Merge ~ahasenack/ubuntu/+source/samba:jammy-samba-win-22h2-fixes into ubuntu/+source/samba:ubuntu/jammy-devel

[Andreas Hasenack]

Fix for Windows 11 22H2 failing to join a Samba AD DC domain. The linked SRU bug has a test plan and more details on the bug.

If you want to follow that test plan, we have the necessary VM created on diglett. You can point virt-manager at qemu+ssh://<youruser>@diglett/system and see:

- win11H22: the Windows 11 22H22 VM that shows the bug. Creds: ubuntu_local/Passw0rd!ub (is an admin) for when NOT joined to a domain. This is on DHCP, current IP is 10.0.18.201 and RDP is enabled.
Note that after joining the domain, RDP access is cut off. You have to login as Administrator and allow the "Domain Users" group to use RDP. I didn't find a way to allow this from the samba AD DC, but didn't search really hard.

Ubuntu VMs, where you can (re)install samba packages at will. They are pointing at my PPA with the fix, so if you want to see the bug, you have to downgrade them to the non-ppa version. These all can be logged in via the virt-manager console, creds ubuntu/ubuntu, and from there you can ssh-import your key.
- ad: jammy AD. Fixed IP at 10.0.18.5
- b-ad: bionic AD. Fixed IP at 10.0.18.3
- f-ad: focal AD. Fixed IP at 10.0.18.2

Libvirt network: 10.0.18.0/24

If you want, we can have a hangout where I can show all of this.

PPA: https://launchpad.net/~ahasenack/+archive/ubuntu/samba-22h2/

[Lucas Kanashiro (lucaskanashiro)]

This is missing the new changelog entry.

review: Needs Fixing

[Lucas Kanashiro (lucaskanashiro)]

The patch DEP-3 headers are missing as well.

[Andreas Hasenack (ahasenack)]

Hmpf, forgot to push

$ git push ahasenack jammy-samba-win-22h2-fixes --force-with-lease
Enumerating objects: 15, done.
Counting objects: 100% (15/15), done.
Delta compression using up to 4 threads
Compressing objects: 100% (10/10), done.
Writing objects: 100% (10/10), 4.46 KiB | 652.00 KiB/s, done.
Total 10 (delta 7), reused 0 (delta 0), pack-reused 0
remote:
remote: Create a merge proposal for 'jammy-samba-win-22h2-fixes' on Launchpad by visiting:
remote: https://code.launchpad.net/~ahasenack/ubuntu/+source/samba/+git/samba/+ref/jammy-samba-win-22h2-fixes/+register-merge
remote:
To ssh://git.launchpad.net/~ahasenack/ubuntu/+source/samba
 + dcf4cec77b0...f8095f8db45 jammy-samba-win-22h2-fixes -> jammy-samba-win-22h2-fixes (forced update)

[Lucas Kanashiro (lucaskanashiro)]

Thanks Andreas, LGTM.

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, uploaded:

Uploading samba_4.15.9+dfsg-0ubuntu0.3.dsc
Uploading samba_4.15.9+dfsg-0ubuntu0.3.debian.tar.xz
Uploading samba_4.15.9+dfsg-0ubuntu0.3_source.buildinfo
Uploading samba_4.15.9+dfsg-0ubuntu0.3_source.changes

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, lucaskanashiro
Uploaders: ahasenack, lucaskanashiro
MP auto-approved

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 3a44200..878e4f3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+samba (2:4.15.9+dfsg-0ubuntu0.3) jammy; urgency=medium
+
+  * d/p/win-22H2-fix.patch: fix interoperability with Windows 22H2
+    clients (LP: #1993934)
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 08 Nov 2022 10:59:27 -0300
+
 samba (2:4.15.9+dfsg-0ubuntu0.2) jammy-security; urgency=medium
 
