|
 |
a3a04f |
From be03c9118e812f93d50c71294fbf9f12bcf2a7f1 Mon Sep 17 00:00:00 2001
|
|
|
a3a04f |
From: Stefan Metzmacher <metze@samba.org>
|
|
|
a3a04f |
Date: Mon, 14 Aug 2017 12:13:18 +0200
|
|
|
a3a04f |
Subject: [PATCH 1/2] CVE-2017-12151: s3:libsmb: add
|
|
|
a3a04f |
cli_state_is_encryption_on() helper function
|
|
|
a3a04f |
|
|
|
a3a04f |
This allows to check if the current cli_state uses encryption
|
|
|
a3a04f |
(either via unix extentions or via SMB3).
|
|
|
a3a04f |
|
|
|
a3a04f |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12996
|
|
|
a3a04f |
|
|
|
a3a04f |
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
|
a3a04f |
---
|
|
|
a3a04f |
source3/libsmb/clientgen.c | 13 +++++++++++++
|
|
|
a3a04f |
source3/libsmb/proto.h | 1 +
|
|
|
a3a04f |
2 files changed, 14 insertions(+)
|
|
|
a3a04f |
|
|
|
a3a04f |
diff --git a/source3/libsmb/clientgen.c b/source3/libsmb/clientgen.c
|
|
|
a3a04f |
index bc5c1b1ce3c..3e8523e5ce8 100644
|
|
|
a3a04f |
--- a/source3/libsmb/clientgen.c
|
|
|
a3a04f |
+++ b/source3/libsmb/clientgen.c
|
|
|
a3a04f |
@@ -339,6 +339,19 @@ uint32_t cli_getpid(struct cli_state *cli)
|
|
|
a3a04f |
return cli->smb1.pid;
|
|
|
a3a04f |
}
|
|
|
a3a04f |
|
|
|
a3a04f |
+bool cli_state_is_encryption_on(struct cli_state *cli)
|
|
|
a3a04f |
+{
|
|
|
a3a04f |
+ if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_SMB2_02) {
|
|
|
a3a04f |
+ return smb1cli_conn_encryption_on(cli->conn);
|
|
|
a3a04f |
+ }
|
|
|
a3a04f |
+
|
|
|
a3a04f |
+ if (cli->smb2.tcon == NULL) {
|
|
|
a3a04f |
+ return false;
|
|
|
a3a04f |
+ }
|
|
|
a3a04f |
+
|
|
|
a3a04f |
+ return smb2cli_tcon_is_encryption_on(cli->smb2.tcon);
|
|
|
a3a04f |
+}
|
|
|
a3a04f |
+
|
|
|
a3a04f |
bool cli_state_has_tcon(struct cli_state *cli)
|
|
|
a3a04f |
{
|
|
|
a3a04f |
uint16_t tid = cli_state_get_tid(cli);
|
|
|
a3a04f |
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
|
|
|
a3a04f |
index 764f3fc1b12..67fa43e4e4a 100644
|
|
|
a3a04f |
--- a/source3/libsmb/proto.h
|
|
|
a3a04f |
+++ b/source3/libsmb/proto.h
|
|
|
a3a04f |
@@ -195,6 +195,7 @@ const char *cli_state_remote_realm(struct cli_state *cli);
|
|
|
a3a04f |
uint16_t cli_state_get_vc_num(struct cli_state *cli);
|
|
|
a3a04f |
uint32_t cli_setpid(struct cli_state *cli, uint32_t pid);
|
|
|
a3a04f |
uint32_t cli_getpid(struct cli_state *cli);
|
|
|
a3a04f |
+bool cli_state_is_encryption_on(struct cli_state *cli);
|
|
|
a3a04f |
bool cli_state_has_tcon(struct cli_state *cli);
|
|
|
a3a04f |
uint16_t cli_state_get_tid(struct cli_state *cli);
|
|
|
a3a04f |
uint16_t cli_state_set_tid(struct cli_state *cli, uint16_t tid);
|
|
|
a3a04f |
--
|
|
|
a3a04f |
2.13.5
|
|
|
a3a04f |
|
|
|
a3a04f |
|
|
|
a3a04f |
From 16d3c8288ae78a686715c242293691c00ec6d7a5 Mon Sep 17 00:00:00 2001
|
|
|
a3a04f |
From: Stefan Metzmacher <metze@samba.org>
|
|
|
a3a04f |
Date: Sat, 17 Dec 2016 10:36:49 +0100
|
|
|
a3a04f |
Subject: [PATCH 2/2] CVE-2017-12151: s3:libsmb: make use of
|
|
|
a3a04f |
cli_state_is_encryption_on()
|
|
|
a3a04f |
|
|
|
a3a04f |
This will keep enforced encryption across dfs referrals.
