summaryrefslogtreecommitdiff
path: root/source4/kdc
AgeCommit message (Collapse)AuthorFilesLines
2026-02-23s4:kdc:db-glue:tests free principalGary Lockyer1-2/+3
Call krb5_free_principal to quiet valgrind leak reports Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2026-02-23s4:kdc:db-glue altSecurityIdentities DN and serial reversedGary Lockyer2-17/+454
When altSecurityIdentities is set by RSAT / ADUC they store the Issuer and Subject DN in last to first order i.e. CN=Common Name, O=Organization, C=Country Need to reverse that to first to last order, i.e. C=Country, O=Organization, CN=Common name Which is how they're stored on the X509 certificates. Also the serial number is stored in reverse order. BUG: https://bugzilla.samba.org/show_bug.cgi?id=16001 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2026-02-18CVE-2026-20833: s4:kdc: Make default domain supported enctypes AES by defaultJennifer Sutton1-4/+9
If AES keys are available in the domain, assume that service accounts support AES by default. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15998 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2026-01-21s4:kdc: Return SDB_ERR_NOENTRY if canonicalization is requiredJennifer Sutton1-1/+1
MIT Kerberos maps this error code to KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN, avoiding problems from the KDC returning KRB5KRB_ERR_GENERIC. Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2026-01-20lib: Remove &data_blob_null refsVolker Lendecke2-4/+8
The next patch will remove the data_blob_null global constant. The APIs here are a bit weird in that they don't work fine with a NULL pointer but require a reference to a NULL blob. But that's few enough to add the special case in the callers. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2026-01-15s4:kdc: honour "kdc require canonicalization = yes"Douglas Bagnall1-1/+22
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-01-15kdc: match implicit dollar without canon affects AS_REQ client onlyDouglas Bagnall1-1/+3
The smb.conf option kdc name match implicit dollar without canonicalization = no is supposed to avoid the dollar ticket attack by refusing to consider "foo$" as a match for "foo" unless canonicalization is requested. This was rather blunt however, as the only time we care about this is for the client name in an AS_REQ, and we can easily check whether that is the case. This makes the option less intrusive, allowing the use of "SERVER" for a server name rather than "SERVER$". A number of tests no longer fail. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-12-08auth: Use new data_blob_..._s() functions and remove talloc_keep_secret()Pavel Filipenský1-4/+4
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-11-20s4:kdc: avoid reusing a variable nameDouglas Bagnall1-11/+12
fallback_principal was used for two different uses: a copy of the original principal from which to derive values, and a new principal which has the '$' appended on the account name. We might as well be clear and an optimising compiler won't see the difference. Whether we actually need a temporary principal as opposed to using the one that was passed in is a separate question. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20s4:kdc: do not match principal + '$' if smb.conf says not toDouglas Bagnall1-4/+52
With this patch we honour kdc name match implicit dollar without canonicalization = no Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20s4:kdc: allocate fallback realm later, closer to useDouglas Bagnall1-9/+7
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20s4:kdc: do not fallback to "$$" if user is "$"Douglas Bagnall1-1/+1
or from "" to "$", though I am not sure it is easy to get this far with an empty account name. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20s4:kdc: flatten samba_kdc_lookup_client dollar fallbackDouglas Bagnall1-52/+56
There is a single linear successful path through the 'num_comp == 1' and various NULL checks, but it is written in a branchy fashion as if you could skip some portion. git diff -b is probably useful. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20s4:kdc: avoid a leak on errorDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20s4:kdc: improve a commentDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-10-22s4:kdc: Implement Object SID certificate security extensionJennifer Sutton3-3/+44
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-22s4:kdc: Don’t leak pub_keys.keysJennifer Sutton1-4/+6
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-22s4:kdc: Move talloc_steal() back to function endJennifer Sutton1-6/+6
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-22s4:kdc: Correct debug messagesJennifer Sutton1-3/+3
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-22s4:kdc: Correct commentsJennifer Sutton1-5/+5
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-22s4:kdc: Correct spellingJennifer Sutton1-1/+1
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-17s4:kdc: Fix cmocka.h includeAndreas Schneider2-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-10-17Add missing include needed for cmocka.hAndreas Schneider2-0/+2
This will be required in future. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-10-13s4:kdc:db-glue-tests Fix CID 1666664Gary Lockyer1-0/+1
Fix Coverity issue CID 1666664 115 char* ts = ldb_timestring(msg, created); >>> CID 1666664: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "ts" when calling >>> "ldb_msg_add_string". 116 ldb_msg_add_string(msg, "whenCreated", ts); Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Martin Schwenke <martin@meltin.net>
2025-10-10s4:kdc:sdb_to_hdb strong/flexible certificate mappingsGary Lockyer2-0/+596
Map the content of sdb_certificate_mappings to the hdb extension HDB_Ext_CertificateMapping Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Autobuild-User(master): Jennifer Sutton <jsutton@samba.org> Autobuild-Date(master): Fri Oct 10 02:30:06 UTC 2025 on atb-devel-224
2025-10-10s4:kdc:sdb Support Windows flexible cert mappingsGary Lockyer4-30/+1451
Extract certificate mappings from the altSecurityIdentities attribute and populate the new sdb_certificate_mappings element of sdb Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-09-25s4:kdc:sdb_to_hdb: Fix CID 1665466Gary Lockyer1-5/+5
