dev/null
|
|
+++ b/librpc/rpc/dcerpc_helper.h
|
|
@@ -0,0 +1,26 @@
|
|
+/*
|
|
+ * Copyright (c) 2020 Andreas Schneider <asn@samba.org>
|
|
+ *
|
|
+ * This program is free software: you can redistribute it and/or modify
|
|
+ * it under the terms of the GNU General Public License as published by
|
|
+ * the Free Software Foundation, either version 3 of the License, or
|
|
+ * (at your option) any later version.
|
|
+ *
|
|
+ * This program is distributed in the hope that it will be useful,
|
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+ * GNU General Public License for more details.
|
|
+ *
|
|
+ * You should have received a copy of the GNU General Public License
|
|
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+ */
|
|
+
|
|
+#ifndef _DCERPC_HELPER_H
|
|
+#define _DCERPC_HELPER_H
|
|
+
|
|
+#define DCERPC_SMB_ENCRYPTION_OFF 0x0000
|
|
+#define DCERPC_SMB_ENCRYPTION_REQUIRED 0x0002
|
|
+
|
|
+bool dcerpc_is_transport_encrypted(struct auth_session_info *session_info);
|
|
+
|
|
+#endif /* _DCERPC_HELPER_H */
|
|
diff --git a/librpc/wscript_build b/librpc/wscript_build
|
|
index 27b180fa63d..109a1834841 100644
|
|
--- a/librpc/wscript_build
|
|
+++ b/librpc/wscript_build
|
|
@@ -669,6 +669,15 @@ bld.SAMBA_LIBRARY('dcerpc-server-core',
|
|
autoproto='rpc/dcesrv_core_proto.h',
|
|
vnum='0.0.1')
|
|
|
|
+bld.SAMBA_SUBSYSTEM('DCERPC_HELPER',
|
|
+ source='rpc/dcerpc_helper.c',
|
|
+ public_deps='''
|
|
+ samba-hostconfig
|
|
+ samba-security
|
|
+ gnutls
|
|
+ GNUTLS_HELPERS
|
|
+ ''')
|
|
+
|
|
bld.SAMBA_SUBSYSTEM('NDR_WINBIND',
|
|
source='gen_ndr/ndr_winbind.c',
|
|
public_deps='ndr NDR_LSA'
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 4a2e7909f3a40c6ab82c045a5a54f8604a6f1dd2 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 28 Aug 2020 16:31:17 +0200
|
|
Subject: [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt'
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 5f1a73be6311c68a21a550c0de5078baeb78f4ee)
|
|
---
|
|
source3/smbd/pipes.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c
|
|
index d51a3de9497..785cbb23b5f 100644
|
|
--- a/source3/smbd/pipes.c
|
|
+++ b/source3/smbd/pipes.c
|
|
@@ -31,6 +31,7 @@
|
|
#include "libcli/security/security.h"
|
|
#include "rpc_server/srv_pipe_hnd.h"
|
|
#include "auth/auth_util.h"
|
|
+#include "librpc/rpc/dcerpc_helper.h"
|
|
|
|
NTSTATUS open_np_file(struct smb_request *smb_req, const char *name,
|
|
struct files_struct **pfsp)
|
|
@@ -74,7 +75,7 @@ NTSTATUS open_np_file(struct smb_request *smb_req, const char *name,
|
|
if (smb_req->smb2req != NULL && smb_req->smb2req->was_encrypted) {
|
|
struct security_token *security_token = NULL;
|
|
uint16_t dialect = xconn->smb2.server.dialect;
|
|
- uint16_t srv_smb_encrypt = 0x0002;
|
|
+ uint16_t srv_smb_encrypt = DCERPC_SMB_ENCRYPTION_REQUIRED;
|
|
uint16_t cipher = xconn->smb2.server.cipher;
|
|
char smb3_sid_str[SID_MAX_SIZE];
|
|
struct dom_sid smb3_dom_sid;
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 69b9e46fa29adcf5a478a240ea6980bf7d97ae4b Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 12 Nov 2019 16:56:45 +0100
|
|
Subject: [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit c6a21e1897985f267bcfc681179cea95165c3c57)
|
|
---
|
|
source3/rpc_server/samr/srv_samr_chgpasswd.c | 3 +
|
|
source3/rpc_server/samr/srv_samr_nt.c | 78 +++++++++++++++++++-
|
|
source3/rpc_server/wscript_build | 2 +-
|
|
3 files changed, 81 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c
|
|
index cb9837ecf01..e326745169e 100644
|
|
--- a/source3/rpc_server/samr/srv_samr_chgpasswd.c
|
|
+++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c
|
|
@@ -769,11 +769,13 @@ static NTSTATUS check_oem_password(const char *user,
|
|
.size = 16,
|
|
};
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
rc = gnutls_cipher_init(&cipher_hnd,
|
|
GNUTLS_CIPHER_ARCFOUR_128,
|
|
&enc_key,
|
|
NULL);
|
|
if (rc < 0) {
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
}
|
|
|
|
@@ -781,6 +783,7 @@ static NTSTATUS check_oem_password(const char *user,
|
|
password_encrypted,
|
|
516);
|
|
gnutls_cipher_deinit(cipher_hnd);
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
if (rc < 0) {
|
|
return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
}
|
|
diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c
|
|
index 5ffc3331185..77cb18b6a88 100644
|
|
--- a/source3/rpc_server/samr/srv_samr_nt.c
|
|
+++ b/source3/rpc_server/samr/srv_samr_nt.c
|
|
@@ -46,6 +46,8 @@
|
|
#include "rpc_server/srv_access_check.h"
|
|
#include "../lib/tsocket/tsocket.h"
|
|
#include "lib/util/base64.h"
|
|
+#include "param/param.h"
|
|
+#include "librpc/rpc/dcerpc_helper.h"
|
|
|
|
#include "lib/crypto/gnutls_helpers.h"
|
|
#include <gnutls/gnutls.h>
|
|
@@ -1887,6 +1889,7 @@ NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p,
|
|
char *user_name = NULL;
|
|
char *rhost;
|
|
const char *wks = NULL;
|
|
+ bool encrypted;
|
|
|
|
DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
|
|
|
|
@@ -1915,6 +1918,12 @@ NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p,
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
+ encrypted = dcerpc_is_transport_encrypted(p->session_info);
|
|
+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED &&
|
|
+ !encrypted) {
|
|
+ return NT_STATUS_ACCESS_DENIED;
|
|
+ }
|
|
+
|
|
/*
|
|
* UNIX username case mangling not required, pass_oem_change
|
|
* is case insensitive.
|
|
@@ -1948,6 +1957,7 @@ NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p,
|
|
char *user_name = NULL;
|
|
const char *wks = NULL;
|
|
char *rhost;
|
|
+ bool encrypted;
|
|
|
|
DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__));
|
|
|
|
@@ -1985,6 +1995,12 @@ NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p,
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
+ encrypted = dcerpc_is_transport_encrypted(p->session_info);
|
|
+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED &&
|
|
+ !encrypted) {
|
|
+ return NT_STATUS_ACCESS_DENIED;
|
|
+ }
|
|
+
|
|
status = pass_oem_change(user_name,
|
|
rhost,
|
|
r->in.password->data,
|
|
@@ -5200,8 +5216,13 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p,
|
|
char *rhost;
|
|
DATA_BLOB session_key;
|
|
struct dom_sid_buf buf;
|
|
+ struct loadparm_context *lp_ctx = NULL;
|
|
+ bool encrypted;
|
|
|
|
- DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__));
|
|
+ lp_ctx = loadparm_init_s3(p->mem_ctx, loadparm_s3_helpers());
|
|
+ if (lp_ctx == NULL) {
|
|
+ return NT_STATUS_NO_MEMORY;
|
|
+ }
|
|
|
|
/* This is tricky. A WinXP domain join sets
|
|
(SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES)
|
|
@@ -5390,13 +5411,27 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p,
|
|
break;
|
|
|
|
case 23:
|
|
+ encrypted =
|
|
+ dcerpc_is_transport_encrypted(p->session_info);
|
|
+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED &&
|
|
+ !encrypted) {
|
|
+ status = NT_STATUS_ACCESS_DENIED;
|
|
+ break;
|
|
+ }
|
|
+
|
|
status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
|
|
if(!NT_STATUS_IS_OK(status)) {
|
|
break;
|
|
}
|
|
+ /*
|
|
+ * This can be allowed as it requires a session key
|
|
+ * which we only have if we have a SMB session.
|
|
+ */
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
status = arc4_decrypt_data(session_key,
|
|
info->info23.password.data,
|
|
516);
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
if(!NT_STATUS_IS_OK(status)) {
|
|
break;
|
|
}
|
|
@@ -5412,14 +5447,27 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p,
|
|
break;
|
|
|
|
case 24:
|
|
+ encrypted =
|
|
+ dcerpc_is_transport_encrypted(p->session_info);
|
|
+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED &&
|
|
+ !encrypted) {
|
|
+ status = NT_STATUS_ACCESS_DENIED;
|
|
+ break;
|
|
+ }
|
|
|
|
status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
|
|
if(!NT_STATUS_IS_OK(status)) {
|
|
break;
|
|
}
|
|
+ /*
|
|
+ * This can be allowed as it requires a session key
|
|
+ * which we only have if we have a SMB session.
|
|
+ */
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
status = arc4_decrypt_data(session_key,
|
|
info->info24.password.data,
|
|
516);
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
if(!NT_STATUS_IS_OK(status)) {
|
|
break;
|
|
}
|
|
@@ -5434,12 +5482,26 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p,
|
|
break;
|
|
|
|
case 25:
|
|
+ encrypted =
|
|
+ dcerpc_is_transport_encrypted(p->session_info);
|
|
+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED &&
|
|
+ !encrypted) {
|
|
+ status = NT_STATUS_ACCESS_DENIED;
|
|
+ break;
|
|
+ }
|
|
+
|
|
status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
|
|
if(!NT_STATUS_IS_OK(status)) {
|
|
break;
|
|
}
|
|
+ /*
|
|
+ * This can be allowed as it requires a session key
|
|
+ * which we only have if we have a SMB session.
|
|
+ */
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
status = decode_rc4_passwd_buffer(&session_key,
|
|
&info->info25.password);
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
break;
|
|
}
|
|
@@ -5454,12 +5516,26 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p,
|
|
break;
|
|
|
|
case 26:
|
|
+ encrypted =
|
|
+ dcerpc_is_transport_encrypted(p->session_info);
|
|
+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED &&
|
|
+ !encrypted) {
|
|
+ status = NT_STATUS_ACCESS_DENIED;
|
|
+ break;
|
|
+ }
|
|
+
|
|
status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
|
|
if(!NT_STATUS_IS_OK(status)) {
|
|
break;
|
|
}
|
|
+ /*
|
|
+ * This can be allowed as it requires a session key
|
|
+ * which we only have if we have a SMB session.
|
|
+ */
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
status = decode_rc4_passwd_buffer(&session_key,
|
|
&info->info26.password);
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
break;
|
|
}
|
|
diff --git a/source3/rpc_server/wscript_build b/source3/rpc_server/wscript_build
|
|
index 2af02ad6fa8..eb91ac09384 100644
|
|
--- a/source3/rpc_server/wscript_build
|
|
+++ b/source3/rpc_server/wscript_build
|
|
@@ -85,7 +85,7 @@ bld.SAMBA3_SUBSYSTEM('RPC_SAMR',
|
|
source='''samr/srv_samr_nt.c
|
|
samr/srv_samr_util.c
|
|
samr/srv_samr_chgpasswd.c''',
|
|
- deps='PLAINTEXT_AUTH SRV_ACCESS_CHECK')
|
|
+ deps='PLAINTEXT_AUTH SRV_ACCESS_CHECK DCERPC_HELPER')
|
|
|
|
bld.SAMBA3_SUBSYSTEM('RPC_SPOOLSS',
|
|
source='''spoolss/srv_spoolss_nt.c
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 110323b646715aabd4468d70773c2d94968f2e99 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 15 Nov 2019 13:49:40 +0100
|
|
Subject: [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit a9c532c6d3e85fbe49b7040254cfc66ab54074bc)
|
|
---
|
|
source4/rpc_server/samr/samr_password.c | 30 +++++++++++++++++++++++++
|
|
source4/rpc_server/wscript_build | 2 +-
|
|
2 files changed, 31 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
|
|
index 52a644176e2..83b104fbd0e 100644
|
|
--- a/source4/rpc_server/samr/samr_password.c
|
|
+++ b/source4/rpc_server/samr/samr_password.c
|
|
@@ -31,6 +31,8 @@
|
|
#include "../lib/util/util_ldb.h"
|
|
#include "rpc_server/samr/proto.h"
|
|
#include "auth/auth_sam.h"
|
|
+#include "lib/param/loadparm.h"
|
|
+#include "librpc/rpc/dcerpc_helper.h"
|
|
|
|
#include "lib/crypto/gnutls_helpers.h"
|
|
#include <gnutls/gnutls.h>
|
|
@@ -129,6 +131,8 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call,
|
|
struct dom_sid *user_objectSid = NULL;
|
|
gnutls_cipher_hd_t cipher_hnd = NULL;
|
|
gnutls_datum_t lm_session_key;
|
|
+ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
|
|
+ bool encrypted;
|
|
int rc;
|
|
|
|
if (pwbuf == NULL) {
|
|
@@ -144,6 +148,12 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call,
|
|
return NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER;
|
|
}
|
|
|
|
+ encrypted = dcerpc_is_transport_encrypted(session_info);
|
|
+ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED &&
|
|
+ !encrypted) {
|
|
+ return NT_STATUS_ACCESS_DENIED;
|
|
+ }
|
|
+
|
|
/* Connect to a SAMDB with system privileges for fetching the old pw
|
|
* hashes. */
|
|
sam_ctx = samdb_connect(mem_ctx,
|
|
@@ -188,11 +198,13 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call,
|
|
.size = sizeof(lm_pwd->hash),
|
|
};
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
rc = gnutls_cipher_init(&cipher_hnd,
|
|
GNUTLS_CIPHER_ARCFOUR_128,
|
|
&lm_session_key,
|
|
NULL);
|
|
if (rc < 0) {
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
goto failed;
|
|
}
|
|
@@ -201,6 +213,7 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call,
|
|
pwbuf->data,
|
|
516);
|
|
gnutls_cipher_deinit(cipher_hnd);
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
if (rc < 0) {
|
|
status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
goto failed;
|
|
@@ -607,7 +620,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call,
|
|
DATA_BLOB session_key = data_blob(NULL, 0);
|
|
gnutls_cipher_hd_t cipher_hnd = NULL;
|
|
gnutls_datum_t _session_key;
|
|
+ struct auth_session_info *session_info =
|
|
+ dcesrv_call_session_info(dce_call);
|
|
+ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
|
|
int rc;
|
|
+ bool encrypted;
|
|
+
|
|
+ encrypted = dcerpc_is_transport_encrypted(session_info);
|
|
+ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED &&
|
|
+ !encrypted) {
|
|
+ return NT_STATUS_ACCESS_DENIED;
|
|
+ }
|
|
|
|
nt_status = dcesrv_transport_session_key(dce_call, &session_key);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
@@ -621,11 +644,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call,
|
|
.size = session_key.length,
|
|
};
|
|
|
|
+ /*
|
|
+ * This is safe to support as we only have a session key
|
|
+ * over a SMB connection which we force to be encrypted.
|
|
+ */
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
rc = gnutls_cipher_init(&cipher_hnd,
|
|
GNUTLS_CIPHER_ARCFOUR_128,
|
|
&_session_key,
|
|
NULL);
|
|
if (rc < 0) {
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
goto out;
|
|
}
|
|
@@ -634,6 +663,7 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call,
|
|
pwbuf->data,
|
|
516);
|
|
gnutls_cipher_deinit(cipher_hnd);
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
if (rc < 0) {
|
|
nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
goto out;
|
|
diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build
|
|
index de55ad6239a..c9c1978f223 100644
|
|
--- a/source4/rpc_server/wscript_build
|
|
+++ b/source4/rpc_server/wscript_build
|
|
@@ -87,7 +87,7 @@ bld.SAMBA_MODULE('dcesrv_samr',
|
|
autoproto='samr/proto.h',
|
|
subsystem='dcerpc_server',
|
|
init_function='dcerpc_server_samr_init',
|
|
- deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS'
|
|
+ deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS DCERPC_HELPER'
|
|
)
|
|
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 6353a991bc6d35b9468867c0e809e752b060da9b Mon Sep 17 00:00:00 2001
|
|
From: Isaac Boukris <iboukris@gmail.com>
|
|
Date: Thu, 20 Aug 2020 12:45:49 +0200
|
|
Subject: [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips
|
|
mode
|
|
|
|
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
|
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 32d4c75d6cbf9153068a0487347097707afb356a)
|
|
---
|
|
lib/crypto/py_crypto.c | 16 ++++++++++++++++
|
|
1 file changed, 16 insertions(+)
|
|
|
|
diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c
|
|
index 32b946eee8f..ad18d3ada0f 100644
|
|
--- a/lib/crypto/py_crypto.c
|
|
+++ b/lib/crypto/py_crypto.c
|
|
@@ -24,6 +24,7 @@
|
|
|
|
#include <gnutls/gnutls.h>
|
|
#include <gnutls/crypto.h>
|
|
+#include "lib/crypto/gnutls_helpers.h"
|
|
|
|
static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args)
|
|
{
|
|
@@ -85,12 +86,27 @@ static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args)
|
|
return result;
|
|
}
|
|
|
|
+static PyObject *py_crypto_set_relax_mode(PyObject *module)
|
|
+{
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
+
|
|
+ Py_RETURN_NONE;
|
|
+}
|
|
+
|
|
+static PyObject *py_crypto_set_strict_mode(PyObject *module)
|
|
+{
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
+
|
|
+ Py_RETURN_NONE;
|
|
+}
|
|
|
|
static const char py_crypto_arcfour_crypt_blob_doc[] = "arcfour_crypt_blob(data, key)\n"
|
|
"Encrypt the data with RC4 algorithm using the key";
|
|
|
|
static PyMethodDef py_crypto_methods[] = {
|
|
{ "arcfour_crypt_blob", (PyCFunction)py_crypto_arcfour_crypt_blob, METH_VARARGS, py_crypto_arcfour_crypt_blob_doc },
|
|
+ { "set_relax_mode", (PyCFunction)py_crypto_set_relax_mode, METH_NOARGS, "Set fips to relax mode" },
|
|
+ { "set_strict_mode", (PyCFunction)py_crypto_set_strict_mode, METH_NOARGS, "Set fips to strict mode" },
|
|
{0},
|
|
};
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 525072939b9292a1744f929803a9597b5f725f9a Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 28 Oct 2020 17:05:36 +0100
|
|
Subject: [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 7d54e4b49c235dc571f47d15e6b0a6fa63340773)
|
|
---
|
|
source4/param/pyparam.c | 22 ++++++++++++++++++++++
|
|
1 file changed, 22 insertions(+)
|
|
|
|
diff --git a/source4/param/pyparam.c b/source4/param/pyparam.c
|
|
index 4023fac4dd6..e15592b5743 100644
|
|
--- a/source4/param/pyparam.c
|
|
+++ b/source4/param/pyparam.c
|
|
@@ -463,6 +463,23 @@ static PyObject *py_lp_ctx_config_file(PyObject *self, void *closure)
|
|
return PyUnicode_FromString(configfile);
|
|
}
|
|
|
|
+static PyObject *py_lp_ctx_weak_crypto(PyObject *self, void *closure)
|
|
+{
|
|
+ enum samba_weak_crypto weak_crypto =
|
|
+ lpcfg_weak_crypto(PyLoadparmContext_AsLoadparmContext(self));
|
|
+
|
|
+ switch(weak_crypto) {
|
|
+ case SAMBA_WEAK_CRYPTO_UNKNOWN:
|
|
+ Py_RETURN_NONE;
|
|
+ case SAMBA_WEAK_CRYPTO_ALLOWED:
|
|
+ return PyUnicode_FromString("allowed");
|
|
+ case SAMBA_WEAK_CRYPTO_DISALLOWED:
|
|
+ return PyUnicode_FromString("disallowed");
|
|
+ }
|
|
+
|
|
+ Py_RETURN_NONE;
|
|
+}
|
|
+
|
|
static PyGetSetDef py_lp_ctx_getset[] = {
|
|
{
|
|
.name = discard_const_p(char, "default_service"),
|
|
@@ -473,6 +490,11 @@ static PyGetSetDef py_lp_ctx_getset[] = {
|
|
.get = (getter)py_lp_ctx_config_file,
|
|
.doc = discard_const_p(char, "Name of last config file that was loaded.")
