OpenWrt – Blame information for rev 1

Subversion Repositories:
Rev:
Rev Author Line No. Line
1 office 1 From 513bd34e4523e49e742487be32a7239111486a12 Mon Sep 17 00:00:00 2001
2 From: Stefan Metzmacher <metze@samba.org>
3 Date: Sat, 27 Feb 2016 03:43:58 +0100
4 Subject: [PATCH 1/4] CVE-2016-2115: docs-xml: add "client ipc signing" option
5  
6 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756
7  
8 Signed-off-by: Stefan Metzmacher <metze@samba.org>
9 Reviewed-by: Ralph Boehme <slow@samba.org>
10 ---
11 docs-xml/smbdotconf/security/clientipcsigning.xml | 23 +++++++++++++++++++++++
12 docs-xml/smbdotconf/security/clientsigning.xml | 3 +++
13 source3/include/proto.h | 1 +
14 source3/param/loadparm.c | 12 ++++++++++++
15 4 files changed, 39 insertions(+)
16 create mode 100644 docs-xml/smbdotconf/security/clientipcsigning.xml
17  
18 --- /dev/null
19 +++ b/docs-xml/smbdotconf/security/clientipcsigning.xml
20 @@ -0,0 +1,23 @@
21 +<samba:parameter name="client ipc signing"
22 + context="G"
23 + type="enum"
24 + enumlist="enum_smb_signing_vals"
25 + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
26 +<description>
27 + <para>This controls whether the client is allowed or required to use SMB signing for IPC$
28 + connections as DCERPC transport inside of winbind. Possible values
29 + are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
30 + and <emphasis>disabled</emphasis>.
31 + </para>
32 +
33 + <para>When set to auto, SMB signing is offered, but not enforced and if set
34 + to disabled, SMB signing is not offered either.</para>
35 +
36 + <para>Connections from winbindd to Active Directory Domain Controllers
37 + always enforce signing.</para>
38 +</description>
39 +
40 +<related>client signing</related>
41 +
42 +<value type="default">mandatory</value>
43 +</samba:parameter>
44 --- a/docs-xml/smbdotconf/security/clientsigning.xml
45 +++ b/docs-xml/smbdotconf/security/clientsigning.xml
46 @@ -12,6 +12,9 @@
47 <para>When set to auto, SMB signing is offered, but not enforced.
48 When set to mandatory, SMB signing is required and if set
49 to disabled, SMB signing is not offered either.
50 +
51 + <para>IPC$ connections for DCERPC e.g. in winbindd, are handled by the
52 + <smbconfoption name="client ipc signing"/> option.</para>
53 </para>
54 </description>
55  
56 --- a/source3/include/proto.h
57 +++ b/source3/include/proto.h
58 @@ -1690,9 +1690,11 @@ int lp_winbind_cache_time(void);
59 int lp_winbind_reconnect_delay(void);
60 int lp_winbind_max_clients(void);
61 const char **lp_winbind_nss_info(void);
62 +bool lp_winbind_sealed_pipes(void);
63 int lp_algorithmic_rid_base(void);
64 int lp_name_cache_timeout(void);
65 int lp_client_signing(void);
66 +int lp_client_ipc_signing(void);
67 int lp_server_signing(void);
68 int lp_client_ldap_sasl_wrapping(void);
69 char *lp_parm_talloc_string(int snum, const char *type, const char *option, const char *def);
70 --- a/source3/param/loadparm.c
71 +++ b/source3/param/loadparm.c
72 @@ -215,6 +215,7 @@ struct global {
73 int winbind_expand_groups;
74 bool bWinbindRefreshTickets;
75 bool bWinbindOfflineLogon;
76 + bool bWinbindSealedPipes;
77 bool bWinbindNormalizeNames;
78 bool bWinbindRpcOnly;
79 bool bCreateKrb5Conf;
