samba.git/auth, branch talloc-2.4.0

auth/creds: fix a typo in a comment

2023-01-17T17:21:38+00:00

Signed-off-by: Björn Baumbach 
Reviewed-by: Ralph Boehme

build: Remove unused dependencies

2022-11-08T02:39:37+00:00

We don't need to include these any more, and removing them allows us to
simplify the build system for system Heimdal builds.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

CVE-2022-2031 auth: Add ticket type field to auth_user_info_dc and auth_session_info

2022-07-27T10:52:36+00:00

This field may be used to convey whether we were provided with a TGT or
a non-TGT. We ensure both structures are zeroed out to avoid incorrect
results being produced by an uninitialised field.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049

Signed-off-by: Joseph Sutton 
Reviewed-by: Andreas Schneider

auth/credentials: Add get_aes256_key()

2022-06-26T22:10:29+00:00

This makes it possible to generate AES256 keys in Python from a given
password and salt.

Signed-off-by: Joseph Sutton 
Reviewed-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

auth/credentials: Add cli_credentials_get_aes256_key()

2022-06-26T22:10:29+00:00

This allows us to generate AES256 keys from a given password and salt.

Signed-off-by: Joseph Sutton 
Reviewed-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4-auth: For LDAP simple bind, fall back to checking the ENCTYPE_AES256_CTS_HMAC_SHA1_96 if stored

2022-06-26T22:10:29+00:00

Since we don't store a salt per-key, but only a single salt, when we do
not have the NT hash in the unicodePwd (eg ntlm auth = disabled), the check
will fail for a previous password if the account was renamed prior to a
newer password being set.

Pair-Programmed-With: Stefan Metzmacher 

Signed-off-by: Andrew Bartlett 
Signed-off-by: Stefan Metzmacher 
Reviewed-by: Stefan Metzmacher

spelling: connnect encrytion exisit expection explicit invalide missmatch paramater paramter partion privilige relase reponse seperate unkown verson authencication progagated

2022-06-10T18:12:33+00:00

Tree-wide spellcheck for some common misspellings.

source3/utils/status.c has misspelled local variable (unkown_dialect).

"missmatch" is a known historical misspelling, only the incorrect
misspellings are fixed.

source3/locale/net/de.po has the spelling error (unkown) in two msgids -
it probably should be updated with current source.

Signed-off-by: Michael Tokarev 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Jeremy Allison

lib/util: Change function to mem_equal_const_time()

2022-06-09T22:49:29+00:00

Since memcmp_const_time() doesn't act as an exact replacement for
memcmp(), and its return value is only ever compared with zero, simplify
it and emphasize the intention of checking equality by returning a bool
instead.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

auth: Use constant-time memcmp when comparing sensitive buffers

2022-06-09T22:49:29+00:00

This helps to avoid timing attacks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15010

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

auth: Covscan: unchecked return value for cli_credentials_set_smb_encryption()

2022-05-14T03:49:32+00:00

Signed-off-by: Pavel Filipenský 
Reviewed-by: Jeremy Allison 
Reviewed-by: Douglas Bagnall