|
|
},
|
|
+ {
|
|
+ .name = discard_const_p(char, "weak_crypto"),
|
|
+ .get = (getter)py_lp_ctx_weak_crypto,
|
|
+ .doc = discard_const_p(char, "If weak crypto is allowed.")
|
|
+ },
|
|
{ .name = NULL }
|
|
};
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From c7dfaf75a8f8bdb18c42325c470bdee8e600d930 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 21 Oct 2020 10:09:22 +0200
|
|
Subject: [PATCH 084/105] python:tests: Add SAMR password change tests for fips
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 9a3ba502d8193b25799ef92917efafd52de2e8c2)
|
|
---
|
|
.../tests/dcerpc/samr_change_password.py | 188 ++++++++++++++++++
|
|
selftest/tests.py | 2 +
|
|
2 files changed, 190 insertions(+)
|
|
create mode 100644 python/samba/tests/dcerpc/samr_change_password.py
|
|
|
|
diff --git a/python/samba/tests/dcerpc/samr_change_password.py b/python/samba/tests/dcerpc/samr_change_password.py
|
|
new file mode 100644
|
|
index 00000000000..109eeea98cc
|
|
--- /dev/null
|
|
+++ b/python/samba/tests/dcerpc/samr_change_password.py
|
|
@@ -0,0 +1,188 @@
|
|
+# Unix SMB/CIFS implementation.
|
|
+#
|
|
+# Copyright © 2020 Andreas Schneider <asn@samba.org>
|
|
+#
|
|
+# This program is free software; you can redistribute it and/or modify
|
|
+# it under the terms of the GNU General Public License as published by
|
|
+# the Free Software Foundation; either version 3 of the License, or
|
|
+# (at your option) any later version.
|
|
+#
|
|
+# This program is distributed in the hope that it will be useful,
|
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+# GNU General Public License for more details.
|
|
+#
|
|
+# You should have received a copy of the GNU General Public License
|
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+#
|
|
+
|
|
+"""Tests for samba.dcerpc.samr.password"""
|
|
+
|
|
+import os
|
|
+import ctypes
|
|
+import samba.tests
|
|
+
|
|
+from samba import crypto, generate_random_password, generate_random_bytes, ntstatus
|
|
+from samba.auth import system_session
|
|
+from samba.credentials import Credentials
|
|
+from samba.credentials import SMB_ENCRYPTION_REQUIRED
|
|
+from samba.dcerpc import samr, security, lsa
|
|
+from samba.samdb import SamDB
|
|
+from samba.tests import RpcInterfaceTestCase
|
|
+
|
|
+
|
|
+class SamrPasswordTests(RpcInterfaceTestCase):
|
|
+ def setUp(self):
|
|
+ super(SamrPasswordTests, self).setUp()
|
|
+ self.open_samdb()
|
|
+
|
|
+ self.create_user_account(10000)
|
|
+
|
|
+ self.remote_server = samba.tests.env_get_var_value('SERVER')
|
|
+ self.remote_domain = samba.tests.env_get_var_value('DOMAIN')
|
|
+ self.remote_user = samba.tests.env_get_var_value('USERNAME')
|
|
+ self.remote_password = samba.tests.env_get_var_value('PASSWORD')
|
|
+ self.remote_binding_string = "ncacn_np:%s[krb5]" % (self.remote_server)
|
|
+
|
|
+ self.remote_creds = Credentials()
|
|
+ self.remote_creds.guess(self.lp)
|
|
+ self.remote_creds.set_username(self.remote_user)
|
|
+ self.remote_creds.set_password(self.remote_password)
|
|
+
|
|
+ def tearDown(self):
|
|
+ super(SamrPasswordTests, self).tearDown()
|
|
+
|
|
+ samr.Close(self.user_handle)
|
|
+ samr.Close(self.domain_handle)
|
|
+ samr.Close(self.handle)
|
|
+
|
|
+ samba.tests.delete_force(self.samdb, self.user_dn)
|
|
+
|
|
+ #
|
|
+ # Open the samba database
|
|
+ #
|
|
+ def open_samdb(self):
|
|
+ self.lp = samba.tests.env_loadparm()
|
|
+
|
|
+ self.local_creds = Credentials()
|
|
+ self.local_creds.guess(self.lp)
|
|
+ self.session = system_session()
|
|
+ self.samdb = SamDB(session_info=self.session,
|
|
+ credentials=self.local_creds,
|
|
+ lp=self.lp)
|
|
+
|
|
+ #
|
|
+ # Open a SAMR Domain handle
|
|
+ #
|
|
+ def open_domain_handle(self):
|
|
+ self.handle = self.conn.Connect2(None,
|
|
+ security.SEC_FLAG_MAXIMUM_ALLOWED)
|
|
+
|
|
+ self.domain_sid = self.conn.LookupDomain(self.handle,
|
|
+ lsa.String(self.remote_domain))
|
|
+
|
|
+ self.domain_handle = self.conn.OpenDomain(self.handle,
|
|
+ security.SEC_FLAG_MAXIMUM_ALLOWED,
|
|
+ self.domain_sid)
|
|
+
|
|
+ def open_user_handle(self):
|
|
+ name = lsa.String(self.user_name)
|
|
+
|
|
+ rids = self.conn.LookupNames(self.domain_handle, [name])
|
|
+
|
|
+ self.user_handle = self.conn.OpenUser(self.domain_handle,
|
|
+ security.SEC_FLAG_MAXIMUM_ALLOWED,
|
|
+ rids[0].ids[0])
|
|
+ #
|
|
+ # Create a test user account
|
|
+ #
|
|
+ def create_user_account(self, user_id):
|
|
+ self.user_name = ("SAMR_USER_%d" % user_id)
|
|
+ self.user_pass = generate_random_password(32, 32)
|
|
+ self.user_dn = "cn=%s,cn=users,%s" % (self.user_name, self.samdb.domain_dn())
|
|
+
|
|
+ samba.tests.delete_force(self.samdb, self.user_dn)
|
|
+
|
|
+ self.samdb.newuser(self.user_name,
|
|
+ self.user_pass,
|
|
+ description="Password for " + self.user_name + " is " + self.user_pass,
|
|
+ givenname=self.user_name,
|
|
+ surname=self.user_name)
|
|
+
|
|
+
|
|
+ def init_samr_CryptPassword(self, password, session_key):
|
|
+
|
|
+ def encode_pw_buffer(password):
|
|
+ data = bytearray([0] * 516)
|
|
+
|
|
+ p = samba.string_to_byte_array(password.encode('utf-16-le'))
|
|
+ plen = len(p)
|
|
+
|
|
+ b = generate_random_bytes(512 - plen)
|
|
+
|
|
+ i = 512 - plen
|
|
+ data[0:i] = b
|
|
+ data[i:i+plen] = p
|
|
+ data[512:516] = plen.to_bytes(4, byteorder='little')
|
|
+
|
|
+ return bytes(data)
|
|
+
|
|
+ # This is a test, so always allow to encrypt using RC4
|
|
+ try:
|
|
+ crypto.set_relax_mode()
|
|
+ encrypted_blob = samba.arcfour_encrypt(session_key, encode_pw_buffer(password))
|
|
+ finally:
|
|
+ crypto.set_strict_mode()
|
|
+
|
|
+ out_blob = samr.CryptPassword()
|
|
+ out_blob.data = list(encrypted_blob)
|
|
+
|
|
+ return out_blob
|
|
+
|
|
+
|
|
+ def test_setUserInfo2_Password(self, password='P@ssw0rd'):
|
|
+ self.conn = samr.samr(self.remote_binding_string,
|
|
+ self.get_loadparm(),
|
|
+ self.remote_creds)
|
|
+ self.open_domain_handle()
|
|
+ self.open_user_handle()
|
|
+
|
|
+ password='P@ssw0rd'
|
|
+
|
|
+ level = 24
|
|
+ info = samr.UserInfo24()
|
|
+
|
|
+ info.password_expired = 0
|
|
+ info.password = self.init_samr_CryptPassword(password, self.conn.session_key)
|
|
+
|
|
+ # If the server is in FIPS mode, it should reject the password change!
|
|
+ try:
|
|
+ self.conn.SetUserInfo2(self.user_handle, level, info)
|
|
+ except samba.NTSTATUSError as e:
|
|
+ code = ctypes.c_uint32(e.args[0]).value
|
|
+ print(code)
|
|
+ if ((code == ntstatus.NT_STATUS_ACCESS_DENIED) and
|
|
+ (self.lp.weak_crypto == 'disallowed')):
|
|
+ pass
|
|
+ else:
|
|
+ raise
|
|
+
|
|
+
|
|
+ def test_setUserInfo2_Password_Encrypted(self, password='P@ssw0rd'):
|
|
+ self.remote_creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED)
|
|
+
|
|
+ self.conn = samr.samr(self.remote_binding_string,
|
|
+ self.get_loadparm(),
|
|
+ self.remote_creds)
|
|
+ self.open_domain_handle()
|
|
+ self.open_user_handle()
|
|
+
|
|
+ password='P@ssw0rd'
|
|
+
|
|
+ level = 24
|
|
+ info = samr.UserInfo24()
|
|
+
|
|
+ info.password_expired = 0
|
|
+ info.password = self.init_samr_CryptPassword(password, self.conn.session_key)
|
|
+
|
|
+ self.conn.SetUserInfo2(self.user_handle, level, info)
|
|
diff --git a/selftest/tests.py b/selftest/tests.py
|
|
index adcb5b53189..86cab3f8046 100644
|
|
--- a/selftest/tests.py
|
|
+++ b/selftest/tests.py
|
|
@@ -93,6 +93,8 @@ planpythontestsuite(
|
|
os.path.join(samba4srcdir, "..", "third_party", "waf")])
|
|
planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest")
|
|
planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding")
|
|
+for env in [ 'ad_dc:local', 'ad_dc_fips:local' ]:
|
|
+ planpythontestsuite(env, "samba.tests.dcerpc.samr_change_password")
|
|
|
|
|
|
def cmdline(script, *args):
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 9dfef9d7129babedfdc0fddd60f76859f44fe7c1 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 21 Oct 2020 10:09:22 +0200
|
|
Subject: [PATCH 085/105] python:tests: Add SAMR password change tests for fips
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
|
|
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
|
|
Autobuild-Date(master): Thu Oct 29 15:41:37 UTC 2020 on sn-devel-184
|
|
|
|
(cherry picked from commit ebd687335b9accfdbae7dbc65c9882ab4d5c0986)
|
|
---
|
|
selftest/target/Samba4.pm | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
|
|
index 649e923ff9a..1ebdf2a5484 100755
|
|
--- a/selftest/target/Samba4.pm
|
|
+++ b/selftest/target/Samba4.pm
|
|
@@ -1040,7 +1040,7 @@ servicePrincipalName: http/testupnspn.$ctx->{dnsname}
|
|
$samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
|
|
$samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
|
|
$samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
|
|
- . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
|
|
+ . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account' -d10";
|
|
unless (system($samba_tool_cmd) == 0) {
|
|
warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
|
|
return undef;
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 8e8b9d33f25c7ef89fdf4af90821ea4de77525e1 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 20 Aug 2020 09:40:41 +0200
|
|
Subject: [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 1298280a22ef7494fb85a6a5953bae15d22fa204)
|
|
---
|
|
auth/credentials/credentials.c | 8 +++++---
|
|
auth/credentials/credentials.h | 9 ++++++---
|
|
auth/credentials/credentials_krb5.c | 4 ++--
|
|
auth/credentials/credentials_ntlm.c | 2 +-
|
|
auth/credentials/credentials_secrets.c | 5 +++--
|
|
auth/credentials/pycredentials.c | 6 +++---
|
|
auth/credentials/tests/simple.c | 2 +-
|
|
auth/credentials/wscript_build | 2 +-
|
|
auth/gensec/gensec_start.c | 8 ++++----
|
|
examples/winexe/winexe.c | 4 ++--
|
|
source3/auth/auth_generic.c | 4 ++--
|
|
source3/lib/util_cmdline.c | 18 +++++++++---------
|
|
source3/libads/sasl.c | 8 ++++----
|
|
source3/libnet/libnet_join.c | 2 +-
|
|
source3/libsmb/cliconnect.c | 16 ++++++++--------
|
|
source3/passdb/passdb.c | 6 +++---
|
|
source3/passdb/pdb_samba_dsdb.c | 4 ++--
|
|
source3/rpc_client/cli_pipe.c | 2 +-
|
|
source3/rpcclient/rpcclient.c | 8 ++++----
|
|
source3/utils/net_ads.c | 2 +-
|
|
source3/utils/net_util.c | 6 +++---
|
|
source3/utils/ntlm_auth.c | 4 ++--
|
|
source3/winbindd/winbindd_cm.c | 2 +-
|
|
source4/auth/gensec/gensec_gssapi.c | 2 +-
|
|
source4/auth/session.c | 2 +-
|
|
source4/lib/cmdline/popt_credentials.c | 4 ++--
|
|
source4/torture/ldap/session_expiry.c | 2 +-
|
|
source4/torture/raw/session.c | 4 ++--
|
|
source4/torture/rpc/schannel.c | 4 ++--
|
|
source4/torture/smb2/session.c | 12 ++++++------
|
|
30 files changed, 84 insertions(+), 78 deletions(-)
|
|
|
|
diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
|
|
index 77c35dd104b..1bdd6f15a09 100644
|
|
--- a/auth/credentials/credentials.c
|
|
+++ b/auth/credentials/credentials.c
|
|
@@ -44,6 +44,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
|
|
|
|
cred->winbind_separator = '\\';
|
|
|
|
+ cred->use_kerberos = CRED_USE_KERBEROS_DESIRED;
|
|
+
|
|
cred->signing_state = SMB_SIGNING_DEFAULT;
|
|
|
|
/*
|
|
@@ -360,7 +362,7 @@ _PUBLIC_ bool cli_credentials_authentication_requested(struct cli_credentials *c
|
|
return true;
|
|
}
|
|
|
|
- if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) {
|
|
+ if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) {
|
|
return true;
|
|
}
|
|
|
|
@@ -1018,7 +1020,7 @@ _PUBLIC_ void cli_credentials_guess(struct cli_credentials *cred,
|
|
}
|
|
|
|
if (lp_ctx != NULL &&
|
|
- cli_credentials_get_kerberos_state(cred) != CRED_DONT_USE_KERBEROS) {
|
|
+ cli_credentials_get_kerberos_state(cred) != CRED_USE_KERBEROS_DISABLED) {
|
|
cli_credentials_set_ccache(cred, lp_ctx, NULL, CRED_GUESS_FILE,
|
|
&error_string);
|
|
}
|
|
@@ -1097,7 +1099,7 @@ _PUBLIC_ void cli_credentials_set_anonymous(struct cli_credentials *cred)
|
|
cli_credentials_set_principal(cred, NULL, CRED_SPECIFIED);
|
|
cli_credentials_set_realm(cred, NULL, CRED_SPECIFIED);
|
|
cli_credentials_set_workstation(cred, "", CRED_UNINITIALISED);
|
|
- cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_DISABLED);
|
|
}
|
|
|
|
/**
|
|
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
|
|
index 438bcdce232..f468b8558dd 100644
|
|
--- a/auth/credentials/credentials.h
|
|
+++ b/auth/credentials/credentials.h
|
|
@@ -53,9 +53,12 @@ enum credentials_obtained {
|
|
};
|
|
|
|
enum credentials_use_kerberos {
|
|
- CRED_AUTO_USE_KERBEROS = 0, /* Default, we try kerberos if available */
|
|
- CRED_DONT_USE_KERBEROS, /* Sometimes trying kerberos just does 'bad things', so don't */
|
|
- CRED_MUST_USE_KERBEROS /* Sometimes administrators are parinoid, so always do kerberos */
|
|
+ /** Sometimes trying kerberos just does 'bad things', so don't */
|
|
+ CRED_USE_KERBEROS_DISABLED = 0,
|
|
+ /** Default, we try kerberos if available */
|
|
+ CRED_USE_KERBEROS_DESIRED,
|
|
+ /** Sometimes administrators are paranoid, so always do kerberos */
|
|
+ CRED_USE_KERBEROS_REQUIRED,
|
|
};
|
|
|
|
enum credentials_krb_forwardable {
|
|
diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
|
|
index 259b35b73b0..36f6b59a72b 100644
|
|
--- a/auth/credentials/credentials_krb5.c
|
|
+++ b/auth/credentials/credentials_krb5.c
|
|
@@ -871,7 +871,7 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
|
|
ret = cli_credentials_get_ccache(cred, event_ctx, lp_ctx,
|
|
&ccache, error_string);
|
|
if (ret) {
|
|
- if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) {
|
|
+ if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) {
|
|
DEBUG(1, ("Failed to get kerberos credentials (kerberos required): %s\n", *error_string));
|
|
} else {
|
|
DEBUG(4, ("Failed to get kerberos credentials: %s\n", *error_string));
|
|
@@ -1431,7 +1431,7 @@ _PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials *
|
|
cred->impersonate_principal = talloc_strdup(cred, principal);
|
|
