From e39dcc08705f0bf59a57ad835821cef41ec8b1e6 Mon Sep 17 00:00:00 2001

From: Ralph Boehme <slow@samba.org>

Date: Tue, 6 Dec 2022 16:00:36 +0100

Subject: [PATCH 01/30] CVE-2022-38023 docs-xml: improve wording for several

 options: "takes precedence" -> "overrides"

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Ralph Boehme <slow@samba.org>

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

(cherry picked from commit 8ec62694a94c346e6ba8f3144a417c9984a1c8b9)

---

 docs-xml/smbdotconf/logon/rejectmd5clients.xml   | 2 +-

 docs-xml/smbdotconf/security/serverschannel.xml  | 2 +-

 docs-xml/smbdotconf/winbind/rejectmd5servers.xml | 2 +-

 docs-xml/smbdotconf/winbind/requirestrongkey.xml | 2 +-

 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs-xml/smbdotconf/logon/rejectmd5clients.xml b/docs-xml/smbdotconf/logon/rejectmd5clients.xml

index 41684ef10805..0bb9f6f6c8ec 100644

--- a/docs-xml/smbdotconf/logon/rejectmd5clients.xml

+++ b/docs-xml/smbdotconf/logon/rejectmd5clients.xml

@@ -10,7 +10,7 @@

 	<para>You can set this to yes if all domain members support aes.

 	This will prevent downgrade attacks.</para>

-	<para>This option takes precedence to the 'allow nt4 crypto' option.</para>

+	<para>This option overrides the 'allow nt4 crypto' option.</para>

 </description>

 <value type="default">no</value>

diff --git a/docs-xml/smbdotconf/security/serverschannel.xml b/docs-xml/smbdotconf/security/serverschannel.xml

index b682d086f76b..79e4e73a95c9 100644

--- a/docs-xml/smbdotconf/security/serverschannel.xml

+++ b/docs-xml/smbdotconf/security/serverschannel.xml

@@ -59,7 +59,7 @@

 	See CVE-2020-1472(ZeroLogon) https://bugzilla.samba.org/show_bug.cgi?id=14497

     </para>

-    <para>This option takes precedence to the <smbconfoption name="server schannel"/> option.</para>

+    <para>This option overrides the <smbconfoption name="server schannel"/> option.</para>

     <programlisting>

 	server require schannel:LEGACYCOMPUTER1$ = no

diff --git a/docs-xml/smbdotconf/winbind/rejectmd5servers.xml b/docs-xml/smbdotconf/winbind/rejectmd5servers.xml

index 37656293aa47..151b4676c57b 100644

--- a/docs-xml/smbdotconf/winbind/rejectmd5servers.xml

+++ b/docs-xml/smbdotconf/winbind/rejectmd5servers.xml

@@ -15,7 +15,7 @@

 	<para>The behavior can be controlled per netbios domain

 	by using 'reject md5 servers:NETBIOSDOMAIN = yes' as option.</para>

-	<para>This option takes precedence to the <smbconfoption name="require strong key"/> option.</para>

+	<para>This option overrides the <smbconfoption name="require strong key"/> option.</para>

 </description>

 <value type="default">no</value>

diff --git a/docs-xml/smbdotconf/winbind/requirestrongkey.xml b/docs-xml/smbdotconf/winbind/requirestrongkey.xml

index 4db62bfb02db..b17620ec8f1d 100644

--- a/docs-xml/smbdotconf/winbind/requirestrongkey.xml

+++ b/docs-xml/smbdotconf/winbind/requirestrongkey.xml

@@ -19,7 +19,7 @@

 	<para>This option yields precedence to the <smbconfoption name="reject md5 servers"/> option.</para>

-	<para>This option takes precedence to the <smbconfoption name="client schannel"/> option.</para>

+	<para>This option overrides the <smbconfoption name="client schannel"/> option.</para>

 </description>

 <value type="default">yes</value>

-- 

2.34.1

From 75fcaa4792afde7599d23316788ce8bbf780fe8a Mon Sep 17 00:00:00 2001

From: Ralph Boehme <slow@samba.org>

Date: Tue, 6 Dec 2022 16:05:26 +0100

Subject: [PATCH 02/30] CVE-2022-38023 docs-xml: improve wording for several

 options: "yields precedence" -> "is over-riden"

