Attachment 18852 Details for Bug 15789 – patch for 4-22-test through to v4-24-test

[patch] patch for 4-22-test through to v4-24-test

bug15789.patch (text/plain), 8.04 KB, created by Noel Power on 2026-02-18 14:38:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Noel Power

Created: 2026-02-18 14:38:28 UTC

Size: 8.04 KB

patch

obsolete

>From c0a8ad25f0e0348febf4208552b0f1fabc524824 Mon Sep 17 00:00:00 2001
>From: Noel Power <noel.power@suse.com>
>Date: Fri, 13 Feb 2026 11:54:46 +0000
>Subject: [PATCH 1/4] selftest: Update tests to use
> --use-kereros=desired|required no creds
>
>Add tests to call smbclient without passing credentials to
>demonstrate failure with --use-kereros=desired
>
>Also add knownfail
>
>Signed-off-by: Noel Power <noel.power@suse.com>
>Reviewed-by: Andreas Schneider <asn@samba.org>
>(cherry picked from commit a22af9420965083b99b956477d1833000b7f2414)
>---
> selftest/knownfail                              |  2 ++
> source3/script/tests/test_smbclient_kerberos.sh | 12 ++++++++++++
> 2 files changed, 14 insertions(+)
>
>diff --git a/selftest/knownfail b/selftest/knownfail
>index ab2d79d7114..f0a5f7bb935 100644
>--- a/selftest/knownfail
>+++ b/selftest/knownfail
>@@ -315,6 +315,8 @@
> # ad_member don't support ntlmv1 (not even over SMB1)
> ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*ad_member
> ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*ad_member
>+# regression smbclient using --use-kerberos=desired https://bugzilla.samba.org/show_bug.cgi?id=15789
>+samba3.blackbox.smbclient.kerberos.smbclient.smb3.kerberos.desired $no user/pass$.*
> #nt-vfs server blocks read with execute access
> ^samba4.smb2.read.access
> #ntvfs server blocks copychunk with execute access on read handle
>diff --git a/source3/script/tests/test_smbclient_kerberos.sh b/source3/script/tests/test_smbclient_kerberos.sh
>index 31678d17e28..1139efd70d7 100755
>--- a/source3/script/tests/test_smbclient_kerberos.sh
>+++ b/source3/script/tests/test_smbclient_kerberos.sh
>@@ -73,6 +73,18 @@ test_smbclient "smbclient.smb3.kerberos.desired[//${SERVER}/tmp]" \
> 	--use-kerberos=desired -U${USERNAME}%${PASSWORD} -mSMB3 ||
> 	failed=$(expr $failed + 1)
> 
>+test_smbclient "smbclient.smb3.kerberos.desired (no user/pass) [//${SERVER}/tmp]" \
>+	"ls; quit" //${SERVER}/tmp \
>+	--use-kerberos=desired -mSMB3 ||
>+	failed=$(expr $failed + 1)
>+
>+test_smbclient "smbclient.smb3.kerberos.required (no user/pass) [//${SERVER}/tmp]" \
>+	"ls; quit" //${SERVER}/tmp \
>+	--use-kerberos=required -mSMB3 ||
>+	failed=$(expr $failed + 1)
>+
>+
>+
> $samba_kdestroy
> 
> rm -rf $KRB5CCNAME_PATH
>-- 
>2.51.0
>
>
>From 9a54e43b2db91d4419877d746da4dee3c172335a Mon Sep 17 00:00:00 2001
>From: Noel Power <noel.power@suse.com>
>Date: Mon, 19 Jan 2026 15:46:59 +0000
>Subject: [PATCH 2/4] auth/credentials: Fix regression with
> --use-kerberos=desired for smbclient
>
>As part of the gse_krb5 processing the following call chain
>
>gensec_gse_client_start()
>  ---> gensec_kerberos_possible()
>         ---> cli_credentials_authentication_requested()
>
>gensec_kerberos_possible()  will always fail when
>cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED
>
>It seems since use kerberos == desired is the default that it isn't
>necessary to see if credentials were modified to indicated authentication
>was requested. gensec_kerberos_possible() should afaics return true
>if kerberos is desired OR required (regardless of whether credentials
>were requested)
>
>This commit removes the knownfail associated with this bug.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789
>Signed-off-by: <noel.power@suse.com>
>Reviewed-by: Andreas Schneider <asn@samba.org>
>(cherry picked from commit 88f42eb222f299189d5f5f8204ae353e63a50970)
>---
> auth/gensec/gensec_util.c | 5 -----
> selftest/knownfail        | 2 --
> 2 files changed, 7 deletions(-)
>
>diff --git a/auth/gensec/gensec_util.c b/auth/gensec/gensec_util.c
>index 0c7688d33d2..af6d198d48f 100644
>--- a/auth/gensec/gensec_util.c
>+++ b/auth/gensec/gensec_util.c
>@@ -362,7 +362,6 @@ char *gensec_get_unparsed_target_principal(struct gensec_security *gensec_securi
> NTSTATUS gensec_kerberos_possible(struct gensec_security *gensec_security)
> {