talloc_free(cred->self_service);
|
|
cred->self_service = talloc_strdup(cred, self_service);
|
|
- cli_credentials_set_kerberos_state(cred, CRED_MUST_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_REQUIRED);
|
|
}
|
|
|
|
/*
|
|
diff --git a/auth/credentials/credentials_ntlm.c b/auth/credentials/credentials_ntlm.c
|
|
index f1b22a6c9e2..1bec60e5dce 100644
|
|
--- a/auth/credentials/credentials_ntlm.c
|
|
+++ b/auth/credentials/credentials_ntlm.c
|
|
@@ -53,7 +53,7 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred
|
|
const struct samr_Password *nt_hash = NULL;
|
|
int rc;
|
|
|
|
- if (cred->use_kerberos == CRED_MUST_USE_KERBEROS) {
|
|
+ if (cred->use_kerberos == CRED_USE_KERBEROS_REQUIRED) {
|
|
TALLOC_FREE(frame);
|
|
return NT_STATUS_INVALID_PARAMETER_MIX;
|
|
}
|
|
diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c
|
|
index 52a89d4d5b4..58067a5bece 100644
|
|
--- a/auth/credentials/credentials_secrets.c
|
|
+++ b/auth/credentials/credentials_secrets.c
|
|
@@ -370,7 +370,8 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti
|
|
}
|
|
|
|
if (secrets_tdb_password_more_recent) {
|
|
- enum credentials_use_kerberos use_kerberos = CRED_DONT_USE_KERBEROS;
|
|
+ enum credentials_use_kerberos use_kerberos =
|
|
+ CRED_USE_KERBEROS_DISABLED;
|
|
char *machine_account = talloc_asprintf(tmp_ctx, "%s$", lpcfg_netbios_name(lp_ctx));
|
|
cli_credentials_set_password(cred, secrets_tdb_password, CRED_SPECIFIED);
|
|
cli_credentials_set_old_password(cred, secrets_tdb_old_password, CRED_SPECIFIED);
|
|
@@ -386,7 +387,7 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti
|
|
|
|
FALL_THROUGH;
|
|
case ROLE_ACTIVE_DIRECTORY_DC:
|
|
- use_kerberos = CRED_AUTO_USE_KERBEROS;
|
|
+ use_kerberos = CRED_USE_KERBEROS_DESIRED;
|
|
break;
|
|
}
|
|
}
|
|
diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c
|
|
index 17c90573f09..95dde276ef7 100644
|
|
--- a/auth/credentials/pycredentials.c
|
|
+++ b/auth/credentials/pycredentials.c
|
|
@@ -1492,9 +1492,9 @@ MODULE_INIT_FUNC(credentials)
|
|
PyModule_AddObject(m, "CALLBACK_RESULT", PyLong_FromLong(CRED_CALLBACK_RESULT));
|
|
PyModule_AddObject(m, "SPECIFIED", PyLong_FromLong(CRED_SPECIFIED));
|
|
|
|
- PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyLong_FromLong(CRED_AUTO_USE_KERBEROS));
|
|
- PyModule_AddObject(m, "DONT_USE_KERBEROS", PyLong_FromLong(CRED_DONT_USE_KERBEROS));
|
|
- PyModule_AddObject(m, "MUST_USE_KERBEROS", PyLong_FromLong(CRED_MUST_USE_KERBEROS));
|
|
+ PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_DESIRED));
|
|
+ PyModule_AddObject(m, "DONT_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_DISABLED));
|
|
+ PyModule_AddObject(m, "MUST_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_REQUIRED));
|
|
|
|
PyModule_AddObject(m, "AUTO_KRB_FORWARDABLE", PyLong_FromLong(CRED_AUTO_KRB_FORWARDABLE));
|
|
PyModule_AddObject(m, "NO_KRB_FORWARDABLE", PyLong_FromLong(CRED_NO_KRB_FORWARDABLE));
|
|
diff --git a/auth/credentials/tests/simple.c b/auth/credentials/tests/simple.c
|
|
index 7f122bed3bc..b39d7a2251b 100644
|
|
--- a/auth/credentials/tests/simple.c
|
|
+++ b/auth/credentials/tests/simple.c
|
|
@@ -73,7 +73,7 @@ static bool test_guess(struct torture_context *tctx)
|
|
const char *passwd_fd = getenv("PASSWD_FD");
|
|
const char *passwd_file = getenv("PASSWD_FILE");
|
|
|
|
- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED);
|
|
|
|
unsetenv("USER");
|
|
unsetenv("PASSWD_FD");
|
|
diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build
|
|
index 1e3302e3e48..ad16b7d8008 100644
|
|
--- a/auth/credentials/wscript_build
|
|
+++ b/auth/credentials/wscript_build
|
|
@@ -5,7 +5,7 @@ bld.SAMBA_LIBRARY('samba-credentials',
|
|
public_headers='credentials.h',
|
|
pc_files='samba-credentials.pc',
|
|
deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5',
|
|
- vnum='0.1.0'
|
|
+ vnum='1.0.0'
|
|
)
|
|
|
|
bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5',
|
|
diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c
|
|
index 3f42d611140..56306efed13 100644
|
|
--- a/auth/gensec/gensec_start.c
|
|
+++ b/auth/gensec/gensec_start.c
|
|
@@ -117,18 +117,18 @@ static const struct gensec_security_ops **gensec_use_kerberos_mechs(
|
|
}
|
|
|
|
switch (use_kerberos) {
|
|
- case CRED_AUTO_USE_KERBEROS:
|
|
+ case CRED_USE_KERBEROS_DESIRED:
|
|
keep = true;
|
|
break;
|
|
|
|
- case CRED_DONT_USE_KERBEROS:
|
|
+ case CRED_USE_KERBEROS_DISABLED:
|
|
if (old_gensec_list[i]->kerberos == false) {
|
|
keep = true;
|
|
}
|
|
|
|
break;
|
|
|
|
- case CRED_MUST_USE_KERBEROS:
|
|
+ case CRED_USE_KERBEROS_REQUIRED:
|
|
if (old_gensec_list[i]->kerberos == true) {
|
|
keep = true;
|
|
}
|
|
@@ -156,7 +156,7 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs(
|
|
TALLOC_CTX *mem_ctx)
|
|
{
|
|
const struct gensec_security_ops * const *backends = gensec_security_all();
|
|
- enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS;
|
|
+ enum credentials_use_kerberos use_kerberos = CRED_USE_KERBEROS_DESIRED;
|
|
bool keep_schannel = false;
|
|
|
|
if (gensec_security != NULL) {
|
|
diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c
|
|
index 03e7ec85198..95386211c0a 100644
|
|
--- a/examples/winexe/winexe.c
|
|
+++ b/examples/winexe/winexe.c
|
|
@@ -283,8 +283,8 @@ static void parse_args(int argc, const char *argv[],
|
|
if (opt_kerberos) {
|
|
cli_credentials_set_kerberos_state(cred,
|
|
strcmp(opt_kerberos, "yes")
|
|
- ? CRED_MUST_USE_KERBEROS
|
|
- : CRED_DONT_USE_KERBEROS);
|
|
+ ? CRED_USE_KERBEROS_REQUIRED
|
|
+ : CRED_USE_KERBEROS_DISABLED);
|
|
}
|
|
|
|
if (options->runas == NULL && options->runas_file != NULL) {
|
|
diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c
|
|
index 0e9500ac08d..f314acd9559 100644
|
|
--- a/source3/auth/auth_generic.c
|
|
+++ b/source3/auth/auth_generic.c
|
|
@@ -356,9 +356,9 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
|
|
cli_credentials_set_conf(server_credentials, lp_ctx);
|
|
|
|
if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
|
|
- cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED);
|
|
} else {
|
|
- cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED);
|
|
}
|
|
|
|
nt_status = gensec_server_start(tmp_ctx, gensec_settings,
|
|
diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c
|
|
index 9c9e2f0ac0f..d2af34ee19b 100644
|
|
--- a/source3/lib/util_cmdline.c
|
|
+++ b/source3/lib/util_cmdline.c
|
|
@@ -307,9 +307,9 @@ void set_cmdline_auth_info_use_kerberos(struct user_auth_info *auth_info,
|
|
enum credentials_use_kerberos krb5_state;
|
|
|
|
if (b) {
|
|
- krb5_state = CRED_MUST_USE_KERBEROS;
|
|
+ krb5_state = CRED_USE_KERBEROS_REQUIRED;
|
|
} else {
|
|
- krb5_state = CRED_DONT_USE_KERBEROS;
|
|
+ krb5_state = CRED_USE_KERBEROS_DISABLED;
|
|
}
|
|
|
|
cli_credentials_set_kerberos_state(auth_info->creds, krb5_state);
|
|
@@ -321,7 +321,7 @@ bool get_cmdline_auth_info_use_kerberos(const struct user_auth_info *auth_info)
|
|
|
|
krb5_state = cli_credentials_get_kerberos_state(auth_info->creds);
|
|
|
|
- if (krb5_state == CRED_MUST_USE_KERBEROS) {
|
|
+ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) {
|
|
return true;
|
|
}
|
|
|
|
@@ -336,17 +336,17 @@ void set_cmdline_auth_info_fallback_after_kerberos(struct user_auth_info *auth_i
|
|
krb5_state = cli_credentials_get_kerberos_state(auth_info->creds);
|
|
|
|
switch (krb5_state) {
|
|
- case CRED_MUST_USE_KERBEROS:
|
|
+ case CRED_USE_KERBEROS_REQUIRED:
|
|
if (b) {
|
|
- krb5_state = CRED_AUTO_USE_KERBEROS;
|
|
+ krb5_state = CRED_USE_KERBEROS_DESIRED;
|
|
}
|
|
break;
|
|
- case CRED_AUTO_USE_KERBEROS:
|
|
+ case CRED_USE_KERBEROS_DESIRED:
|
|
if (!b) {
|
|
- krb5_state = CRED_MUST_USE_KERBEROS;
|
|
+ krb5_state = CRED_USE_KERBEROS_REQUIRED;
|
|
}
|
|
break;
|
|
- case CRED_DONT_USE_KERBEROS:
|
|
+ case CRED_USE_KERBEROS_DISABLED:
|
|
/* nothing to do */
|
|
break;
|
|
}
|
|
@@ -360,7 +360,7 @@ bool get_cmdline_auth_info_fallback_after_kerberos(const struct user_auth_info *
|
|
|
|
krb5_state = cli_credentials_get_kerberos_state(auth_info->creds);
|
|
|
|
- if (krb5_state == CRED_AUTO_USE_KERBEROS) {
|
|
+ if (krb5_state == CRED_USE_KERBEROS_DESIRED) {
|
|
return true;
|
|
}
|
|
|
|
diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
|
|
index 87beeafe3ed..90ffa040ec0 100644
|
|
--- a/source3/libads/sasl.c
|
|
+++ b/source3/libads/sasl.c
|
|
@@ -158,7 +158,7 @@ static ADS_STATUS ads_sasl_spnego_gensec_bind(ADS_STRUCT *ads,
|
|
use_spnego_principal = false;
|
|
}
|
|
|
|
- if (krb5_state == CRED_DONT_USE_KERBEROS) {
|
|
+ if (krb5_state == CRED_USE_KERBEROS_DISABLED) {
|
|
use_spnego_principal = false;
|
|
}
|
|
|
|
@@ -565,7 +565,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
|
|
{
|
|
|
|
status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO",
|
|
- CRED_MUST_USE_KERBEROS,
|
|
+ CRED_USE_KERBEROS_REQUIRED,
|
|
p.service, p.hostname,
|
|
blob);
|
|
if (ADS_ERR_OK(status)) {
|
|
@@ -581,7 +581,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
|
|
|
|
if (ADS_ERR_OK(status)) {
|
|
status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO",
|
|
- CRED_MUST_USE_KERBEROS,
|
|
+ CRED_USE_KERBEROS_REQUIRED,
|
|
p.service, p.hostname,
|
|
blob);
|
|
if (!ADS_ERR_OK(status)) {
|
|
@@ -616,7 +616,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
|
|
library for HMAC_MD4 encryption */
|
|
mech = "NTLMSSP";
|
|
status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO",
|
|
- CRED_DONT_USE_KERBEROS,
|
|
+ CRED_USE_KERBEROS_DISABLED,
|
|
p.service, p.hostname,
|
|
data_blob_null);
|
|
done:
|
|
diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
|
|
index f3bf27e6c00..bd3aeec9434 100644
|
|
--- a/source3/libnet/libnet_join.c
|
|
+++ b/source3/libnet/libnet_join.c
|
|
@@ -1707,7 +1707,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
|
|
|
|
if (use_kerberos) {
|
|
cli_credentials_set_kerberos_state(cli_creds,
|
|
- CRED_MUST_USE_KERBEROS);
|
|
+ CRED_USE_KERBEROS_REQUIRED);
|
|
}
|
|
|
|
status = cli_full_connection_creds(&cli, NULL,
|
|
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
|
|
index abfd18bfaf1..f7b4741de89 100644
|
|
--- a/source3/libsmb/cliconnect.c
|
|
+++ b/source3/libsmb/cliconnect.c
|
|
@@ -124,13 +124,13 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx,
|
|
|
|
if (use_kerberos && fallback_after_kerberos) {
|
|
cli_credentials_set_kerberos_state(creds,
|
|
- CRED_AUTO_USE_KERBEROS);
|
|
+ CRED_USE_KERBEROS_DESIRED);
|
|
} else if (use_kerberos) {
|
|
cli_credentials_set_kerberos_state(creds,
|
|
- CRED_MUST_USE_KERBEROS);
|
|
+ CRED_USE_KERBEROS_REQUIRED);
|
|
} else {
|
|
cli_credentials_set_kerberos_state(creds,
|
|
- CRED_DONT_USE_KERBEROS);
|
|
+ CRED_USE_KERBEROS_DISABLED);
|
|
}
|
|
|
|
if (use_ccache) {
|
|
@@ -255,7 +255,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
|
|
|
|
krb5_state = cli_credentials_get_kerberos_state(creds);
|
|
|
|
- if (krb5_state != CRED_DONT_USE_KERBEROS) {
|
|
+ if (krb5_state != CRED_USE_KERBEROS_DISABLED) {
|
|
try_kerberos = true;
|
|
}
|
|
|
|
@@ -275,7 +275,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
|
|
try_kerberos = false;
|
|
}
|
|
|
|
- if (krb5_state == CRED_MUST_USE_KERBEROS && !try_kerberos) {
|
|
+ if (krb5_state == CRED_USE_KERBEROS_REQUIRED && !try_kerberos) {
|
|
DEBUG(0, ("Kerberos auth with '%s' (%s\\%s) to access "
|
|
"'%s' not possible\n",
|
|
user_principal, user_domain, user_account,
|
|
@@ -286,7 +286,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
|
|
|
|
if (pass == NULL || strlen(pass) == 0) {
|
|
need_kinit = false;
|
|
- } else if (krb5_state == CRED_MUST_USE_KERBEROS) {
|
|
+ } else if (krb5_state == CRED_USE_KERBEROS_REQUIRED) {
|
|
need_kinit = try_kerberos;
|
|
} else {
|
|
need_kinit = try_kerberos;
|
|
@@ -321,14 +321,14 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
|
|
if (ret != 0) {
|
|
int dbglvl = DBGLVL_NOTICE;
|
|
|
|
- if (krb5_state == CRED_MUST_USE_KERBEROS) {
|
|
+ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) {
|
|
dbglvl = DBGLVL_ERR;
|
|
}
|
|
|
|
DEBUG(dbglvl, ("Kinit for %s to access %s failed: %s\n",
|
|
user_principal, target_hostname,
|
|
error_message(ret)));
|
|
- if (krb5_state == CRED_MUST_USE_KERBEROS) {
|
|
+ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) {
|
|
TALLOC_FREE(frame);
|
|
return krb5_to_nt_status(ret);
|
|
}
|
|
diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
|
|
index 8ed1bafcea3..b12c845d9d2 100644
|
|
--- a/source3/passdb/passdb.c
|
|
+++ b/source3/passdb/passdb.c
|
|
@@ -2630,7 +2630,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain,
|
|
/*
|
|
* It's not possible to use NTLMSSP with a domain trust account.
|
|
*/
|
|
- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED);
|
|
} else {
|
|
/*
|
|
* We can't use kerberos against an NT4 domain.
|
|
@@ -2638,7 +2638,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain,
|
|
* We should have a mode that also disallows NTLMSSP here,
|
|
* as only NETLOGON SCHANNEL is possible.
|
|
*/
|
|
- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED);
|
|
}
|
|
|
|
ok = cli_credentials_set_username(creds, account_name, CRED_SPECIFIED);
|
|
@@ -2656,7 +2656,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain,
|
|
/*
|
|
* We currently can't do kerberos just with an NTHASH.
|
|
*/
|
|
- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED);
|
|
goto done;
|
|
}
|
|
|
|
diff --git a/source3/passdb/pdb_samba_dsdb.c b/source3/passdb/pdb_samba_dsdb.c
|
|
index 276bda88efc..93e8f5bebe6 100644
|
|
--- a/source3/passdb/pdb_samba_dsdb.c
|
|
+++ b/source3/passdb/pdb_samba_dsdb.c
|
|
@@ -2599,13 +2599,13 @@ static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m,
|
|
* Force kerberos if this is an active directory domain
|
|
*/
|
|
cli_credentials_set_kerberos_state(creds,
|
|
- CRED_MUST_USE_KERBEROS);
|
|
+ CRED_USE_KERBEROS_REQUIRED);
|
|
} else {
|
|
/*
|
|
* TODO: we should allow krb5 with the raw nt hash.