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Ralph Boehme <slow@samba.org>

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

(cherry picked from commit 830e865ba5648f6520bc552ffd71b61f754b8251)

---

 docs-xml/smbdotconf/logon/allownt4crypto.xml                 | 2 +-

 docs-xml/smbdotconf/security/allowdcerpcauthlevelconnect.xml | 2 +-

 docs-xml/smbdotconf/security/clientschannel.xml              | 2 +-

 docs-xml/smbdotconf/security/serverschannel.xml              | 2 +-

 docs-xml/smbdotconf/winbind/requirestrongkey.xml             | 2 +-

 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs-xml/smbdotconf/logon/allownt4crypto.xml b/docs-xml/smbdotconf/logon/allownt4crypto.xml

index 03dc8fa93f72..06afcef73b1b 100644

--- a/docs-xml/smbdotconf/logon/allownt4crypto.xml

+++ b/docs-xml/smbdotconf/logon/allownt4crypto.xml

@@ -18,7 +18,7 @@

 	<para>"allow nt4 crypto = yes" allows weak crypto to be negotiated, maybe via downgrade attacks.</para>

-	<para>This option yields precedence to the 'reject md5 clients' option.</para>

+	<para>This option is over-ridden by the 'reject md5 clients' option.</para>

 </description>

 <value type="default">no</value>

diff --git a/docs-xml/smbdotconf/security/allowdcerpcauthlevelconnect.xml b/docs-xml/smbdotconf/security/allowdcerpcauthlevelconnect.xml

index 03531adbfb36..8bccab391cc2 100644

--- a/docs-xml/smbdotconf/security/allowdcerpcauthlevelconnect.xml

+++ b/docs-xml/smbdotconf/security/allowdcerpcauthlevelconnect.xml

@@ -15,7 +15,7 @@

 	<para>The behavior can be overwritten per interface name (e.g. lsarpc, netlogon, samr, srvsvc,

 	winreg, wkssvc ...) by using 'allow dcerpc auth level connect:interface = yes' as option.</para>

-	<para>This option yields precedence to the implementation specific restrictions.

+	<para>This option is over-ridden by the implementation specific restrictions.

 	E.g. the drsuapi and backupkey protocols require DCERPC_AUTH_LEVEL_PRIVACY.

 	The dnsserver protocol requires DCERPC_AUTH_LEVEL_INTEGRITY.

 	</para>

diff --git a/docs-xml/smbdotconf/security/clientschannel.xml b/docs-xml/smbdotconf/security/clientschannel.xml

index 5b07da95050c..d124ad481818 100644

--- a/docs-xml/smbdotconf/security/clientschannel.xml

+++ b/docs-xml/smbdotconf/security/clientschannel.xml

@@ -23,7 +23,7 @@

     <para>Note that for active directory domains this is hardcoded to

     <smbconfoption name="client schannel">yes</smbconfoption>.</para>

-    <para>This option yields precedence to the <smbconfoption name="require strong key"/> option.</para>

+    <para>This option is over-ridden by the <smbconfoption name="require strong key"/> option.</para>

 </description>

 <value type="default">yes</value>

 <value type="example">auto</value>

diff --git a/docs-xml/smbdotconf/security/serverschannel.xml b/docs-xml/smbdotconf/security/serverschannel.xml

index 79e4e73a95c9..3e66df1c2032 100644

--- a/docs-xml/smbdotconf/security/serverschannel.xml

+++ b/docs-xml/smbdotconf/security/serverschannel.xml

@@ -23,7 +23,7 @@

     <para>If you still have legacy domain members use the <smbconfoption name="server require schannel:COMPUTERACCOUNT"/> option.

