Merge ~ahasenack/ubuntu/+source/samba:bionic-samba-win-22h2-fixes into ubuntu/+source/samba:ubuntu/bionic-devel

[Andreas Hasenack]

Fix for Windows 11 22H2 failing to join a Samba AD DC domain. The linked SRU bug has a test plan and more details on the bug.

If you want to follow that test plan, we have the necessary VM created on diglett. You can point virt-manager at qemu+ssh://<youruser>@diglett/system and see:

- win11H22: the Windows 11 22H22 VM that shows the bug. Creds: ubuntu_local/Passw0rd!ub (is an admin) for when NOT joined to a domain. This is on DHCP, current IP is 10.0.18.201 and RDP is enabled.
Note that after joining the domain, RDP access is cut off. You have to login as Administrator and allow the "Domain Users" group to use RDP. I didn't find a way to allow this from the samba AD DC, but didn't search really hard.

Ubuntu VMs, where you can (re)install samba packages at will. They are pointing at my PPA with the fix, so if you want to see the bug, you have to downgrade them to the non-ppa version. These all can be logged in via the virt-manager console, creds ubuntu/ubuntu, and from there you can ssh-import your key.
- ad: jammy AD. Fixed IP at 10.0.18.5
- b-ad: bionic AD. Fixed IP at 10.0.18.3
- f-ad: focal AD. Fixed IP at 10.0.18.2

Libvirt network: 10.0.18.0/24

If you want, we can have a hangout where I can show all of this.

PPA: https://launchpad.net/~ahasenack/+archive/ubuntu/samba-22h2/

[Lucas Kanashiro (lucaskanashiro)]

I did not test the feature itself but I see you got some good feedback on the bug. The packaging changes LGTM.

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, uploaded:

Uploading samba_4.7.6+dfsg~ubuntu-0ubuntu2.29.dsc
Uploading samba_4.7.6+dfsg~ubuntu-0ubuntu2.29.debian.tar.xz
Uploading samba_4.7.6+dfsg~ubuntu-0ubuntu2.29_source.buildinfo
Uploading samba_4.7.6+dfsg~ubuntu-0ubuntu2.29_source.changes

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, lucaskanashiro
Uploaders: ahasenack, lucaskanashiro
MP auto-approved

review: Approve

diff --git a/debian/changelog b/debian/changelog
index c853f9d..824c9d2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+samba (2:4.7.6+dfsg~ubuntu-0ubuntu2.29) bionic; urgency=medium
+
+  * d/p/win-22H2-fix.patch: fix interoperability with Windows 22H2
+    clients (LP: #1993934)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 09 Nov 2022 11:42:14 -0300
+
 samba (2:4.7.6+dfsg~ubuntu-0ubuntu2.28) bionic-security; urgency=medium
 