|
|
*/
|
|
cli_credentials_set_kerberos_state(creds,
|
|
- CRED_DONT_USE_KERBEROS);
|
|
+ CRED_USE_KERBEROS_DISABLED);
|
|
}
|
|
|
|
*_creds = talloc_move(mem_ctx, &creds);
|
|
diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c
|
|
index 8227ef0b0bd..ba6c86cc227 100644
|
|
--- a/source3/rpc_client/cli_pipe.c
|
|
+++ b/source3/rpc_client/cli_pipe.c
|
|
@@ -2637,7 +2637,7 @@ NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
|
|
NAME_NT_AUTHORITY, /* domain */
|
|
"SYSTEM",
|
|
NULL, /* password */
|
|
- CRED_DONT_USE_KERBEROS,
|
|
+ CRED_USE_KERBEROS_DISABLED,
|
|
NULL, /* netlogon_creds_CredentialState */
|
|
presult);
|
|
}
|
|
diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c
|
|
index 575a42ebf70..a38f69f5592 100644
|
|
--- a/source3/rpcclient/rpcclient.c
|
|
+++ b/source3/rpcclient/rpcclient.c
|
|
@@ -810,19 +810,19 @@ static NTSTATUS do_cmd(struct cli_state *cli,
|
|
case DCERPC_AUTH_TYPE_SPNEGO:
|
|
switch (pipe_default_auth_spnego_type) {
|
|
case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
|
|
- krb5_state = CRED_DONT_USE_KERBEROS;
|
|
+ krb5_state = CRED_USE_KERBEROS_DISABLED;
|
|
break;
|
|
case PIPE_AUTH_TYPE_SPNEGO_KRB5:
|
|
- krb5_state = CRED_MUST_USE_KERBEROS;
|
|
+ krb5_state = CRED_USE_KERBEROS_REQUIRED;
|
|
break;
|
|
case PIPE_AUTH_TYPE_SPNEGO_NONE:
|
|
- krb5_state = CRED_AUTO_USE_KERBEROS;
|
|
+ krb5_state = CRED_USE_KERBEROS_DESIRED;
|
|
break;
|
|
}
|
|
FALL_THROUGH;
|
|
case DCERPC_AUTH_TYPE_NTLMSSP:
|
|
case DCERPC_AUTH_TYPE_KRB5:
|
|
- if (krb5_state != CRED_AUTO_USE_KERBEROS) {
|
|
+ if (krb5_state != CRED_USE_KERBEROS_DESIRED) {
|
|
cli_credentials_set_kerberos_state(creds,
|
|
krb5_state);
|
|
}
|
|
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
|
|
index 7f5b9c3a440..1a0e8a5c9dd 100644
|
|
--- a/source3/utils/net_ads.c
|
|
+++ b/source3/utils/net_ads.c
|
|
@@ -2432,7 +2432,7 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char *
|
|
talloc_destroy(mem_ctx);
|
|
return -1;
|
|
}
|
|
- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED);
|
|
|
|
nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername,
|
|
&server_ss, 0,
|
|
diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c
|
|
index 5829d891075..6c5321db0fd 100644
|
|
--- a/source3/utils/net_util.c
|
|
+++ b/source3/utils/net_util.c
|
|
@@ -493,13 +493,13 @@ struct cli_credentials *net_context_creds(struct net_context *c,
|
|
|
|
if (c->opt_kerberos && c->opt_user_specified) {
|
|
cli_credentials_set_kerberos_state(creds,
|
|
- CRED_AUTO_USE_KERBEROS);
|
|
+ CRED_USE_KERBEROS_DESIRED);
|
|
} else if (c->opt_kerberos) {
|
|
cli_credentials_set_kerberos_state(creds,
|
|
- CRED_MUST_USE_KERBEROS);
|
|
+ CRED_USE_KERBEROS_REQUIRED);
|
|
} else {
|
|
cli_credentials_set_kerberos_state(creds,
|
|
- CRED_DONT_USE_KERBEROS);
|
|
+ CRED_USE_KERBEROS_DISABLED);
|
|
}
|
|
|
|
if (c->opt_ccache) {
|
|
diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c
|
|
index 7f8d2688978..bfaeff5188d 100644
|
|
--- a/source3/utils/ntlm_auth.c
|
|
+++ b/source3/utils/ntlm_auth.c
|
|
@@ -1364,9 +1364,9 @@ static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx,
|
|
cli_credentials_set_conf(server_credentials, lp_ctx);
|
|
|
|
if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC || lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
|
|
- cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED);
|
|
} else {
|
|
- cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED);
|
|
}
|
|
|
|
nt_status = gensec_server_start(tmp_ctx, gensec_settings,
|
|
diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
|
|
index 5fb22d7e9c8..466a0095ef2 100644
|
|
--- a/source3/winbindd/winbindd_cm.c
|
|
+++ b/source3/winbindd/winbindd_cm.c
|
|
@@ -706,7 +706,7 @@ static NTSTATUS cm_get_ipc_credentials(TALLOC_CTX *mem_ctx,
|
|
}
|
|
|
|
cli_credentials_set_conf(creds, lp_ctx);
|
|
- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED);
|
|
|
|
ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED);
|
|
if (!ok) {
|
|
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
|
|
index d66abf32a7f..b668d4ed258 100644
|
|
--- a/source4/auth/gensec/gensec_gssapi.c
|
|
+++ b/source4/auth/gensec/gensec_gssapi.c
|
|
@@ -1556,7 +1556,7 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi
|
|
}
|
|
|
|
/* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */
|
|
- cli_credentials_set_kerberos_state(session_info->credentials, CRED_MUST_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(session_info->credentials, CRED_USE_KERBEROS_REQUIRED);
|
|
|
|
/* It has been taken from this place... */
|
|
gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
|
|
diff --git a/source4/auth/session.c b/source4/auth/session.c
|
|
index c5fc226a7d7..8e44dcd24f1 100644
|
|
--- a/source4/auth/session.c
|
|
+++ b/source4/auth/session.c
|
|
@@ -295,7 +295,7 @@ struct auth_session_info *auth_session_info_from_transport(TALLOC_CTX *mem_ctx,
|
|
/* This credential handle isn't useful for password
|
|
* authentication, so ensure nobody tries to do that */
|
|
cli_credentials_set_kerberos_state(creds,
|
|
- CRED_MUST_USE_KERBEROS);
|
|
+ CRED_USE_KERBEROS_REQUIRED);
|
|
|
|
}
|
|
#endif
|
|
diff --git a/source4/lib/cmdline/popt_credentials.c b/source4/lib/cmdline/popt_credentials.c
|
|
index 5dd61f6339c..7d8963da99e 100644
|
|
--- a/source4/lib/cmdline/popt_credentials.c
|
|
+++ b/source4/lib/cmdline/popt_credentials.c
|
|
@@ -120,8 +120,8 @@ static void popt_common_credentials_callback(poptContext con,
|
|
cli_credentials_set_kerberos_state(
|
|
popt_get_cmdline_credentials(),
|
|
use_kerberos
|
|
- ? CRED_MUST_USE_KERBEROS
|
|
- : CRED_DONT_USE_KERBEROS);
|
|
+ ? CRED_USE_KERBEROS_REQUIRED
|
|
+ : CRED_USE_KERBEROS_DISABLED);
|
|
break;
|
|
}
|
|
|
|
diff --git a/source4/torture/ldap/session_expiry.c b/source4/torture/ldap/session_expiry.c
|
|
index 35dda439b17..e5e38450745 100644
|
|
--- a/source4/torture/ldap/session_expiry.c
|
|
+++ b/source4/torture/ldap/session_expiry.c
|
|
@@ -55,7 +55,7 @@ bool torture_ldap_session_expiry(struct torture_context *torture)
|
|
torture, url!=NULL, ret, fail, "talloc_asprintf failed");
|
|
|
|
cli_credentials_set_kerberos_state(
|
|
- credentials, CRED_MUST_USE_KERBEROS);
|
|
+ credentials, CRED_USE_KERBEROS_REQUIRED);
|
|
|
|
ok = lpcfg_set_option(
|
|
torture->lp_ctx, "gensec_gssapi:requested_life_time=4");
|
|
diff --git a/source4/torture/raw/session.c b/source4/torture/raw/session.c
|
|
index 0c460ae3069..e246d25e9fb 100644
|
|
--- a/source4/torture/raw/session.c
|
|
+++ b/source4/torture/raw/session.c
|
|
@@ -245,12 +245,12 @@ static bool test_session_expire1(struct torture_context *tctx)
|
|
|
|
use_kerberos = cli_credentials_get_kerberos_state(
|
|
popt_get_cmdline_credentials());
|
|
- if (use_kerberos != CRED_MUST_USE_KERBEROS) {
|
|
+ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) {
|
|
torture_warning(tctx, "smb2.session.expire1 requires -k yes!");
|
|
torture_skip(tctx, "smb2.session.expire1 requires -k yes!");
|
|
}
|
|
|
|
- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS,
|
|
+ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED,
|
|
"please use -k yes");
|
|
|
|
lpcfg_set_option(tctx->lp_ctx, "gensec_gssapi:requested_life_time=4");
|
|
diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c
|
|
index fff0b1aacbd..a5755041040 100644
|
|
--- a/source4/torture/rpc/schannel.c
|
|
+++ b/source4/torture/rpc/schannel.c
|
|
@@ -965,8 +965,8 @@ bool torture_rpc_schannel_bench1(struct torture_context *torture)
|
|
torture_assert(torture, s->join_ctx2 != NULL,
|
|
"Failed to join domain with acct_flags=ACB_WSTRUST");
|
|
|
|
- cli_credentials_set_kerberos_state(s->wks_creds1, CRED_DONT_USE_KERBEROS);
|
|
- cli_credentials_set_kerberos_state(s->wks_creds2, CRED_DONT_USE_KERBEROS);
|
|
+ cli_credentials_set_kerberos_state(s->wks_creds1, CRED_USE_KERBEROS_DISABLED);
|
|
+ cli_credentials_set_kerberos_state(s->wks_creds2, CRED_USE_KERBEROS_DISABLED);
|
|
|
|
for (i=0; i < s->nprocs; i++) {
|
|
struct cli_credentials *wks = s->wks_creds1;
|
|
diff --git a/source4/torture/smb2/session.c b/source4/torture/smb2/session.c
|
|
index 07c6faebb15..701dfc10a07 100644
|
|
--- a/source4/torture/smb2/session.c
|
|
+++ b/source4/torture/smb2/session.c
|
|
@@ -956,7 +956,7 @@ bool test_session_reauth6(struct torture_context *tctx, struct smb2_tree *tree)
|
|
|
|
krb_state = cli_credentials_get_kerberos_state(
|
|
popt_get_cmdline_credentials());
|
|
- if (krb_state == CRED_MUST_USE_KERBEROS) {
|
|
+ if (krb_state == CRED_USE_KERBEROS_REQUIRED) {
|
|
torture_skip(tctx,
|
|
"Can't test failing session setup with kerberos.");
|
|
}
|
|
@@ -1064,12 +1064,12 @@ static bool test_session_expire1i(struct torture_context *tctx,
|
|
size_t i;
|
|
|
|
use_kerberos = cli_credentials_get_kerberos_state(credentials);
|
|
- if (use_kerberos != CRED_MUST_USE_KERBEROS) {
|
|
+ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) {
|
|
torture_warning(tctx, "smb2.session.expire1 requires -k yes!");
|
|
torture_skip(tctx, "smb2.session.expire1 requires -k yes!");
|
|
}
|
|
|
|
- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS,
|
|
+ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED,
|
|
"please use -k yes");
|
|
|
|
cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED);
|
|
@@ -1250,12 +1250,12 @@ static bool test_session_expire2i(struct torture_context *tctx,
|
|
struct smb2_notify ntf2;
|
|
|
|
use_kerberos = cli_credentials_get_kerberos_state(credentials);
|
|
- if (use_kerberos != CRED_MUST_USE_KERBEROS) {
|
|
+ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) {
|
|
torture_warning(tctx, "smb2.session.expire2 requires -k yes!");
|
|
torture_skip(tctx, "smb2.session.expire2 requires -k yes!");
|
|
}
|
|
|
|
- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS,
|
|
+ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED,
|
|
"please use -k yes");
|
|
|
|
cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED);
|
|
@@ -1612,7 +1612,7 @@ static bool test_session_expire_disconnect(struct torture_context *tctx)
|
|
bool connected;
|
|
|
|
use_kerberos = cli_credentials_get_kerberos_state(credentials);
|
|
- if (use_kerberos != CRED_MUST_USE_KERBEROS) {
|
|
+ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) {
|
|
torture_warning(tctx, "smb2.session.expire1 requires -k yes!");
|
|
torture_skip(tctx, "smb2.session.expire1 requires -k yes!");
|
|
}
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 6a356a6e79fa76de18a4ca0760ac4f053d70137f Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Tue, 1 Sep 2020 12:32:28 +0200
|
|
Subject: [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 1a92994a9513f5e73d30604a1dc217ddeb1ac8d5)
|
|
---
|
|
auth/credentials/tests/test_creds.c | 221 ++++++++++++++++++++++++++++
|
|
auth/credentials/wscript_build | 6 +
|
|
selftest/tests.py | 2 +
|
|
source4/torture/local/local.c | 1 -
|
|
source4/torture/local/wscript_build | 2 +-
|
|
5 files changed, 230 insertions(+), 2 deletions(-)
|
|
create mode 100644 auth/credentials/tests/test_creds.c
|
|
|
|
diff --git a/auth/credentials/tests/test_creds.c b/auth/credentials/tests/test_creds.c
|
|
new file mode 100644
|
|
index 00000000000..d2d3d30d73d
|
|
--- /dev/null
|
|
+++ b/auth/credentials/tests/test_creds.c
|
|
@@ -0,0 +1,221 @@
|
|
+/*
|
|
+ * Unix SMB/CIFS implementation.
|
|
+ *
|
|
+ * Copyright (C) 2018-2019 Andreas Schneider <asn@samba.org>
|
|
+ *
|
|
+ * This program is free software; you can redistribute it and/or modify
|
|
+ * it under the terms of the GNU General Public License as published by
|
|
+ * the Free Software Foundation; either version 3 of the License, or
|
|
+ * (at your option) any later version.
|
|
+ *
|
|
+ * This program is distributed in the hope that it will be useful,
|
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+ * GNU General Public License for more details.
