1
0

026-CVE-2016-2115-v3-6.patch 9.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256
  1. From 513bd34e4523e49e742487be32a7239111486a12 Mon Sep 17 00:00:00 2001
  2. From: Stefan Metzmacher <metze@samba.org>
  3. Date: Sat, 27 Feb 2016 03:43:58 +0100
  4. Subject: [PATCH 1/4] CVE-2016-2115: docs-xml: add "client ipc signing" option
  5. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756
  6. Signed-off-by: Stefan Metzmacher <metze@samba.org>
  7. Reviewed-by: Ralph Boehme <slow@samba.org>
  8. ---
  9. docs-xml/smbdotconf/security/clientipcsigning.xml | 23 +++++++++++++++++++++++
  10. docs-xml/smbdotconf/security/clientsigning.xml | 3 +++
  11. source3/include/proto.h | 1 +
  12. source3/param/loadparm.c | 12 ++++++++++++
  13. 4 files changed, 39 insertions(+)
  14. create mode 100644 docs-xml/smbdotconf/security/clientipcsigning.xml
  15. --- /dev/null
  16. +++ b/docs-xml/smbdotconf/security/clientipcsigning.xml
  17. @@ -0,0 +1,23 @@
  18. +<samba:parameter name="client ipc signing"
  19. + context="G"
  20. + type="enum"
  21. + enumlist="enum_smb_signing_vals"
  22. + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
  23. +<description>
  24. + <para>This controls whether the client is allowed or required to use SMB signing for IPC$
  25. + connections as DCERPC transport inside of winbind. Possible values
  26. + are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
  27. + and <emphasis>disabled</emphasis>.
  28. + </para>
  29. +
  30. + <para>When set to auto, SMB signing is offered, but not enforced and if set
  31. + to disabled, SMB signing is not offered either.</para>
  32. +
  33. + <para>Connections from winbindd to Active Directory Domain Controllers
  34. + always enforce signing.</para>
  35. +</description>
  36. +
  37. +<related>client signing</related>
  38. +
  39. +<value type="default">mandatory</value>
  40. +</samba:parameter>
  41. --- a/docs-xml/smbdotconf/security/clientsigning.xml
  42. +++ b/docs-xml/smbdotconf/security/clientsigning.xml
  43. @@ -12,6 +12,9 @@
  44. <para>When set to auto, SMB signing is offered, but not enforced.
  45. When set to mandatory, SMB signing is required and if set
  46. to disabled, SMB signing is not offered either.
  47. +
  48. + <para>IPC$ connections for DCERPC e.g. in winbindd, are handled by the
  49. + <smbconfoption name="client ipc signing"/> option.</para>
  50. </para>
  51. </description>
  52. --- a/source3/include/proto.h
  53. +++ b/source3/include/proto.h
  54. @@ -1690,9 +1690,11 @@ int lp_winbind_cache_time(void);
  55. int lp_winbind_reconnect_delay(void);
  56. int lp_winbind_max_clients(void);
  57. const char **lp_winbind_nss_info(void);
  58. +bool lp_winbind_sealed_pipes(void);
  59. int lp_algorithmic_rid_base(void);
  60. int lp_name_cache_timeout(void);
  61. int lp_client_signing(void);
  62. +int lp_client_ipc_signing(void);
  63. int lp_server_signing(void);
  64. int lp_client_ldap_sasl_wrapping(void);
  65. char *lp_parm_talloc_string(int snum, const char *type, const char *option, const char *def);
  66. --- a/source3/param/loadparm.c
  67. +++ b/source3/param/loadparm.c
  68. @@ -215,6 +215,7 @@ struct global {
  69. int winbind_expand_groups;
  70. bool bWinbindRefreshTickets;
  71. bool bWinbindOfflineLogon;
  72. + bool bWinbindSealedPipes;
  73. bool bWinbindNormalizeNames;
  74. bool bWinbindRpcOnly;
  75. bool bCreateKrb5Conf;
  76. @@ -366,6 +367,7 @@ struct global {