   * Updated to 2.15.9 to fix multiple security issues.
diff --git a/debian/patches/series b/debian/patches/series
index d2d04e9..e411ebc 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -9,3 +9,4 @@ heimdal-rfc3454.txt
 smbd.service-Run-update-apparmor-samba-profile-befor.patch
 fix-nfs-service-name-to-nfs-kernel-server.patch
 ctdb-config-enable-syslog-by-default.patch
+win-22H2-fix.patch
diff --git a/debian/patches/win-22H2-fix.patch b/debian/patches/win-22H2-fix.patch
 new file mode 100644
index 0000000..615ab44
--- /dev/null
+++ b/debian/patches/win-22H2-fix.patch
@@ -0,0 +1,294 @@
+From 5b7d8363ce6a3ac8bcec707c4fe318770213dc32 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <[e-mail]>
+Date: Tue, 4 Oct 2022 12:25:08 +1300
+Subject: [PATCH 1/3] tests/krb5: Add test requesting a service ticket expiring
+ post-2038
+
+Windows 11 22H2 performs such requests, with year 9999.
+The test fails with KDC_ERR_BAD_INTEGRITY on older
+Heimdal versions, which are unable to verify a checksum
+over the modified request body (due to a re-encoding failure).
+
+REF: https://github.com/heimdal/heimdal/issues/1011
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15197
+
+[[e-mail] Add knownfail for backport - as Samba
+ 4.15 and earlier fail this test, adapted commit
+ 67811e121fbef08337675d473390160793544719 to test
+ paraemters in 4.15]
+
+Signed-off-by: Joseph Sutton <[e-mail]>
+Reviewed-by: Douglas Bagnall <[e-mail]>
+(backported from commit 67811e121fbef08337675d473390160793544719)
+
+Origin: https://attachments.samba.org/attachment.cgi?id=17595
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1993934
+Last-Update: 2022-11-08
+---
+ python/samba/tests/krb5/kdc_tgs_tests.py | 14 ++++++++++++++
+ selftest/knownfail.d/windows11-22h2      |  2 ++
+ 2 files changed, 16 insertions(+)
+ create mode 100644 selftest/knownfail.d/windows11-22h2
+
+diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py
+index e52f46152fa..a4bc48e587a 100755
+--- a/python/samba/tests/krb5/kdc_tgs_tests.py
++++ b/python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -2099,6 +2099,18 @@ class KdcTgsTests(KDCBaseTest):
+         self._run_tgs(tgt, expected_error=(KDC_ERR_TGT_REVOKED,
+                                            KDC_ERR_C_PRINCIPAL_UNKNOWN))
+ 
++    # Test making a TGS request for a ticket expiring post-2038.
++    def test_tgs_req_future_till(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds)
++
++        target_creds = self.get_service_creds()
++        self._tgs_req(
++            tgt=tgt,
++            expected_error=0,
++            target_creds=target_creds,
++            till='99990913024805Z')
++
+     def _modify_renewable(self, enc_part):
+         # Set the renewable flag.
+         enc_part = self.modify_ticket_flag(enc_part, 'renewable', value=True)
+@@ -2469,6 +2481,7 @@ class KdcTgsTests(KDCBaseTest):
+                  sname=None,
+                  srealm=None,
+                  use_fast=False,
++                 till=None,
+                  expect_claims=True,
+                  expect_pac=True,
+                  expect_pac_attrs=None,
+@@ -2580,6 +2593,7 @@ class KdcTgsTests(KDCBaseTest):
+                                          cname=None,
+                                          realm=srealm,
+                                          sname=sname,
++                                         till_time=till,
+                                          etypes=etypes,
+                                          additional_tickets=additional_tickets)
+         if expected_error:
+diff --git a/selftest/knownfail.d/windows11-22h2 b/selftest/knownfail.d/windows11-22h2
+new file mode 100644
+index 00000000000..69980ce763a