|
|
+ *
|
|
+ * You should have received a copy of the GNU General Public License
|
|
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+ */
|
|
+
|
|
+#include <stdarg.h>
|
|
+#include <stddef.h>
|
|
+#include <stdint.h>
|
|
+#include <setjmp.h>
|
|
+#include <cmocka.h>
|
|
+
|
|
+#include "lib/replace/replace.h"
|
|
+#include "auth/credentials/credentials.c"
|
|
+
|
|
+static int setup_talloc_context(void **state)
|
|
+{
|
|
+ TALLOC_CTX *frame = talloc_stackframe();
|
|
+
|
|
+ *state = frame;
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+static int teardown_talloc_context(void **state)
|
|
+{
|
|
+ TALLOC_CTX *frame = *state;
|
|
+ TALLOC_FREE(frame);
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+static void torture_creds_init(void **state)
|
|
+{
|
|
+ TALLOC_CTX *mem_ctx = *state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+ const char *username = NULL;
|
|
+ const char *domain = NULL;
|
|
+ const char *password = NULL;
|
|
+ bool ok;
|
|
+
|
|
+ creds = cli_credentials_init(mem_ctx);
|
|
+ assert_non_null(creds);
|
|
+ assert_null(creds->username);
|
|
+ assert_int_equal(creds->username_obtained, CRED_UNINITIALISED);
|
|
+
|
|
+ domain = cli_credentials_get_domain(creds);
|
|
+ assert_null(domain);
|
|
+ ok = cli_credentials_set_domain(creds, "WURST", CRED_SPECIFIED);
|
|
+ assert_true(ok);
|
|
+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED);
|
|
+ domain = cli_credentials_get_domain(creds);
|
|
+ assert_string_equal(domain, "WURST");
|
|
+
|
|
+ username = cli_credentials_get_username(creds);
|
|
+ assert_null(username);
|
|
+ ok = cli_credentials_set_username(creds, "brot", CRED_SPECIFIED);
|
|
+ assert_true(ok);
|
|
+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED);
|
|
+ username = cli_credentials_get_username(creds);
|
|
+ assert_string_equal(username, "brot");
|
|
+
|
|
+ password = cli_credentials_get_password(creds);
|
|
+ assert_null(password);
|
|
+ ok = cli_credentials_set_password(creds, "SECRET", CRED_SPECIFIED);
|
|
+ assert_true(ok);
|
|
+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED);
|
|
+ password = cli_credentials_get_password(creds);
|
|
+ assert_string_equal(password, "SECRET");
|
|
+}
|
|
+
|
|
+static void torture_creds_init_anonymous(void **state)
|
|
+{
|
|
+ TALLOC_CTX *mem_ctx = *state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+
|
|
+ creds = cli_credentials_init_anon(mem_ctx);
|
|
+ assert_non_null(creds);
|
|
+
|
|
+ assert_string_equal(creds->domain, "");
|
|
+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->username, "");
|
|
+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_null(creds->password);
|
|
+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED);
|
|
+}
|
|
+
|
|
+static void torture_creds_guess(void **state)
|
|
+{
|
|
+ TALLOC_CTX *mem_ctx = *state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+ const char *env_user = getenv("USER");
|
|
+
|
|
+ creds = cli_credentials_init(mem_ctx);
|
|
+ assert_non_null(creds);
|
|
+
|
|
+ setenv("PASSWD", "SECRET", 1);
|
|
+ cli_credentials_guess(creds, NULL);
|
|
+
|
|
+ assert_string_equal(creds->username, env_user);
|
|
+ assert_int_equal(creds->username_obtained, CRED_GUESS_ENV);
|
|
+
|
|
+ assert_string_equal(creds->password, "SECRET");
|
|
+ assert_int_equal(creds->password_obtained, CRED_GUESS_ENV);
|
|
+ unsetenv("PASSWD");
|
|
+}
|
|
+
|
|
+static void torture_creds_anon_guess(void **state)
|
|
+{
|
|
+ TALLOC_CTX *mem_ctx = *state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+
|
|
+ creds = cli_credentials_init_anon(mem_ctx);
|
|
+ assert_non_null(creds);
|
|
+
|
|
+ setenv("PASSWD", "SECRET", 1);
|
|
+ cli_credentials_guess(creds, NULL);
|
|
+
|
|
+ assert_string_equal(creds->username, "");
|
|
+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_null(creds->password);
|
|
+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED);
|
|
+ unsetenv("PASSWD");
|
|
+}
|
|
+
|
|
+static void torture_creds_parse_string(void **state)
|
|
+{
|
|
+ TALLOC_CTX *mem_ctx = *state;
|
|
+ struct cli_credentials *creds = NULL;
|
|
+
|
|
+ creds = cli_credentials_init(mem_ctx);
|
|
+ assert_non_null(creds);
|
|
+
|
|
+ /* Anonymous */
|
|
+ cli_credentials_parse_string(creds, "%", CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->domain, "");
|
|
+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->username, "");
|
|
+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_null(creds->password);
|
|
+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ /* Username + password */
|
|
+ cli_credentials_parse_string(creds, "wurst%BROT", CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->domain, "");
|
|
+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->username, "wurst");
|
|
+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->password, "BROT");
|
|
+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ /* Domain + username + password */
|
|
+ cli_credentials_parse_string(creds, "XXL\\wurst%BROT", CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->domain, "XXL");
|
|
+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->username, "wurst");
|
|
+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->password, "BROT");
|
|
+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ /* Principal */
|
|
+ cli_credentials_parse_string(creds, "wurst@brot.realm", CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->domain, "");
|
|
+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->username, "wurst@brot.realm");
|
|
+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->principal, "wurst@brot.realm");
|
|
+ assert_int_equal(creds->principal_obtained, CRED_SPECIFIED);
|
|
+
|
|
+ assert_string_equal(creds->password, "BROT");
|
|
+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED);
|
|
+}
|
|
+
|
|
+int main(int argc, char *argv[])
|
|
+{
|
|
+ int rc;
|
|
+ const struct CMUnitTest tests[] = {
|
|
+ cmocka_unit_test(torture_creds_init),
|
|
+ cmocka_unit_test(torture_creds_init_anonymous),
|
|
+ cmocka_unit_test(torture_creds_guess),
|
|
+ cmocka_unit_test(torture_creds_anon_guess),
|
|
+ cmocka_unit_test(torture_creds_parse_string),
|
|
+ };
|
|
+
|
|
+ if (argc == 2) {
|
|
+ cmocka_set_test_filter(argv[1]);
|
|
+ }
|
|
+ cmocka_set_message_output(CM_OUTPUT_SUBUNIT);
|
|
+
|
|
+ rc = cmocka_run_group_tests(tests,
|
|
+ setup_talloc_context,
|
|
+ teardown_talloc_context);
|
|
+
|
|
+ return rc;
|
|
+}
|
|
diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build
|
|
index ad16b7d8008..46111164b36 100644
|
|
--- a/auth/credentials/wscript_build
|
|
+++ b/auth/credentials/wscript_build
|
|
@@ -31,3 +31,9 @@ bld.SAMBA_PYTHON('pycredentials',
|
|
public_deps='samba-credentials cmdline-credentials %s %s CREDENTIALS_KRB5 CREDENTIALS_SECRETS' % (pytalloc_util, pyparam_util),
|
|
realname='samba/credentials.so'
|
|
)
|
|
+
|
|
+bld.SAMBA_BINARY('test_creds',
|
|
+ source='tests/test_creds.c',
|
|
+ deps='cmocka samba-credentials',
|
|
+ local_include=False,
|
|
+ for_selftest=True)
|
|
diff --git a/selftest/tests.py b/selftest/tests.py
|
|
index 86cab3f8046..4a968cdbe8a 100644
|
|
--- a/selftest/tests.py
|
|
+++ b/selftest/tests.py
|
|
@@ -418,3 +418,5 @@ plantestsuite("samba.unittests.test_oLschema2ldif", "none",
|
|
if with_elasticsearch_backend:
|
|
plantestsuite("samba.unittests.mdsparser_es", "none",
|
|
[os.path.join(bindir(), "default/source3/test_mdsparser_es")] + [configuration])
|
|
+plantestsuite("samba.unittests.credentials", "none",
|
|
+ [os.path.join(bindir(), "default/auth/credentials/test_creds")])
|
|
diff --git a/source4/torture/local/local.c b/source4/torture/local/local.c
|
|
index a3186788524..d19b55e9502 100644
|
|
--- a/source4/torture/local/local.c
|
|
+++ b/source4/torture/local/local.c
|
|
@@ -70,7 +70,6 @@
|
|
torture_local_tevent_req,
|
|
torture_local_torture,
|
|
torture_local_dbspeed,
|
|
- torture_local_credentials,
|
|
torture_ldb,
|
|
torture_dsdb_dn,
|
|
torture_dsdb_syntax,
|
|
diff --git a/source4/torture/local/wscript_build b/source4/torture/local/wscript_build
|
|
index 38b6c8f4b6e..f0ab0357986 100644
|
|
--- a/source4/torture/local/wscript_build
|
|
+++ b/source4/torture/local/wscript_build
|
|
@@ -16,7 +16,7 @@ TORTURE_LOCAL_SOURCE = '''../../../lib/util/charset/tests/iconv.c
|
|
../../libcli/security/tests/sddl.c ../../../lib/tdr/testsuite.c
|
|
../../../lib/tevent/testsuite.c ../../param/tests/share.c
|
|
../../../lib/tevent/test_req.c
|
|
- ../../param/tests/loadparm.c ../../../auth/credentials/tests/simple.c local.c
|
|
+ ../../param/tests/loadparm.c local.c
|
|
dbspeed.c torture.c ../ldb/ldb.c ../../dsdb/common/tests/dsdb_dn.c
|
|
../../dsdb/schema/tests/schema_syntax.c
|
|
../../../lib/util/tests/anonymous_shared.c
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From f6a4f70007e5c5ad1df3ddb018bde8568fc63f57 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
|
Date: Mon, 2 Nov 2020 16:10:44 +0100
|
|
Subject: [PATCH 088/105] s3-vfs_glusterfs: always disable write-behind
|
|
translator
|
|
|
|
The "pass-through" option has now been merged upstream as of:
|
|
https://github.com/gluster/glusterfs/pull/1640
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486
|
|
|
|
Guenther
|
|
|
|
Signed-off-by: Guenther Deschner <gd@samba.org>
|
|
Pair-Programmed-With: Anoop C S <anoopcs@samba.org>
|
|
Pair-Programmed-With: Sachin Prabhu <sprabhu@redhat.com>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
|
|
Autobuild-User(master): Jeremy Allison <jra@samba.org>
|
|
Autobuild-Date(master): Wed Nov 4 22:53:49 UTC 2020 on sn-devel-184
|
|
|
|
(cherry picked from commit a51cda69ec6a017ad04b5690a3ae67a5478deee9)
|
|
|
|
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
|
|
Autobuild-Date(v4-13-test): Thu Nov 5 13:54:25 UTC 2020 on sn-devel-184
|
|
---
|
|
source3/modules/vfs_glusterfs.c | 20 +++++++++++++++++---
|
|
source3/wscript | 3 +++
|
|
2 files changed, 20 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/source3/modules/vfs_glusterfs.c b/source3/modules/vfs_glusterfs.c
|
|
index 3cbb1ab6cb6..bdfe35ced82 100644
|
|
--- a/source3/modules/vfs_glusterfs.c
|
|
+++ b/source3/modules/vfs_glusterfs.c
|
|
@@ -363,6 +363,7 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle,
|
|
glfs_t *fs = NULL;
|
|
TALLOC_CTX *tmp_ctx;
|
|
int ret = 0;
|
|
+ bool write_behind_pass_through_set = false;
|
|
|
|
tmp_ctx = talloc_new(NULL);
|
|
if (tmp_ctx == NULL) {
|
|
@@ -435,6 +436,17 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle,
|
|
goto done;
|
|
}
|
|
|
|
+#ifdef HAVE_GFAPI_VER_7_9
|
|
+ ret = glfs_set_xlator_option(fs, "*-write-behind", "pass-through",
|
|
+ "true");
|
|
+ if (ret < 0) {
|
|
+ DBG_ERR("%s: Failed to set xlator option: pass-through\n",
|
|
+ volume);
|
|
+ goto done;
|
|
+ }
|
|
+ write_behind_pass_through_set = true;
|
|
+#endif
|
|
+
|
|
ret = glfs_set_logging(fs, logfile, loglevel);
|
|
if (ret < 0) {
|
|
DEBUG(0, ("%s: Failed to set logfile %s loglevel %d\n",
|
|
@@ -449,9 +461,11 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle,
|
|
goto done;
|
|
}
|
|
|
|
- ret = check_for_write_behind_translator(tmp_ctx, fs, volume);
|
|
- if (ret < 0) {
|
|
- goto done;
|
|
+ if (!write_behind_pass_through_set) {
|
|
+ ret = check_for_write_behind_translator(tmp_ctx, fs, volume);
|
|
+ if (ret < 0) {
|
|
+ goto done;
|
|
+ }
|
|
}
|
|
|
|
ret = glfs_set_preopened(volume, handle->conn->connectpath, fs);
|
|
diff --git a/source3/wscript b/source3/wscript
|
|
index 335cfd797f1..9920432a360 100644
|
|
--- a/source3/wscript
|
|
+++ b/source3/wscript
|
|
@@ -1766,6 +1766,9 @@ main() {
|
|
conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.6" --cflags --libs',
|
|
msg='Checking for glusterfs-api >= 7.6',
|
|
uselib_store="GFAPI_VER_7_6")
|
|
+ conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.9" --cflags --libs',
|
|
+ msg='Checking for glusterfs-api >= 7.9',
|
|
+ uselib_store="GFAPI_VER_7_9")
|
|
else:
|
|
conf.SET_TARGET_TYPE('gfapi', 'EMPTY')
|
|
conf.undefine('HAVE_GLUSTERFS')
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 0d6268ff0a055e8fb418da761eeb820a8e11e2ad Mon Sep 17 00:00:00 2001
|
|
From: Isaac Boukris <iboukris@gmail.com>
|
|
Date: Thu, 20 Aug 2020 12:09:05 +0200
|
|
Subject: [PATCH 089/105] Add smb2cli_session_get_encryption_cipher()
|
|
|
|
When 'session->smb2->should_encrypt' is true, the client MUST encrypt
|
|
all transport messages (see also MS-SMB2 3.2.4.1.8).
|
|
|
|
Signed-off-by: Isaac Boukris <iboukris@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit f0f8de9d4a4e05445e427f00bb10eb34e1110a97)
|
|
---
|
|
libcli/smb/smbXcli_base.c | 13 +++++++++++++
|
|
libcli/smb/smbXcli_base.h | 1 +
|
|
2 files changed, 14 insertions(+)
|
|
|
|
diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
|
|
index 7d2da4b9ebc..471319a32f1 100644
|
|
--- a/libcli/smb/smbXcli_base.c
|
|
+++ b/libcli/smb/smbXcli_base.c
|
|
@@ -6436,6 +6436,19 @@ NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session)
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
+uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session)
|
|
+{
|
|
+ if (session->conn->protocol < PROTOCOL_SMB2_24) {
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ if (!session->smb2->should_encrypt) {
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ return session->conn->smb2.server.cipher;
|
|
+}
|
|
+
|
|
struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx)
|
|
{
|
|
struct smbXcli_tcon *tcon;
|
|
diff --git a/libcli/smb/smbXcli_base.h b/libcli/smb/smbXcli_base.h
|
|
index 2afc7165cd9..db5f5d58799 100644
|
|
--- a/libcli/smb/smbXcli_base.h
|
|
+++ b/libcli/smb/smbXcli_base.h
|
|
@@ -518,6 +518,7 @@ NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
|
|
const DATA_BLOB channel_key,
|
|
const struct iovec *recv_iov);
|
|
NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session);
|
|
+uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session);
|
|
|
|
struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx);
|
|
struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 3f77e6cb6220d50b75ceb197e26813e9e5244cc0 Mon Sep 17 00:00:00 2001
|
|
From: Isaac Boukris <iboukris@gmail.com>
|
|
Date: Thu, 20 Aug 2020 12:18:21 +0200
|
|
Subject: [PATCH 090/105] Add dcerpc_transport_encrypted()
|
|
|
|
Signed-off-by: Isaac Boukris <iboukris@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 339bfcd67af2675d10287946d8f5dabba1022d57)
|
|
---
|
|
source4/librpc/rpc/dcerpc.h | 2 ++
|
|
source4/librpc/rpc/dcerpc_smb.c | 11 +++++++++++
|
|
source4/librpc/rpc/dcerpc_util.c | 13 +++++++++++++
|
|
3 files changed, 26 insertions(+)
|
|
|
|
diff --git a/source4/librpc/rpc/dcerpc.h b/source4/librpc/rpc/dcerpc.h
|
|
index 6b0b841d64d..57124f10778 100644
|
|
--- a/source4/librpc/rpc/dcerpc.h
|
|
+++ b/source4/librpc/rpc/dcerpc.h
|
|
@@ -87,6 +87,7 @@ struct dcecli_connection {
|
|
struct dcerpc_transport {
|
|
enum dcerpc_transport_t transport;
|
|
void *private_data;
|
|
+ bool encrypted;
|
|
|
|
struct tstream_context *stream;
|
|
/** to serialize write events */
|
|
@@ -181,6 +182,7 @@ NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p,
|
|
const struct ndr_interface_table *table);
|
|
NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p,
|
|
DATA_BLOB *session_key);
|
|
+bool dcerpc_transport_encrypted(struct dcerpc_pipe *p);
|
|
struct composite_context;
|
|
NTSTATUS dcerpc_secondary_connection_recv(struct composite_context *c,
|
|
struct dcerpc_pipe **p2);
|
|
diff --git a/source4/librpc/rpc/dcerpc_smb.c b/source4/librpc/rpc/dcerpc_smb.c
|
|
index b20b154a1cb..101ed64f0cd 100644
|
|
--- a/source4/librpc/rpc/dcerpc_smb.c
|
|
+++ b/source4/librpc/rpc/dcerpc_smb.c
|
|
@@ -145,6 +145,7 @@ static void dcerpc_pipe_open_smb_done(struct tevent_req *subreq)
|
|
struct dcerpc_pipe_open_smb_state);
|
|
struct composite_context *ctx = state->ctx;
|
|
struct dcecli_connection *c = state->c;
|
|
+ uint16_t enc_cipher;
|
|
|
|
ctx->status = tstream_smbXcli_np_open_recv(subreq,
|
|
state->smb,
|
|
@@ -173,6 +174,16 @@ static void dcerpc_pipe_open_smb_done(struct tevent_req *subreq)
|
|
/* Over-ride the default session key with the SMB session key */
|
|
c->security_state.session_key = smb_session_key;
|
|
|
|
+ enc_cipher = smb2cli_session_get_encryption_cipher(state->smb->session);
|
|
+ switch (enc_cipher) {
|
|
+ case SMB2_ENCRYPTION_AES128_CCM:
|
|
+ case SMB2_ENCRYPTION_AES128_GCM:
|
|
+ c->transport.encrypted = true;
|
|
+ break;
|
|
+ default:
|
|
+ c->transport.encrypted = false;
|
|
+ }
|
|
+
|
|
c->transport.private_data = talloc_move(c, &state->smb);
|
|
|
|
composite_done(ctx);
|
|
diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c
|
|
index bd79a072bc8..6ea27a8d9a3 100644
|
|
--- a/source4/librpc/rpc/dcerpc_util.c
|
|
+++ b/source4/librpc/rpc/dcerpc_util.c
|
|
@@ -743,6 +743,19 @@ _PUBLIC_ NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p,
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
+_PUBLIC_ bool dcerpc_transport_encrypted(struct dcerpc_pipe *p)
|
|
+{
|
|
+ if (p == NULL) {
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ if (p->conn == NULL) {
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ return p->conn->transport.encrypted;
|
|
+}
|
|
+
|
|
/*
|
|
create a secondary context from a primary connection
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 4045c677a3ea3c44e5509025c1c7d03936ba9d82 Mon Sep 17 00:00:00 2001
|
|
From: Isaac Boukris <iboukris@gmail.com>
|
|
Date: Thu, 20 Aug 2020 12:35:01 +0200
|
|
Subject: [PATCH 091/105] Add py binding for dcerpc_transport_encrypted
|
|
|
|
Signed-off-by: Isaac Boukris <iboukris@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit eba91f0dfa8e3267689b4076302e257f4cecd63b)
|
|
---
|
|
source4/librpc/rpc/pyrpc.c | 14 ++++++++++++++
|
|
1 file changed, 14 insertions(+)
|
|
|
|
diff --git a/source4/librpc/rpc/pyrpc.c b/source4/librpc/rpc/pyrpc.c
|
|
index be914ed5f14..309a6d72e26 100644
|
|
--- a/source4/librpc/rpc/pyrpc.c
|
|
+++ b/source4/librpc/rpc/pyrpc.c
|
|
@@ -293,11 +293,25 @@ static PyObject *py_iface_request(PyObject *self, PyObject *args, PyObject *kwar
|
|
return ret;
|
|
}
|
|
|
|
+static PyObject *py_iface_transport_encrypted(PyObject *self)
|
|
+{
|
|
+ dcerpc_InterfaceObject *iface = (dcerpc_InterfaceObject *)self;
|
|
+
|
|
+ if (dcerpc_transport_encrypted(iface->pipe)) {
|
|
+ Py_RETURN_TRUE;
|
|
+ }
|
|
+
|
|
+ Py_RETURN_FALSE;
|
|
+}
|
|
+
|
|
static PyMethodDef dcerpc_interface_methods[] = {
|
|
{ "request", PY_DISCARD_FUNC_SIG(PyCFunction, py_iface_request),
|
|
METH_VARARGS|METH_KEYWORDS,
|
|
"S.request(opnum, data, object=None) -> data\n"
|
|
"Make a raw request" },
|
|
+ { "transport_encrypted", PY_DISCARD_FUNC_SIG(PyCFunction, py_iface_transport_encrypted),
|
|
+ METH_NOARGS,
|
|
+ "Check if the DCE transport is encrypted" },
|
|
{ NULL, NULL, 0, NULL },
|
|
};
|
|
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 07a87eaff7e2e18c2d462f4caff95cace92a0130 Mon Sep 17 00:00:00 2001
|
|
From: Isaac Boukris <iboukris@gmail.com>
|
|
Date: Thu, 20 Aug 2020 12:44:08 +0200
|
|
Subject: [PATCH 092/105] selftest: add a test for py dce transport_encrypted
|
|
|
|
Signed-off-by: Isaac Boukris <iboukris@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit a77551bea969ce73a3dc27384d94b4126bef04f7)
|
|
---
|
|
python/samba/tests/dcerpc/binding.py | 23 ++++++++++++++++++++++-
|
|
1 file changed, 22 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/python/samba/tests/dcerpc/binding.py b/python/samba/tests/dcerpc/binding.py
|
|
index 8e0d6a5ef0a..24e4ac77d89 100644
|
|
--- a/python/samba/tests/dcerpc/binding.py
|
|
+++ b/python/samba/tests/dcerpc/binding.py
|
|
@@ -22,7 +22,7 @@ import samba.tests
|
|
from samba.tests import RpcInterfaceTestCase, TestCase
|
|
from samba.dcerpc import lsa
|
|
import samba.dcerpc.security as security
|
|
-from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED
|
|
+from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED, SMB_ENCRYPTION_OFF
|
|
from samba import NTSTATUSError
|
|
|
|
class RpcBindingTests(RpcInterfaceTestCase):
|
|
@@ -40,6 +40,26 @@ class RpcBindingTests(RpcInterfaceTestCase):
|
|
c.set_password(password)
|
|
return c
|
|
|
|
+ def test_smb3_dcerpc_no_encryption(self):
|
|
+ creds = self.get_user_creds()
|
|
+ creds.set_smb_encryption(SMB_ENCRYPTION_OFF)
|
|
+
|
|
+ lp = self.get_loadparm()
|
|
+ lp.set('client ipc max protocol', 'SMB3')
|
|
+ lp.set('client ipc min protocol', 'SMB3')
|
|
+
|
|
+ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER')))
|
|
+ lsa_conn = lsa.lsarpc(binding_string, lp, creds)
|
|
+ self.assertFalse(lsa_conn.transport_encrypted())
|
|
+
|
|
+ objectAttr = lsa.ObjectAttribute()
|
|
+ objectAttr.sec_qos = lsa.QosInfo()
|
|
+
|
|
+ pol_handle = lsa_conn.OpenPolicy2('',
|
|
+ objectAttr,
|
|
+ security.SEC_FLAG_MAXIMUM_ALLOWED)
|
|
+ self.assertIsNotNone(pol_handle)
|
|
+
|
|
def test_smb3_dcerpc_encryption(self):
|
|
creds = self.get_user_creds()
|
|
creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED)
|
|
@@ -50,6 +70,7 @@ class RpcBindingTests(RpcInterfaceTestCase):
|
|
|
|
binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER')))
|
|
lsa_conn = lsa.lsarpc(binding_string, lp, creds)
|
|
+ self.assertTrue(lsa_conn.transport_encrypted())
|
|
|
|
objectAttr = lsa.ObjectAttribute()
|
|
objectAttr.sec_qos = lsa.QosInfo()
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 1c74d87e4dfe78d6e884c9bb4e57ec383d632a88 Mon Sep 17 00:00:00 2001
|
|
From: Isaac Boukris <iboukris@gmail.com>
|
|
Date: Thu, 20 Aug 2020 12:47:12 +0200
|
|
Subject: [PATCH 093/105] Add CreateTrustedDomainRelax wrapper for fips mode
|
|
|
|
Signed-off-by: Isaac Boukris <iboukris@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit c2644032b49b4160517a7c73634cebc54a76f827)
|
|
---
|
|
python/samba/trust_utils.py | 62 +++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 62 insertions(+)
|
|
create mode 100644 python/samba/trust_utils.py
|
|
|
|
diff --git a/python/samba/trust_utils.py b/python/samba/trust_utils.py
|
|
new file mode 100644
|
|
index 00000000000..b4df0fa5bb8
|
|
--- /dev/null
|
|
+++ b/python/samba/trust_utils.py
|
|
@@ -0,0 +1,62 @@
|
|
+# trust utils
|
|
+#
|
|
+# Copyright Isaac Boukris 2020
|
|
+#
|
|
+# This program is free software; you can redistribute it and/or modify
|
|
+# it under the terms of the GNU General Public License as published by
|
|
+# the Free Software Foundation; either version 3 of the License, or
|
|
+# (at your option) any later version.
