From 6899179e2a8193a0d60dc4d22ec91044f7519ac2 Mon Sep 17 00:00:00 2001 From: RISCi_ATOM Date: Sat, 29 Jun 2019 13:57:33 -0400 Subject: [PATCH] update Samba to 3.6.25, based upon 18.06 --- package/network/services/samba36/Makefile | 51 +++++-- .../services/samba36/files/lib/samba.sh | 89 ++++++++++++ .../services/samba36/files/samba.config | 4 +- .../services/samba36/files/samba.hotplug | 11 ++ .../network/services/samba36/files/samba.init | 14 +- .../services/samba36/files/smb.conf.template | 12 +- .../patches/028-CVE-2016-2125-v3.6.patch | 59 ++++++++ ...3-6.patch => 029-CVE-2017-7494-v3-6.patch} | 0 ...75.patch => 030-CVE-2017-15275-v3.6.patch} | 0 .../patches/031-CVE-2017-12163-v3.6.patch | 136 ++++++++++++++++++ .../patches/032-CVE-2017-12150-v3.6.patch | 75 ++++++++++ .../patches/032-CVE-2018-1050-v3-6.patch | 49 +++++++ .../patches/200-remove_printer_support.patch | 4 +- 13 files changed, 471 insertions(+), 33 deletions(-) create mode 100644 package/network/services/samba36/files/lib/samba.sh create mode 100644 package/network/services/samba36/files/samba.hotplug create mode 100644 package/network/services/samba36/patches/028-CVE-2016-2125-v3.6.patch rename package/network/services/samba36/patches/{028-CVE-2017-7494-v3-6.patch => 029-CVE-2017-7494-v3-6.patch} (100%) rename package/network/services/samba36/patches/{029-CVE-2017-15275.patch => 030-CVE-2017-15275-v3.6.patch} (100%) create mode 100644 package/network/services/samba36/patches/031-CVE-2017-12163-v3.6.patch create mode 100644 package/network/services/samba36/patches/032-CVE-2017-12150-v3.6.patch create mode 100644 package/network/services/samba36/patches/032-CVE-2018-1050-v3-6.patch diff --git a/package/network/services/samba36/Makefile b/package/network/services/samba36/Makefile index 24d3f03001..b4322f04f4 100644 --- a/package/network/services/samba36/Makefile +++ b/package/network/services/samba36/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=samba PKG_VERSION:=3.6.25 -PKG_RELEASE:=7 +PKG_RELEASE:=12 PKG_SOURCE_URL:=https://download.samba.org/pub/samba \ https://download.samba.org/pub/samba/stable @@ -18,8 +18,7 @@ PKG_HASH:=8f2c8a7f2bd89b0dfd228ed917815852f7c625b2bc0936304ac3ed63aaf83751 PKG_LICENSE:=GPL-3.0 PKG_LICENSE_FILES:=COPYING - -PKG_MAINTAINER:=Felix Fietkau +PKG_CPE_ID:=cpe:/a:samba:samba PKG_BUILD_PARALLEL:=1 @@ -30,19 +29,35 @@ CONFIGURE_PATH:=source3 PKG_BUILD_BIN:=$(PKG_BUILD_DIR)/$(MAKE_PATH)/bin -define Package/samba36-server +define Package/samba/Default SECTION:=net CATEGORY:=Network - TITLE:=Samba 3.6 SMB/CIFS server + TITLE:=Samba 3.6 SMB/CIFS URL:=https://www.samba.org/ + MAINTAINER:=Felix Fietkau +endef + +define Package/samba36-server + $(call Package/samba/Default) + TITLE+= server DEPENDS:=+USE_GLIBC:librt $(ICONV_DEPENDS) endef +define Package/samba36-hotplug + $(call Package/samba/Default) + TITLE+= hotplug + DEPENDS:=+block-mount +endef + define Package/samba36-client - SECTION:=net - CATEGORY:=Network - TITLE:=Samba 3.6 SMB/CIFS client - URL:=https://www.samba.org/ + $(call Package/samba/Default) + TITLE+= client + DEPENDS:=+libreadline +libncurses +endef + +define Package/samba36-net + $(call Package/samba/Default) + TITLE+= net commands DEPENDS:=+libreadline +libncurses endef @@ -51,7 +66,6 @@ define Package/samba36-server/config int "Maximum level of compiled-in debug messages" depends on PACKAGE_samba36-server || PACKAGE_samba36-client default -1 - endef define Package/samba36-server/description @@ -93,6 +107,9 @@ CONFIGURE_ARGS += \ --prefix=/ \ --disable-avahi \ --disable-cups \ + --disable-external-libtalloc \ + --disable-external-libtdb \ + --disable-external-libtevent \ --disable-pie \ --disable-relro \ --disable-static \ @@ -150,12 +167,26 @@ define Package/samba36-server/install $(LN) samba_multicall $(1)/usr/sbin/smbpasswd endef +define Package/samba36-hotplug/install + $(INSTALL_DIR) $(1)/lib/samba + $(INSTALL_DATA) ./files/lib/samba.sh $(1)/lib/samba/samba.sh + $(INSTALL_DIR) $(1)/etc/hotplug.d/block + $(INSTALL_DATA) ./files/samba.hotplug $(1)/etc/hotplug.d/block/60-samba +endef + define Package/samba36-client/install $(INSTALL_DIR) $(1)/usr/sbin $(INSTALL_BIN) $(PKG_BUILD_BIN)/smbclient $(1)/usr/sbin $(INSTALL_BIN) $(PKG_BUILD_BIN)/nmblookup $(1)/usr/sbin endef +define Package/samba36-net/install + $(INSTALL_DIR) $(1)/usr/sbin + $(INSTALL_BIN) $(PKG_BUILD_BIN)/net $(1)/usr/sbin +endef + $(eval $(call BuildPackage,samba36-client)) $(eval $(call BuildPackage,samba36-server)) +$(eval $(call BuildPackage,samba36-hotplug)) +$(eval $(call BuildPackage,samba36-net)) diff --git a/package/network/services/samba36/files/lib/samba.sh b/package/network/services/samba36/files/lib/samba.sh new file mode 100644 index 0000000000..a72a2a1933 --- /dev/null +++ b/package/network/services/samba36/files/lib/samba.sh @@ -0,0 +1,89 @@ +#!/bin/sh +# +# Copyright (C) 2018 OpenWrt.org +# Copyright (C) 2018 rosysong@rosinson.com +# + +. /lib/functions.sh + +FLAG_DEV_TYPE= +FLAG_DEV_MOPT= +FLAG_HAS_SECT= + +samba_dev_filter() { # <[path,/dev/]> + case $1 in + ${2}mtdblock*|\ + ${2}ubi*) + FLAG_DEV_TYPE="mtd" + ;; + ${2}loop*|\ + ${2}mmcblk*|\ + ${2}sd*|\ + ${2}hd*|\ + ${2}md*|\ + ${2}nvme*|\ + ${2}vd*|\ + ${2}xvd*) + FLAG_DEV_TYPE="not-mtd" + ;; + *) + [ -b ${2}${1} ] && FLAG_DEV_TYPE="not-mtd" + [ -b /dev/mapper/$1 ] && FLAG_DEV_TYPE="not-mtd" + ;; + esac +} + +samba_cfg_lookup() { #
+ config_get name $1 name + [ "$name" = "$2" ] || return + FLAG_HAS_SECT=y +} + +samba_cfg_delete() { #
+ config_get name $1 name + [ "$name" = "$2" ] || return + uci -q delete samba.$1 +} + +samba_find_mount_point() { # + # search mount point in /proc/mounts + while read l; do + local d=$(echo $l | awk '/^\/dev/ {print $1}') + [ "$d" = "/dev/$1" ] || continue + + FLAG_DEV_MOPT=$(echo $l | awk '/^\/dev/ {print $2}') + break + done < /proc/mounts +} + +_samba_add_section() { # + uci -q batch <<-EOF + add samba sambashare + set samba.@sambashare[-1].browseable='yes' + set samba.@sambashare[-1].name='$1' + set samba.@sambashare[-1].path='$2' + set samba.@sambashare[-1].users='root' + set samba.@sambashare[-1].read_only='no' + set samba.@sambashare[-1].guest_ok='yes' + set samba.@sambashare[-1].create_mask='0755' + set samba.