package/network/services/samba36/patches/026-CVE-2016-2115-v3-6.patch

   1 From 513bd34e4523e49e742487be32a7239111486a12 Mon Sep 17 00:00:00 2001
   2 From: Stefan Metzmacher <metze@samba.org>
   3 Date: Sat, 27 Feb 2016 03:43:58 +0100
   4 Subject: [PATCH 1/4] CVE-2016-2115: docs-xml: add "client ipc signing" option
   5
   6 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756
   7
   8 Signed-off-by: Stefan Metzmacher <metze@samba.org>
   9 Reviewed-by: Ralph Boehme <slow@samba.org>
  10 ---
  11  docs-xml/smbdotconf/security/clientipcsigning.xml | 23 +++++++++++++++++++++++
  12  docs-xml/smbdotconf/security/clientsigning.xml    |  3 +++
  13  source3/include/proto.h                           |  1 +
  14  source3/param/loadparm.c                          | 12 ++++++++++++
  15  4 files changed, 39 insertions(+)
  16  create mode 100644 docs-xml/smbdotconf/security/clientipcsigning.xml
  17
  18 --- /dev/null
  19 +++ b/docs-xml/smbdotconf/security/clientipcsigning.xml
  20 @@ -0,0 +1,23 @@
  21 +<samba:parameter name="client ipc signing"
  22 +                 context="G"
  23 +                 type="enum"
  24 +                 enumlist="enum_smb_signing_vals"
  25 +                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
  26 +<description>
  27 +    <para>This controls whether the client is allowed or required to use SMB signing for IPC$
  28 +    connections as DCERPC transport inside of winbind. Possible values
  29 +    are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
  30 +    and <emphasis>disabled</emphasis>.
  31 +    </para>
  32 +
  33 +    <para>When set to auto, SMB signing is offered, but not enforced and if set
  34 +    to disabled, SMB signing is not offered either.</para>
  35 +
  36 +    <para>Connections from winbindd to Active Directory Domain Controllers
  37 +    always enforce signing.</para>
  38 +</description>
  39 +
  40 +<related>client signing</related>
  41 +
  42 +<value type="default">mandatory</value>
  43 +</samba:parameter>
  44 --- a/docs-xml/smbdotconf/security/clientsigning.xml
  45 +++ b/docs-xml/smbdotconf/security/clientsigning.xml
  46 @@ -12,6 +12,9 @@
  47      <para>When set to auto, SMB signing is offered, but not enforced.
  48      When set to mandatory, SMB signing is required and if set
  49         to disabled, SMB signing is not offered either.
  50 +
  51 +    <para>IPC$ connections for DCERPC e.g. in winbindd, are handled by the
  52 +    <smbconfoption name="client ipc signing"/> option.</para>
  53  </para>
  54  </description>
  55
  56 --- a/source3/include/proto.h
  57 +++ b/source3/include/proto.h
  58 @@ -1690,9 +1690,11 @@ int lp_winbind_cache_time(void);
  59  int lp_winbind_reconnect_delay(void);
  60  int lp_winbind_max_clients(void);
  61  const char **lp_winbind_nss_info(void);
  62 +bool lp_winbind_sealed_pipes(void);
  63  int lp_algorithmic_rid_base(void);
  64  int lp_name_cache_timeout(void);
  65  int lp_client_signing(void);
  66 +int lp_client_ipc_signing(void);
  67  int lp_server_signing(void);
  68  int lp_client_ldap_sasl_wrapping(void);
  69  char *lp_parm_talloc_string(int snum, const char *type, const char *option, const char *def);
  70 --- a/source3/param/loadparm.c
  71 +++ b/source3/param/loadparm.c
  72 @@ -215,6 +215,7 @@ struct global {
  73         int  winbind_expand_groups;
  74         bool bWinbindRefreshTickets;
  75         bool bWinbindOfflineLogon;
  76 +       bool bWinbindSealedPipes;
  77         bool bWinbindNormalizeNames;
  78         bool bWinbindRpcOnly;
  79         bool bCreateKrb5Conf;
  80 @@ -366,6 +367,7 @@ struct global {
  81         int restrict_anonymous;
  82         int name_cache_timeout;
  83         int client_signing;
  84 +       int client_ipc_signing;
  85         int server_signing;
  86         int client_ldap_sasl_wrapping;
  87         int iUsershareMaxShares;
  88 @@ -2319,6 +2321,15 @@ static struct parm_struct parm_table[] =
  89                 .flags          = FLAG_ADVANCED,
  90         },
  91         {
