update icewind/smb to 3.6.0

Signed-off-by: Robin Appelman <[email protected]>

apps/files_external/3rdparty/composer.json

@@ -8,7 +8,7 @@
 		"classmap-authoritative": true
 	},
 	"require": {
-		"icewind/smb": "3.5.4",
+		"icewind/smb": "3.6.0",
 		"icewind/streams": "0.7.7"
 	}
 }

apps/files_external/3rdparty/composer/autoload_classmap.php

@@ -32,6 +32,7 @@
     'Icewind\\SMB\\Exception\\InvalidPathException' => $vendorDir . '/icewind/smb/src/Exception/InvalidPathException.php',
     'Icewind\\SMB\\Exception\\InvalidRequestException' => $vendorDir . '/icewind/smb/src/Exception/InvalidRequestException.php',
     'Icewind\\SMB\\Exception\\InvalidResourceException' => $vendorDir . '/icewind/smb/src/Exception/InvalidResourceException.php',
+    'Icewind\\SMB\\Exception\\InvalidTicket' => $vendorDir . '/icewind/smb/src/Exception/InvalidTicket.php',
     'Icewind\\SMB\\Exception\\InvalidTypeException' => $vendorDir . '/icewind/smb/src/Exception/InvalidTypeException.php',
     'Icewind\\SMB\\Exception\\NoLoginServerException' => $vendorDir . '/icewind/smb/src/Exception/NoLoginServerException.php',
     'Icewind\\SMB\\Exception\\NoRouteToHostException' => $vendorDir . '/icewind/smb/src/Exception/NoRouteToHostException.php',
@@ -50,6 +51,7 @@
     'Icewind\\SMB\\ITimeZoneProvider' => $vendorDir . '/icewind/smb/src/ITimeZoneProvider.php',
     'Icewind\\SMB\\KerberosApacheAuth' => $vendorDir . '/icewind/smb/src/KerberosApacheAuth.php',
     'Icewind\\SMB\\KerberosAuth' => $vendorDir . '/icewind/smb/src/KerberosAuth.php',
+    'Icewind\\SMB\\KerberosTicket' => $vendorDir . '/icewind/smb/src/KerberosTicket.php',
     'Icewind\\SMB\\Native\\NativeFileInfo' => $vendorDir . '/icewind/smb/src/Native/NativeFileInfo.php',
     'Icewind\\SMB\\Native\\NativeReadStream' => $vendorDir . '/icewind/smb/src/Native/NativeReadStream.php',
     'Icewind\\SMB\\Native\\NativeServer' => $vendorDir . '/icewind/smb/src/Native/NativeServer.php',

apps/files_external/3rdparty/composer/autoload_static.php

@@ -52,6 +52,7 @@ class ComposerStaticInit98fe9b281934250b3a93f69a5ce843b3
         'Icewind\\SMB\\Exception\\InvalidPathException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/InvalidPathException.php',
         'Icewind\\SMB\\Exception\\InvalidRequestException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/InvalidRequestException.php',
         'Icewind\\SMB\\Exception\\InvalidResourceException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/InvalidResourceException.php',
+        'Icewind\\SMB\\Exception\\InvalidTicket' => __DIR__ . '/..' . '/icewind/smb/src/Exception/InvalidTicket.php',
         'Icewind\\SMB\\Exception\\InvalidTypeException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/InvalidTypeException.php',
         'Icewind\\SMB\\Exception\\NoLoginServerException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/NoLoginServerException.php',
         'Icewind\\SMB\\Exception\\NoRouteToHostException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/NoRouteToHostException.php',
@@ -70,6 +71,7 @@ class ComposerStaticInit98fe9b281934250b3a93f69a5ce843b3
         'Icewind\\SMB\\ITimeZoneProvider' => __DIR__ . '/..' . '/icewind/smb/src/ITimeZoneProvider.php',
         'Icewind\\SMB\\KerberosApacheAuth' => __DIR__ . '/..' . '/icewind/smb/src/KerberosApacheAuth.php',
         'Icewind\\SMB\\KerberosAuth' => __DIR__ . '/..' . '/icewind/smb/src/KerberosAuth.php',
+        'Icewind\\SMB\\KerberosTicket' => __DIR__ . '/..' . '/icewind/smb/src/KerberosTicket.php',
         'Icewind\\SMB\\Native\\NativeFileInfo' => __DIR__ . '/..' . '/icewind/smb/src/Native/NativeFileInfo.php',
         'Icewind\\SMB\\Native\\NativeReadStream' => __DIR__ . '/..' . '/icewind/smb/src/Native/NativeReadStream.php',
         'Icewind\\SMB\\Native\\NativeServer' => __DIR__ . '/..' . '/icewind/smb/src/Native/NativeServer.php',