@sambashare[-1].dir_mask='0755' + EOF +} + +samba_add_section() { # [] + FLAG_HAS_SECT= + FLAG_DEV_MOPT= + + config_foreach samba_cfg_lookup sambashare $1 + [ -z "$FLAG_HAS_SECT" ] || return + + samba_find_mount_point $1 + [ -n "$FLAG_DEV_MOPT" ] || return + + [ -n "$2" -a "$2" = "$FLAG_DEV_MOPT" ] || \ + _samba_add_section $1 $FLAG_DEV_MOPT +} + +samba_delete_section() { # + config_foreach samba_cfg_delete sambashare $1 +} diff --git a/package/network/services/samba36/files/samba.config b/package/network/services/samba36/files/samba.config index b34a8dcaac..c79db0d322 100644 --- a/package/network/services/samba36/files/samba.config +++ b/package/network/services/samba36/files/samba.config @@ -1,6 +1,6 @@ config samba - option 'name' 'Lede' + option 'name' 'OpenWrt' option 'workgroup' 'WORKGROUP' - option 'description' 'Lede' + option 'description' 'OpenWrt' option 'homes' '1' diff --git a/package/network/services/samba36/files/samba.hotplug b/package/network/services/samba36/files/samba.hotplug new file mode 100644 index 0000000000..9c6dbe5e41 --- /dev/null +++ b/package/network/services/samba36/files/samba.hotplug @@ -0,0 +1,11 @@ +. /lib/samba/samba.sh + +samba_dev_filter $DEVNAME +[ "$FLAG_DEV_TYPE" = "not-mtd" ] || exit + +config_load samba +case $ACTION in + add) samba_add_section $DEVNAME;; + remove) samba_delete_section $DEVNAME;; +esac +uci commit samba diff --git a/package/network/services/samba36/files/samba.init b/package/network/services/samba36/files/samba.init index c8413243ba..1c5bb3b3c4 100755 --- a/package/network/services/samba36/files/samba.init +++ b/package/network/services/samba36/files/samba.init @@ -15,12 +15,7 @@ smb_header() { for net in $samba_iface; do local device network_is_up $net || continue - network_get_device device "$net" && { - local subnet - network_get_subnet subnet "$net" && echo -n "$subnet " - network_get_subnet6 subnet "$net" && echo -n "$subnet " - } - + network_get_device device "$net" echo -n "${device:-$net} " done ) @@ -28,9 +23,9 @@ smb_header() { local name workgroup description charset local hostname="$(uci_get system.@system[0].hostname)" - config_get name $1 name "${hostname:-Lede}" - config_get workgroup $1 workgroup "${hostname:-Lede}" - config_get description $1 description "Samba on ${hostname:-Lede}" + config_get name $1 name "${hostname:-OpenWrt}" + config_get workgroup $1 workgroup "${hostname:-OpenWrt}" + config_get description $1 description "Samba on ${hostname:-OpenWrt}" config_get charset $1 charset "UTF-8" mkdir -p /var/etc @@ -106,6 +101,7 @@ start_service() { init_config procd_open_instance + procd_add_mdns "smb" "tcp" "445" procd_set_param command /usr/sbin/smbd -F procd_set_param respawn procd_set_param file /var/etc/smb.conf diff --git a/package/network/services/samba36/files/smb.conf.template b/package/network/services/samba36/files/smb.conf.template index 35e486fd89..fc72f9258c 100644 --- a/package/network/services/samba36/files/smb.conf.template +++ b/package/network/services/samba36/files/smb.conf.template @@ -5,24 +5,16 @@ server string = |DESCRIPTION| unix charset = |CHARSET| workgroup = |WORKGROUP| - local master = no - browseable = yes + bind interfaces only = yes deadtime = 30 - domain master = yes - encrypt passwords = yes enable core files = no - guest ok = yes invalid users = root - load printers = no + local master = no map to guest = Bad User max protocol = SMB2 min receivefile size = 16384 null passwords = yes passdb backend = smbpasswd - preferred master = yes security = user smb passwd file = /etc/samba/smbpasswd - syslog = 2 use sendfile = yes - writeable = yes - bind interfaces only = yes diff --git a/package/network/services/samba36/patches/028-CVE-2016-2125-v3.6.patch b/package/network/services/samba36/patches/028-CVE-2016-2125-v3.6.patch new file mode 100644 index 0000000000..8e174f0e7b --- /dev/null +++ b/package/network/services/samba36/patches/028-CVE-2016-2125-v3.6.patch @@ -0,0 +1,59 @@ +From: =?utf-8?q?Guido_G=C3=BCnther?