  77. int restrict_anonymous;
  78. int name_cache_timeout;
  79. int client_signing;
  80. + int client_ipc_signing;
  81. int server_signing;
  82. int client_ldap_sasl_wrapping;
  83. int iUsershareMaxShares;
  84. @@ -2319,6 +2321,15 @@ static struct parm_struct parm_table[] =
  85. .flags = FLAG_ADVANCED,
  86. },
  87. {
  88. + .label = "client ipc signing",
  89. + .type = P_ENUM,
  90. + .p_class = P_GLOBAL,
  91. + .ptr = &Globals.client_ipc_signing,
  92. + .special = NULL,
  93. + .enum_list = enum_smb_signing_vals,
  94. + .flags = FLAG_ADVANCED,
  95. + },
  96. + {
  97. .label = "server signing",
  98. .type = P_ENUM,
  99. .p_class = P_GLOBAL,
  100. @@ -4765,6 +4776,15 @@ static struct parm_struct parm_table[] =
  101. .flags = FLAG_ADVANCED,
  102. },
  103. {
  104. + .label = "winbind sealed pipes",
  105. + .type = P_BOOL,
  106. + .p_class = P_GLOBAL,
  107. + .ptr = &Globals.bWinbindSealedPipes,
  108. + .special = NULL,
  109. + .enum_list = NULL,
  110. + .flags = FLAG_ADVANCED,
  111. + },
  112. + {
  113. .label = "winbind normalize names",
  114. .type = P_BOOL,
  115. .p_class = P_GLOBAL,
  116. @@ -5458,6 +5478,7 @@ static void init_globals(bool reinit_glo
  117. Globals.szWinbindNssInfo = str_list_make_v3(NULL, "template", NULL);
  118. Globals.bWinbindRefreshTickets = False;
  119. Globals.bWinbindOfflineLogon = False;
  120. + Globals.bWinbindSealedPipes = True;
  121. Globals.iIdmapCacheTime = 86400 * 7; /* a week by default */
  122. Globals.iIdmapNegativeCacheTime = 120; /* 2 minutes by default */
  123. @@ -5470,6 +5491,7 @@ static void init_globals(bool reinit_glo
  124. Globals.bClientUseSpnego = True;
  125. Globals.client_signing = Auto;
  126. + Globals.client_ipc_signing = Required;
  127. Globals.server_signing = False;
  128. Globals.bDeferSharingViolations = True;
  129. @@ -5736,6 +5758,7 @@ FN_GLOBAL_BOOL(lp_winbind_nested_groups,
  130. FN_GLOBAL_INTEGER(lp_winbind_expand_groups, &Globals.winbind_expand_groups)
  131. FN_GLOBAL_BOOL(lp_winbind_refresh_tickets, &Globals.bWinbindRefreshTickets)
  132. FN_GLOBAL_BOOL(lp_winbind_offline_logon, &Globals.bWinbindOfflineLogon)
  133. +FN_GLOBAL_BOOL(lp_winbind_sealed_pipes, &Globals.bWinbindSealedPipes)
  134. FN_GLOBAL_BOOL(lp_winbind_normalize_names, &Globals.bWinbindNormalizeNames)
  135. FN_GLOBAL_BOOL(lp_winbind_rpc_only, &Globals.bWinbindRpcOnly)
  136. FN_GLOBAL_BOOL(lp_create_krb5_conf, &Globals.bCreateKrb5Conf)
  137. @@ -6071,6 +6094,7 @@ FN_GLOBAL_LIST(lp_winbind_nss_info, &Glo
  138. FN_GLOBAL_INTEGER(lp_algorithmic_rid_base, &Globals.AlgorithmicRidBase)
  139. FN_GLOBAL_INTEGER(lp_name_cache_timeout, &Globals.name_cache_timeout)
  140. FN_GLOBAL_INTEGER(lp_client_signing, &Globals.client_signing)
  141. +FN_GLOBAL_INTEGER(lp_client_ipc_signing, &Globals.client_ipc_signing)
  142. FN_GLOBAL_INTEGER(lp_server_signing, &Globals.server_signing)
  143. FN_GLOBAL_INTEGER(lp_client_ldap_sasl_wrapping, &Globals.client_ldap_sasl_wrapping)
  144. @@ -9700,6 +9724,20 @@ static bool lp_load_ex(const char *pszFn
  145. lp_do_parameter(GLOBAL_SECTION_SNUM, "wins server", "127.0.0.1");
  146. }
  147. + if (!lp_is_in_client()) {
  148. + switch (lp_client_ipc_signing()) {
  149. + case Required:
  150. + lp_set_cmdline("client signing", "mandatory");
  151. + break;
  152. + case Auto:
  153. + lp_set_cmdline("client signing", "auto");
  154. + break;
  155. + case False:
