CVE-2022-38023 selftest:Samba4: avoid global 'allow nt4 crypto = yes' and 'reject...

Instead of using the generic deprecated option use the specific
allow nt4 crypto:COMPUTERACCOUNT = yes and
server reject md5 schannel:COMPUTERACCOUNT = no
in order to allow legacy tests for pass.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(backported from commit 7ae3735810c2db32fa50f309f8af3c76ffa29768)

diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 8ed5db6b6a5ed7fe7b7861ae06a4fe409a3813bc..4a4b594c7edaf7f54f9aa665f34aca6902998275 100755 (executable)
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -1570,7 +1570,6 @@ sub provision_ad_dc_ntvfs($$$)
         my $extra_conf_options = "netbios aliases = localDC1-a
         server services = +winbind -winbindd
        ldap server require strong auth = allow_sasl_over_tls
-       allow nt4 crypto = yes
        raw NTLMv2 auth = yes
        lsa over netlogon = yes
         rpc server port = 1027
@@ -1579,9 +1578,19 @@ sub provision_ad_dc_ntvfs($$$)
        dsdb password event notification = true
        dsdb group change notification = true
 
-       reject md5 clients = no
-
        CVE_2020_1472:warn_about_unused_debug_level = 3
+       CVE_2022_38023:warn_about_unused_debug_level = 3
+       allow nt4 crypto:torturetest\$ = yes
+       server reject md5 schannel:schannel2\$ = no
+       server reject md5 schannel:schannel3\$ = no
+       server reject md5 schannel:schannel8\$ = no
+       server reject md5 schannel:schannel9\$ = no
+       server reject md5 schannel:torturetest\$ = no
+       server reject md5 schannel:tests4u2proxywk\$ = no
+       server reject md5 schannel:tests4u2selfbdc\$ = no
+       server reject md5 schannel:tests4u2selfwk\$ = no
+       server reject md5 schannel:torturepacbdc\$ = no
+       server reject md5 schannel:torturepacwksta\$ = no
        server require schannel:schannel0\$ = no
        server require schannel:schannel1\$ = no
        server require schannel:schannel2\$ = no
@@ -1634,6 +1643,13 @@ sub provision_fl2000dc($$)
        my $extra_conf_options = "
        spnego:simulate_w2k=yes
        ntlmssp_server:force_old_spnego=yes
+
+       CVE_2022_38023:warn_about_unused_debug_level = 3
+       server reject md5 schannel:tests4u2proxywk\$ = no
+       server reject md5 schannel:tests4u2selfbdc\$ = no
+       server reject md5 schannel:tests4u2selfwk\$ = no
+       server reject md5 schannel:torturepacbdc\$ = no
+       server reject md5 schannel:torturepacwksta\$ = no
 ";
        my $extra_provision_options = ["--use-ntvfs", "--base-schema=2008_R2"];
        # This environment uses plain text secrets
@@ -1676,7 +1692,16 @@ sub provision_fl2003dc($$$)
        my $extra_conf_options = "allow dns updates = nonsecure and secure
        dcesrv:header signing = no
        dcesrv:max auth states = 0
-       dns forwarder = $ip_addr1 $ip_addr2";
+       dns forwarder = $ip_addr1 $ip_addr2
+
+       CVE_2022_38023:warn_about_unused_debug_level = 3
+       server reject md5 schannel:tests4u2proxywk\$ = no
+       server reject md5 schannel:tests4u2selfbdc\$ = no
+       server reject md5 schannel:tests4u2selfwk\$ = no
+       server reject md5 schannel:torturepacbdc\$ = no
+       server reject md5 schannel:torturepacwksta\$ = no
+";
+
        my $extra_provision_options = ["--use-ntvfs", "--base-schema=2008_R2"];
        my $ret = $self->provision($prefix,
                                   "domain controller",
@@ -1726,7 +1751,16 @@ sub provision_fl2008r2dc($$$)
        my ($self, $prefix, $dcvars) = @_;
 
        print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
-        my $extra_conf_options = "ldap server require strong auth = no";
+       my $extra_conf_options = "
+       ldap server require strong auth = no
+
+       CVE_2022_38023:warn_about_unused_debug_level = 3
+       server reject md5 schannel:tests4u2proxywk\$ = no
+       server reject md5 schannel:tests4u2selfbdc\$ = no
+       server reject md5 schannel:tests4u2selfwk\$ = no
+       server reject md5 schannel:torturepacbdc\$ = no
+       server reject md5 schannel:torturepacwksta\$ = no
+";
        my $extra_provision_options = ["--use-ntvfs", "--base-schema=2008_R2"];
        my $ret = $self->provision($prefix,
                                   "domain controller",
@@ -1930,9 +1964,20 @@ sub provision_ad_dc($$$$$$)
        lpq cache time = 0
        print notify backchannel = yes
 
-       reject md5 clients = no
-
        CVE_2020_1472:warn_about_unused_debug_level = 3
+       CVE_2022_38023:warn_about_unused_debug_level = 3
+       CVE_2022_38023:error_debug_level = 2
+       server reject md5 schannel:schannel2\$ = no
+       server reject md5 schannel:schannel3\$ = no
+       server reject md5 schannel:schannel8\$ = no
+       server reject md5 schannel:schannel9\$ = no
+       server reject md5 schannel:torturetest\$ = no
+       server reject md5 schannel:tests4u2proxywk\$ = no
+       server reject md5 schannel:tests4u2selfbdc\$ = no
+       server reject md5 schannel:tests4u2selfwk\$ = no
+       server reject md5 schannel:torturepacbdc\$ = no
+       server reject md5 schannel:torturepacwksta\$ = no
+       server reject md5 schannel:samlogontest\$ = no
        server require schannel:schannel0\$ = no
        server require schannel:schannel1\$ = no
        server require schannel:schannel2\$ = no