  92 +               .label          = "client ipc signing",
  93 +               .type           = P_ENUM,
  94 +               .p_class        = P_GLOBAL,
  95 +               .ptr            = &Globals.client_ipc_signing,
  96 +               .special        = NULL,
  97 +               .enum_list      = enum_smb_signing_vals,
  98 +               .flags          = FLAG_ADVANCED,
  99 +       },
 100 +       {
 101                 .label          = "server signing",
 102                 .type           = P_ENUM,
 103                 .p_class        = P_GLOBAL,
 104 @@ -4765,6 +4776,15 @@ static struct parm_struct parm_table[] =
 105                 .flags          = FLAG_ADVANCED,
 106         },
 107         {
 108 +               .label          = "winbind sealed pipes",
 109 +               .type           = P_BOOL,
 110 +               .p_class        = P_GLOBAL,
 111 +               .ptr            = &Globals.bWinbindSealedPipes,
 112 +               .special        = NULL,
 113 +               .enum_list      = NULL,
 114 +               .flags          = FLAG_ADVANCED,
 115 +       },
 116 +       {
 117                 .label          = "winbind normalize names",
 118                 .type           = P_BOOL,
 119                 .p_class        = P_GLOBAL,
 120 @@ -5458,6 +5478,7 @@ static void init_globals(bool reinit_glo
 121         Globals.szWinbindNssInfo = str_list_make_v3(NULL, "template", NULL);
 122         Globals.bWinbindRefreshTickets = False;
 123         Globals.bWinbindOfflineLogon = False;
 124 +       Globals.bWinbindSealedPipes = True;
 125
 126         Globals.iIdmapCacheTime = 86400 * 7; /* a week by default */
 127         Globals.iIdmapNegativeCacheTime = 120; /* 2 minutes by default */
 128 @@ -5470,6 +5491,7 @@ static void init_globals(bool reinit_glo
 129         Globals.bClientUseSpnego = True;
 130
 131         Globals.client_signing = Auto;
 132 +       Globals.client_ipc_signing = Required;
 133         Globals.server_signing = False;
 134
 135         Globals.bDeferSharingViolations = True;
 136 @@ -5736,6 +5758,7 @@ FN_GLOBAL_BOOL(lp_winbind_nested_groups,
 137  FN_GLOBAL_INTEGER(lp_winbind_expand_groups, &Globals.winbind_expand_groups)
 138  FN_GLOBAL_BOOL(lp_winbind_refresh_tickets, &Globals.bWinbindRefreshTickets)
 139  FN_GLOBAL_BOOL(lp_winbind_offline_logon, &Globals.bWinbindOfflineLogon)
 140 +FN_GLOBAL_BOOL(lp_winbind_sealed_pipes, &Globals.bWinbindSealedPipes)
 141  FN_GLOBAL_BOOL(lp_winbind_normalize_names, &Globals.bWinbindNormalizeNames)
 142  FN_GLOBAL_BOOL(lp_winbind_rpc_only, &Globals.bWinbindRpcOnly)
 143  FN_GLOBAL_BOOL(lp_create_krb5_conf, &Globals.bCreateKrb5Conf)
 144 @@ -6071,6 +6094,7 @@ FN_GLOBAL_LIST(lp_winbind_nss_info, &Glo
 145  FN_GLOBAL_INTEGER(lp_algorithmic_rid_base, &Globals.AlgorithmicRidBase)
 146  FN_GLOBAL_INTEGER(lp_name_cache_timeout, &Globals.name_cache_timeout)
 147  FN_GLOBAL_INTEGER(lp_client_signing, &Globals.client_signing)
 148 +FN_GLOBAL_INTEGER(lp_client_ipc_signing, &Globals.client_ipc_signing)
 149  FN_GLOBAL_INTEGER(lp_server_signing, &Globals.server_signing)
 150  FN_GLOBAL_INTEGER(lp_client_ldap_sasl_wrapping, &Globals.client_ldap_sasl_wrapping)
 151
 152 @@ -9700,6 +9724,20 @@ static bool lp_load_ex(const char *pszFn
 153                 lp_do_parameter(GLOBAL_SECTION_SNUM, "wins server", "127.0.0.1");
 154         }
 155
 156 +       if (!lp_is_in_client()) {
 157 +               switch (lp_client_ipc_signing()) {
 158 +               case Required:
 159 +                       lp_set_cmdline("client signing", "mandatory");
 160 +                       break;
 161 +               case Auto:
 162 +                       lp_set_cmdline("client signing", "auto");
 163 +                       break;
 164 +               case False:
 165 +                       lp_set_cmdline("client signing", "disabled");
 166 +                       break;
 167 +               }
 168 +       }
 169 +
 170         init_iconv();
 171
 172         bAllowIncludeRegistry = true;
 173 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