+--- /dev/null
++++ b/selftest/knownfail.d/windows11-22h2
+@@ -0,0 +1,2 @@
++# This tests shows the new timestamp from Windows 11 22H2 which fails in this version
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_future_till
+\ No newline at end of file
+-- 
+2.25.1
+
+
+From e8a1c05847618c1c4b83d92757c928484dc172e9 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <[e-mail]>
+Date: Thu, 20 Oct 2022 12:36:44 +1300
+Subject: [PATCH 2/3] tests/krb5: Add test requesting a TGT expiring post-2038
+
+This demonstrates the behaviour of Windows 11 22H2 over Kerberos,
+which changed to use a year 9999 date for a forever timetime in
+tickets.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15197
+
+Signed-off-by: Joseph Sutton <[e-mail]>
+Reviewed-by: Douglas Bagnall <[e-mail]>
+
+Autobuild-User(master): Andrew Bartlett <[e-mail]>
+Autobuild-Date(master): Thu Oct 20 05:00:23 UTC 2022 on sn-devel-184
+
+(backported from commit 50cbdecf2e276e5f87b9c2d95fd3ca86d11a08e2)
+
+[[e-mail] Adapted from 50cbdecf2e276e5f87b9c2d95fd3ca86d11a08e2
+ as the kerberos tests have changed parameters in newer versions
+ breaking the context]
+---
+ python/samba/tests/krb5/as_req_tests.py | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py
+index 054a49b64aa..aa4bc2370c4 100755
+--- a/python/samba/tests/krb5/as_req_tests.py
++++ b/python/samba/tests/krb5/as_req_tests.py
+@@ -42,7 +42,7 @@ global_hexdump = False
+ 
+ class AsReqBaseTest(KDCBaseTest):
+     def _run_as_req_enc_timestamp(self, client_creds, sname=None,
+-                                  expected_error=None):
++                                  expected_error=None, till=None):
+         client_account = client_creds.get_username()
+         client_as_etypes = self.get_default_enctypes()
+         client_kvno = client_creds.get_kvno()
+@@ -62,7 +62,8 @@ class AsReqBaseTest(KDCBaseTest):
+         expected_sname = sname
+         expected_salt = client_creds.get_salt()
+ 
+-        till = self.get_KerberosTime(offset=36000)
++        if till is None:
++            till = self.get_KerberosTime(offset=36000)
+ 
+         initial_etypes = client_as_etypes
+         initial_kdc_options = krb5_asn1.KDCOptions('forwardable')
+@@ -241,6 +242,14 @@ class AsReqKerberosTests(AsReqBaseTest):
+             sname=wrong_krbtgt_princ,
+             expected_error=KDC_ERR_S_PRINCIPAL_UNKNOWN)
+ 
++    # Test that we can make a request for a ticket expiring post-2038.
++    def test_future_till(self):
++        client_creds = self.get_client_creds()
++
++        self._run_as_req_enc_timestamp(
++            client_creds,
++            till='99990913024805Z')
++
+ 
+ if __name__ == "__main__":
+     global_asn1_print = False
+-- 
+2.25.1
+
+
+From 7bcbe9428438ee9fed60af133b1863e150001d35 Mon Sep 17 00:00:00 2001
+From: Luke Howard <[e-mail]>
+Date: Thu, 20 Oct 2022 13:27:31 +1300
+Subject: [PATCH 3/3] kdc: avoid re-encoding KDC-REQ-BODY
+
+Use --preserve-binary=KDC-REQ-BODY option to ASN.1 compiler to avoid
+re-encoding KDC-REQ-BODYs for verification in GSS preauth, TGS and PKINIT.
+
+[[e-mail] adapted from Heimdal commit
+ ebfd48e40a1b61bf5a6b8d00fe5c581e24652b6e
+ by removing references to FAST and GSS-pre-auth.
+
+ This fixes the Windows 11 22H2 issue with TGS-REQ
+ as seen at https://github.com/heimdal/heimdal/issues/1011 and so
+ removes the knownfail file for this test]
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15197
+
+Signed-off-by: Andrew Bartlett <[e-mail]>
+---
+ selftest/knownfail.d/windows11-22h2 |  2 --
+ source4/heimdal/kdc/krb5tgs.c       | 24 ++----------------------
+ source4/heimdal/kdc/pkinit.c        | 16 ++--------------
+ source4/heimdal/lib/asn1/krb5.opt   |  1 +