80 @@ -366,6 +367,7 @@ struct global {
81 int restrict_anonymous;
82 int name_cache_timeout;
83 int client_signing;
84 + int client_ipc_signing;
85 int server_signing;
86 int client_ldap_sasl_wrapping;
87 int iUsershareMaxShares;
88 @@ -2319,6 +2321,15 @@ static struct parm_struct parm_table[] =
89 .flags = FLAG_ADVANCED,
90 },
91 {
92 + .label = "client ipc signing",
93 + .type = P_ENUM,
94 + .p_class = P_GLOBAL,
95 + .ptr = &Globals.client_ipc_signing,
96 + .special = NULL,
97 + .enum_list = enum_smb_signing_vals,
98 + .flags = FLAG_ADVANCED,
99 + },
100 + {
101 .label = "server signing",
102 .type = P_ENUM,
103 .p_class = P_GLOBAL,
104 @@ -4765,6 +4776,15 @@ static struct parm_struct parm_table[] =
105 .flags = FLAG_ADVANCED,
106 },
107 {
108 + .label = "winbind sealed pipes",
109 + .type = P_BOOL,
110 + .p_class = P_GLOBAL,
111 + .ptr = &Globals.bWinbindSealedPipes,
112 + .special = NULL,
113 + .enum_list = NULL,
114 + .flags = FLAG_ADVANCED,
115 + },
116 + {
117 .label = "winbind normalize names",
118 .type = P_BOOL,
119 .p_class = P_GLOBAL,
120 @@ -5458,6 +5478,7 @@ static void init_globals(bool reinit_glo
121 Globals.szWinbindNssInfo = str_list_make_v3(NULL, "template", NULL);
122 Globals.bWinbindRefreshTickets = False;
123 Globals.bWinbindOfflineLogon = False;
124 + Globals.bWinbindSealedPipes = True;
125  
126 Globals.iIdmapCacheTime = 86400 * 7; /* a week by default */
127 Globals.iIdmapNegativeCacheTime = 120; /* 2 minutes by default */
128 @@ -5470,6 +5491,7 @@ static void init_globals(bool reinit_glo
129 Globals.bClientUseSpnego = True;
130  
131 Globals.client_signing = Auto;
132 + Globals.client_ipc_signing = Required;
133 Globals.server_signing = False;
134  
135 Globals.bDeferSharingViolations = True;
136 @@ -5736,6 +5758,7 @@ FN_GLOBAL_BOOL(lp_winbind_nested_groups,
137 FN_GLOBAL_INTEGER(lp_winbind_expand_groups, &Globals.winbind_expand_groups)
138 FN_GLOBAL_BOOL(lp_winbind_refresh_tickets, &Globals.bWinbindRefreshTickets)
139 FN_GLOBAL_BOOL(lp_winbind_offline_logon, &Globals.bWinbindOfflineLogon)
140 +FN_GLOBAL_BOOL(lp_winbind_sealed_pipes, &Globals.bWinbindSealedPipes)
141 FN_GLOBAL_BOOL(lp_winbind_normalize_names, &Globals.bWinbindNormalizeNames)
142 FN_GLOBAL_BOOL(lp_winbind_rpc_only, &Globals.bWinbindRpcOnly)
143 FN_GLOBAL_BOOL(lp_create_krb5_conf, &Globals.bCreateKrb5Conf)
144 @@ -6071,6 +6094,7 @@ FN_GLOBAL_LIST(lp_winbind_nss_info, &Glo
145 FN_GLOBAL_INTEGER(lp_algorithmic_rid_base, &Globals.AlgorithmicRidBase)
146 FN_GLOBAL_INTEGER(lp_name_cache_timeout, &Globals.name_cache_timeout)
147 FN_GLOBAL_INTEGER(lp_client_signing, &Globals.client_signing)
148 +FN_GLOBAL_INTEGER(lp_client_ipc_signing, &Globals.client_ipc_signing)
149 FN_GLOBAL_INTEGER(lp_server_signing, &Globals.server_signing)
150 FN_GLOBAL_INTEGER(lp_client_ldap_sasl_wrapping, &Globals.client_ldap_sasl_wrapping)
151  
152 @@ -9700,6 +9724,20 @@ static bool lp_load_ex(const char *pszFn
153 lp_do_parameter(GLOBAL_SECTION_SNUM, "wins server", "127.0.0.1");
154 }
155  
156 + if (!lp_is_in_client()) {
157 + switch (lp_client_ipc_signing()) {
158 + case Required:
159 + lp_set_cmdline("client signing", "mandatory");
160 + break;
161 + case Auto:
162 + lp_set_cmdline("client signing", "auto");
163 + break;