|
|
+#
|
|
+# This program is distributed in the hope that it will be useful,
|
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+# GNU General Public License for more details.
|
|
+#
|
|
+# You should have received a copy of the GNU General Public License
|
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+
|
|
+
|
|
+from samba.dcerpc import lsa, drsblobs
|
|
+from samba.ndr import ndr_pack
|
|
+from samba import arcfour_encrypt, string_to_byte_array
|
|
+import random
|
|
+from samba import crypto
|
|
+
|
|
+def CreateTrustedDomainRelax(lsaconn, policy, trust_info, mask, in_blob, out_blob):
|
|
+
|
|
+ def generate_AuthInfoInternal(session_key, incoming=None, outgoing=None):
|
|
+ confounder = [0] * 512
|
|
+ for i in range(len(confounder)):
|
|
+ confounder[i] = random.randint(0, 255)
|
|
+
|
|
+ trustpass = drsblobs.trustDomainPasswords()
|
|
+
|
|
+ trustpass.confounder = confounder
|
|
+ trustpass.outgoing = outgoing
|
|
+ trustpass.incoming = incoming
|
|
+
|
|
+ trustpass_blob = ndr_pack(trustpass)
|
|
+
|
|
+ encrypted_trustpass = arcfour_encrypt(session_key, trustpass_blob)
|
|
+
|
|
+ auth_blob = lsa.DATA_BUF2()
|
|
+ auth_blob.size = len(encrypted_trustpass)
|
|
+ auth_blob.data = string_to_byte_array(encrypted_trustpass)
|
|
+
|
|
+ auth_info = lsa.TrustDomainInfoAuthInfoInternal()
|
|
+ auth_info.auth_blob = auth_blob
|
|
+
|
|
+ return auth_info
|
|
+
|
|
+ session_key = lsaconn.session_key
|
|
+
|
|
+ try:
|
|
+ if lsaconn.transport_encrypted():
|
|
+ crypto.set_relax_mode()
|
|
+ auth_info = generate_AuthInfoInternal(session_key,
|
|
+ incoming=in_blob,
|
|
+ outgoing=out_blob)
|
|
+ finally:
|
|
+ crypto.set_strict_mode()
|
|
+
|
|
+ return lsaconn.CreateTrustedDomainEx2(policy, trust_info, auth_info, mask)
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 067c8d73800b928b02bcb1095c13083d9e0e368d Mon Sep 17 00:00:00 2001
|
|
From: Isaac Boukris <iboukris@gmail.com>
|
|
Date: Thu, 20 Aug 2020 12:49:17 +0200
|
|
Subject: [PATCH 094/105] Use the new CreateTrustedDomainRelax()
|
|
|
|
Signed-off-by: Isaac Boukris <iboukris@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit baf4e2930ee13b47c23c63c7e945fdc4444f0c69)
|
|
---
|
|
python/samba/netcmd/domain.py | 57 ++++++++---------------------------
|
|
1 file changed, 13 insertions(+), 44 deletions(-)
|
|
|
|
diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py
|
|
index 1d12c362911..93a3258d28d 100644
|
|
--- a/python/samba/netcmd/domain.py
|
|
+++ b/python/samba/netcmd/domain.py
|
|
@@ -102,6 +102,7 @@ from samba.netcmd.domain_backup import cmd_domain_backup
|
|
|
|
from samba.compat import binary_type
|
|
from samba.compat import get_string
|
|
+from samba.trust_utils import CreateTrustedDomainRelax
|
|
|
|
string_version_to_constant = {
|
|
"2008_R2": DS_DOMAIN_FUNCTION_2008_R2,
|
|
@@ -2528,54 +2529,20 @@ class cmd_domain_trust_create(DomainTrustCommand):
|
|
|
|
return blob
|
|
|
|
- def generate_AuthInfoInternal(session_key, incoming=None, outgoing=None):
|
|
- confounder = [0] * 512
|
|
- for i in range(len(confounder)):
|
|
- confounder[i] = random.randint(0, 255)
|
|
-
|
|
- trustpass = drsblobs.trustDomainPasswords()
|
|
-
|
|
- trustpass.confounder = confounder
|
|
- trustpass.outgoing = outgoing
|
|
- trustpass.incoming = incoming
|
|
-
|
|
- trustpass_blob = ndr_pack(trustpass)
|
|
-
|
|
- encrypted_trustpass = arcfour_encrypt(session_key, trustpass_blob)
|
|
-
|
|
- auth_blob = lsa.DATA_BUF2()
|
|
- auth_blob.size = len(encrypted_trustpass)
|
|
- auth_blob.data = string_to_byte_array(encrypted_trustpass)
|
|
-
|
|
- auth_info = lsa.TrustDomainInfoAuthInfoInternal()
|
|
- auth_info.auth_blob = auth_blob
|
|
-
|
|
- return auth_info
|
|
-
|
|
update_time = samba.current_unix_time()
|
|
incoming_blob = generate_AuthInOutBlob(incoming_secret, update_time)
|
|
outgoing_blob = generate_AuthInOutBlob(outgoing_secret, update_time)
|
|
|
|
- local_tdo_handle = None
|
|
- remote_tdo_handle = None
|
|
-
|
|
- local_auth_info = generate_AuthInfoInternal(local_lsa.session_key,
|
|
- incoming=incoming_blob,
|
|
- outgoing=outgoing_blob)
|
|
- if remote_trust_info:
|
|
- remote_auth_info = generate_AuthInfoInternal(remote_lsa.session_key,
|
|
- incoming=outgoing_blob,
|
|
- outgoing=incoming_blob)
|
|
-
|
|
try:
|
|
if remote_trust_info:
|
|
self.outf.write("Creating remote TDO.\n")
|
|
current_request = {"location": "remote", "name": "CreateTrustedDomainEx2"}
|
|
- remote_tdo_handle = \
|
|
- remote_lsa.CreateTrustedDomainEx2(remote_policy,
|
|
- remote_trust_info,
|
|
- remote_auth_info,
|
|
- lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS)
|
|
+ remote_tdo_handle = CreateTrustedDomainRelax(remote_lsa,
|
|
+ remote_policy,
|
|
+ remote_trust_info,
|
|
+ lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS,
|
|
+ outgoing_blob,
|
|
+ incoming_blob)
|
|
self.outf.write("Remote TDO created.\n")
|
|
if enc_types:
|
|
self.outf.write("Setting supported encryption types on remote TDO.\n")
|
|
@@ -2586,10 +2553,12 @@ class cmd_domain_trust_create(DomainTrustCommand):
|
|
|
|
self.outf.write("Creating local TDO.\n")
|
|
current_request = {"location": "local", "name": "CreateTrustedDomainEx2"}
|
|
- local_tdo_handle = local_lsa.CreateTrustedDomainEx2(local_policy,
|
|
- local_trust_info,
|
|
- local_auth_info,
|
|
- lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS)
|
|
+ local_tdo_handle = CreateTrustedDomainRelax(local_lsa,
|
|
+ local_policy,
|
|
+ local_trust_info,
|
|
+ lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS,
|
|
+ incoming_blob,
|
|
+ outgoing_blob)
|
|
self.outf.write("Local TDO created\n")
|
|
if enc_types:
|
|
self.outf.write("Setting supported encryption types on local TDO.\n")
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 72dfcc923d0cf8054cb0f011e8405fa96b9ec6e0 Mon Sep 17 00:00:00 2001
|
|
From: Isaac Boukris <iboukris@gmail.com>
|
|
Date: Tue, 1 Sep 2020 20:14:29 +0300
|
|
Subject: [PATCH 095/105] selftest: add a test for the CreateTrustedDomainRelax
|
|
wrapper
|
|
|
|
Originally copied from 'source4/scripting/devel/createtrust'
|
|
(had to drop the TRUST_AUTH_TYPE_VERSION part though, as it
|
|
fails against samba DC).
|
|
|
|
Signed-off-by: Isaac Boukris <iboukris@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit cfaad16ff632df83a881fe5d8ec498bab102c9c9)
|
|
---
|
|
python/samba/tests/dcerpc/createtrustrelax.py | 131 ++++++++++++++++++
|
|
selftest/knownfail.d/createtrustrelax_server | 1 +
|
|
source4/selftest/tests.py | 4 +
|
|
3 files changed, 136 insertions(+)
|
|
create mode 100644 python/samba/tests/dcerpc/createtrustrelax.py
|
|
create mode 100644 selftest/knownfail.d/createtrustrelax_server
|
|
|
|
diff --git a/python/samba/tests/dcerpc/createtrustrelax.py b/python/samba/tests/dcerpc/createtrustrelax.py
|
|
new file mode 100644
|
|
index 00000000000..48beb0f9680
|
|
--- /dev/null
|
|
+++ b/python/samba/tests/dcerpc/createtrustrelax.py
|
|
@@ -0,0 +1,131 @@
|
|
+# Unix SMB/CIFS implementation.
|
|
+#
|
|
+# Copyright (C) Andrew Bartlett 2011
|
|
+# Copyright (C) Isaac Boukris 2020
|
|
+#
|
|
+# This program is free software; you can redistribute it and/or modify
|
|
+# it under the terms of the GNU General Public License as published by
|
|
+# the Free Software Foundation; either version 3 of the License, or
|
|
+# (at your option) any later version.
|
|
+#
|
|
+# This program is distributed in the hope that it will be useful,
|
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+# GNU General Public License for more details.
|
|
+#
|
|
+# You should have received a copy of the GNU General Public License
|
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+#
|
|
+
|
|
+"""Tests for the CreateTrustedDomainRelax wrapper"""
|
|
+
|
|
+import os
|
|
+import samba
|
|
+from samba.tests import TestCase
|
|
+from samba.dcerpc import lsa, security, drsblobs
|
|
+from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED, SMB_ENCRYPTION_OFF
|
|
+from samba.trust_utils import CreateTrustedDomainRelax
|
|
+
|
|
+class CreateTrustedDomainRelaxTest(TestCase):
|
|
+ def setUp(self):
|
|
+ super(CreateTrustedDomainRelaxTest, self).setUp()
|
|
+
|
|
+ def get_user_creds(self):
|
|
+ c = Credentials()
|
|
+ c.guess()
|
|
+ domain = samba.tests.env_get_var_value('DOMAIN')
|
|
+ username = samba.tests.env_get_var_value('USERNAME')
|
|
+ password = samba.tests.env_get_var_value('PASSWORD')
|
|
+ c.set_domain(domain)
|
|
+ c.set_username(username)
|
|
+ c.set_password(password)
|
|
+ return c
|
|
+
|
|
+ def _create_trust_relax(self, smbencrypt=True):
|
|
+ creds = self.get_user_creds()
|
|
+
|
|
+ if smbencrypt:
|
|
+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED)
|
|
+ else:
|
|
+ creds.set_smb_encryption(SMB_ENCRYPTION_OFF)
|
|
+
|
|
+ lp = self.get_loadparm()
|
|
+
|
|
+ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER')))
|
|
+ lsa_conn = lsa.lsarpc(binding_string, lp, creds)
|
|
+
|
|
+ if smbencrypt:
|
|
+ self.assertTrue(lsa_conn.transport_encrypted())
|
|
+ else:
|
|
+ self.assertFalse(lsa_conn.transport_encrypted())
|
|
+
|
|
+ objectAttr = lsa.ObjectAttribute()
|
|
+ objectAttr.sec_qos = lsa.QosInfo()
|
|
+
|
|
+ pol_handle = lsa_conn.OpenPolicy2('',
|
|
+ objectAttr,
|
|
+ security.SEC_FLAG_MAXIMUM_ALLOWED)
|
|
+ self.assertIsNotNone(pol_handle)
|
|
+
|
|
+ name = lsa.String()
|
|
+ name.string = "tests.samba.example.com"
|
|
+ try:
|
|
+ info = lsa_conn.QueryTrustedDomainInfoByName(pol_handle, name,
|
|
+ lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)
|
|
+
|
|
+ lsa_conn.DeleteTrustedDomain(pol_handle, info.info_ex.sid)
|
|
+ except RuntimeError:
|
|
+ pass
|
|
+
|
|
+ info = lsa.TrustDomainInfoInfoEx()
|
|
+ info.domain_name.string = name.string
|
|
+ info.netbios_name.string = "createtrustrelax"
|
|
+ info.sid = security.dom_sid("S-1-5-21-538490383-3740119673-95748416")
|
|
+ info.trust_direction = lsa.LSA_TRUST_DIRECTION_INBOUND | lsa.LSA_TRUST_DIRECTION_OUTBOUND
|
|
+ info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL
|
|
+ info.trust_attributes = lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE
|
|
+
|
|
+ password_blob = samba.string_to_byte_array("password".encode('utf-16-le'))
|
|
+
|
|
+ clear_value = drsblobs.AuthInfoClear()
|
|
+ clear_value.size = len(password_blob)
|
|
+ clear_value.password = password_blob
|
|
+
|
|
+ clear_authentication_information = drsblobs.AuthenticationInformation()
|
|
+ clear_authentication_information.LastUpdateTime = 0
|
|
+ clear_authentication_information.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR
|
|
+ clear_authentication_information.AuthInfo = clear_value
|
|
+
|
|
+ authentication_information_array = drsblobs.AuthenticationInformationArray()
|
|
+ authentication_information_array.count = 1
|
|
+ authentication_information_array.array = [clear_authentication_information]
|
|
+
|
|
+ outgoing = drsblobs.trustAuthInOutBlob()
|
|
+ outgoing.count = 1
|
|
+ outgoing.current = authentication_information_array
|
|
+
|
|
+ trustdom_handle = None
|
|
+ try:
|
|
+ trustdom_handle = CreateTrustedDomainRelax(lsa_conn,
|
|
+ pol_handle,
|
|
+ info,
|
|
+ security.SEC_STD_DELETE,
|
|
+ outgoing,
|
|
+ outgoing)
|
|
+ except samba.NTSTATUSError as nt:
|
|
+ raise AssertionError(nt)
|
|
+ except OSError as e:
|
|
+ if smbencrypt:
|
|
+ raise AssertionError(e)
|
|
+
|
|
+ if smbencrypt:
|
|
+ self.assertIsNotNone(trustdom_handle)
|
|
+ lsa_conn.DeleteTrustedDomain(pol_handle, info.sid)
|
|
+ else:
|
|
+ self.assertIsNone(trustdom_handle)
|
|
+
|
|
+ def test_create_trust_relax_encrypt(self):
|
|
+ self._create_trust_relax(True)
|
|
+
|
|
+ def test_create_trust_relax_no_enc(self):
|
|
+ self._create_trust_relax(False)
|
|
diff --git a/selftest/knownfail.d/createtrustrelax_server b/selftest/knownfail.d/createtrustrelax_server
|
|
new file mode 100644
|
|
index 00000000000..80effda8343
|
|
--- /dev/null
|
|
+++ b/selftest/knownfail.d/createtrustrelax_server
|
|
@@ -0,0 +1 @@
|
|
+^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\)
|
|
diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
|
|
index 3a903a7eee0..96f51b68cfc 100755
|
|
--- a/source4/selftest/tests.py
|
|
+++ b/source4/selftest/tests.py
|
|
@@ -704,6 +704,10 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex
|
|
name = module
|
|
plantestsuite_loadlist(name, env, args)
|
|
|
|
+if have_gnutls_crypto_policies:
|
|
+ planoldpythontestsuite("ad_dc", "samba.tests.dcerpc.createtrustrelax", environ={'GNUTLS_FORCE_FIPS_MODE':'1'})
|
|
+ planoldpythontestsuite("ad_dc_fips", "samba.tests.dcerpc.createtrustrelax", environ={'GNUTLS_FORCE_FIPS_MODE':'1'})
|
|
+
|
|
# Run complex search expressions test once for each database backend.
|
|
# Right now ad_dc has mdb and ad_dc_ntvfs has tdb
|
|
mdb_testenv = "ad_dc"
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 341cc046bf816ad5818932c6c5d170a2a9a38783 Mon Sep 17 00:00:00 2001
|
|
From: Isaac Boukris <iboukris@gmail.com>
|
|
Date: Thu, 5 Nov 2020 15:38:19 +0200
|
|
Subject: [PATCH 096/105] Remove source4/scripting/devel/createtrust script
|
|
|
|
We now have the 'samba-tool domain trust' command.