     </para>

-    <para>This option yields precedence to the <smbconfoption name="server require schannel:COMPUTERACCOUNT"/> option.</para>

+    <para>This option is over-ridden by the <smbconfoption name="server require schannel:COMPUTERACCOUNT"/> option.</para>

 </description>

diff --git a/docs-xml/smbdotconf/winbind/requirestrongkey.xml b/docs-xml/smbdotconf/winbind/requirestrongkey.xml

index b17620ec8f1d..9c1c1d7af148 100644

--- a/docs-xml/smbdotconf/winbind/requirestrongkey.xml

+++ b/docs-xml/smbdotconf/winbind/requirestrongkey.xml

@@ -17,7 +17,7 @@

 	<para>Note for active directory domain this option is hardcoded to 'yes'</para>

-	<para>This option yields precedence to the <smbconfoption name="reject md5 servers"/> option.</para>

+	<para>This option is over-ridden by the <smbconfoption name="reject md5 servers"/> option.</para>

 	<para>This option overrides the <smbconfoption name="client schannel"/> option.</para>

 </description>

-- 

2.34.1

From cbf7cf691860d92c1890009b639a1fd495cf1cf2 Mon Sep 17 00:00:00 2001

From: Stefan Metzmacher <metze@samba.org>

Date: Wed, 30 Nov 2022 14:46:59 +0100

Subject: [PATCH 03/30] CVE-2022-38023 libcli/auth: pass lp_ctx to

 netlogon_creds_cli_set_global_db()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Ralph Boehme <slow@samba.org>

(cherry picked from commit 992f39a2c8a58301ceeb965f401e29cd64c5a209)

---

 libcli/auth/netlogon_creds_cli.c           | 3 ++-

 libcli/auth/netlogon_creds_cli.h           | 2 +-

 source3/rpc_client/cli_netlogon.c          | 2 +-

 source3/utils/destroy_netlogon_creds_cli.c | 2 +-

 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/libcli/auth/netlogon_creds_cli.c b/libcli/auth/netlogon_creds_cli.c

index e92a042c0120..030191174dca 100644

--- a/libcli/auth/netlogon_creds_cli.c

+++ b/libcli/auth/netlogon_creds_cli.c

@@ -202,7 +202,8 @@ static NTSTATUS netlogon_creds_cli_context_common(

 static struct db_context *netlogon_creds_cli_global_db;

-NTSTATUS netlogon_creds_cli_set_global_db(struct db_context **db)

+NTSTATUS netlogon_creds_cli_set_global_db(struct loadparm_context *lp_ctx,

+					  struct db_context **db)

 {

 	if (netlogon_creds_cli_global_db != NULL) {

 		return NT_STATUS_INVALID_PARAMETER_MIX;

diff --git a/libcli/auth/netlogon_creds_cli.h b/libcli/auth/netlogon_creds_cli.h

index 6f40a46aa0a6..d10197c2d2af 100644

--- a/libcli/auth/netlogon_creds_cli.h

+++ b/libcli/auth/netlogon_creds_cli.h

@@ -31,7 +31,7 @@ struct messaging_context;

 struct dcerpc_binding_handle;

 struct db_context;

-NTSTATUS netlogon_creds_cli_set_global_db(struct db_context **db);

+NTSTATUS netlogon_creds_cli_set_global_db(struct loadparm_context *lp_ctx, struct db_context **db);

 NTSTATUS netlogon_creds_cli_open_global_db(struct loadparm_context *lp_ctx);

 void netlogon_creds_cli_close_global_db(void);

diff --git a/source3/rpc_client/cli_netlogon.c b/source3/rpc_client/cli_netlogon.c

index 50dae9d7f3eb..18664e8b91af 100644

--- a/source3/rpc_client/cli_netlogon.c

+++ b/source3/rpc_client/cli_netlogon.c

@@ -76,7 +76,7 @@ NTSTATUS rpccli_pre_open_netlogon_creds(void)

 		return NT_STATUS_NO_MEMORY;

 	}

-	status = netlogon_creds_cli_set_global_db(&global_db);

+	status = netlogon_creds_cli_set_global_db(lp_ctx, &global_db);

 	TALLOC_FREE(frame);

 	if (!NT_STATUS_IS_OK(status)) {

 		return status;

diff --git a/source3/utils/destroy_netlogon_creds_cli.c b/source3/utils/destroy_netlogon_creds_cli.c

index f28cad527dfb..a2e1952e434c 100644

--- a/source3/utils/destroy_netlogon_creds_cli.c

+++ b/source3/utils/destroy_netlogon_creds_cli.c

@@ -82,7 +82,7 @@ int main(int argc, const char *argv[])

 		goto done;

