summaryrefslogtreecommitdiff
path: root/source4/kdc/sdb.c
AgeCommit message (Collapse)AuthorFilesLines
2025-10-10s4:kdc:sdb Support Windows flexible cert mappingsGary Lockyer1-0/+43
Extract certificate mappings from the altSecurityIdentities attribute and populate the new sdb_certificate_mappings element of sdb Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-07-29s4:kdc:sdb: Add support for key trust public keysGary Lockyer1-1/+40
Add public keys to the sdb entry to allow them to be passed to Kerberos for key trust authentication. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-06-03s4:kdc: Fix ticket encryption types memory leakIvan Korytov1-0/+4
sdb_entry_free was not releasing memory for s->etypes->val. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15812 Signed-off-by: Ivan Korytov <korytovip@basealt.ru> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-10-17s4:kdc: Remove unused function int2SDBFlags()Joseph Sutton1-28/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14s4:kdc: Fix leaks of sdb_entry’s membersJoseph Sutton1-0/+8
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 s4:kdc: announce PA-SUPPORTED-ETYPES like windows.Stefan Metzmacher1-40/+29
We need to take the value from the msDS-SupportedEncryptionTypes attribute and only take the default if there's no value or if the value is 0. For krbtgt and DC accounts we need to force support for ARCFOUR-HMAC-MD5 and AES encryption types and add the related bits in addtition. (Note for krbtgt msDS-SupportedEncryptionTypes is completely ignored the hardcoded value is the default, so there's no AES256-SK for krbtgt). For UF_USE_DES_KEY_ONLY on the account we reset the value to 0, these accounts are in fact disabled completely, as they always result in KRB5KDC_ERR_ETYPE_NOSUPP. Then we try to get all encryption keys marked in supported_enctypes, and the available_enctypes is a reduced set depending on what keys are actually stored in the database. We select the supported session key enctypes by the available keys and in addition based on AES256-SK as well as the "kdc force enable rc4 weak session keys" option. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13135 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 kdc: Implement new Kerberos session key behaviour since ↵Andrew Bartlett1-0/+102
ENC_HMAC_SHA1_96_AES256_SK was added ENC_HMAC_SHA1_96_AES256_SK is a flag introduced for by Microsoft in this CVE to indicate that additionally, AES session keys are available. We set the etypes available for session keys depending on the encryption types that are supported by the principal. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15219 Pair-Programmed-With: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-09-12s4:kdc: Set Kerberos debug class for all KDC filesAndreas Schneider1-0/+3
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Sep 12 03:27:55 UTC 2022 on sn-devel-184
2022-03-24s4:kdc: add old and older keys to sdb_entryStefan Metzmacher1-0/+2
This is the first step to return the password history in order to avoid badPwdCount updates for failing pre-authentication with passwords from the recent history. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14054 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: finally remove unused 'struct sdb_entry_ex'Stefan Metzmacher1-6/+0
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: expose a sdb_entry_free() functionStefan Metzmacher1-4/+2
We'll remove sdb_entry_ex soon. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: let samba_kdc_entry take references to sdb_entry and kdc_entryStefan Metzmacher1-0/+6
kdc_entry can be hdb_entry or krb5_db_entry. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: split out a sdb_keys_free() helper functionStefan Metzmacher1-7/+16
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: rename free_sdb_key() as public sdb_key_free() functionStefan Metzmacher1-2/+2
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: make free_sdb_entry() staticStefan Metzmacher1-1/+3
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: don't leak salt in free_sdb_key()Stefan Metzmacher1-0/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: call krb5_free_keyblock_contents() in free_sdb_key()Stefan Metzmacher1-15/+6
This is much clearer than doing it in sdb_free_entry() already. It also simplifies the next cleanups. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: remove unused sdb_entry_ex->free_entry()Stefan Metzmacher1-4/+0
It seems we need to take a closer look at the memory hierachy of the sdb_entry related code. I'll check that during the next commits, but for now just remove use the unused hook. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: let sdb_free_entry clear sdb_entry_ex at the endStefan Metzmacher1-0/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24s4:kdc: remove unused mkvno from sdb_keyStefan Metzmacher1-4/+0
This is not related to the kvno of the key, the mkvno tells the HDB layer that the keys need to be decrypted with a master key (with the given [m]kvno). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-09-26s4-kdc: Remove unused etypes from sdb structureAndreas Schneider1-6/+0
Signed-off-by: Andreas Schneider <asn@samba.org> eviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Sep 26 06:08:09 CEST 2016 on sn-devel-144
2016-08-31krb5_wrap: Rename kerberos_free_data_contents()Andreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-07-30s4-kdc: Introduce sdb a KDC backend abstractionGünther Deschner1-0/+131
Guenther Pair-Programmed-With: Andreas Schneider <asn@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-23 06:33:02 +0000