= +Date: Wed, 28 Dec 2016 19:21:49 +0100 +Subject: security-CVE-2016-2125: Don't pass GSS_C_DELEG_FLAG by default + +This is a backport of upstream commits + + b1a056f77e793efc45df34ab7bf78fbec1bf8a59 + b83897ae49fdee1fda73c10c7fe73362bfaba690 (code not used in wheezy) + 3106964a640ddf6a3c08c634ff586a814f94dff8 (code not used in wheezy) +--- + source3/librpc/crypto/gse.c | 1 - + source3/libsmb/clifsinfo.c | 2 +- + source4/auth/gensec/gensec_gssapi.c | 2 +- + source4/scripting/bin/nsupdate-gss | 2 +- + 4 files changed, 3 insertions(+), 4 deletions(-) + +--- a/source3/librpc/crypto/gse.c ++++ b/source3/librpc/crypto/gse.c +@@ -162,7 +162,6 @@ static NTSTATUS gse_context_init(TALLOC_ + memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc)); + + gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG | +- GSS_C_DELEG_FLAG | + GSS_C_DELEG_POLICY_FLAG | + GSS_C_REPLAY_FLAG | + GSS_C_SEQUENCE_FLAG; +--- a/source3/libsmb/clifsinfo.c ++++ b/source3/libsmb/clifsinfo.c +@@ -726,7 +726,7 @@ static NTSTATUS make_cli_gss_blob(TALLOC + &es->s.gss_state->gss_ctx, + srv_name, + GSS_C_NO_OID, /* default OID. */ +- GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_FLAG, ++ GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_POLICY_FLAG, + GSS_C_INDEFINITE, /* requested ticket lifetime. */ + NULL, /* no channel bindings */ + p_tok_in, +--- a/source4/auth/gensec/gensec_gssapi.c ++++ b/source4/auth/gensec/gensec_gssapi.c +@@ -172,7 +172,7 @@ static NTSTATUS gensec_gssapi_start(stru + if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "mutual", true)) { + gensec_gssapi_state->want_flags |= GSS_C_MUTUAL_FLAG; + } +- if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", true)) { ++ if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", false)) { + gensec_gssapi_state->want_flags |= GSS_C_DELEG_FLAG; + } + if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "replay", true)) { +--- a/source4/scripting/bin/nsupdate-gss ++++ b/source4/scripting/bin/nsupdate-gss +@@ -178,7 +178,7 @@ sub negotiate_tkey($$$$) + my $flags = + GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | + GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG | +- GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG; ++ GSS_C_INTEG_FLAG; + + + $status = GSSAPI::Cred::acquire_cred(undef, 120, undef, GSS_C_INITIATE, diff --git a/package/network/services/samba36/patches/028-CVE-2017-7494-v3-6.patch b/package/network/services/samba36/patches/029-CVE-2017-7494-v3-6.patch similarity index 100% rename from package/network/services/samba36/patches/028-CVE-2017-7494-v3-6.patch rename to package/network/services/samba36/patches/029-CVE-2017-7494-v3-6.patch diff --git a/package/network/services/samba36/patches/029-CVE-2017-15275.patch b/package/network/services/samba36/patches/030-CVE-2017-15275-v3.6.patch similarity index 100% rename from package/network/services/samba36/patches/029-CVE-2017-15275.patch rename to package/network/services/samba36/patches/030-CVE-2017-15275-v3.6.patch diff --git a/package/network/services/samba36/patches/031-CVE-2017-12163-v3.6.patch b/package/network/services/samba36/patches/031-CVE-2017-12163-v3.6.patch new file mode 100644 index 0000000000..d7faa1388d --- /dev/null +++ b/package/network/services/samba36/patches/031-CVE-2017-12163-v3.6.patch @@ -0,0 +1,136 @@ +From: =?utf-8?q?Guido_G=C3=BCnther?