apps/files_external/3rdparty/composer/installed.json

@@ -2,17 +2,17 @@
     "packages": [
         {
             "name": "icewind/smb",
-            "version": "v3.5.4",
-            "version_normalized": "3.5.4.0",
+            "version": "v3.6.0",
+            "version_normalized": "3.6.0.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/icewind1991/SMB.git",
-                "reference": "76995aa11c14e39bccd0f2370ed63b2f8f623a6d"
+                "reference": "e0e86b16640f5892dd00408ed50ad18357dac6c1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/icewind1991/SMB/zipball/76995aa11c14e39bccd0f2370ed63b2f8f623a6d",
-                "reference": "76995aa11c14e39bccd0f2370ed63b2f8f623a6d",
+                "url": "https://api.github.com/repos/icewind1991/SMB/zipball/e0e86b16640f5892dd00408ed50ad18357dac6c1",
+                "reference": "e0e86b16640f5892dd00408ed50ad18357dac6c1",
                 "shasum": ""
             },
             "require": {
@@ -25,7 +25,7 @@
                 "phpunit/phpunit": "^8.5|^9.3.8",
                 "psalm/phar": "^4.3"
             },
-            "time": "2022-05-30T15:18:19+00:00",
+            "time": "2023-08-10T13:17:39+00:00",
             "type": "library",
             "installation-source": "dist",
             "autoload": {
@@ -46,7 +46,7 @@
             "description": "php wrapper for smbclient and libsmbclient-php",
             "support": {
                 "issues": "https://github.com/icewind1991/SMB/issues",
-                "source": "https://github.com/icewind1991/SMB/tree/v3.5.4"
+                "source": "https://github.com/icewind1991/SMB/tree/v3.6.0"
             },
             "install-path": "../icewind/smb"
         },

apps/files_external/3rdparty/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => 'files_external/3rdparty',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '979f4033ca1cd0be7f255f028d4cc637a216440d',
+        'reference' => '733d6b54097417b3f49673ac0491aebdb46648fd',
         'type' => 'library',
         'install_path' => __DIR__ . '/../',
         'aliases' => array(),
@@ -13,16 +13,16 @@
         'files_external/3rdparty' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '979f4033ca1cd0be7f255f028d4cc637a216440d',
+            'reference' => '733d6b54097417b3f49673ac0491aebdb46648fd',
             'type' => 'library',
             'install_path' => __DIR__ . '/../',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'icewind/smb' => array(
-            'pretty_version' => 'v3.5.4',
-            'version' => '3.5.4.0',
-            'reference' => '76995aa11c14e39bccd0f2370ed63b2f8f623a6d',
+            'pretty_version' => 'v3.6.0',
+            'version' => '3.6.0.0',
+            'reference' => 'e0e86b16640f5892dd00408ed50ad18357dac6c1',
             'type' => 'library',
             'install_path' => __DIR__ . '/../icewind/smb',
             'aliases' => array(),

apps/files_external/3rdparty/icewind/smb/README.md

@@ -65,19 +65,20 @@ $server = $serverFactory->createServer('localhost', $auth);
 
 By re-using a client ticket you can create a single sign-on setup where the user authenticates against
 the web service using kerberos. And the web server can forward that ticket to the smb server, allowing it
-to act on the behalf of the user without requiring the user to enter his passord.
+to act on the behalf of the user without requiring the user to enter his password.
 
 The setup for such a system is fairly involved and requires roughly the following this
 
 - The web server is authenticated against kerberos with a machine account
 - Delegation is enabled for the web server's machine account
-- Apache is setup to perform kerberos authentication and save the ticket in it's environment
+- The web server is setup to perform kerberos authentication and save the ticket in it's environment
 - Php has the krb5 extension installed
 - The client authenticates using a ticket with forwarding enabled
 
 ```php
 $serverFactory = new ServerFactory();
-$auth = new KerberosApacheAuth();
+$auth = new KerberosAuth();
+$auth->setTicket(KerberosTicket::fromEnv());
 $server = $serverFactory->createServer('localhost', $auth);
 ```
 

apps/files_external/3rdparty/icewind/smb/example-sso-kerberos.php

@@ -0,0 +1,26 @@
+<?php
+
+use Icewind\SMB\KerberosTicket;
+
+require('vendor/autoload.php');
+
+if (php_sapi_name() == "cli") {
+	echo "Note: this example shouldn't be called from cli as it expects apache to setup the keberos ticket\n";
+}
+
+// dfs paths not working
+$host = 'krb.domain.test';
+$share = 'netlogon';
+
+$auth = new \Icewind\SMB\KerberosAuth();
+$auth->setTicket(KerberosTicket::fromEnv());
+$serverFactory = new \Icewind\SMB\ServerFactory();
+
+$server = $serverFactory->createServer($host, $auth);
+
+$share = $server->getShare($share);
+
+$files = $share->dir('/');
+foreach ($files as $file) {
+	echo $file->getName() . "\n";
+}

apps/files_external/3rdparty/icewind/smb/src/Exception/InvalidTicket.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * @copyright Copyright (c) 2022 Robin Appelman <[email protected]>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace Icewind\SMB\Exception;
+
+class InvalidTicket extends Exception {
+
+}

apps/files_external/3rdparty/icewind/smb/src/KerberosApacheAuth.php

@@ -23,114 +23,40 @@
 
 use Icewind\SMB\Exception\DependencyException;
 use Icewind\SMB\Exception\Exception;
+use Icewind\SMB\Exception\InvalidTicket;
 