|
|
|
|
Signed-off-by: Isaac Boukris <iboukris@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
|
|
Autobuild-User(master): Isaac Boukris <iboukris@samba.org>
|
|
Autobuild-Date(master): Fri Nov 6 11:25:02 UTC 2020 on sn-devel-184
|
|
|
|
(cherry picked from commit 604153525afc892f57a1df710c41ffca275b0dd3)
|
|
---
|
|
source4/scripting/devel/createtrust | 125 ----------------------------
|
|
1 file changed, 125 deletions(-)
|
|
delete mode 100755 source4/scripting/devel/createtrust
|
|
|
|
diff --git a/source4/scripting/devel/createtrust b/source4/scripting/devel/createtrust
|
|
deleted file mode 100755
|
|
index 26b0d0dcb68..00000000000
|
|
--- a/source4/scripting/devel/createtrust
|
|
+++ /dev/null
|
|
@@ -1,125 +0,0 @@
|
|
-#!/usr/bin/env python3
|
|
-
|
|
-# create a domain trust
|
|
-
|
|
-import sys
|
|
-from optparse import OptionParser
|
|
-
|
|
-sys.path.insert(0, "bin/python")
|
|
-
|
|
-import samba
|
|
-import samba.getopt as options
|
|
-from samba.dcerpc import lsa, security, drsblobs
|
|
-from samba.ndr import ndr_pack
|
|
-from samba import arcfour_encrypt, string_to_byte_array
|
|
-import random
|
|
-
|
|
-########### main code ###########
|
|
-if __name__ == "__main__":
|
|
- parser = OptionParser("createtrust [options] server")
|
|
- sambaopts = options.SambaOptions(parser)
|
|
- credopts = options.CredentialsOptionsDouble(parser)
|
|
- parser.add_option_group(credopts)
|
|
-
|
|
- (opts, args) = parser.parse_args()
|
|
-
|
|
- lp = sambaopts.get_loadparm()
|
|
- creds = credopts.get_credentials(lp)
|
|
-
|
|
- if len(args) != 1:
|
|
- parser.error("You must supply a server")
|
|
-
|
|
- if not creds.authentication_requested():
|
|
- parser.error("You must supply credentials")
|
|
-
|
|
- server = args[0]
|
|
-
|
|
- binding_str = "ncacn_np:%s[print]" % server
|
|
-
|
|
- lsaconn = lsa.lsarpc(binding_str, lp, creds)
|
|
-
|
|
- objectAttr = lsa.ObjectAttribute()
|
|
- objectAttr.sec_qos = lsa.QosInfo()
|
|
-
|
|
- pol_handle = lsaconn.OpenPolicy2(''.decode('utf-8'),
|
|
- objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED)
|
|
-
|
|
- name = lsa.String()
|
|
- name.string = "sub2.win2k3.obed.home.abartlet.net"
|
|
- try:
|
|
- info = lsaconn.QueryTrustedDomainInfoByName(pol_handle, name, lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)
|
|
-
|
|
- lsaconn.DeleteTrustedDomain(pol_handle, info.info_ex.sid)
|
|
- except RuntimeError:
|
|
- pass
|
|
-
|
|
- info = lsa.TrustDomainInfoInfoEx()
|
|
- info.domain_name.string = "sub2.win2k3.obed.home.abartlet.net"
|
|
- info.netbios_name.string = "sub2"
|
|
- info.sid = security.dom_sid("S-1-5-21-538090388-3760119675-95745416")
|
|
- info.trust_direction = lsa.LSA_TRUST_DIRECTION_INBOUND | lsa.LSA_TRUST_DIRECTION_OUTBOUND
|
|
- info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL
|
|
- info.trust_attributes = lsa.LSA_TRUST_ATTRIBUTE_WITHIN_FOREST
|
|
-
|
|
- password_blob = string_to_byte_array("password".encode('utf-16-le'))
|
|
-
|
|
- clear_value = drsblobs.AuthInfoClear()
|
|
- clear_value.size = len(password_blob)
|
|
- clear_value.password = password_blob
|
|
-
|
|
- clear_authentication_information = drsblobs.AuthenticationInformation()
|
|
- clear_authentication_information.LastUpdateTime = 0
|
|
- clear_authentication_information.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR
|
|
- clear_authentication_information.AuthInfo = clear_value
|
|
-
|
|
- version_value = drsblobs.AuthInfoVersion()
|
|
- version_value.version = 1
|
|
-
|
|
- version = drsblobs.AuthenticationInformation()
|
|
- version.LastUpdateTime = 0
|
|
- version.AuthType = lsa.TRUST_AUTH_TYPE_VERSION
|
|
- version.AuthInfo = version_value
|
|
-
|
|
- authentication_information_array = drsblobs.AuthenticationInformationArray()
|
|
- authentication_information_array.count = 2
|
|
- authentication_information_array.array = [clear_authentication_information, version]
|
|
-
|
|
- outgoing = drsblobs.trustAuthInOutBlob()
|
|
- outgoing.count = 1
|
|
- outgoing.current = authentication_information_array
|
|
-
|
|
- trustpass = drsblobs.trustDomainPasswords()
|
|
- confounder = [3] * 512
|
|
-
|
|
- for i in range(512):
|
|
- confounder[i] = random.randint(0, 255)
|
|
-
|
|
- trustpass.confounder = confounder
|
|
-
|
|
-# print "confounder: ", trustpass.confounder
|
|
-
|
|
- trustpass.outgoing = outgoing
|
|
- trustpass.incoming = outgoing
|
|
-
|
|
- trustpass_blob = ndr_pack(trustpass)
|
|
-
|
|
-# print "trustpass_blob: ", list(trustpass_blob)
|
|
-
|
|
- encrypted_trustpass = arcfour_encrypt(lsaconn.session_key, trustpass_blob)
|
|
-
|
|
-# print "encrypted_trustpass: ", list(encrypted_trustpass)
|
|
-
|
|
- auth_blob = lsa.DATA_BUF2()
|
|
- auth_blob.size = len(encrypted_trustpass)
|
|
- auth_blob.data = string_to_byte_array(encrypted_trustpass)
|
|
-
|
|
- auth_info = lsa.TrustDomainInfoAuthInfoInternal()
|
|
- auth_info.auth_blob = auth_blob
|
|
-
|
|
-
|
|
-# print "auth_info.auth_blob.data: ", auth_info.auth_blob.data
|
|
-
|
|
- trustdom_handle = lsaconn.CreateTrustedDomainEx2(pol_handle,
|
|
- info,
|
|
- auth_info,
|
|
- security.SEC_STD_DELETE)
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From f51b23a9b8ad22d4cd4d7dea3ed8f0150974a209 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 6 Nov 2020 14:30:26 +0100
|
|
Subject: [PATCH 097/105] s3:rpc_server: Use gnutls_cipher_decrypt() in
|
|
get_trustdom_auth_blob()
|
|
|
|
It doesn't matter for RC4, but just to be correct.
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit 6c11e5f42ba3248c97d85c989d422b256d2465a9)
|
|
---
|
|
source3/rpc_server/lsa/srv_lsa_nt.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c
|
|
index 198387424e6..e749caf2551 100644
|
|
--- a/source3/rpc_server/lsa/srv_lsa_nt.c
|
|
+++ b/source3/rpc_server/lsa/srv_lsa_nt.c
|
|
@@ -1726,7 +1726,7 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p,
|
|
goto out;
|
|
}
|
|
|
|
- rc = gnutls_cipher_encrypt(cipher_hnd,
|
|
+ rc = gnutls_cipher_decrypt(cipher_hnd,
|
|
auth_blob->data,
|
|
auth_blob->length);
|
|
gnutls_cipher_deinit(cipher_hnd);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 7b24fdcb4a797b1daa97750f8a2c4f2c603115f3 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 6 Nov 2020 14:33:38 +0100
|
|
Subject: [PATCH 098/105] s4:rpc_server: Use gnutls_cipher_decrypt() in
|
|
get_trustdom_auth_blob()
|
|
|
|
It doesn't matter for RC4, but just to be correct.
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
(cherry picked from commit c93ccebdfedd60c1d19f1b1436ac30062259952a)
|
|
---
|
|
source4/rpc_server/lsa/dcesrv_lsa.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c
|
|
index 8333cb149b6..4bb8aaa9592 100644
|
|
--- a/source4/rpc_server/lsa/dcesrv_lsa.c
|
|
+++ b/source4/rpc_server/lsa/dcesrv_lsa.c
|
|
@@ -889,7 +889,7 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call,
|
|
goto out;
|
|
}
|
|
|
|
- rc = gnutls_cipher_encrypt(cipher_hnd,
|
|
+ rc = gnutls_cipher_decrypt(cipher_hnd,
|
|
auth_blob->data,
|
|
auth_blob->length);
|
|
gnutls_cipher_deinit(cipher_hnd);
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From acbb59f45cb2b4c35df678ba774425180e9cf8c6 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 20 Aug 2020 13:40:21 +0200
|
|
Subject: [PATCH 099/105] s3:rpc_server: Allow to use RC4 for creating trusts
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
(cherry picked from commit 4425f2c113a4dc33a8dc609d84a92018d61b4d2e)
|
|
---
|
|
source3/rpc_server/lsa/srv_lsa_nt.c | 13 +++++++++++++
|
|
1 file changed, 13 insertions(+)
|
|
|
|
diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c
|
|
index e749caf2551..d6d606ddeca 100644
|
|
--- a/source3/rpc_server/lsa/srv_lsa_nt.c
|
|
+++ b/source3/rpc_server/lsa/srv_lsa_nt.c
|
|
@@ -51,6 +51,8 @@
|
|
#include "../libcli/lsarpc/util_lsarpc.h"
|
|
#include "lsa.h"
|
|
#include "librpc/rpc/dcesrv_core.h"
|
|
+#include "librpc/rpc/dcerpc_helper.h"
|
|
+#include "lib/param/loadparm.h"
|
|
|
|
#include "lib/crypto/gnutls_helpers.h"
|
|
#include <gnutls/gnutls.h>
|
|
@@ -1706,6 +1708,14 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p,
|
|
gnutls_datum_t my_session_key;
|
|
NTSTATUS status;
|
|
int rc;
|
|
+ bool encrypted;
|
|
+
|
|
+ encrypted =
|
|
+ dcerpc_is_transport_encrypted(p->session_info);
|
|
+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED &&
|
|
+ !encrypted) {
|
|
+ return NT_STATUS_ACCESS_DENIED;
|
|
+ }
|
|
|
|
status = session_extract_session_key(p->session_info, &lsession_key, KEY_USE_16BYTES);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
@@ -1717,11 +1727,13 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p,
|
|
.size = lsession_key.length,
|
|
};
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
rc = gnutls_cipher_init(&cipher_hnd,
|
|
GNUTLS_CIPHER_ARCFOUR_128,
|
|
&my_session_key,
|
|
NULL);
|
|
if (rc < 0) {
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
goto out;
|
|
}
|
|
@@ -1730,6 +1742,7 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p,
|
|
auth_blob->data,
|
|
auth_blob->length);
|
|
gnutls_cipher_deinit(cipher_hnd);
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
if (rc < 0) {
|
|
status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
goto out;
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From a4d0e69eb7a429a13e456cff7f96870e87791694 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Thu, 20 Aug 2020 13:51:39 +0200
|
|
Subject: [PATCH 100/105] s4:rpc_server: Allow to use RC4 for creating trusts
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
(cherry picked from commit c75dd1ea178325b8f65343cb5c35bb93f43a49a3)
|
|
---
|
|
source4/rpc_server/lsa/dcesrv_lsa.c | 18 ++++++++++++++++++
|
|
1 file changed, 18 insertions(+)
|
|
|
|
diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c
|
|
index 4bb8aaa9592..5b3ef71d458 100644
|
|
--- a/source4/rpc_server/lsa/dcesrv_lsa.c
|
|
+++ b/source4/rpc_server/lsa/dcesrv_lsa.c
|
|
@@ -33,6 +33,8 @@
|
|
#include "libcli/lsarpc/util_lsarpc.h"
|
|
#include "lib/messaging/irpc.h"
|
|
#include "libds/common/roles.h"
|
|
+#include "lib/param/loadparm.h"
|
|
+#include "librpc/rpc/dcerpc_helper.h"
|
|
|
|
#include "lib/crypto/gnutls_helpers.h"
|
|
#include <gnutls/gnutls.h>
|
|
@@ -869,6 +871,19 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call,
|
|
gnutls_cipher_hd_t cipher_hnd = NULL;
|
|
gnutls_datum_t _session_key;
|
|
int rc;
|
|
+ struct auth_session_info *session_info =
|
|
+ dcesrv_call_session_info(dce_call);
|
|
+ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
|
|
+ bool encrypted;
|
|
+
|
|
+ encrypted =
|
|
+ dcerpc_is_transport_encrypted(session_info);
|
|
+ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED &&
|
|
+ !encrypted) {
|
|
+ DBG_ERR("Transport isn't encrypted and weak crypto disallowed!\n");
|
|
+ return NT_STATUS_ACCESS_DENIED;
|
|
+ }
|
|
+
|
|
|
|
nt_status = dcesrv_transport_session_key(dce_call, &session_key);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
@@ -880,11 +895,13 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call,
|
|
.size = session_key.length,
|
|
};
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
rc = gnutls_cipher_init(&cipher_hnd,
|
|
GNUTLS_CIPHER_ARCFOUR_128,
|
|
&_session_key,
|
|
NULL);
|
|
if (rc < 0) {
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
goto out;
|
|
}
|
|
@@ -893,6 +910,7 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call,
|
|
auth_blob->data,
|
|
auth_blob->length);
|
|
gnutls_cipher_deinit(cipher_hnd);
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
if (rc < 0) {
|
|
nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
goto out;
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From f327133ced90a52d1ff9e104b1722876b21b7a78 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Fri, 6 Nov 2020 10:13:48 +0100
|
|
Subject: [PATCH 101/105] sefltest: Enable the dcerpc.createtrustrelax test
|
|
against ad_dc_fips
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
|
|
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
|
|
Autobuild-Date(master): Mon Nov 9 10:22:51 UTC 2020 on sn-devel-184
|
|
|
|
(cherry picked from commit b89134013041e772418c2c8bcfffe8a9ade6db91)
|
|
---
|
|
selftest/knownfail.d/createtrustrelax_server | 1 -
|
|
1 file changed, 1 deletion(-)
|
|
delete mode 100644 selftest/knownfail.d/createtrustrelax_server
|
|
|
|
diff --git a/selftest/knownfail.d/createtrustrelax_server b/selftest/knownfail.d/createtrustrelax_server
|
|
deleted file mode 100644
|
|
index 80effda8343..00000000000
|
|
--- a/selftest/knownfail.d/createtrustrelax_server
|
|
+++ /dev/null
|
|
@@ -1 +0,0 @@
|
|
-^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\)
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 721f97817de2d1e14d99459f9e6af9fccf11b621 Mon Sep 17 00:00:00 2001
|
|
From: Jeremy Allison <jra@samba.org>
|
|
Date: Thu, 5 Nov 2020 15:48:08 -0800
|
|
Subject: [PATCH 102/105] s3: spoolss: Make parameters in call to
|
|
user_ok_token() match all other uses.
|
|
|
|
We already have p->session_info->unix_info->unix_name, we don't
|
|
need to go through a legacy call to uidtoname(p->session_info->unix_token->uid).