 	}

-	status = netlogon_creds_cli_set_global_db(&global_db);

+	status = netlogon_creds_cli_set_global_db(lp_ctx, &global_db);

 	if (!NT_STATUS_IS_OK(status)) {

 		fprintf(stderr,

 			"netlogon_creds_cli_set_global_db failed: %s\n",

-- 

2.34.1

From 2c4f9869b208cfd969607248420e36e3bd4aecfa Mon Sep 17 00:00:00 2001

From: Stefan Metzmacher <metze@samba.org>

Date: Wed, 30 Nov 2022 14:47:33 +0100

Subject: [PATCH 04/30] CVE-2022-38023 libcli/auth: add/use

 netlogon_creds_cli_warn_options()

This warns the admin about insecure options

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Ralph Boehme <slow@samba.org>

(similar to commit 7e7adf86e59e8a673fbe87de46cef0d62221e800)

[jsutton@samba.org Replaced call to tevent_cached_getpid() with one to

 getpid()]

---

 libcli/auth/netlogon_creds_cli.c | 66 ++++++++++++++++++++++++++++++++

 libcli/auth/netlogon_creds_cli.h |  2 +

 2 files changed, 68 insertions(+)

diff --git a/libcli/auth/netlogon_creds_cli.c b/libcli/auth/netlogon_creds_cli.c

index 030191174dca..3794d8b6b6ef 100644

--- a/libcli/auth/netlogon_creds_cli.c

+++ b/libcli/auth/netlogon_creds_cli.c

@@ -205,6 +205,8 @@ static struct db_context *netlogon_creds_cli_global_db;

 NTSTATUS netlogon_creds_cli_set_global_db(struct loadparm_context *lp_ctx,

 					  struct db_context **db)

 {

+	netlogon_creds_cli_warn_options(lp_ctx);

+

 	if (netlogon_creds_cli_global_db != NULL) {

 		return NT_STATUS_INVALID_PARAMETER_MIX;

 	}

@@ -219,6 +221,8 @@ NTSTATUS netlogon_creds_cli_open_global_db(struct loadparm_context *lp_ctx)

 	struct db_context *global_db;

 	int hash_size, tdb_flags;

+	netlogon_creds_cli_warn_options(lp_ctx);

+

 	if (netlogon_creds_cli_global_db != NULL) {

 		return NT_STATUS_OK;

 	}

@@ -259,6 +263,68 @@ void netlogon_creds_cli_close_global_db(void)

 	TALLOC_FREE(netlogon_creds_cli_global_db);

 }

+void netlogon_creds_cli_warn_options(struct loadparm_context *lp_ctx)

+{

+	bool global_reject_md5_servers = lpcfg_reject_md5_servers(lp_ctx);

+	bool global_require_strong_key = lpcfg_require_strong_key(lp_ctx);

+	int global_client_schannel = lpcfg_client_schannel(lp_ctx);

+	bool global_seal_secure_channel = lpcfg_winbind_sealed_pipes(lp_ctx);

+	static bool warned_global_reject_md5_servers = false;

+	static bool warned_global_require_strong_key = false;

+	static bool warned_global_client_schannel = false;

+	static bool warned_global_seal_secure_channel = false;

+	static int warned_global_pid = 0;

+	int current_pid = getpid();

+

+	if (warned_global_pid != current_pid) {

+		warned_global_reject_md5_servers = false;

+		warned_global_require_strong_key = false;

+		warned_global_client_schannel = false;

+		warned_global_seal_secure_channel = false;

+		warned_global_pid = current_pid;

+	}

+

+	if (!global_reject_md5_servers && !warned_global_reject_md5_servers) {

+		/*

+		 * We want admins to notice their misconfiguration!

+		 */

+		DBG_ERR("CVE-2022-38023 (and others): "

+			"Please configure 'reject md5 servers = yes' (the default), "

+			"See https://bugzilla.samba.org/show_bug.cgi?id=15240\n");

+		warned_global_reject_md5_servers = true;

+	}

+

+	if (!global_require_strong_key && !warned_global_require_strong_key) {

+		/*

+		 * We want admins to notice their misconfiguration!

