summaryrefslogtreecommitdiff
path: root/auth
AgeCommit message (Collapse)AuthorFilesLines
2023-01-17auth/creds: fix a typo in a commentBjörn Baumbach1-1/+1
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Ralph Boehme <slow@samba.org>
2022-11-08build: Remove unused dependenciesJoseph Sutton1-1/+1
We don't need to include these any more, and removing them allows us to simplify the build system for system Heimdal builds. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-07-27CVE-2022-2031 auth: Add ticket type field to auth_user_info_dc and ↵Joseph Sutton2-2/+2
auth_session_info This field may be used to convey whether we were provided with a TGT or a non-TGT. We ensure both structures are zeroed out to avoid incorrect results being produced by an uninitialised field. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-06-26auth/credentials: Add get_aes256_key()Joseph Sutton1-0/+56
This makes it possible to generate AES256 keys in Python from a given password and salt. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-26auth/credentials: Add cli_credentials_get_aes256_key()Joseph Sutton2-0/+70
This allows us to generate AES256 keys from a given password and salt. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-26s4-auth: For LDAP simple bind, fall back to checking the ↵Andrew Bartlett1-0/+3
ENCTYPE_AES256_CTS_HMAC_SHA1_96 if stored Since we don't store a salt per-key, but only a single salt, when we do not have the NT hash in the unicodePwd (eg ntlm auth = disabled), the check will fail for a previous password if the account was renamed prior to a newer password being set. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-06-10spelling: connnect encrytion exisit expection explicit invalide missmatch ↵Michael Tokarev1-2/+2
paramater paramter partion privilige relase reponse seperate unkown verson authencication progagated Tree-wide spellcheck for some common misspellings. source3/utils/status.c has misspelled local variable (unkown_dialect). "missmatch" is a known historical misspelling, only the incorrect misspellings are fixed. source3/locale/net/de.po has the spelling error (unkown) in two msgids - it probably should be updated with current source. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-06-09lib/util: Change function to mem_equal_const_time()Joseph Sutton4-13/+13
Since memcmp_const_time() doesn't act as an exact replacement for memcmp(), and its return value is only ever compared with zero, simplify it and emphasize the intention of checking equality by returning a bool instead. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-09auth: Use constant-time memcmp when comparing sensitive buffersJoseph Sutton4-7/+7
This helps to avoid timing attacks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15010 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-14auth: Covscan: unchecked return value for cli_credentials_set_smb_encryption()Pavel Filipenský1-1/+1
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-05-14auth: Fix trailing whitespace in pycredentials.cPavel Filipenský1-4/+4
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-03-18auth/credentials: Add encrypt_samr_password()Joseph Sutton1-1/+42
This method encrypts a samr_Password structure with the current session key, which allows for interactive SamLogon from Python. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17auth: Add required headers to auth_sam_reply.hAndreas Schneider1-0/+4
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-03-10auth: let auth logging prefer user_info->orig_client.{account,domain}_name ↵Stefan Metzmacher2-5/+17
if available The optional user_info->orig_client.{account,domain}_name are the once really used by the client and should be used in audit logging. But we still fallback to user_info->client.{account,domain}_name. This will be important for the next commit. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10s4:auth: rename user_info->mapped_state to user_info->cracknames_calledStefan Metzmacher1-1/+1
This makes it much clearer what it is used for and it is a special hack for authenticate_ldap_simple_bind_send() in order to avoid some additional work in authsam_check_password_internals(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10auth/ntlmssp: don't set mapped_state explicitly in auth_usersupplied_infoStefan Metzmacher1-1/+0
We already use talloc_zero() and mapped_state will be removed in the next commits. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-01auth: Cope with NULL upn_name in PACJoseph Sutton1-5/+7
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-01-04auth/ntlmssp: make sure we return INVALID_PARAMETER for NTLMv2_RESPONSE ↵Stefan Metzmacher1-0/+8
parsing errors BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Jan 4 20:57:41 UTC 2022 on sn-devel-184
2022-01-04auth/credentials: cli_credentials_set_ntlm_response() pass session_keysStefan Metzmacher3-9/+64
Otherwise cli_credentials_get_ntlm_response() will return session keys with a 0 length, which leads to errors in the NTLMSSP code. This wasn't noticed as cli_credentials_set_ntlm_response() has no callers yet, but that will change in the next commits. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-12-10auth: Fix a typo in auth/gensec/ncalrpc.cVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-12-09auth/credentials: Fix cli_credentials_shallow_ccache error caseStefan Metzmacher1-3/+8