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14568
|
|
|
|
Signed-off-by: Jeremy Allison <jra@samba.org>
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
|
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
|
|
Autobuild-Date(master): Mon Nov 9 04:10:45 UTC 2020 on sn-devel-184
|
|
|
|
(cherry picked from commit e5e1759057a767f517bf480a2172a36623df2799)
|
|
---
|
|
source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
|
index e98401a4365..906fab2adb5 100644
|
|
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
|
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
|
@@ -1880,7 +1880,8 @@ WERROR _spoolss_OpenPrinterEx(struct pipes_struct *p,
|
|
return WERR_ACCESS_DENIED;
|
|
}
|
|
|
|
- if (!user_ok_token(uidtoname(p->session_info->unix_token->uid), NULL,
|
|
+ if (!user_ok_token(p->session_info->unix_info->unix_name,
|
|
+ p->session_info->info->domain_name,
|
|
p->session_info->security_token, snum) ||
|
|
!W_ERROR_IS_OK(print_access_check(p->session_info,
|
|
p->msg_ctx,
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From a078205ce3816c175cd16dc22875dc147a5da645 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@samba.org>
|
|
Date: Wed, 11 Nov 2020 13:42:06 +0100
|
|
Subject: [PATCH 103/105] s3:smbd: Fix possible null pointer dereference in
|
|
token_contains_name()
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14572
|
|
|
|
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
|
|
Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
|
|
Autobuild-Date(master): Thu Nov 12 15:13:47 UTC 2020 on sn-devel-184
|
|
|
|
(cherry picked from commit 8036bf9717f83e83c3e4a9cf00fded42e9a5de15)
|
|
---
|
|
source3/smbd/share_access.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c
|
|
index 57754a0f766..694c0c290e8 100644
|
|
--- a/source3/smbd/share_access.c
|
|
+++ b/source3/smbd/share_access.c
|
|
@@ -79,7 +79,7 @@ static bool token_contains_name(TALLOC_CTX *mem_ctx,
|
|
enum lsa_SidType type;
|
|
|
|
if (username != NULL) {
|
|
- size_t domain_len = strlen(domain);
|
|
+ size_t domain_len = domain != NULL ? strlen(domain) : 0;
|
|
|
|
/* Check if username starts with domain name */
|
|
if (domain_len > 0) {
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From 5654101584b7742e684d12e6aea43e5004142dcb Mon Sep 17 00:00:00 2001
|
|
From: Alexander Bokovoy <ab@samba.org>
|
|
Date: Tue, 10 Nov 2020 17:35:24 +0200
|
|
Subject: [PATCH 104/105] lookup_name: allow lookup names prefixed with DNS
|
|
forest root for FreeIPA DC
|
|
|
|
In FreeIPA deployment with active Global Catalog service, when a two-way
|
|
trust to Active Directory forest is established, Windows systems can
|
|
look up FreeIPA users and groups. When using a security tab in Windows
|
|
Explorer on AD side, a lookup over a trusted forest might come as
|
|
realm\name instead of NetBIOS domain name:
|
|
|
|
--------------------------------------------------------------------
|
|
[2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug)
|
|
lsa_LookupNames3: struct lsa_LookupNames3
|
|
in: struct lsa_LookupNames3
|
|
handle : *
|
|
handle: struct policy_handle
|
|
handle_type : 0x00000000 (0)
|
|
uuid : 0000000e-0000-0000-1c5e-a750e5810000
|
|
num_names : 0x00000001 (1)
|
|
names: ARRAY(1)
|
|
names: struct lsa_String
|
|
length : 0x001e (30)
|
|
size : 0x0020 (32)
|
|
string : *
|
|
string : 'ipa.test\admins'
|
|
sids : *
|
|
sids: struct lsa_TransSidArray3
|
|
count : 0x00000000 (0)
|
|
sids : NULL
|
|
level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6)
|
|
count : *
|
|
count : 0x00000000 (0)
|
|
lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0)
|
|
client_revision : LSA_CLIENT_REVISION_2 (2)
|
|
--------------------------------------------------------------------
|
|
|
|
If we are running as a DC and PASSDB supports returning domain info
|
|
(pdb_get_domain_info() returns a valid structure), check domain of the
|
|
name in lookup_name() against DNS forest name and allow the request to
|
|
be done against the primary domain. This corresponds to FreeIPA's use of
|
|
Samba as a DC. For normal domain members a realm-based lookup falls back
|
|
to a lookup over to its own domain controller with the help of winbindd.
|
|
|
|
Signed-off-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
|
|
Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
|
|
Autobuild-Date(master): Wed Nov 11 10:59:01 UTC 2020 on sn-devel-184
|
|
|
|
(cherry picked from commit 31c703766fd2b89737826fb7e9a707f0622bb8cd)
|
|
---
|
|
source3/passdb/lookup_sid.c | 37 ++++++++++++++++++++++++++++---------
|
|
1 file changed, 28 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c
|
|
index 82c47b3145b..864246da56e 100644
|
|
--- a/source3/passdb/lookup_sid.c
|
|
+++ b/source3/passdb/lookup_sid.c
|
|
@@ -113,17 +113,36 @@ bool lookup_name(TALLOC_CTX *mem_ctx,
|
|
full_name, domain, name));
|
|
DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags));
|
|
|
|
- if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) &&
|
|
- strequal(domain, get_global_sam_name()))
|
|
- {
|
|
+ if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) {
|
|
+ bool check_global_sam = false;
|
|
+
|
|
+ check_global_sam = strequal(domain, get_global_sam_name());
|
|
+
|
|
+ /* If we are running on a DC that has PASSDB module with domain
|
|
+ * information, check if DNS forest name is matching the domain
|
|
+ * name. This is the case of FreeIPA domain controller when
|
|
+ * trusted AD DC looks up users found in a Global Catalog of
|
|
+ * the forest root domain. */
|
|
+ if (!check_global_sam && (IS_DC)) {
|
|
+ struct pdb_domain_info *dom_info = NULL;
|
|
+ dom_info = pdb_get_domain_info(tmp_ctx);
|
|
+
|
|
+ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) {
|
|
+ check_global_sam = strequal(domain, dom_info->dns_forest);
|
|
+ }
|
|
|
|
- /* It's our own domain, lookup the name in passdb */
|
|
- if (lookup_global_sam_name(name, flags, &rid, &type)) {
|
|
- sid_compose(&sid, get_global_sam_sid(), rid);
|
|
- goto ok;
|
|
+ TALLOC_FREE(dom_info);
|
|
+ }
|
|
+
|
|
+ if (check_global_sam) {
|
|
+ /* It's our own domain, lookup the name in passdb */
|
|
+ if (lookup_global_sam_name(name, flags, &rid, &type)) {
|
|
+ sid_compose(&sid, get_global_sam_sid(), rid);
|
|
+ goto ok;
|
|
+ }
|
|
+ TALLOC_FREE(tmp_ctx);
|
|
+ return false;
|
|
}
|
|
- TALLOC_FREE(tmp_ctx);
|
|
- return false;
|
|
}
|
|
|
|
if ((flags & LOOKUP_NAME_BUILTIN) &&
|
|
--
|
|
2.28.0
|
|
|
|
|
|
From efa59aa4b2455ea3bc4d0fd0358b160858626585 Mon Sep 17 00:00:00 2001
|
|
From: Alexander Bokovoy <ab@samba.org>
|
|
Date: Wed, 11 Nov 2020 14:42:55 +0200
|
|
Subject: [PATCH 105/105] auth_sam: use pdb_get_domain_info to look up DNS
|
|
forest information
|
|
|
|
When Samba is used as a part of FreeIPA domain controller, Windows
|
|
clients for a trusted AD forest may try to authenticate (perform logon
|
|
operation) as a REALM\name user account.
|
|
|
|
Fix auth_sam plugins to accept DNS forest name if we are running on a DC
|
|
with PASSDB module providing domain information (e.g. pdb_get_domain_info()
|
|
returning non-NULL structure). Right now, only FreeIPA or Samba AD DC
|
|
PASSDB backends return this information but Samba AD DC configuration is
|
|
explicitly ignored by the two auth_sam (strict and netlogon3) modules.
|
|
|
|
Detailed logs below:
|
|
|
|
[2020/11/11 09:23:53.281296, 1, pid=42677, effective(65534, 65534), real(65534, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:482(ndr_print_function_debug)
|
|
netr_LogonSamLogonWithFlags: struct netr_LogonSamLogonWithFlags
|
|
in: struct netr_LogonSamLogonWithFlags
|
|
server_name : *
|
|
server_name : '\\master.ipa.test'
|
|
computer_name : *
|
|
computer_name : 'AD1'
|
|
credential : *
|
|
credential: struct netr_Authenticator
|
|
cred: struct netr_Credential
|
|
data : 529f4b087c5f6546
|
|
timestamp : Wed Nov 11 09:23:55 AM 2020 UTC
|
|
return_authenticator : *
|
|
return_authenticator: struct netr_Authenticator
|
|
cred: struct netr_Credential
|
|
data : 204f28f622010000
|
|
timestamp : Fri May 2 06:37:50 AM 1986 UTC
|
|
logon_level : NetlogonNetworkTransitiveInformation (6)
|
|
logon : *
|
|
logon : union netr_LogonLevel(case 6)
|
|
network : *
|
|
network: struct netr_NetworkInfo
|
|
identity_info: struct netr_IdentityInfo
|
|
domain_name: struct lsa_String
|
|
length : 0x0010 (16)
|
|
size : 0x01fe (510)
|
|
string : *
|
|
string : 'IPA.TEST'
|
|
parameter_control : 0x00002ae0 (10976)
|
|
0: MSV1_0_CLEARTEXT_PASSWORD_ALLOWED
|
|
0: MSV1_0_UPDATE_LOGON_STATISTICS
|
|
0: MSV1_0_RETURN_USER_PARAMETERS
|
|
0: MSV1_0_DONT_TRY_GUEST_ACCOUNT
|
|
1: MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT
|
|
1: MSV1_0_RETURN_PASSWORD_EXPIRY
|
|
1: MSV1_0_USE_CLIENT_CHALLENGE
|
|
0: MSV1_0_TRY_GUEST_ACCOUNT_ONLY
|
|
1: MSV1_0_RETURN_PROFILE_PATH
|
|
0: MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY
|
|
1: MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT
|
|
0: MSV1_0_DISABLE_PERSONAL_FALLBACK
|
|
1: MSV1_0_ALLOW_FORCE_GUEST
|
|
0: MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED
|
|
0: MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY
|
|
0: MSV1_0_ALLOW_MSVCHAPV2
|
|
0: MSV1_0_S4U2SELF
|
|
0: MSV1_0_CHECK_LOGONHOURS_FOR_S4U
|
|
0: MSV1_0_SUBAUTHENTICATION_DLL_EX
|
|
logon_id : 0x0000000000884ef2 (8933106)
|
|
account_name: struct lsa_String
|
|
length : 0x000e (14)
|
|
size : 0x000e (14)
|
|
string : *
|
|
string : 'idmuser'
|
|
workstation: struct lsa_String
|
|
length : 0x0000 (0)
|
|
size : 0x0000 (0)
|
|
string : *
|
|
string : ''
|
|
challenge : 417207867bd33c74
|
|
nt: struct netr_ChallengeResponse
|
|
length : 0x00c0 (192)
|
|
size : 0x00c0 (192)
|
|
data : *
|
|
data: ARRAY(192)
|
|
[0000] A5 24 62 6E 31 DF 69 66 9E DC 54 D6 63 4C D6 2F .$bn1.if ..T.cL./
|
|
[0010] 01 01 00 00 00 00 00 00 50 37 D7 60 0C B8 D6 01 ........ P7.`....
|
|
[0020] 15 1B 38 4F 47 95 4D 62 00 00 00 00 02 00 0E 00 ..8OG.Mb ........
|
|
[0030] 57 00 49 00 4E 00 32 00 30 00 31 00 36 00 01 00 W.I.N.2. 0.1.6...
|
|
[0040] 06 00 41 00 44 00 31 00 04 00 18 00 77 00 69 00 ..A.D.1. ....w.i.
|
|
[0050] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e.
|
|
[0060] 73 00 74 00 03 00 20 00 61 00 64 00 31 00 2E 00 s.t... . a.d.1...
|
|
[0070] 77 00 69 00 6E 00 32 00 30 00 31 00 36 00 2E 00 w.i.n.2. 0.1.6...
|
|
[0080] 74 00 65 00 73 00 74 00 05 00 18 00 77 00 69 00 t.e.s.t. ....w.i.
|
|
[0090] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e.
|
|
[00A0] 73 00 74 00 07 00 08 00 50 37 D7 60 0C B8 D6 01 s.t..... P7.`....
|
|
[00B0] 06 00 04 00 02 00 00 00 00 00 00 00 00 00 00 00 ........ ........
|
|
lm: struct netr_ChallengeResponse
|
|
length : 0x0018 (24)
|
|
size : 0x0018 (24)
|
|
data : *
|
|
data : 000000000000000000000000000000000000000000000000
|
|
validation_level : 0x0006 (6)
|
|
flags : *
|
|
flags : 0x00000000 (0)
|
|
0: NETLOGON_SAMLOGON_FLAG_PASS_TO_FOREST_ROOT
|
|
0: NETLOGON_SAMLOGON_FLAG_PASS_CROSS_FOREST_HOP
|
|
0: NETLOGON_SAMLOGON_FLAG_RODC_TO_OTHER_DOMAIN
|
|
0: NETLOGON_SAMLOGON_FLAG_RODC_NTLM_REQUEST
|
|
|
|
In such case checks for a workgroup name will not match the DNS forest
|
|
name used in the username specification:
|
|
|
|
[2020/11/11 09:23:53.283055, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:200(auth_check_ntlm_password)
|
|
check_ntlm_password: Checking password for unmapped user [IPA.TEST]\[idmuser]@[] with the new password interface
|
|
[2020/11/11 09:23:53.283073, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:203(auth_check_ntlm_password)
|
|
check_ntlm_password: mapped user is: [IPA.TEST]\[idmuser]@[]
|
|
[2020/11/11 09:23:53.283082, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:213(auth_check_ntlm_password)
|
|
check_ntlm_password: auth_context challenge created by fixed
|
|
[2020/11/11 09:23:53.283091, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:216(auth_check_ntlm_password)
|
|
challenge is:
|
|
[2020/11/11 09:23:53.283099, 5, pid=42677, effective(65534, 65534), real(65534, 0)] ../../lib/util/util.c:678(dump_data)
|
|
[0000] 41 72 07 86 7B D3 3C 74 Ar..{.<t
|
|
[2020/11/11 09:23:53.283113, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth_sam.c:209(auth_sam_netlogon3_auth)
|
|
auth_sam_netlogon3_auth: Check auth for: [IPA.TEST]\[idmuser]
|
|
[2020/11/11 09:23:53.283123, 5, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth_sam.c:234(auth_sam_netlogon3_auth)
|
|
auth_sam_netlogon3_auth: IPA.TEST is not our domain name (DC for IPA)
|
|
[2020/11/11 09:23:53.283131, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:249(auth_check_ntlm_password)
|
|
auth_check_ntlm_password: sam_netlogon3 had nothing to say
|
|
|
|
and overall authentication attempt will fail: auth_winbind will complain
|
|
that this domain is not a trusted one and refuse operating on it:
|
|
|
|
[2020/11/11 09:23:53.283784, 10, pid=42663, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:742(process_request_send)
|
|
process_request_send: process_request: Handling async request smbd(42677):PAM_AUTH_CRAP
|
|
[2020/11/11 09:23:53.283796, 3, pid=42663, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_pam_auth_crap.c:110(winbindd_pam_auth_crap_send)
|
|
[42677]: pam auth crap domain: [IPA.TEST] user: idmuser
|
|
[2020/11/11 09:23:53.283810, 3, pid=42663, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_pam.c:409(find_auth_domain)
|
|
Authentication for domain [IPA.TEST] refused as it is not a trusted domain
|
|
[2020/11/11 09:23:53.283825, 10, pid=42663, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:810(process_request_done)
|
|
process_request_done: [smbd(42677):PAM_AUTH_CRAP]: NT_STATUS_NO_SUCH_USER
|
|
[2020/11/11 09:23:53.283844, 10, pid=42663, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:855(process_request_written)
|
|
process_request_written: [smbd(42677):PAM_AUTH_CRAP]: delivered response to client
|
|
|
|
Signed-off-by: Alexander Bokovoy <ab@samba.org>
|
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
|
(cherry picked from commit 2a8b672652dcbcf55ec59be537773d76f0f14d0a)
|
|
---
|
|
source3/auth/auth_sam.c | 45 +++++++++++++++++++++++++++++++++++++----
|
|
1 file changed, 41 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c
|
|
index 3c12f959faf..e8e0d543f8c 100644
|
|
--- a/source3/auth/auth_sam.c
|
|
+++ b/source3/auth/auth_sam.c
|
|
@@ -22,6 +22,7 @@
|
|
|
|
#include "includes.h"
|
|
#include "auth.h"
|
|
+#include "passdb.h"
|
|
|
|
#undef DBGC_CLASS
|
|
#define DBGC_CLASS DBGC_AUTH
|
|
@@ -142,10 +143,28 @@ static NTSTATUS auth_samstrict_auth(const struct auth_context *auth_context,
|
|
break;
|
|
case ROLE_DOMAIN_PDC:
|
|
case ROLE_DOMAIN_BDC:
|
|
- if ( !is_local_name && !is_my_domain ) {
|
|
- DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n",
|
|
- effective_domain));
|
|
- return NT_STATUS_NOT_IMPLEMENTED;
|
|
+ if (!is_local_name && !is_my_domain) {
|
|
+ /* If we are running on a DC that has PASSDB module with domain
|
|
+ * information, check if DNS forest name is matching the domain
|
|
+ * name. This is the case of FreeIPA domain controller when
|
|
+ * trusted AD DCs attempt to authenticate FreeIPA users using
|
|
+ * the forest root domain (which is the only domain in FreeIPA).
|
|
+ */
|
|
+ struct pdb_domain_info *dom_info = NULL;
|
|
+
|
|
+ dom_info = pdb_get_domain_info(mem_ctx);
|
|
+ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) {
|
|
+ is_my_domain = strequal(user_info->mapped.domain_name,
|
|
+ dom_info->dns_forest);
|
|
+ }
|
|
+
|
|
+ TALLOC_FREE(dom_info);
|
|
+ if (!is_my_domain) {
|
|
+ DEBUG(6,("check_samstrict_security: %s is not one "
|
|
+ "of my local names or domain name (DC)\n",
|
|
+ effective_domain));
|
|
+ return NT_STATUS_NOT_IMPLEMENTED;
|
|
+ }
|
|
}
|
|
|
|
break;
|
|
@@ -230,6 +249,24 @@ static NTSTATUS auth_sam_netlogon3_auth(const struct auth_context *auth_context,
|
|
}
|
|
|
|
is_my_domain = strequal(user_info->mapped.domain_name, lp_workgroup());
|
|
+ if (!is_my_domain) {
|
|
+ /* If we are running on a DC that has PASSDB module with domain
|
|
+ * information, check if DNS forest name is matching the domain
|
|
+ * name. This is the case of FreeIPA domain controller when
|
|
+ * trusted AD DCs attempt to authenticate FreeIPA users using
|
|
+ * the forest root domain (which is the only domain in FreeIPA).
|
|
+ */
|
|
+ struct pdb_domain_info *dom_info = NULL;
|
|
+ dom_info = pdb_get_domain_info(mem_ctx);
|
|
+
|
|
+ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) {
|
|
+ is_my_domain = strequal(user_info->mapped.domain_name,
|
|
+ dom_info->dns_forest);
|
|
+ }
|
|
+
|
|
+ TALLOC_FREE(dom_info);
|
|
+ }
|
|
+
|
|
if (!is_my_domain) {
|
|
DBG_INFO("%s is not our domain name (DC for %s)\n",
|
|
effective_domain, lp_workgroup());
|
|
--
|
|
2.28.0
|
|
|