+ 4 files changed, 5 insertions(+), 38 deletions(-)
+ delete mode 100644 selftest/knownfail.d/windows11-22h2
+
+diff --git a/selftest/knownfail.d/windows11-22h2 b/selftest/knownfail.d/windows11-22h2
+deleted file mode 100644
+index 69980ce763a..00000000000
+--- a/selftest/knownfail.d/windows11-22h2
++++ /dev/null
+@@ -1,2 +0,0 @@
+-# This tests shows the new timestamp from Windows 11 22H2 which fails in this version
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_future_till
+\ No newline at end of file
+diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c
+index 15be136496f..fa7755a4e3d 100644
+--- a/source4/heimdal/kdc/krb5tgs.c
++++ b/source4/heimdal/kdc/krb5tgs.c
+@@ -780,9 +780,6 @@ tgs_check_authenticator(krb5_context context,
+ 			krb5_keyblock *key)
+ {
+     krb5_authenticator auth;
+-    size_t len = 0;
+-    unsigned char *buf;
+-    size_t buf_size;
+     krb5_error_code ret;
+     krb5_crypto crypto;
+ 
+@@ -808,25 +805,9 @@ tgs_check_authenticator(krb5_context context,
+ 	goto out;
+     }
+ 
+-    /* XXX should not re-encode this */
+-    ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, b, &len, ret);
+-    if(ret){
+-	const char *msg = krb5_get_error_message(context, ret);
+-	kdc_log(context, config, 0, "Failed to encode KDC-REQ-BODY: %s", msg);
+-	krb5_free_error_message(context, msg);
+-	goto out;
+-    }
+-    if(buf_size != len) {
+-	free(buf);
+-	kdc_log(context, config, 0, "Internal error in ASN.1 encoder");
+-	*e_text = "KDC internal error";
+-	ret = KRB5KRB_ERR_GENERIC;
+-	goto out;
+-    }
+     ret = krb5_crypto_init(context, key, 0, &crypto);
+     if (ret) {
+ 	const char *msg = krb5_get_error_message(context, ret);
+-	free(buf);
+ 	kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
+ 	krb5_free_error_message(context, msg);
+ 	goto out;
+@@ -834,10 +815,9 @@ tgs_check_authenticator(krb5_context context,
+     ret = krb5_verify_checksum(context,
+ 			       crypto,
+ 			       KRB5_KU_TGS_REQ_AUTH_CKSUM,
+-			       buf,
+-			       len,
++			       b->_save.data,
++			       b->_save.length,
+ 			       auth->cksum);
+-    free(buf);
+     krb5_crypto_destroy(context, crypto);
+     if(ret){
+ 	const char *msg = krb5_get_error_message(context, ret);
+diff --git a/source4/heimdal/kdc/pkinit.c b/source4/heimdal/kdc/pkinit.c
+index ad7f3efc10a..64ea4c00e41 100644
+--- a/source4/heimdal/kdc/pkinit.c
++++ b/source4/heimdal/kdc/pkinit.c
+@@ -113,10 +113,7 @@ pk_check_pkauthenticator(krb5_context context,
+ 			 PKAuthenticator *a,
+ 			 const KDC_REQ *req)
+ {
+-    u_char *buf = NULL;
+-    size_t buf_size;
+     krb5_error_code ret;
+-    size_t len = 0;
+     krb5_timestamp now;
+     Checksum checksum;
+ 
+@@ -128,22 +125,13 @@ pk_check_pkauthenticator(krb5_context context,
+ 	return KRB5KRB_AP_ERR_SKEW;
+     }
+ 
+-    ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, &req->req_body, &len, ret);
+-    if (ret) {
+-	krb5_clear_error_message(context);
+-	return ret;
+-    }
+-    if (buf_size != len)
+-	krb5_abortx(context, "Internal error in ASN.1 encoder");
+-
+     ret = krb5_create_checksum(context,
+ 			       NULL,
+ 			       0,
+ 			       CKSUMTYPE_SHA1,
+-			       buf,
+-			       len,
++			       req->req_body._save.data,
++			       req->req_body._save.length,
+ 			       &checksum);
+-    free(buf);
+     if (ret) {
+ 	krb5_clear_error_message(context);
+ 	return ret;
+diff --git a/source4/heimdal/lib/asn1/krb5.opt b/source4/heimdal/lib/asn1/krb5.opt
+index 1d6d5e8989f..5acc596d39c 100644
+--- a/source4/heimdal/lib/asn1/krb5.opt
++++ b/source4/heimdal/lib/asn1/krb5.opt
+@@ -4,3 +4,4 @@
+ --sequence=METHOD-DATA
+ --sequence=ETYPE-INFO
+ --sequence=ETYPE-INFO2
++--preserve-binary=KDC-REQ-BODY
+-- 
+2.25.1
+