/[smeserver]/rpms/samba/sme10/samba-v4-6-fix-net-ads-keytab-handling.patch
ViewVC logotype

Annotation of /rpms/samba/sme10/samba-v4-6-fix-net-ads-keytab-handling.patch

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.1 - (hide annotations) (download)
Tue May 8 16:37:54 2018 UTC (6 years, 5 months ago) by jpp
Branch: MAIN
CVS Tags: samba-4_6_2-12_el7_4, samba--, samba-4_6_2-12_3_el7_sme, samba-4_6_2-12_4_el7_sme, samba-4_6_2-12_2_el7_sme
upgrade to samba-4.6.2-12

1 jpp 1.1 From e73223b0edc62a6e89f68fe5f0a3c56cd14322de Mon Sep 17 00:00:00 2001
2     From: Andreas Schneider <asn@samba.org>
3     Date: Mon, 13 Mar 2017 17:30:37 +0100
4     Subject: [PATCH 1/5] testprogs: Correctly expand shell parameters
5    
6     The old behaviour is:
7    
8     for var in $*
9     do
10     echo "$var"
11     done
12    
13     And you get this:
14    
15     $ sh test.sh 1 2 '3 4'
16     1
17     2
18     3
19     4
20    
21     Changing it to:
22    
23     for var in "$@"
24     do
25     echo "$var"
26     done
27    
28     will correctly expand to:
29    
30     $ sh test.sh 1 2 '3 4'
31     1
32     2
33     3 4
34    
35     Signed-off-by: Andreas Schneider <asn@samba.org>
36     Reviewed-by: Jeremy Allison <jra@samba.org>
37    
38     Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
39     Autobuild-Date(master): Wed Mar 15 05:26:17 CET 2017 on sn-devel-144
40    
41     (cherry picked from commit acad0adc2977ca26df44e5b22d8b8e991177af71)
42     ---
43     testprogs/blackbox/subunit.sh | 4 ++--
44     1 file changed, 2 insertions(+), 2 deletions(-)
45    
46     diff --git a/testprogs/blackbox/subunit.sh b/testprogs/blackbox/subunit.sh
47     index 0791d775d27..5c81ce20a11 100755
48     --- a/testprogs/blackbox/subunit.sh
49     +++ b/testprogs/blackbox/subunit.sh
50     @@ -78,7 +78,7 @@ subunit_skip_test () {
51     testit () {
52     name="$1"
53     shift
54     - cmdline="$*"
55     + cmdline="$@"
56     subunit_start_test "$name"
57     output=`$cmdline 2>&1`
58     status=$?
59     @@ -93,7 +93,7 @@ testit () {
60     testit_expect_failure () {
61     name="$1"
62     shift
63     - cmdline="$*"
64     + cmdline="$@"
65     subunit_start_test "$name"
66     output=`$cmdline 2>&1`
67     status=$?
68     --
69     2.12.0
70    
71    
72     From 7a729d0c4ff2e423bd500f6e0acd91f2ba766b68 Mon Sep 17 00:00:00 2001
73     From: Andreas Schneider <asn@samba.org>
74     Date: Mon, 13 Mar 2017 16:11:39 +0100
75     Subject: [PATCH 2/5] krb5_wrap: Print a warning for an invalid keytab name
76    
77     Signed-off-by: Andreas Schneider <asn@samba.org>
78     Reviewed-by: Andrew Bartlet <abartlet@samba.org>
79     (cherry picked from commit a6a527e1e83a979ef035c49a087b5e79599c10a4)
80     ---
81     lib/krb5_wrap/krb5_samba.c | 2 ++
82     1 file changed, 2 insertions(+)
83    
84     diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
85     index 10b42dec53f..fd8e4a96071 100644
86     --- a/lib/krb5_wrap/krb5_samba.c
87     +++ b/lib/krb5_wrap/krb5_samba.c
88     @@ -1187,6 +1187,8 @@ krb5_error_code smb_krb5_kt_open(krb5_context context,
89     goto open_keytab;
90     }
91    
92     + DBG_WARNING("ERROR: Invalid keytab name: %s\n", keytab_name_req);
93     +
94     return KRB5_KT_BADNAME;
95    
96     open_keytab:
97     --
98     2.12.0
99    
100    
101     From 8efd7f6c759a65ab83d7ec679915ea2a0d3752f3 Mon Sep 17 00:00:00 2001
102     From: Andreas Schneider <asn@samba.org>
103     Date: Mon, 13 Mar 2017 16:24:52 +0100
104     Subject: [PATCH 3/5] s3:libads: Correctly handle the keytab kerberos methods
105    
106     Signed-off-by: Andreas Schneider <asn@samba.org>
107     Reviewed-by: Andrew Bartlet <abartlet@samba.org>
108     (cherry picked from commit ca2d8f3161c647c425c8c1eaaac1837c2e97faad)
109     ---
110     source3/libads/kerberos_keytab.c | 69 +++++++++++++++++++++++++++++++++-------