= +Date: Wed, 20 Sep 2017 20:02:03 +0200 +Subject: CVE-2017-12163: s3:smbd: Prevent client short SMB1 write from + writing server memory to file. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=13020 + +Author: Jeremy Allison +Signed-off-by: Jeremy Allison +Signed-off-by: Stefan Metzmacher +--- + source3/smbd/reply.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 50 insertions(+) + +--- a/source3/smbd/reply.c ++++ b/source3/smbd/reply.c +@@ -3979,6 +3979,9 @@ void reply_writebraw(struct smb_request + } + + /* Ensure we don't write bytes past the end of this packet. */ ++ /* ++ * This already protects us against CVE-2017-12163. ++ */ + if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) { + reply_nterror(req, NT_STATUS_INVALID_PARAMETER); + error_to_writebrawerr(req); +@@ -4080,6 +4083,11 @@ void reply_writebraw(struct smb_request + exit_server_cleanly("secondary writebraw failed"); + } + ++ /* ++ * We are not vulnerable to CVE-2017-12163 ++ * here as we are guarenteed to have numtowrite ++ * bytes available - we just read from the client. ++ */ + nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite); + if (nwritten == -1) { + TALLOC_FREE(buf); +@@ -4161,6 +4169,7 @@ void reply_writeunlock(struct smb_reques + connection_struct *conn = req->conn; + ssize_t nwritten = -1; + size_t numtowrite; ++ size_t remaining; + SMB_OFF_T startpos; + const char *data; + NTSTATUS status = NT_STATUS_OK; +@@ -4193,6 +4202,17 @@ void reply_writeunlock(struct smb_reques + startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0); + data = (const char *)req->buf + 3; + ++ /* ++ * Ensure client isn't asking us to write more than ++ * they sent. CVE-2017-12163. ++ */ ++ remaining = smbreq_bufrem(req, data); ++ if (numtowrite > remaining) { ++ reply_nterror(req, NT_STATUS_INVALID_PARAMETER); ++ END_PROFILE(SMBwriteunlock); ++ return; ++ } ++ + if (!fsp->print_file && numtowrite > 0) { + init_strict_lock_struct(fsp, (uint64_t)req->smbpid, + (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK, +@@ -4274,6 +4294,7 @@ void reply_write(struct smb_request *req + { + connection_struct *conn = req->conn; + size_t numtowrite; ++ size_t remaining; + ssize_t nwritten = -1; + SMB_OFF_T startpos; + const char *data; +@@ -4314,6 +4335,17 @@ void reply_write(struct smb_request *req + startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0); + data = (const char *)req->buf + 3; + ++ /* ++ * Ensure client isn't asking us to write more than ++ * they sent. CVE-2017-12163. ++ */ ++ remaining = smbreq_bufrem(req, data); ++ if (numtowrite > remaining) { ++ reply_nterror(req, NT_STATUS_INVALID_PARAMETER); ++ END_PROFILE(SMBwrite); ++ return; ++ } ++ + if (!fsp->print_file) { + init_strict_lock_struct(fsp, (uint64_t)req->smbpid, + (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK, +@@ -4525,6 +4557,9 @@ void reply_write_and_X(struct smb_reques + return; + } + } else { ++ /* ++ * This already protects us