 /**
  * Use existing kerberos ticket to authenticate and reuse the apache ticket cache (mod_auth_kerb)
+ *
+ * @deprecated Use `KerberosAuth` with `$auth->setTicket(KerberosTicket::fromEnv())` instead
  */
 class KerberosApacheAuth extends KerberosAuth implements IAuth {
-	/** @var string */
-	private $ticketPath = "";
-
-	/** @var bool */
-	private $init = false;
-
-	/** @var string|false */
-	private $ticketName;
-
-	public function __construct() {
-		$this->ticketName = getenv("KRB5CCNAME");
+	public function getTicket(): KerberosTicket {
+		if ($this->ticket === null) {
+			$ticket = KerberosTicket::fromEnv();
+			if ($ticket === null) {
+				throw new InvalidTicket("No ticket found in environment");
+			}
+			$this->ticket = $ticket;
+		}
+		return $this->ticket;
 	}
 
-
 	/**
 	 * Copy the ticket to a temporary location and use that ticket for authentication
 	 *
 	 * @return void
 	 */
 	public function copyTicket(): void {
-		if (!$this->checkTicket()) {
-			return;
-		}
-		$krb5 = new \KRB5CCache();
-		$krb5->open($this->ticketName);
-		$tmpFilename = tempnam("/tmp", "krb5cc_php_");
-		$tmpCacheFile = "FILE:" . $tmpFilename;
-		$krb5->save($tmpCacheFile);
-		$this->ticketPath = $tmpFilename;
-		$this->ticketName = $tmpCacheFile;
-	}
-
-	/**
-	 * Pass the ticket to smbclient by memory instead of path
-	 *
-	 * @return void
-	 */
-	public function passTicketFromMemory(): void {
-		if (!$this->checkTicket()) {
-			return;
-		}
-		$krb5 = new \KRB5CCache();
-		$krb5->open($this->ticketName);
-		$this->ticketName = (string)$krb5->getName();
+		$this->ticket = KerberosTicket::load($this->getTicket()->save());
 	}
 
 	/**
 	 * Check if a valid kerberos ticket is present
 	 *
 	 * @return bool
-	 * @psalm-assert-if-true string $this->ticketName
 	 */
 	public function checkTicket(): bool {
-		//read apache kerberos ticket cache
-		if (!$this->ticketName) {
-			return false;
-		}
-
-		$krb5 = new \KRB5CCache();
-		$krb5->open($this->ticketName);
-		/** @psalm-suppress MixedArgument */
-		return count($krb5->getEntries()) > 0;
-	}
-
-	private function init(): void {
-		if ($this->init) {
-			return;
-		}
-		$this->init = true;
-		// inspired by https://git.typo3.org/TYPO3CMS/Extensions/fal_cifs.git
-
-		if (!extension_loaded("krb5")) {
-			// https://pecl.php.net/package/krb5
-			throw new DependencyException('Ensure php-krb5 is installed.');
-		}
-
-		//read apache kerberos ticket cache
-		if (!$this->checkTicket()) {
-			throw new Exception('No kerberos ticket cache environment variable (KRB5CCNAME) found.');
-		}
-
-		// note that even if the ticketname is the value we got from `getenv("KRB5CCNAME")` we still need to set the env variable ourselves
-		// this is because `getenv` also reads the variables passed from the SAPI (apache-php) and we need to set the variable in the OS's env
-		putenv("KRB5CCNAME=" . $this->ticketName);
-	}
-
-	public function getExtraCommandLineArguments(): string {
-		$this->init();
-		return parent::getExtraCommandLineArguments();
-	}
-
-	public function setExtraSmbClientOptions($smbClientState): void {
-		$this->init();
-		try {
-			parent::setExtraSmbClientOptions($smbClientState);
-		} catch (Exception $e) {
-			// suppress
-		}
-	}
-
-	public function __destruct() {
-		if (!empty($this->ticketPath) && file_exists($this->ticketPath) && is_file($this->ticketPath)) {
-			unlink($this->ticketPath);
-		}
+		return $this->getTicket()->isValid();
 	}
 }