 174 +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
 175 @@ -2480,7 +2480,7 @@ static bool spoolss_connect_to_client(st
 176                 "", /* username */
 177                 "", /* domain */
 178                 "", /* password */
 179 -               0, lp_client_signing());
 180 +               0, False);
 181
 182         if ( !NT_STATUS_IS_OK( ret ) ) {
 183                 DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n",
 184 --- /dev/null
 185 +++ b/docs-xml/smbdotconf/winbind/winbindsealedpipes.xml
 186 @@ -0,0 +1,15 @@
 187 +<samba:parameter name="winbind sealed pipes"
 188 +                 context="G"
 189 +                 type="boolean"
 190 +                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
 191 +<description>
 192 +       <para>This option controls whether any requests from winbindd to domain controllers
 193 +               pipe will be sealed. Disabling sealing can be useful for debugging
 194 +               purposes.</para>
 195 +
 196 +       <para>The behavior can be controlled per netbios domain
 197 +       by using 'winbind sealed pipes:NETBIOSDOMAIN = no' as option.</para>
 198 +</description>
 199 +
 200 +<value type="default">yes</value>
 201 +</samba:parameter>
 202 --- a/source3/winbindd/winbindd_cm.c
 203 +++ b/source3/winbindd/winbindd_cm.c
 204 @@ -2384,6 +2384,15 @@ NTSTATUS cm_connect_sam(struct winbindd_
 205         TALLOC_FREE(conn->samr_pipe);
 206
 207   anonymous:
 208 +       if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
 209 +               status = NT_STATUS_DOWNGRADE_DETECTED;
 210 +               DEBUG(1, ("Unwilling to make SAMR connection to domain %s "
 211 +                         "without connection level security, "
 212 +                         "must set 'winbind sealed pipes = false' "
 213 +                         "to proceed: %s\n",
 214 +                         domain->name, nt_errstr(status)));
 215 +               goto done;
 216 +       }
 217
 218         /* Finally fall back to anonymous. */
 219         status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
 220 @@ -2610,6 +2619,16 @@ NTSTATUS cm_connect_lsa(struct winbindd_
 221
 222   anonymous:
 223
 224 +       if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
 225 +               result = NT_STATUS_DOWNGRADE_DETECTED;
 226 +               DEBUG(1, ("Unwilling to make LSA connection to domain %s "
 227 +                         "without connection level security, "
 228 +                         "must set 'winbind sealed pipes = false' "
 229 +                         "to proceed: %s\n",
 230 +                         domain->name, nt_errstr(result)));
 231 +               goto done;
 232 +       }
 233 +
 234         result = cli_rpc_pipe_open_noauth(conn->cli,
 235                                           &ndr_table_lsarpc.syntax_id,
 236                                           &conn->lsa_pipe);
 237 @@ -2749,7 +2768,18 @@ NTSTATUS cm_connect_netlogon(struct winb
 238
 239   no_schannel:
 240         if ((lp_client_schannel() == False) ||
 241 -                       ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
 242 +               ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
 243 +               if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
 244 +                       result = NT_STATUS_DOWNGRADE_DETECTED;
 245 +                       DEBUG(1, ("Unwilling to make connection to domain %s "
 246 +                                 "without connection level security, "
 247 +                                 "must set 'winbind sealed pipes = false' "
 248 +                                 "to proceed: %s\n",
 249 +                                 domain->name, nt_errstr(result)));
 250 +                       TALLOC_FREE(netlogon_pipe);
 251 +                       invalidate_cm_connection(conn);
 252 +                       return result;
 253 +               }
 254                 /*
 255                  * NetSamLogonEx only works for schannel
 256                  */