Changeset 989 for vendor/current/auth

Timestamp:

Nov 25, 2016, 8:04:54 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.7

Location:

vendor/current/auth

Files:

• gensec/spnego.c (modified) (5 diffs)
• kerberos/gssapi_pac.c (modified) (4 diffs)

vendor/current/auth/gensec/spnego.c

@@ -55 +55 @@
         DATA_BLOB mech_types;
         size_t num_targs;
+        bool downgraded;
         bool mic_requested;
         bool needs_mic_sign;
         bool needs_mic_check;
+        bool may_skip_mic_check;
         bool done_mic_check;
 
@@ -434 +436 @@
                                          * mic.
                                          */
+                                        spnego_state->downgraded = true;
                                         spnego_state->mic_requested = true;
                                         break;
@@ -1078 +1081 @@
                                  gensec_get_name_by_oid(gensec_security, spnego_state->neg_oid),
                                  gensec_get_name_by_oid(gensec_security, spnego.negTokenTarg.supportedMech)));
-
+                        spnego_state->downgraded = true;
                         spnego_state->no_response_expected = false;
                         talloc_free(spnego_state->sub_sec_security);
@@ -1133 +1136 @@
                                 spnego_free_data(&spnego);
                                 return NT_STATUS_INVALID_PARAMETER;
+                        }
+
+                        if (spnego.negTokenTarg.mechListMIC.length == 0
+                            && spnego_state->may_skip_mic_check) {
+                                /*
+                                 * In this case we don't require
+                                 * a mechListMIC from the server.
+                                 *
+                                 * This works around bugs in the Azure
+                                 * and Apple spnego implementations.
+                                 *
+                                 * See
+                                 * https://bugzilla.samba.org/show_bug.cgi?id=11994
+                                 */
+                                spnego_state->needs_mic_check = false;
+                                nt_status = NT_STATUS_OK;
+                                goto client_response;
                         }
 
@@ -1190 +1210 @@
                                         new_spnego = false;
                                 }
+
                                 break;
 
                         case SPNEGO_ACCEPT_INCOMPLETE:
+                                if (spnego.negTokenTarg.mechListMIC.length > 0) {
+                                        new_spnego = true;
+                                        break;
+                                }
+
+                                if (spnego_state->downgraded) {
+                                        /*
+                                         * A downgrade should be protected if
+                                         * supported
+                                         */
+                                        break;
+                                }
+
+                                /*
+                                 * The caller may just asked for
+                                 * GENSEC_FEATURE_SESSION_KEY, this
+                                 * is only reflected in the want_features.
+                                 *
+                                 * As it will imply
+                                 * gensec_have_features(GENSEC_FEATURE_SIGN)
+                                 * to return true.
+                                 */
+                                if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
+                                        break;
+                                }
+                                if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
+                                        break;
+                                }
+                                /*
+                                 * Here we're sure our preferred mech was
+                                 * selected by the server and our caller doesn't
+                                 * need GENSEC_FEATURE_SIGN nor
+                                 * GENSEC_FEATURE_SEAL support.
+                                 *
+                                 * In this case we don't require
+                                 * a mechListMIC from the server.
+                                 *
+                                 * This works around bugs in the Azure
+                                 * and Apple spnego implementations.
+                                 *
+                                 * See
+                                 * https://bugzilla.samba.org/show_bug.cgi?id=11994
+                                 */
+                                spnego_state->may_skip_mic_check = true;
+                                break;
+
                         case SPNEGO_REQUEST_MIC:
                                 if (spnego.negTokenTarg.mechListMIC.length > 0) {

vendor/current/auth/kerberos/gssapi_pac.c

@@ -247 +247 @@
                 const uint8_t *p;
 
+                *keytype = 0;
                 if (set->count < 2) {
 
@@ -257 +258 @@
                                 *keytype = KRB5_KEY_TYPE(subkey);
                                 krb5_free_keyblock(NULL /* should be krb5_context */, subkey);
-                        } else
-#else
-                        {
-                                *keytype = 0;
                         }
 #endif
@@ -271 +268 @@
                                   gse_sesskeytype_oid.length) != 0) {
                         /* Perhaps a non-krb5 session key */
-                        *keytype = 0;
                         gss_maj = gss_release_buffer_set(&gss_min, &set);
                         return NT_STATUS_OK;
@@ -281 +277 @@
                         return NT_STATUS_INVALID_PARAMETER;
                 }
-                *keytype = 0;
                 for (i = 0; i < diflen; i++) {
                         *keytype = (*keytype << 7) | (p[i] & 0x7f);