1 |
From e73223b0edc62a6e89f68fe5f0a3c56cd14322de Mon Sep 17 00:00:00 2001 |
2 |
From: Andreas Schneider <asn@samba.org> |
3 |
Date: Mon, 13 Mar 2017 17:30:37 +0100 |
4 |
Subject: [PATCH 1/5] testprogs: Correctly expand shell parameters |
5 |
|
6 |
The old behaviour is: |
7 |
|
8 |
for var in $* |
9 |
do |
10 |
echo "$var" |
11 |
done |
12 |
|
13 |
And you get this: |
14 |
|
15 |
$ sh test.sh 1 2 '3 4' |
16 |
1 |
17 |
2 |
18 |
3 |
19 |
4 |
20 |
|
21 |
Changing it to: |
22 |
|
23 |
for var in "$@" |
24 |
do |
25 |
echo "$var" |
26 |
done |
27 |
|
28 |
will correctly expand to: |
29 |
|
30 |
$ sh test.sh 1 2 '3 4' |
31 |
1 |
32 |
2 |
33 |
3 4 |
34 |
|
35 |
Signed-off-by: Andreas Schneider <asn@samba.org> |
36 |
Reviewed-by: Jeremy Allison <jra@samba.org> |
37 |
|
38 |
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> |
39 |
Autobuild-Date(master): Wed Mar 15 05:26:17 CET 2017 on sn-devel-144 |
40 |
|
41 |
(cherry picked from commit acad0adc2977ca26df44e5b22d8b8e991177af71) |
42 |
--- |
43 |
testprogs/blackbox/subunit.sh | 4 ++-- |
44 |
1 file changed, 2 insertions(+), 2 deletions(-) |
45 |
|
46 |
diff --git a/testprogs/blackbox/subunit.sh b/testprogs/blackbox/subunit.sh |
47 |
index 0791d775d27..5c81ce20a11 100755 |
48 |
--- a/testprogs/blackbox/subunit.sh |
49 |
+++ b/testprogs/blackbox/subunit.sh |
50 |
@@ -78,7 +78,7 @@ subunit_skip_test () { |
51 |
testit () { |
52 |
name="$1" |
53 |
shift |
54 |
- cmdline="$*" |
55 |
+ cmdline="$@" |
56 |
subunit_start_test "$name" |
57 |
output=`$cmdline 2>&1` |
58 |
status=$? |
59 |
@@ -93,7 +93,7 @@ testit () { |
60 |
testit_expect_failure () { |
61 |
name="$1" |
62 |
shift |
63 |
- cmdline="$*" |
64 |
+ cmdline="$@" |
65 |
subunit_start_test "$name" |
66 |
output=`$cmdline 2>&1` |
67 |
status=$? |
68 |
-- |
69 |
2.12.0 |
70 |
|
71 |
|
72 |
From 7a729d0c4ff2e423bd500f6e0acd91f2ba766b68 Mon Sep 17 00:00:00 2001 |
73 |
From: Andreas Schneider <asn@samba.org> |
74 |
Date: Mon, 13 Mar 2017 16:11:39 +0100 |
75 |
Subject: [PATCH 2/5] krb5_wrap: Print a warning for an invalid keytab name |
76 |
|
77 |
Signed-off-by: Andreas Schneider <asn@samba.org> |
78 |
Reviewed-by: Andrew Bartlet <abartlet@samba.org> |
79 |
(cherry picked from commit a6a527e1e83a979ef035c49a087b5e79599c10a4) |
80 |
--- |
81 |
lib/krb5_wrap/krb5_samba.c | 2 ++ |
82 |
1 file changed, 2 insertions(+) |
83 |
|
84 |
diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c |
85 |
index 10b42dec53f..fd8e4a96071 100644 |
86 |
--- a/lib/krb5_wrap/krb5_samba.c |
87 |
+++ b/lib/krb5_wrap/krb5_samba.c |
88 |
@@ -1187,6 +1187,8 @@ krb5_error_code smb_krb5_kt_open(krb5_context context, |
89 |
goto open_keytab; |
90 |
} |
91 |
|
92 |
+ DBG_WARNING("ERROR: Invalid keytab name: %s\n", keytab_name_req); |
93 |
+ |
94 |
return KRB5_KT_BADNAME; |
95 |
|
96 |
open_keytab: |
97 |
-- |
98 |
2.12.0 |
99 |
|
100 |
|
101 |
From 8efd7f6c759a65ab83d7ec679915ea2a0d3752f3 Mon Sep 17 00:00:00 2001 |
102 |
From: Andreas Schneider <asn@samba.org> |
103 |
Date: Mon, 13 Mar 2017 16:24:52 +0100 |
104 |
Subject: [PATCH 3/5] s3:libads: Correctly handle the keytab kerberos methods |
105 |
|
106 |
Signed-off-by: Andreas Schneider <asn@samba.org> |
107 |
Reviewed-by: Andrew Bartlet <abartlet@samba.org> |
108 |
(cherry picked from commit ca2d8f3161c647c425c8c1eaaac1837c2e97faad) |
109 |
--- |
110 |
source3/libads/kerberos_keytab.c | 69 +++++++++++++++++++++++++++++++++------- |
111 |
1 file changed, 57 insertions(+), 12 deletions(-) |
112 |
|
113 |
diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c |
114 |
index 3c73b089bbb..96df10fcf65 100644 |
115 |
--- a/source3/libads/kerberos_keytab.c |
116 |
+++ b/source3/libads/kerberos_keytab.c |
117 |
@@ -34,6 +34,57 @@ |
118 |
|
119 |
#ifdef HAVE_ADS |
120 |
|
121 |
+/* This MAX_NAME_LEN is a constant defined in krb5.h */ |
122 |
+#ifndef MAX_KEYTAB_NAME_LEN |
123 |
+#define MAX_KEYTAB_NAME_LEN 1100 |
124 |
+#endif |
125 |
+ |
126 |
+static krb5_error_code ads_keytab_open(krb5_context context, |
127 |
+ krb5_keytab *keytab) |
128 |
+{ |
129 |
+ char keytab_str[MAX_KEYTAB_NAME_LEN] = {0}; |
130 |
+ const char *keytab_name = NULL; |
131 |
+ krb5_error_code ret = 0; |
132 |
+ |
133 |
+ switch (lp_kerberos_method()) { |
134 |
+ case KERBEROS_VERIFY_SYSTEM_KEYTAB: |
135 |
+ case KERBEROS_VERIFY_SECRETS_AND_KEYTAB: |
136 |
+ ret = krb5_kt_default_name(context, |
137 |
+ keytab_str, |
138 |
+ sizeof(keytab_str) - 2); |
139 |
+ if (ret != 0) { |
140 |
+ DBG_WARNING("Failed to get default keytab name"); |
141 |
+ goto out; |
142 |
+ } |
143 |
+ keytab_name = keytab_str; |
144 |
+ break; |
145 |
+ case KERBEROS_VERIFY_DEDICATED_KEYTAB: |
146 |
+ keytab_name = lp_dedicated_keytab_file(); |
147 |
+ break; |
148 |
+ default: |
149 |
+ DBG_ERR("Invalid kerberos method set (%d)\n", |
150 |
+ lp_kerberos_method()); |
151 |
+ ret = KRB5_KT_BADNAME; |
152 |
+ goto out; |
153 |
+ } |
154 |
+ |
155 |
+ if (keytab_name == NULL || keytab_name[0] == '\0') { |
156 |
+ DBG_ERR("Invalid keytab name\n"); |
157 |
+ ret = KRB5_KT_BADNAME; |
158 |
+ goto out; |
159 |
+ } |
160 |
+ |
161 |
+ ret = smb_krb5_kt_open(context, keytab_name, true, keytab); |
162 |
+ if (ret != 0) { |
163 |
+ DBG_WARNING("smb_krb5_kt_open failed (%s)\n", |
164 |
+ error_message(ret)); |
165 |
+ goto out; |
166 |
+ } |
167 |
+ |
168 |
+out: |
169 |
+ return ret; |
170 |
+} |
171 |
+ |
172 |
/********************************************************************** |
173 |
Adds a single service principal, i.e. 'host' to the system keytab |
174 |
***********************************************************************/ |
175 |
@@ -75,10 +126,8 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc) |
176 |
return -1; |
177 |
} |
178 |
|
179 |
- ret = smb_krb5_kt_open(context, NULL, True, &keytab); |
180 |
- if (ret) { |
181 |
- DEBUG(1, ("smb_krb5_kt_open failed (%s)\n", |
182 |
- error_message(ret))); |
183 |
+ ret = ads_keytab_open(context, &keytab); |
184 |
+ if (ret != 0) { |
185 |
goto out; |
186 |
} |
187 |
|
188 |
@@ -262,10 +311,8 @@ int ads_keytab_flush(ADS_STRUCT *ads) |
189 |
return ret; |
190 |
} |
191 |
|
192 |
- ret = smb_krb5_kt_open(context, NULL, True, &keytab); |
193 |
- if (ret) { |
194 |
- DEBUG(1, ("smb_krb5_kt_open failed (%s)\n", |
195 |
- error_message(ret))); |
196 |
+ ret = ads_keytab_open(context, &keytab); |
197 |
+ if (ret != 0) { |
198 |
goto out; |
199 |
} |
200 |
|
201 |
@@ -447,10 +494,8 @@ int ads_keytab_create_default(ADS_STRUCT *ads) |
202 |
DEBUG(3, (__location__ ": Searching for keytab entries to preserve " |
203 |
"and update.\n")); |
204 |
|
205 |
- ret = smb_krb5_kt_open(context, NULL, True, &keytab); |
206 |
- if (ret) { |
207 |
- DEBUG(1, ("smb_krb5_kt_open failed (%s)\n", |
208 |
- error_message(ret))); |
209 |
+ ret = ads_keytab_open(context, &keytab); |
210 |
+ if (ret != 0) { |
211 |
goto done; |
212 |
} |
213 |
|
214 |
-- |
215 |
2.12.0 |
216 |
|
217 |
|
218 |
From d755048c0797e1c88382d63ae90e6ca0dceebb71 Mon Sep 17 00:00:00 2001 |
219 |
From: Andreas Schneider <asn@samba.org> |
220 |
Date: Mon, 13 Mar 2017 17:28:58 +0100 |
221 |
Subject: [PATCH 4/5] param: Allow to specify kerberos method on the |
222 |
commandline |
223 |
|
224 |
We support --option for our tools but you cannot set an option where the |
225 |
value of the option includes a space. |
226 |
|
227 |
Signed-off-by: Andreas Schneider <asn@samba.org> |
228 |
Reviewed-by: Andrew Bartlet <abartlet@samba.org> |
229 |
(cherry picked from commit 12d26899a45ce5d05ac4279fa5915318daa4f2e0) |
230 |
--- |
231 |
lib/param/param_table.c | 4 ++++ |
232 |
1 file changed, 4 insertions(+) |
233 |
|
234 |
diff --git a/lib/param/param_table.c b/lib/param/param_table.c |
235 |
index 4b5234a7c9e..9a944ef19b3 100644 |
236 |
--- a/lib/param/param_table.c |
237 |
+++ b/lib/param/param_table.c |
238 |
@@ -202,9 +202,13 @@ static const struct enum_list enum_smbd_profiling_level[] = { |
239 |
static const struct enum_list enum_kerberos_method[] = { |
240 |
{KERBEROS_VERIFY_SECRETS, "default"}, |
241 |
{KERBEROS_VERIFY_SECRETS, "secrets only"}, |
242 |
+ {KERBEROS_VERIFY_SECRETS, "secretsonly"}, |
243 |
{KERBEROS_VERIFY_SYSTEM_KEYTAB, "system keytab"}, |
244 |
+ {KERBEROS_VERIFY_SYSTEM_KEYTAB, "systemkeytab"}, |
245 |
{KERBEROS_VERIFY_DEDICATED_KEYTAB, "dedicated keytab"}, |
246 |
+ {KERBEROS_VERIFY_DEDICATED_KEYTAB, "dedicatedkeytab"}, |
247 |
{KERBEROS_VERIFY_SECRETS_AND_KEYTAB, "secrets and keytab"}, |
248 |
+ {KERBEROS_VERIFY_SECRETS_AND_KEYTAB, "secretsandkeytab"}, |
249 |
{-1, NULL} |
250 |
}; |
251 |
|
252 |
-- |
253 |
2.12.0 |
254 |
|
255 |
|
256 |
From 1916ab4c51bdde58480259d4b45dbcf9c0c46842 Mon Sep 17 00:00:00 2001 |
257 |
From: Andreas Schneider <asn@samba.org> |
258 |
Date: Mon, 13 Mar 2017 16:34:05 +0100 |
259 |
Subject: [PATCH 5/5] testprogs: Test 'net ads join' with a dedicated keytab |
260 |
|
261 |
This checks that a 'net ads join' can create the keytab and make sure we |
262 |
will not regress in future. |
263 |
|
264 |
Signed-off-by: Andreas Schneider <asn@samba.org> |
265 |
Reviewed-by: Andrew Bartlet <abartlet@samba.org> |
266 |
(cherry picked from commit 00e22fe3f63f986978d946e063e19e615cb00ab3) |
267 |
--- |
268 |
testprogs/blackbox/test_net_ads.sh | 9 +++++++++ |
269 |
1 file changed, 9 insertions(+) |
270 |
|
271 |
diff --git a/testprogs/blackbox/test_net_ads.sh b/testprogs/blackbox/test_net_ads.sh |
272 |
index 8e915cdcf1f..99b886f53eb 100755 |
273 |
--- a/testprogs/blackbox/test_net_ads.sh |
274 |
+++ b/testprogs/blackbox/test_net_ads.sh |
275 |
@@ -35,6 +35,15 @@ testit "testjoin" $VALGRIND $net_tool ads testjoin -kP || failed=`expr $failed + |
276 |
|
277 |
testit "leave" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1` |
278 |
|
279 |
+# Test with kerberos method = secrets and keytab |
280 |
+dedicated_keytab_file="$PREFIX_ABS/test_net_ads_dedicated_krb5.keytab" |
281 |
+testit "join (decicated keytab)" $VALGRIND $net_tool ads join -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1` |
282 |
+ |
283 |
+testit "testjoin (dedicated keytab)" $VALGRIND $net_tool ads testjoin -kP || failed=`expr $failed + 1` |
284 |
+ |
285 |
+testit "leave (dedicated keytab)" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1` |
286 |
+rm -f $dedicated_keytab_file |
287 |
+ |
288 |
testit_expect_failure "testjoin(not joined)" $VALGRIND $net_tool ads testjoin -kP || failed=`expr $failed + 1` |
289 |
|
290 |
testit "join+kerberos" $VALGRIND $net_tool ads join -kU$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1` |
291 |
-- |
292 |
2.12.0 |
293 |
|