111     1 file changed, 57 insertions(+), 12 deletions(-)
112    
113     diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
114     index 3c73b089bbb..96df10fcf65 100644
115     --- a/source3/libads/kerberos_keytab.c
116     +++ b/source3/libads/kerberos_keytab.c
117     @@ -34,6 +34,57 @@
118    
119     #ifdef HAVE_ADS
120    
121     +/* This MAX_NAME_LEN is a constant defined in krb5.h */
122     +#ifndef MAX_KEYTAB_NAME_LEN
123     +#define MAX_KEYTAB_NAME_LEN 1100
124     +#endif
125     +
126     +static krb5_error_code ads_keytab_open(krb5_context context,
127     + krb5_keytab *keytab)
128     +{
129     + char keytab_str[MAX_KEYTAB_NAME_LEN] = {0};
130     + const char *keytab_name = NULL;
131     + krb5_error_code ret = 0;
132     +
133     + switch (lp_kerberos_method()) {
134     + case KERBEROS_VERIFY_SYSTEM_KEYTAB:
135     + case KERBEROS_VERIFY_SECRETS_AND_KEYTAB:
136     + ret = krb5_kt_default_name(context,
137     + keytab_str,
138     + sizeof(keytab_str) - 2);
139     + if (ret != 0) {
140     + DBG_WARNING("Failed to get default keytab name");
141     + goto out;
142     + }
143     + keytab_name = keytab_str;
144     + break;
145     + case KERBEROS_VERIFY_DEDICATED_KEYTAB:
146     + keytab_name = lp_dedicated_keytab_file();
147     + break;
148     + default:
149     + DBG_ERR("Invalid kerberos method set (%d)\n",
150     + lp_kerberos_method());
151     + ret = KRB5_KT_BADNAME;
152     + goto out;
153     + }
154     +
155     + if (keytab_name == NULL || keytab_name[0] == '\0') {
156     + DBG_ERR("Invalid keytab name\n");
157     + ret = KRB5_KT_BADNAME;
158     + goto out;
159     + }
160     +
161     + ret = smb_krb5_kt_open(context, keytab_name, true, keytab);
162     + if (ret != 0) {
163     + DBG_WARNING("smb_krb5_kt_open failed (%s)\n",
164     + error_message(ret));
165     + goto out;
166     + }
167     +
168     +out:
169     + return ret;
170     +}
171     +
172     /**********************************************************************
173     Adds a single service principal, i.e. 'host' to the system keytab
174     ***********************************************************************/
175     @@ -75,10 +126,8 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
176     return -1;
177     }
178    
179     - ret = smb_krb5_kt_open(context, NULL, True, &keytab);
180     - if (ret) {
181     - DEBUG(1, ("smb_krb5_kt_open failed (%s)\n",
182     - error_message(ret)));
183     + ret = ads_keytab_open(context, &keytab);
184     + if (ret != 0) {
185     goto out;
186     }
187    
188     @@ -262,10 +311,8 @@ int ads_keytab_flush(ADS_STRUCT *ads)
189     return ret;
190     }
191    
192     - ret = smb_krb5_kt_open(context, NULL, True, &keytab);
193     - if (ret) {
194     - DEBUG(1, ("smb_krb5_kt_open failed (%s)\n",
195     - error_message(ret)));
196     + ret = ads_keytab_open(context, &keytab);
197     + if (ret != 0) {
198     goto out;
199     }
200    
201     @@ -447,10 +494,8 @@ int ads_keytab_create_default(ADS_STRUCT *ads)
202     DEBUG(3, (__location__ ": Searching for keytab entries to preserve "
203     "and update.\n"));
204    
205     - ret = smb_krb5_kt_open(context, NULL, True, &keytab);
206     - if (ret) {
207     - DEBUG(1, ("smb_krb5_kt_open failed (%s)\n",
208     - error_message(ret)));
209     + ret = ads_keytab_open(context, &keytab);
210     + if (ret != 0) {
211     goto done;
212     }
213    
214     --
215     2.12.0
216    
217    
218     From d755048c0797e1c88382d63ae90e6ca0dceebb71 Mon Sep 17 00:00:00 2001
219     From: Andreas Schneider <asn@samba.org>
220     Date: Mon, 13 Mar 2017 17:28:58 +0100
221     Subject: [PATCH 4/5] param: Allow to specify kerberos method on the
222     commandline
223    
224     We support --option for our tools but you cannot set an option where the
225     value of the option includes a space.