|
|
|
a3a04f |
|
|
|
a3a04f |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12996
|
|
|
a3a04f |
|
|
|
a3a04f |
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
|
a3a04f |
---
|
|
|
a3a04f |
source3/libsmb/clidfs.c | 4 ++--
|
|
|
a3a04f |
source3/libsmb/libsmb_context.c | 2 +-
|
|
|
a3a04f |
2 files changed, 3 insertions(+), 3 deletions(-)
|
|
|
a3a04f |
|
|
|
a3a04f |
diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
|
|
|
a3a04f |
index c477d7c6a46..99818a681e3 100644
|
|
|
a3a04f |
--- a/source3/libsmb/clidfs.c
|
|
|
a3a04f |
+++ b/source3/libsmb/clidfs.c
|
|
|
a3a04f |
@@ -980,7 +980,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
|
a3a04f |
"IPC$",
|
|
|
a3a04f |
dfs_auth_info,
|
|
|
a3a04f |
false,
|
|
|
a3a04f |
- smb1cli_conn_encryption_on(rootcli->conn),
|
|
|
a3a04f |
+ cli_state_is_encryption_on(rootcli),
|
|
|
a3a04f |
smbXcli_conn_protocol(rootcli->conn),
|
|
|
a3a04f |
0,
|
|
|
a3a04f |
0x20,
|
|
|
a3a04f |
@@ -1038,7 +1038,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx,
|
|
|
a3a04f |
dfs_refs[count].share,
|
|
|
a3a04f |
dfs_auth_info,
|
|
|
a3a04f |
false,
|
|
|
a3a04f |
- smb1cli_conn_encryption_on(rootcli->conn),
|
|
|
a3a04f |
+ cli_state_is_encryption_on(rootcli),
|
|
|
a3a04f |
smbXcli_conn_protocol(rootcli->conn),
|
|
|
a3a04f |
0,
|
|
|
a3a04f |
0x20,
|
|
|
a3a04f |
diff --git a/source3/libsmb/libsmb_context.c b/source3/libsmb/libsmb_context.c
|
|
|
a3a04f |
index ed6ca2b1b9f..b55cf1e2d15 100644
|
|
|
a3a04f |
--- a/source3/libsmb/libsmb_context.c
|
|
|
a3a04f |
+++ b/source3/libsmb/libsmb_context.c
|
|
|
a3a04f |
@@ -486,7 +486,7 @@ smbc_option_get(SMBCCTX *context,
|
|
|
a3a04f |
|
|
|
a3a04f |
for (s = context->internal->servers; s; s = s->next) {
|
|
|
a3a04f |
num_servers++;
|
|
|
a3a04f |
- if (!smb1cli_conn_encryption_on(s->cli->conn)) {
|
|
|
a3a04f |
+ if (!cli_state_is_encryption_on(s->cli)) {
|
|
|
a3a04f |
return (void *)false;
|
|
|
a3a04f |
}
|
|
|
a3a04f |
}
|
|
|
a3a04f |
--
|
|
|
a3a04f |
2.13.5
|
|
|
a3a04f |
|