CVE-2022-37966 s4:kdc: Set supported enctypes in KDC entry

This allows us to return the supported enctypes to the client as
PA-SUPPORTED-ENCTYPES padata.

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit cb382f7cddebabde3dac2b4bdb50d5b864463abf)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237
[jsutton@samba.org Adapted to Samba 4.15; removed FAST-supported bit for
 KDC]
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index cfa2097acbd476391b2c1847f6b7a4a2f694ebb9..ec696bf53b8fb1bc660bdc58b4b09ff29e7324eb 100644 (file)
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -324,7 +324,8 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
                                                    bool is_rodc,
                                                    uint32_t userAccountControl,
                                                    enum samba_kdc_ent_type ent_type,
-                                                   struct sdb_entry_ex *entry_ex)
+                                                   struct sdb_entry_ex *entry_ex,
+                                                   uint32_t *supported_enctypes_out)
 {
        struct sdb_entry *entry = &entry_ex->entry;
        krb5_error_code ret = 0;
@@ -347,6 +348,7 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
                = ldb_msg_find_attr_as_uint(msg,
                                            "msDS-SupportedEncryptionTypes",
                                            0);
+       *supported_enctypes_out = 0;
 
        if (rid == DOMAIN_RID_KRBTGT || is_rodc) {
                /* KDCs (and KDCs on RODCs) use AES */
@@ -460,6 +462,8 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
                        entry_ex->entry.keys.len++;
                }
 
+               *supported_enctypes_out = supported_enctypes;
+
                ret = 0;
                goto out;
        }
@@ -610,15 +614,19 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
 
                entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
                entry_ex->entry.keys.len++;
+
+               *supported_enctypes_out |= ENC_RC4_HMAC_MD5;
        }
 
        if (pkb4) {
                for (i=0; i < pkb4->num_keys; i++) {
                        struct sdb_key key = {};
+                       uint32_t enctype_bit;
 
                        if (!pkb4->keys[i].value) continue;
 
-                       if (!(kerberos_enctype_to_bitmap(pkb4->keys[i].keytype) & supported_enctypes)) {
+                       enctype_bit = kerberos_enctype_to_bitmap(pkb4->keys[i].keytype);
+                       if (!(enctype_bit & supported_enctypes)) {
                                continue;
                        }
 
@@ -669,14 +677,18 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
 
                        entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
                        entry_ex->entry.keys.len++;
+
+                       *supported_enctypes_out |= enctype_bit;
                }
        } else if (pkb3) {
                for (i=0; i < pkb3->num_keys; i++) {
                        struct sdb_key key = {};
+                       uint32_t enctype_bit;
 
                        if (!pkb3->keys[i].value) continue;
 
-                       if (!(kerberos_enctype_to_bitmap(pkb3->keys[i].keytype) & supported_enctypes)) {
+                       enctype_bit = kerberos_enctype_to_bitmap(pkb3->keys[i].keytype);
+                       if (!(enctype_bit & supported_enctypes)) {
                                continue;
                        }
 
@@ -725,9 +737,16 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
 
                        entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
                        entry_ex->entry.keys.len++;
+
+                       *supported_enctypes_out |= enctype_bit;
                }
        }
 
+       /* Set FAST support bits */
+       *supported_enctypes_out |= supported_enctypes & (ENC_FAST_SUPPORTED |
+                                                        ENC_COMPOUND_IDENTITY_SUPPORTED |
+                                                        ENC_CLAIMS_SUPPORTED);
+
        returned_kvno = current_kvno;
        if (is_krbtgt) {
                /*
@@ -957,6 +976,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
        krb5_boolean is_computer = FALSE;
 
        struct samba_kdc_entry *p;
+       uint32_t supported_enctypes = 0;
        NTTIME acct_expiry;
        NTSTATUS status;
 
@@ -1259,13 +1279,14 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
        /* Get keys from the db */
        ret = samba_kdc_message2entry_keys(context, kdc_db_ctx, p, msg,
                                           rid, is_rodc, userAccountControl,
-                                          ent_type, entry_ex);
+                                          ent_type, entry_ex, &supported_enctypes);
        if (ret) {
                /* Could be bogus data in the entry, or out of memory */
                goto out;
        }
 
        p->msg = talloc_steal(p, msg);
+       p->supported_enctypes = supported_enctypes;
 
 out:
        if (ret != 0) {
@@ -1406,6 +1427,7 @@ static krb5_error_code samba_kdc_trust_message2entry(krb5_context context,
        p->is_trust = true;
        p->kdc_db_ctx = kdc_db_ctx;
        p->realm_dn = realm_dn;
+       p->supported_enctypes = supported_enctypes;
 
        talloc_set_destructor(p, samba_kdc_entry_destructor);
 

diff --git a/source4/kdc/samba_kdc.h b/source4/kdc/samba_kdc.h
index 8010d7c35ed05b14da2cafa70be3b61b76b755a1..29ccad34c0cff3e2e3732f65570c2198fe4457eb 100644 (file)
--- a/source4/kdc/samba_kdc.h
+++ b/source4/kdc/samba_kdc.h
@@ -58,6 +58,7 @@ struct samba_kdc_entry {
        bool is_rodc;
        bool is_trust;
        void *entry_ex;
+       uint32_t supported_enctypes;
 };
 
 extern struct hdb_method hdb_samba4_interface;