+		 */

+		DBG_ERR("CVE-2022-38023 (and others): "

+			"Please configure 'require strong key = yes' (the default), "

+			"See https://bugzilla.samba.org/show_bug.cgi?id=15240\n");

+		warned_global_require_strong_key = true;

+	}

+

+	if (global_client_schannel != true && !warned_global_client_schannel) {

+		/*

+		 * We want admins to notice their misconfiguration!

+		 */

+		DBG_ERR("CVE-2022-38023 (and others): "

+			"Please configure 'client schannel = yes' (the default), "

+			"See https://bugzilla.samba.org/show_bug.cgi?id=15240\n");

+		warned_global_client_schannel = true;

+	}

+

+	if (!global_seal_secure_channel && !warned_global_seal_secure_channel) {

+		/*

+		 * We want admins to notice their misconfiguration!

+		 */

+		DBG_ERR("CVE-2022-38023 (and others): "

+			"Please configure 'winbind sealed pipes = yes' (the default), "

+			"See https://bugzilla.samba.org/show_bug.cgi?id=15240\n");

+		warned_global_seal_secure_channel = true;

+	}

+}

+

 NTSTATUS netlogon_creds_cli_context_global(struct loadparm_context *lp_ctx,

 				struct messaging_context *msg_ctx,

 				const char *client_account,

diff --git a/libcli/auth/netlogon_creds_cli.h b/libcli/auth/netlogon_creds_cli.h

index d10197c2d2af..600242e1aea7 100644

--- a/libcli/auth/netlogon_creds_cli.h

+++ b/libcli/auth/netlogon_creds_cli.h

@@ -35,6 +35,8 @@ NTSTATUS netlogon_creds_cli_set_global_db(struct loadparm_context *lp_ctx, struc

 NTSTATUS netlogon_creds_cli_open_global_db(struct loadparm_context *lp_ctx);

 void netlogon_creds_cli_close_global_db(void);

+void netlogon_creds_cli_warn_options(struct loadparm_context *lp_ctx);

+

 NTSTATUS netlogon_creds_cli_context_global(struct loadparm_context *lp_ctx,

 				struct messaging_context *msg_ctx,

 				const char *client_account,

-- 

2.34.1

From 558c68e0915885ed77b3d02e52d93f4c64a0e20e Mon Sep 17 00:00:00 2001

From: Stefan Metzmacher <metze@samba.org>

Date: Wed, 30 Nov 2022 16:16:05 +0100

Subject: [PATCH 05/30] CVE-2022-38023 s3:net: add and use

 net_warn_member_options() helper

This makes sure domain member related 'net' commands print warnings

about unsecure smb.conf options.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Ralph Boehme <slow@samba.org>

(cherry picked from commit 1fdf1d55a5dd550bdb16d037b5dc995c33c1a67a)

---

 source3/utils/net.c             |  6 ++++++

 source3/utils/net_ads.c         | 14 ++++++++++++++

 source3/utils/net_dom.c         |  2 ++

 source3/utils/net_join.c        |  2 ++

 source3/utils/net_offlinejoin.c |  2 ++

 source3/utils/net_proto.h       |  2 ++

 source3/utils/net_rpc.c         | 10 ++++++++++

 source3/utils/net_util.c        | 14 ++++++++++++++

 8 files changed, 52 insertions(+)

diff --git a/source3/utils/net.c b/source3/utils/net.c

index e1e14743c117..b96d7f5d9d48 100644

--- a/source3/utils/net.c

+++ b/source3/utils/net.c

@@ -85,6 +85,8 @@ enum netr_SchannelType get_sec_channel_type(const char *param)

 static int net_changetrustpw(struct net_context *c, int argc, const char **argv)

 {

+	net_warn_member_options();

+

 	if (net_ads_check_our_domain(c) == 0)

 		return net_ads_changetrustpw(c, argc, argv);

@@ -112,6 +114,8 @@ static int net_primarytrust_dumpinfo(struct net_context *c, int argc,

 		return 1;