   * SECURITY UPDATE: code exec via out-of-bounds read/write in vfs_fruit
diff --git a/debian/patches/series b/debian/patches/series
index 90fb827..507126f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -171,3 +171,4 @@ CVE-2021-44142-3.patch
 CVE-2021-44142-4.patch
 CVE-2021-44142-5.patch
 CVE-2021-44142-6.patch
+win-22H2-fix.patch
diff --git a/debian/patches/win-22H2-fix.patch b/debian/patches/win-22H2-fix.patch
new file mode 100644
index 0000000..b92d37f
--- /dev/null
+++ b/debian/patches/win-22H2-fix.patch
@@ -0,0 +1,138 @@
+From 56c949d2764b69050bc441bec68008f4a046f1d3 Mon Sep 17 00:00:00 2001
+From: Luke Howard <[e-mail]>
+Date: Thu, 20 Oct 2022 13:27:31 +1300
+Subject: [PATCH 3/3] kdc: avoid re-encoding KDC-REQ-BODY
+
+Use --preserve-binary=KDC-REQ-BODY option to ASN.1 compiler to avoid
+re-encoding KDC-REQ-BODYs for verification in GSS preauth, TGS and PKINIT.
+
+[[e-mail] adapted from Heimdal commit
+ ebfd48e40a1b61bf5a6b8d00fe5c581e24652b6e
+ by removing references to FAST and GSS-pre-auth.
+
+ This fixes the Windows 11 22H2 issue with TGS-REQ
+ as seen at https://github.com/heimdal/heimdal/issues/1011 and so
+ removes the knownfail file for this test]
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15197
+
+Signed-off-by: Andrew Bartlett <[e-mail]>
+
+Ubuntu backport note: removed diff for files that do not exist in this version
+
+Origin: backport, https://bugzilla.samba.org/attachment.cgi?id=17596
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1993934
+Last-Update: 2022-11-09
+---
+ selftest/knownfail.d/windows11-22h2 |  2 --
+ source4/heimdal/kdc/krb5tgs.c       | 24 ++----------------------
+ source4/heimdal/kdc/pkinit.c        | 16 ++--------------
+ source4/heimdal/lib/asn1/krb5.opt   |  1 +
+ 4 files changed, 5 insertions(+), 38 deletions(-)
+ delete mode 100644 selftest/knownfail.d/windows11-22h2
+
+diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c
+index 13996f96b4a..f1393fa87a1 100644
+--- a/source4/heimdal/kdc/krb5tgs.c
++++ b/source4/heimdal/kdc/krb5tgs.c
+@@ -780,9 +780,6 @@ tgs_check_authenticator(krb5_context context,
+ 			krb5_keyblock *key)
+ {
+     krb5_authenticator auth;
+-    size_t len = 0;
+-    unsigned char *buf;
+-    size_t buf_size;
+     krb5_error_code ret;
+     krb5_crypto crypto;
+ 
+@@ -808,25 +805,9 @@ tgs_check_authenticator(krb5_context context,
+ 	goto out;
+     }
+ 
+-    /* XXX should not re-encode this */
+-    ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, b, &len, ret);
+-    if(ret){
+-	const char *msg = krb5_get_error_message(context, ret);
+-	kdc_log(context, config, 0, "Failed to encode KDC-REQ-BODY: %s", msg);
+-	krb5_free_error_message(context, msg);
+-	goto out;
+-    }
+-    if(buf_size != len) {
+-	free(buf);
+-	kdc_log(context, config, 0, "Internal error in ASN.1 encoder");
+-	*e_text = "KDC internal error";
+-	ret = KRB5KRB_ERR_GENERIC;
+-	goto out;
+-    }
+     ret = krb5_crypto_init(context, key, 0, &crypto);
+     if (ret) {
+ 	const char *msg = krb5_get_error_message(context, ret);
+-	free(buf);
+ 	kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
+ 	krb5_free_error_message(context, msg);
+ 	goto out;
+@@ -834,10 +815,9 @@ tgs_check_authenticator(krb5_context context,
+     ret = krb5_verify_checksum(context,
+ 			       crypto,
+ 			       KRB5_KU_TGS_REQ_AUTH_CKSUM,
+-			       buf,
+-			       len,
++			       b->_save.data,
++			       b->_save.length,
+ 			       auth->cksum);
+-    free(buf);
+     krb5_crypto_destroy(context, crypto);
+     if(ret){
+ 	const char *msg = krb5_get_error_message(context, ret);
+diff --git a/source4/heimdal/kdc/pkinit.c b/source4/heimdal/kdc/pkinit.c
+index ad7f3efc10a..64ea4c00e41 100644
+--- a/source4/heimdal/kdc/pkinit.c
++++ b/source4/heimdal/kdc/pkinit.c
+@@ -113,10 +113,7 @@ pk_check_pkauthenticator(krb5_context context,
+ 			 PKAuthenticator *a,
+ 			 const KDC_REQ *req)
+ {
+-    u_char *buf = NULL;
+-    size_t buf_size;
+     krb5_error_code ret;
+-    size_t len = 0;
+     krb5_timestamp now;
+     Checksum checksum;
+ 
+@@ -128,22 +125,13 @@ pk_check_pkauthenticator(krb5_context context,
+ 	return KRB5KRB_AP_ERR_SKEW;
+     }
+ 
+-    ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, &req->req_body, &len, ret);
+-    if (ret) {
+-	krb5_clear_error_message(context);
+-	return ret;
+-    }
+-    if (buf_size != len)
+-	krb5_abortx(context, "Internal error in ASN.1 encoder");
+-
+     ret = krb5_create_checksum(context,
+ 			       NULL,
+ 			       0,
+ 			       CKSUMTYPE_SHA1,
+-			       buf,
+-			       len,
++			       req->req_body._save.data,
++			       req->req_body._save.length,
+ 			       &checksum);
+-    free(buf);
+     if (ret) {
+ 	krb5_clear_error_message(context);
+ 	return ret;
+diff --git a/source4/heimdal/lib/asn1/krb5.opt b/source4/heimdal/lib/asn1/krb5.opt
+index 1d6d5e8989f..5acc596d39c 100644
+--- a/source4/heimdal/lib/asn1/krb5.opt
++++ b/source4/heimdal/lib/asn1/krb5.opt
+@@ -4,3 +4,4 @@
+ --sequence=METHOD-DATA
+ --sequence=ETYPE-INFO
+ --sequence=ETYPE-INFO2
++--preserve-binary=KDC-REQ-BODY
+-- 
+2.25.1
+