Avoid dangling values if something fails... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2021-12-09auth/credentials: Handle ENOENT when obtaining ccache lifetimeStefan Metzmacher1-1/+1
The new Heimdal may return ENOENT instead of KRB5_CC_END. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2021-11-13IPA DC: add missing checksAlexander Bokovoy1-0/+1
When introducing FreeIPA support, two places were forgotten: - schannel gensec module needs to be aware of IPA DC - _lsa_QueryInfoPolicy should treat IPA DC as PDC BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903 Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Alexander Bokovoy <ab@samba.org> Autobuild-Date(master): Sat Nov 13 07:01:26 UTC 2021 on sn-devel-184
2021-11-10auth:creds: Guess the username first via getpwuid(my_id)Andreas Schneider1-0/+13
If we have a container, we often don't have USER or LOGNAME set. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14883 Tested-by: Anoop C S <anoopcs@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Nov 10 19:11:53 UTC 2021 on sn-devel-184
2021-11-10auth:creds: Remove trailing spacesAndreas Schneider1-56/+56
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-11-09CVE-2021-3738 auth_util: avoid talloc_tos() in copy_session_info()Stefan Metzmacher1-3/+6
We want to use this also in code without existing stackframe. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14468 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25719 CVE-2020-25717: auth/gensec: always require a PAC in domain ↵Stefan Metzmacher1-4/+23
mode (DC or member) AD domains always provide a PAC unless UF_NO_AUTH_DATA_REQUIRED is set on the service account, which can only be explicitly configured, but that's an invalid configuration! We still try to support standalone servers in an MIT realm, as legacy setup. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> [jsutton@samba.org Removed knownfail entries]
2021-11-09CVE-2020-25717: auth/ntlmssp: start with authoritative = 1Stefan Metzmacher1-1/+1
This is not strictly needed, but makes it easier to audit that we don't miss important places. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722 selftest: allow for future failures in ↵Andrew Bartlett1-2/+11
BindTests.test_virtual_email_account_style_bind This allows for any failures here to be handled via the knownfail system. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-10-20dsdb: Allow special chars like "@" in samAccountName when generating the saltAndrew Bartlett1-6/+6
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Oct 20 12:54:54 UTC 2021 on sn-devel-184
2021-09-04python: Fix usage stringsJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-08-03auth:gensec: Use lpcfg_weak_crypto()Andreas Schneider1-2/+3
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-07-08auth:creds: Remove unused simple.c fileAndreas Schneider1-168/+0
This code is tested by the cmocka unit test: auth/credentials/tests/test_creds.c Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-07-01auth/credentials: allow credentials.Credentials to act as base classStefan Metzmacher1-1/+1
In tests it's useful to add more details. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29auth:creds: Check return code of cli_credentials_guess()Andreas Schneider1-2/+5
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29auth:creds: Return bool for cli_credentials_guess()Andreas Schneider3-15/+39
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29auth:creds: Add sanity check for env variablesAndreas Schneider1-18/+45
CID 710829 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29auth:creds: Check return code of cli_credentials_set_conf()Andreas Schneider1-2/+5
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-29auth:creds: Return a bool for cli_credentials_set_conf()Andreas Schneider3-18/+74
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-05-19auth:creds: Fix parameter in creds.set_named_ccache()Joseph Sutton1-1/+2
Use the passed-in value for 'obtained' rather than always using CRED_SPECIFIED. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-05-19auth:creds: Remove unused variableJoseph Sutton1-3/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-04-28auth:creds:tests: Add test for cli_credentials_get_password_and_obtained()Andreas Schneider1-0/+6
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28auth:creds: Add cli_credentials_get_password_and_obtained()Andreas Schneider2-0/+22
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28auth:creds:tests: Add test for cli_credentials_get_username_and_obtained()Andreas Schneider1-0/+6
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28auth:creds: Add cli_credentials_get_username_and_obtained()Andreas Schneider2-0/+22
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28auth:creds:tests: Add test for cli_credentials_set_gensec_features()Andreas Schneider1-0/+27
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28auth:creds: Add obtained arg to cli_credentials_set_gensec_features()Andreas Schneider4-6/+36
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28auth:creds: Use 'client protection' option for smb sign and encrypt defaultsAndreas Schneider1-0/+30
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28lib:param: Add 'client protection' config optionAndreas Schneider1-0/+7
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28auth:creds:tests: Add test for cli_credentials_set_kerberos_state()Andreas Schneider1-0/+42
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-26 03:18:36 +0000