Fix: *** CID 1665466: Resource leaks (RESOURCE_LEAK) /source4/kdc/sdb_to_hdb.c: 482 in sdb_entry_to_hdb_entry() 476 } 477 478 h->context = ske; 479 if (ske != NULL) { 480 ske->kdc_entry = h; 481 } >>> CID 1665466: Resource leaks (RESOURCE_LEAK) >>> Variable "kt" going out of scope leaks the storage "kt.val" points to. 482 return 0; 483 error: 484 free_hdb_entry(h); 485 return rc; This is almost certainly a false positive as when kt.len == 0, kt.val will be NULL. But changing the condition to kt.val != NULL, will not do any harm. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Autobuild-User(master): Anoop C S <anoopcs@samba.org> Autobuild-Date(master): Thu Sep 25 07:13:28 UTC 2025 on atb-devel-224
2025-09-17s4:kdc/db-glue: Use realloc_p macroMike L1-4/+4
Signed-off-by: Mike L. <cl.jeremy@gmail.com> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Wed Sep 17 13:19:25 UTC 2025 on atb-devel-224
2025-09-16s4:kdc:sdb_to_hdb key trust supportGary Lockyer3-0/+314
Convert key trust public keys contained in the clients sdb records, and add to the HDB_Ext_KeyTrust extension on the clients HDB record Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Sep 16 23:23:42 UTC 2025 on atb-devel-224
2025-09-16s4:kdc:db-glue binary dn changesGary Lockyer2-33/+144
msDS-KeyCredentialLink will be stored as a BinaryDN and not a binary blob. This commit updates db-glue and it's tests accordingly. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-08-06s4:kdc:db-glue talloc steal pub_key dataGary Lockyer1-0/+5
talloc_steal the data pointers of pub_key, modulus and exponent onto pub_key. To allow fuzz testing of ndr_pull_KeyMaterialInternal the KeyMaterialInternal struct may not be a talloc_context. So the data portions will be allocated on the ndr context. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-07-29s4:kdc Support for key trust authenticationGary Lockyer3-0/+1309
Extract the public kes from msDS-KeyCredentialLink and populate the sdb structure. These values can then be passed to Kergeros to allow key trust authentication. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Jul 29 05:31:10 UTC 2025 on atb-devel-224
2025-07-29s4:kdc:sdb: Add support for key trust public keysGary Lockyer2-1/+54
Add public keys to the sdb entry to allow them to be passed to Kerberos for key trust authentication. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-07-29s4:kdc: Fix clang-tidy error in db-glue.cGary Lockyer1-0/+5
../../source4/kdc/db-glue.c:968:14: warning: Access to field 'kvno' results in a dereference of a null pointer (loaded from variable 'entry') [clang-analyzer-core.NullDereference] 968 | entry->kvno = returned_kvno; | ~~~~~ ^ Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-06-03s4:kdc: Fix memory leak of padata_valueIvan Korytov1-5/+2
md.padata_value is not needed even if no error occurred. kdc_request_add_encrypted_padata copies data from it to newly allocated r->ek.encrypted_pa_data. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15813 Signed-off-by: Ivan Korytov <korytovip@basealt.ru> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-06-03s4:kdc: Fix ticket encryption types memory leakIvan Korytov1-0/+4
sdb_entry_free was not releasing memory for s->etypes->val. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15812 Signed-off-by: Ivan Korytov <korytovip@basealt.ru> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-06-03s4:kdc: Fix memory leak for unused keys in TGTIvan Korytov1-0/+11
Length of key list was reduced to one but unused keys were not deallocated before changing the length. As such, free_sdb_entry/sdb_keys_free function could not release unused keys indexed from 1 onwards on entry deallocation. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15712 Signed-off-by: Ivan Korytov <korytovip@basealt.ru> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-28Fix clang 20 unused-function warningsGary Lockyer1-6/+0
Remove unused function: static inline struct ldb_val talloc_steal_ldb_val(TALLOC_CTX *mem_ctx, struct ldb_val val) From source4/kdc/ad_claims.c 1 error generated. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-04-03s4:kdc: samba_kdc_add_compounded_auth() should add Compounded_Authentication ↵Stefan Metzmacher1-1/+5
again if it's already there Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: only use compound authentication with an explicit FAST armorStefan Metzmacher3-0/+9
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: samba_kdc_update_pac() doesn't need explicit delegated_proxy_principalStefan Metzmacher4-8/+1
It comes along as delegated_proxy.pac_princ now. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: store pac_princ in struct samba_kdc_entry_pacStefan Metzmacher2-6/+38
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: pass pac_princ to samba_kdc_entry_pac()Stefan Metzmacher5-3/+14
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: pass pac_princ to samba_kdc_entry_pac_from_trusted()Stefan Metzmacher3-0/+13
For mit_samba_update_pac() we can only pass it optionally. This should be fixed in future, but it requires changes in MIT Kerberos. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: let samba_kdc_entry_pac[_from_trusted]() assert krbtgt is valid if ↵Stefan Metzmacher1-0/+8
pac is valid Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: let hdb_samba4_check_rbcd() fill device_pac_entry() without device_entryStefan Metzmacher1-6/+16
If we have a device_pac we also have device_server/krbtgt_entry, while device_entry is optional. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: let samba_wdc_get_pac() use samba_kdc_get_device_pac()Stefan Metzmacher1-20/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: let samba_kdc_get_device_pac() always extract device_krbtgt_skdc_entryStefan Metzmacher1-7/+18
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: let samba_wdc_reget_pac() use krbtgt_skdc_entry as ↵Stefan Metzmacher1-6/+14
delegated_proxy_krbtgt_entry Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:kdc: let mit_samba_check_allowed_to_delegate_from() fetch krbtgt_entryStefan Metzmacher1-1/+46
samba_kdc_entry_pac_from_trusted() will soon assert that it has a valid krbtgt_entry. In the long run this should be passed from the caller... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 21:44:49 +0000