 	}

+	net_warn_member_options();

+

 	if (c->opt_stdin) {

 		set_line_buffering(stdin);

 		set_line_buffering(stdout);

@@ -193,6 +197,8 @@ static int net_changesecretpw(struct net_context *c, int argc,

 		return 1;

 	}

+	net_warn_member_options();

+

 	if(c->opt_force) {

 		struct secrets_domain_info1 *info = NULL;

 		struct secrets_domain_info1_change *prev = NULL;

diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c

index d666f7fc3ec9..cc0d4a0d966c 100644

--- a/source3/utils/net_ads.c

+++ b/source3/utils/net_ads.c

@@ -1306,6 +1306,8 @@ static int net_ads_status(struct net_context *c, int argc, const char **argv)

 		return 0;

 	}

+	net_warn_member_options();

+

 	if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {

 		return -1;

 	}

@@ -1447,6 +1449,8 @@ static NTSTATUS net_ads_join_ok(struct net_context *c)

 		return NT_STATUS_ACCESS_DENIED;

 	}

+	net_warn_member_options();

+

 	net_use_krb_machine_account(c);

 	get_dc_name(lp_workgroup(), lp_realm(), dc_name, &dcip);

@@ -1477,6 +1481,8 @@ int net_ads_testjoin(struct net_context *c, int argc, const char **argv)

 		return 0;

 	}

+	net_warn_member_options();

+

 	/* Display success or failure */

 	status = net_ads_join_ok(c);

 	if (!NT_STATUS_IS_OK(status)) {

@@ -1571,6 +1577,8 @@ int net_ads_join(struct net_context *c, int argc, const char **argv)

 	if (c->display_usage)

 		return net_ads_join_usage(c, argc, argv);

+	net_warn_member_options();

+

 	if (!modify_config) {

 		werr = check_ads_config();

@@ -2505,6 +2513,8 @@ int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)

 		return -1;

 	}

+	net_warn_member_options();

+

 	net_use_krb_machine_account(c);

 	use_in_memory_ccache();

@@ -2778,6 +2788,8 @@ static int net_ads_keytab_add(struct net_context *c,

 		return 0;

 	}

+	net_warn_member_options();

+

 	d_printf(_("Processing principals to add...\n"));

 	if (!c->opt_user_specified && c->opt_password == NULL) {

@@ -2822,6 +2834,8 @@ static int net_ads_keytab_create(struct net_context *c, int argc, const char **a

 		return 0;

 	}

+	net_warn_member_options();

+

 	if (!c->opt_user_specified && c->opt_password == NULL) {

 		net_use_krb_machine_account(c);

 	}

diff --git a/source3/utils/net_dom.c b/source3/utils/net_dom.c

index 13e65a933142..4b48e1566bc8 100644

--- a/source3/utils/net_dom.c

+++ b/source3/utils/net_dom.c

@@ -154,6 +154,8 @@ static int net_dom_join(struct net_context *c, int argc, const char **argv)

 		return net_dom_usage(c, argc, argv);

 	}

+	net_warn_member_options();

+

 	if (c->opt_host) {

 		server_name = c->opt_host;

 	}

diff --git a/source3/utils/net_join.c b/source3/utils/net_join.c

index 1493dff74d7b..f67f08f79a81 100644

--- a/source3/utils/net_join.c

+++ b/source3/utils/net_join.c

@@ -39,6 +39,8 @@ int net_join(struct net_context *c, int argc, const char **argv)

 		return 0;

 	}

+	net_warn_member_options();

+

 	if (net_ads_check_our_domain(c) == 0) {

 		if (net_ads_join(c, argc, argv) == 0)

 			return 0;

diff --git a/source3/utils/net_offlinejoin.c b/source3/utils/net_offlinejoin.c

index 03e5df0eace9..0cfd5fdfe235 100644

--- a/source3/utils/net_offlinejoin.c

+++ b/source3/utils/net_offlinejoin.c

@@ -49,6 +49,8 @@ int net_offlinejoin(struct net_context *c, int argc, const char **argv)

 		return -1;

 	}

+	net_warn_member_options();