against CVE-2017-12163. ++ */ + if (smb_doff > smblen || smb_doff + numtowrite < numtowrite || + smb_doff + numtowrite > smblen) { + reply_nterror(req, NT_STATUS_INVALID_PARAMETER); +@@ -4894,6 +4929,7 @@ void reply_writeclose(struct smb_request + { + connection_struct *conn = req->conn; + size_t numtowrite; ++ size_t remaining; + ssize_t nwritten = -1; + NTSTATUS close_status = NT_STATUS_OK; + SMB_OFF_T startpos; +@@ -4927,6 +4963,17 @@ void reply_writeclose(struct smb_request + mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4)); + data = (const char *)req->buf + 1; + ++ /* ++ * Ensure client isn't asking us to write more than ++ * they sent. CVE-2017-12163. ++ */ ++ remaining = smbreq_bufrem(req, data); ++ if (numtowrite > remaining) { ++ reply_nterror(req, NT_STATUS_INVALID_PARAMETER); ++ END_PROFILE(SMBwriteclose); ++ return; ++ } ++ + if (!fsp->print_file) { + init_strict_lock_struct(fsp, (uint64_t)req->smbpid, + (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK, +@@ -5497,6 +5544,9 @@ void reply_printwrite(struct smb_request + + numtowrite = SVAL(req->buf, 1); + ++ /* ++ * This already protects us against CVE-2017-12163. ++ */ + if (req->buflen < numtowrite + 3) { + reply_nterror(req, NT_STATUS_INVALID_PARAMETER); + END_PROFILE(SMBsplwr); diff --git a/package/network/services/samba36/patches/032-CVE-2017-12150-v3.6.patch b/package/network/services/samba36/patches/032-CVE-2017-12150-v3.6.patch new file mode 100644 index 0000000000..01589b8a74 --- /dev/null +++ b/package/network/services/samba36/patches/032-CVE-2017-12150-v3.6.patch @@ -0,0 +1,75 @@ +From: =?utf-8?q?Guido_G=C3=BCnther?= +Date: Wed, 20 Sep 2017 20:01:34 +0200 +Subject: CVE-2017-12150 + +These are the three upstream patches + + From: Stefan Metzmacher + Subject: CVE-2017-12150: s3:lib: get_cmdline_auth_info_signing_state use Required for smb_encrypt + + This is an addition to the fixes for CVE-2015-5296. + + It applies to smb2mount -e, smbcacls -e and smbcquotas -e. + + BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997 + + + From: Stefan Metzmacher + Subject: CVE-2017-12150: libgpo: make use of Required for SMB signing in gpo_connect_server() + + It's important that we use a signed connection to get the GPOs! + + BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997 + + Signed-off-by: Stefan Metzmacher + Backported-by: Andreas Schneider + + + From: Stefan Metzmacher + Subject: CVE-2017-12150: s3:libsmb: only fallback to anonymous if authentication was not requested + + With forced encryption or required signing we should also don't fallback. + + BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997 + +--- + libgpo/gpo_fetch.c | 2 +- + source3/lib/util_cmdline.c | 3 +++ + source3/libsmb/clidfs.c | 2 ++ + 3 files changed, 6 insertions(+), 1 deletion(-) + +--- a/libgpo/gpo_fetch.c ++++ b/libgpo/gpo_fetch.c +@@ -151,7 +151,7 @@ static NTSTATUS gpo_connect_server(ADS_S + ads->auth.password, + CLI_FULL_CONNECTION_USE_KERBEROS | + CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS, +- Undefined); ++ Required); + if (!NT_STATUS_IS_OK(result)) { + DEBUG(10,("check_refresh_gpo: " + "failed to connect: %s\n", +--- a/source3/lib/util_cmdline.c ++++ b/source3/lib/util_cmdline.c +@@ -122,6 +122,9 @@ bool set_cmdline_auth_info_signing_state + + int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info) + { ++ if (auth_info->smb_encrypt) { ++ return Required; ++ } + return auth_info->signing_state; + } + +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -202,7 +202,9 @@ static struct cli_state *do_connect(TALL + /* If a password was not supplied then + * try again with a null username. */ + if (password[0] || !username[0] || ++ force_encrypt || client_is_signing_mandatory(c) || + get_cmdline_auth_info_use_kerberos(auth_info) || ++ get_cmdline_auth_info_use_ccache(auth_info) || + !NT_STATUS_IS_OK(cli_session_setup(c, "", + "", 0, + "", 0, diff --git a/package/network/services/samba36/patches/032-CVE-2018-1050-v3-6.patch b/package/network/services/samba36/patches/032-CVE-2018-1050-v3-6.patch new file mode 100644 index 0000000000..4c44243a63 --- /dev/null +++ b/package/network/services/samba36/patches/032-CVE-2018-1050-v3-6.patch @@ -0,0 +1,49 @@ +From 6cc45e3452194f312e04109cfdae047eb0719c7c Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Tue, 2 Jan 2018 15:56:03 -0800 +Subject: [PATCH] CVE-2018-1050: s3: RPC: spoolss server. Protect against null + pointer derefs. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=11343 + +Signed-off-by: Jeremy Allison +--- + source3/rpc_server/spoolss/srv_spoolss_nt.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c ++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c +@@ -176,6 +176,11 @@ static void prune_printername_cache(void + static const char *canon_servername(const char *servername) + { + const char *pservername = servername; ++ ++ if (servername == NULL) { ++ return ""; ++ } ++ + while (*pservername == '\\') { + pservername++; + } +@@ -2080,6 +2085,10 @@ WERROR _spoolss_DeletePrinterDriver(stru + return WERR_ACCESS_DENIED; + } + ++ if (r->in.architecture == NULL || r->in.driver == NULL) { ++ return WERR_INVALID_ENVIRONMENT; ++ } ++ + /* check that we have a valid driver name first */ + + if ((version = get_version_id(r->in.architecture)) == -1) +@@ -2225,6 +2234,10 @@ WERROR _spoolss_DeletePrinterDriverEx(st + return WERR_ACCESS_DENIED; + } + ++ if (r->in.architecture == NULL || r->in.driver == NULL) { ++ return WERR_INVALID_ENVIRONMENT; ++ } ++ + /* check that we have a valid driver name first */ + if (get_version_id(r->in.architecture) == -1) { + /* this is what NT returns */ diff --git a/package/network/services/samba36/patches/200-remove_printer_support.patch b/package/network/services/samba36/patches/200-remove_printer_support.patch index de567a7627..90f13feb0d 100644 --- a/package/network/services/samba36/patches/200-remove_printer_support.patch +++ b/package/network/services/samba36/patches/200-remove_printer_support.patch @@ -51,7 +51,7 @@ d_printf(_("Usage:\n")); --- a/source3/smbd/reply.c +++ b/source3/smbd/reply.c -@@ -5208,7 +5208,11 @@ void reply_printopen(struct smb_request +@@ -5255,7 +5255,11 @@ void reply_printopen(struct smb_request return; } @@ -64,7 +64,7 @@ reply_nterror(req, NT_STATUS_ACCESS_DENIED); END_PROFILE(SMBsplopen); return; -@@ -5314,7 +5318,10 @@ void reply_printqueue(struct smb_request +@@ -5361,7 +5365,10 @@ void reply_printqueue(struct smb_request is really quite gross and only worked when there was only one printer - I think we should now only accept it if they get it right (tridge) */ -- 2.25.1