226    
227     Signed-off-by: Andreas Schneider <asn@samba.org>
228     Reviewed-by: Andrew Bartlet <abartlet@samba.org>
229     (cherry picked from commit 12d26899a45ce5d05ac4279fa5915318daa4f2e0)
230     ---
231     lib/param/param_table.c | 4 ++++
232     1 file changed, 4 insertions(+)
233    
234     diff --git a/lib/param/param_table.c b/lib/param/param_table.c
235     index 4b5234a7c9e..9a944ef19b3 100644
236     --- a/lib/param/param_table.c
237     +++ b/lib/param/param_table.c
238     @@ -202,9 +202,13 @@ static const struct enum_list enum_smbd_profiling_level[] = {
239     static const struct enum_list enum_kerberos_method[] = {
240     {KERBEROS_VERIFY_SECRETS, "default"},
241     {KERBEROS_VERIFY_SECRETS, "secrets only"},
242     + {KERBEROS_VERIFY_SECRETS, "secretsonly"},
243     {KERBEROS_VERIFY_SYSTEM_KEYTAB, "system keytab"},
244     + {KERBEROS_VERIFY_SYSTEM_KEYTAB, "systemkeytab"},
245     {KERBEROS_VERIFY_DEDICATED_KEYTAB, "dedicated keytab"},
246     + {KERBEROS_VERIFY_DEDICATED_KEYTAB, "dedicatedkeytab"},
247     {KERBEROS_VERIFY_SECRETS_AND_KEYTAB, "secrets and keytab"},
248     + {KERBEROS_VERIFY_SECRETS_AND_KEYTAB, "secretsandkeytab"},
249     {-1, NULL}
250     };
251    
252     --
253     2.12.0
254    
255    
256     From 1916ab4c51bdde58480259d4b45dbcf9c0c46842 Mon Sep 17 00:00:00 2001
257     From: Andreas Schneider <asn@samba.org>
258     Date: Mon, 13 Mar 2017 16:34:05 +0100
259     Subject: [PATCH 5/5] testprogs: Test 'net ads join' with a dedicated keytab
260    
261     This checks that a 'net ads join' can create the keytab and make sure we
262     will not regress in future.
263    
264     Signed-off-by: Andreas Schneider <asn@samba.org>
265     Reviewed-by: Andrew Bartlet <abartlet@samba.org>
266     (cherry picked from commit 00e22fe3f63f986978d946e063e19e615cb00ab3)
267     ---
268     testprogs/blackbox/test_net_ads.sh | 9 +++++++++
269     1 file changed, 9 insertions(+)
270    
271     diff --git a/testprogs/blackbox/test_net_ads.sh b/testprogs/blackbox/test_net_ads.sh
272     index 8e915cdcf1f..99b886f53eb 100755
273     --- a/testprogs/blackbox/test_net_ads.sh
274     +++ b/testprogs/blackbox/test_net_ads.sh
275     @@ -35,6 +35,15 @@ testit "testjoin" $VALGRIND $net_tool ads testjoin -kP || failed=`expr $failed +
276    
277     testit "leave" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
278    
279     +# Test with kerberos method = secrets and keytab
280     +dedicated_keytab_file="$PREFIX_ABS/test_net_ads_dedicated_krb5.keytab"
281     +testit "join (decicated keytab)" $VALGRIND $net_tool ads join -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1`
282     +
283     +testit "testjoin (dedicated keytab)" $VALGRIND $net_tool ads testjoin -kP || failed=`expr $failed + 1`
284     +
285     +testit "leave (dedicated keytab)" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
286     +rm -f $dedicated_keytab_file
287     +
288     testit_expect_failure "testjoin(not joined)" $VALGRIND $net_tool ads testjoin -kP || failed=`expr $failed + 1`
289    
290     testit "join+kerberos" $VALGRIND $net_tool ads join -kU$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
291     --
292     2.12.0
293    

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed