The Samba-Bugzilla – Attachment 15533 Details for
Bug 14155
kpasswd fails when built with MIT Kerberos
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
patch for 4.10
v4.10.patch (text/plain), 3.46 KB, created by
Andreas Schneider
on 2019-10-14 08:17:38 UTC
(
hide
)
Description:
patch for 4.10
Filename:
MIME Type:
Creator:
Andreas Schneider
Created:
2019-10-14 08:17:38 UTC
Size:
3.46 KB
patch
obsolete
>From c5bfb862f3026da251ced0a214b071804a758c69 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Wed, 9 Oct 2019 20:11:03 +0200 >Subject: [PATCH 1/2] lib:krb5_wrap: Do not create a temporary file for MEMORY > keytabs > >The autobuild cleanup script fails with: > >The tree has 3 new uncommitted files!!! >git clean -n >Would remove MEMORY:tmp_smb_creds_SK98Lv >Would remove MEMORY:tmp_smb_creds_kornU6 >Would remove MEMORY:tmp_smb_creds_ljR828 > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit d888655244b4d8ec7a69a042e0ff3c074585b0de) >--- > lib/krb5_wrap/krb5_samba.c | 16 ++++++++-------- > 1 file changed, 8 insertions(+), 8 deletions(-) > >diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c >index abdcb308728..6ce1d09952e 100644 >--- a/lib/krb5_wrap/krb5_samba.c >+++ b/lib/krb5_wrap/krb5_samba.c >@@ -2002,21 +2002,21 @@ krb5_error_code smb_krb5_kinit_keyblock_ccache(krb5_context ctx, > krb_options); > #elif defined(HAVE_KRB5_GET_INIT_CREDS_KEYTAB) > { >-#define SMB_CREDS_KEYTAB "MEMORY:tmp_smb_creds_XXXXXX" >- char tmp_name[sizeof(SMB_CREDS_KEYTAB)]; >+#define SMB_CREDS_KEYTAB "MEMORY:tmp_kinit_keyblock_ccache" >+ char tmp_name[64] = {0}; > krb5_keytab_entry entry; > krb5_keytab keytab; >- mode_t mask; >+ int rc; > > memset(&entry, 0, sizeof(entry)); > entry.principal = principal; > *(KRB5_KT_KEY(&entry)) = *keyblock; > >- memcpy(tmp_name, SMB_CREDS_KEYTAB, sizeof(SMB_CREDS_KEYTAB)); >- mask = umask(S_IRWXO | S_IRWXG); >- mktemp(tmp_name); >- umask(mask); >- if (tmp_name[0] == 0) { >+ rc = snprintf(tmp_name, sizeof(tmp_name), >+ "%s-%p", >+ SMB_CREDS_KEYTAB, >+ &my_creds); >+ if (rc < 0) { > return KRB5_KT_BADNAME; > } > code = krb5_kt_resolve(ctx, tmp_name, &keytab); >-- >2.23.0 > > >From 57b46362fceb7cf1ae13485b9399d99d91077898 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Wed, 9 Oct 2019 16:32:47 +0200 >Subject: [PATCH 2/2] s3:libads: Do not turn on canonicalization flag for MIT > Kerberos > >This partially reverts 303b7e59a286896888ee2473995fc50bb2b5ce5e. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14155 > >Pair-Programmed-With: Isaac Boukris <iboukris@redhat.com> > >Signed-off-by: Andreas Schneider <asn@samba.org> >Signed-off-by: Isaac Boukris <iboukris@redhat.com> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit 123584294cfd153acc2d9a5be9d71c395c847a25) >(cherry picked from commit 2d17adb1d8ca727258ae79c8bfa69c7f5b0c5560) >--- > source3/libads/krb5_setpw.c | 15 +++++++++++++++ > 1 file changed, 15 insertions(+) > >diff --git a/source3/libads/krb5_setpw.c b/source3/libads/krb5_setpw.c >index 67bc2f4640d..028b0dcfa65 100644 >--- a/source3/libads/krb5_setpw.c >+++ b/source3/libads/krb5_setpw.c >@@ -207,7 +207,22 @@ static ADS_STATUS ads_krb5_chg_password(const char *kdc_host, > krb5_get_init_creds_opt_set_win2k(context, opts, true); > krb5_get_init_creds_opt_set_canonicalize(context, opts, true); > #else /* MIT */ >+#if 0 >+ /* >+ * FIXME >+ * >+ * Due to an upstream MIT Kerberos bug, this feature is not >+ * not working. Affection versions (2019-10-09): <= 1.17 >+ * >+ * Reproducer: >+ * kinit -C aDmInIsTrAtOr@ACME.COM -S kadmin/changepw@ACME.COM >+ * >+ * This is NOT a problem if the service is a krbtgt. >+ * >+ * https://bugzilla.samba.org/show_bug.cgi?id=14155 >+ */ > krb5_get_init_creds_opt_set_canonicalize(opts, true); >+#endif > #endif /* MIT */ > > /* note that heimdal will fill in the local addresses if the addresses >-- >2.23.0 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 14155
:
15532
|
15533
|
15534