  156. + lp_set_cmdline("client signing", "disabled");
  157. + break;
  158. + }
  159. + }
  160. +
  161. init_iconv();
  162. bAllowIncludeRegistry = true;
  163. --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
  164. +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
  165. @@ -2480,7 +2480,7 @@ static bool spoolss_connect_to_client(st
  166. "", /* username */
  167. "", /* domain */
  168. "", /* password */
  169. - 0, lp_client_signing());
  170. + 0, False);
  171. if ( !NT_STATUS_IS_OK( ret ) ) {
  172. DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n",
  173. --- /dev/null
  174. +++ b/docs-xml/smbdotconf/winbind/winbindsealedpipes.xml
  175. @@ -0,0 +1,15 @@
  176. +<samba:parameter name="winbind sealed pipes"
  177. + context="G"
  178. + type="boolean"
  179. + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
  180. +<description>
  181. + <para>This option controls whether any requests from winbindd to domain controllers
  182. + pipe will be sealed. Disabling sealing can be useful for debugging
  183. + purposes.</para>
  184. +
  185. + <para>The behavior can be controlled per netbios domain
  186. + by using 'winbind sealed pipes:NETBIOSDOMAIN = no' as option.</para>
  187. +</description>
  188. +
  189. +<value type="default">yes</value>
  190. +</samba:parameter>
  191. --- a/source3/winbindd/winbindd_cm.c
  192. +++ b/source3/winbindd/winbindd_cm.c
  193. @@ -2384,6 +2384,15 @@ NTSTATUS cm_connect_sam(struct winbindd_
  194. TALLOC_FREE(conn->samr_pipe);
  195. anonymous:
  196. + if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
  197. + status = NT_STATUS_DOWNGRADE_DETECTED;
  198. + DEBUG(1, ("Unwilling to make SAMR connection to domain %s "
  199. + "without connection level security, "
  200. + "must set 'winbind sealed pipes = false' "
  201. + "to proceed: %s\n",
  202. + domain->name, nt_errstr(status)));
  203. + goto done;
  204. + }
  205. /* Finally fall back to anonymous. */
  206. status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
  207. @@ -2610,6 +2619,16 @@ NTSTATUS cm_connect_lsa(struct winbindd_
  208. anonymous:
  209. + if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
  210. + result = NT_STATUS_DOWNGRADE_DETECTED;
  211. + DEBUG(1, ("Unwilling to make LSA connection to domain %s "
  212. + "without connection level security, "
  213. + "must set 'winbind sealed pipes = false' "
  214. + "to proceed: %s\n",
  215. + domain->name, nt_errstr(result)));
  216. + goto done;
  217. + }
  218. +
  219. result = cli_rpc_pipe_open_noauth(conn->cli,
  220. &ndr_table_lsarpc.syntax_id,
  221. &conn->lsa_pipe);
  222. @@ -2749,7 +2768,18 @@ NTSTATUS cm_connect_netlogon(struct winb
  223. no_schannel:
  224. if ((lp_client_schannel() == False) ||
  225. - ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
  226. + ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
  227. + if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
  228. + result = NT_STATUS_DOWNGRADE_DETECTED;
  229. + DEBUG(1, ("Unwilling to make connection to domain %s "
  230. + "without connection level security, "
  231. + "must set 'winbind sealed pipes = false' "
  232. + "to proceed: %s\n",
  233. + domain->name, nt_errstr(result)));
  234. + TALLOC_FREE(netlogon_pipe);
  235. + invalidate_cm_connection(conn);
  236. + return result;
  237. + }
  238. /*
  239. * NetSamLogonEx only works for schannel
  240. */