> 	struct cli_credentials *creds = gensec_get_credentials(gensec_security);
>-	bool auth_requested = cli_credentials_authentication_requested(creds);
> 	enum credentials_use_kerberos krb5_state =
> 		cli_credentials_get_kerberos_state(creds);
> 	char *user_principal = NULL;
>@@ -370,10 +369,6 @@ NTSTATUS gensec_kerberos_possible(struct gensec_security *gensec_security)
> 	const char *target_principal = gensec_get_target_principal(gensec_security);
> 	const char *hostname = gensec_get_target_hostname(gensec_security);
> 
>-	if (!auth_requested) {
>-		return NT_STATUS_INVALID_PARAMETER;
>-	}
>-
> 	if (krb5_state == CRED_USE_KERBEROS_DISABLED) {
> 		return NT_STATUS_INVALID_PARAMETER;
> 	}
>diff --git a/selftest/knownfail b/selftest/knownfail
>index f0a5f7bb935..ab2d79d7114 100644
>--- a/selftest/knownfail
>+++ b/selftest/knownfail
>@@ -315,8 +315,6 @@
> # ad_member don't support ntlmv1 (not even over SMB1)
> ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*ad_member
> ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*ad_member
>-# regression smbclient using --use-kerberos=desired https://bugzilla.samba.org/show_bug.cgi?id=15789
>-samba3.blackbox.smbclient.kerberos.smbclient.smb3.kerberos.desired $no user/pass$.*
> #nt-vfs server blocks read with execute access
> ^samba4.smb2.read.access
> #ntvfs server blocks copychunk with execute access on read handle
>-- 
>2.51.0
>
>
>From 16fc0790a766d1e64295e982499983d03500deb3 Mon Sep 17 00:00:00 2001
>From: Noel Power <noel.power@suse.com>
>Date: Mon, 19 Jan 2026 16:10:10 +0000
>Subject: [PATCH 3/4] s3/libsmb: cli_session_creds_init fails when kerberos is
> desired
>
>There is a regression with code using cli_session_creds_init when
>cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED
>
>Authentication succeeds when boolean fallback_after_kerberos is false
>and fails when true.
>There doesn't seem to be a good reason why the value of
>fallback_after_kerberos should initialise the krb5 ccache or not.
>It would seems that krb5 cache should be setup for creds
>for *any* kerberos auth (whether fallback is enabled or not)
>
>Partial patch from <will69@gmx.de> (see bug referenced below)
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789
>Signed-off-by: Noel Power <noel.power@suse.com>
>Reviewed-by: Andreas Schneider <asn@samba.org>
>(cherry picked from commit 1c48599105736499d18aa1f647bce9e1f8dbdcca)
>---
> source3/libsmb/cliconnect.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
>index c7c22c18810..0bcbf532873 100644
>--- a/source3/libsmb/cliconnect.c
>+++ b/source3/libsmb/cliconnect.c
>@@ -218,7 +218,7 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx,
> 				goto fail;
> 			}
> 		}
>-	} else if (use_kerberos && !fallback_after_kerberos) {
>+	} else if (use_kerberos) {
> 		const char *error_string = NULL;
> 		int rc;
> 
>-- 
>2.51.0
>
>
>From 853fbec92db69436e1f077c6621f3196b6bd0df9 Mon Sep 17 00:00:00 2001
>From: Noel Power <noel.power@suse.com>
>Date: Mon, 19 Jan 2026 16:18:02 +0000
>Subject: [PATCH 4/4] s3/libsmb: block anon authentication fallback is
> use-kerberos = desired
>
>When cli_credentials_get_kerberos_state returns CRED_USE_KERBEROS_REQUIRED
>libsmbclient method SMBC_server_internal will still try to fallback to
>anon NTLM. This patch prevents that.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789
>Signed-off-by: Noel Power <noel.power@suse.com>
>Reviewed-by: Andreas Schneider <asn@samba.org>
>
>Autobuild-User(master): Noel Power <npower@samba.org>
>Autobuild-Date(master): Tue Feb 17 16:06:18 UTC 2026 on atb-devel-224
>
>(cherry picked from commit bc868800276fe09cbcb206ebe4cb4da32af7599f)
>---
> source3/libsmb/libsmb_server.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c
>index 7b1def05f0b..46887d9d33e 100644
>--- a/source3/libsmb/libsmb_server.c
>+++ b/source3/libsmb/libsmb_server.c
>@@ -617,6 +617,8 @@ SMBC_server_internal(TALLOC_CTX *ctx,
> 		password_used = "";
> 
>                 if (smbc_getOptionNoAutoAnonymousLogin(context) ||
>+		    cli_credentials_get_kerberos_state(creds) ==
>+			    CRED_USE_KERBEROS_REQUIRED ||
> 		    !NT_STATUS_IS_OK(cli_session_setup_anon(c))) {
> 
>                         cli_shutdown(c);
>-- 
>2.51.0
>

Flags:

asn: review+

Actions: View

Attachments on bug 15789: 18537 | 18852