164 + case False:
165 + lp_set_cmdline("client signing", "disabled");
166 + break;
167 + }
168 + }
169 +
170 init_iconv();
171  
172 bAllowIncludeRegistry = true;
173 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
174 +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
175 @@ -2480,7 +2480,7 @@ static bool spoolss_connect_to_client(st
176 "", /* username */
177 "", /* domain */
178 "", /* password */
179 - 0, lp_client_signing());
180 + 0, False);
181  
182 if ( !NT_STATUS_IS_OK( ret ) ) {
183 DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n",
184 --- /dev/null
185 +++ b/docs-xml/smbdotconf/winbind/winbindsealedpipes.xml
186 @@ -0,0 +1,15 @@
187 +<samba:parameter name="winbind sealed pipes"
188 + context="G"
189 + type="boolean"
190 + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
191 +<description>
192 + <para>This option controls whether any requests from winbindd to domain controllers
193 + pipe will be sealed. Disabling sealing can be useful for debugging
194 + purposes.</para>
195 +
196 + <para>The behavior can be controlled per netbios domain
197 + by using 'winbind sealed pipes:NETBIOSDOMAIN = no' as option.</para>
198 +</description>
199 +
200 +<value type="default">yes</value>
201 +</samba:parameter>
202 --- a/source3/winbindd/winbindd_cm.c
203 +++ b/source3/winbindd/winbindd_cm.c
204 @@ -2384,6 +2384,15 @@ NTSTATUS cm_connect_sam(struct winbindd_
205 TALLOC_FREE(conn->samr_pipe);
206  
207 anonymous:
208 + if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
209 + status = NT_STATUS_DOWNGRADE_DETECTED;
210 + DEBUG(1, ("Unwilling to make SAMR connection to domain %s "
211 + "without connection level security, "
212 + "must set 'winbind sealed pipes = false' "
213 + "to proceed: %s\n",
214 + domain->name, nt_errstr(status)));
215 + goto done;
216 + }
217  
218 /* Finally fall back to anonymous. */
219 status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
220 @@ -2610,6 +2619,16 @@ NTSTATUS cm_connect_lsa(struct winbindd_
221  
222 anonymous:
223  
224 + if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
225 + result = NT_STATUS_DOWNGRADE_DETECTED;
226 + DEBUG(1, ("Unwilling to make LSA connection to domain %s "
227 + "without connection level security, "
228 + "must set 'winbind sealed pipes = false' "
229 + "to proceed: %s\n",
230 + domain->name, nt_errstr(result)));
231 + goto done;
232 + }
233 +
234 result = cli_rpc_pipe_open_noauth(conn->cli,
235 &ndr_table_lsarpc.syntax_id,
236 &conn->lsa_pipe);
237 @@ -2749,7 +2768,18 @@ NTSTATUS cm_connect_netlogon(struct winb
238  
239 no_schannel:
240 if ((lp_client_schannel() == False) ||
241 - ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
242 + ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
243 + if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
244 + result = NT_STATUS_DOWNGRADE_DETECTED;
245 + DEBUG(1, ("Unwilling to make connection to domain %s "
246 + "without connection level security, "
247 + "must set 'winbind sealed pipes = false' "
248 + "to proceed: %s\n",
249 + domain->name, nt_errstr(result)));
250 + TALLOC_FREE(netlogon_pipe);
251 + invalidate_cm_connection(conn);
252 + return result;
253 + }
254 /*
255 * NetSamLogonEx only works for schannel
256 */