+

 	status = libnetapi_net_init(&c->netapi_ctx);

 	if (status != 0) {

 		return -1;

diff --git a/source3/utils/net_proto.h b/source3/utils/net_proto.h

index b6ff639a0941..42096ba218d5 100644

--- a/source3/utils/net_proto.h

+++ b/source3/utils/net_proto.h

@@ -442,6 +442,8 @@ int net_run_function(struct net_context *c, int argc, const char **argv,

 		      const char *whoami, struct functable *table);

 void net_display_usage_from_functable(struct functable *table);

+void net_warn_member_options(void);

+

 const char *net_share_type_str(int num_type);

 NTSTATUS net_scan_dc(struct net_context *c,

diff --git a/source3/utils/net_rpc.c b/source3/utils/net_rpc.c

index 97c0158d612f..16a541413d2e 100644

--- a/source3/utils/net_rpc.c

+++ b/source3/utils/net_rpc.c

@@ -371,6 +371,8 @@ static int net_rpc_oldjoin(struct net_context *c, int argc, const char **argv)

 		return 0;

 	}

+	net_warn_member_options();

+

 	mem_ctx = talloc_init("net_rpc_oldjoin");

 	if (!mem_ctx) {

 		return -1;

@@ -490,6 +492,8 @@ int net_rpc_testjoin(struct net_context *c, int argc, const char **argv)

 		return 0;

 	}

+	net_warn_member_options();

+

 	mem_ctx = talloc_init("net_rpc_testjoin");

 	if (!mem_ctx) {

 		return -1;

@@ -564,6 +568,8 @@ static int net_rpc_join_newstyle(struct net_context *c, int argc, const char **a

 		return 0;

 	}

+	net_warn_member_options();

+

 	mem_ctx = talloc_init("net_rpc_join_newstyle");

 	if (!mem_ctx) {

 		return -1;

@@ -685,6 +691,8 @@ int net_rpc_join(struct net_context *c, int argc, const char **argv)

 		return -1;

 	}

+	net_warn_member_options();

+

 	if (strlen(lp_netbios_name()) > 15) {

 		d_printf(_("Our netbios name can be at most 15 chars long, "

 			   "\"%s\" is %u chars long\n"),

@@ -815,6 +823,8 @@ int net_rpc_info(struct net_context *c, int argc, const char **argv)

 		return 0;

 	}

+	net_warn_member_options();

+

 	return run_rpc_command(c, NULL, &ndr_table_samr,

 			       NET_FLAGS_PDC, rpc_info_internals,

 			       argc, argv);

diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c

index 298d9a64dc0c..f3b7755063bf 100644

--- a/source3/utils/net_util.c

+++ b/source3/utils/net_util.c

@@ -31,6 +31,7 @@

 #include "libsmb/libsmb.h"

 #include "lib/param/param.h"

 #include "auth/gensec/gensec.h"

+#include "libcli/auth/netlogon_creds_cli.h"

 #include "lib/cmdline/cmdline.h"

 NTSTATUS net_rpc_lookup_name(struct net_context *c,

@@ -478,6 +479,19 @@ void net_display_usage_from_functable(struct functable *table)

 	}

 }

+void net_warn_member_options(void)

+{

+	TALLOC_CTX *frame = talloc_stackframe();

+	struct loadparm_context *lp_ctx = NULL;

+

+	lp_ctx = loadparm_init_s3(frame, loadparm_s3_helpers());

+	if (lp_ctx != NULL) {

+		netlogon_creds_cli_warn_options(lp_ctx);

+	}

+

+	TALLOC_FREE(frame);

+}

+

 const char *net_share_type_str(int num_type)

 {

 	switch(num_type) {

-- 

2.34.1

From 9172fa1fe342a13c773d14c73ffcaa9f9561cdc7 Mon Sep 17 00:00:00 2001

From: Stefan Metzmacher <metze@samba.org>

Date: Wed, 30 Nov 2022 14:59:36 +0100

Subject: [PATCH 06/30] CVE-2022-38023 s3:winbindd: also allow per domain

 "winbind sealed pipes:DOMAIN" and "require strong key:DOMAIN"

This avoids advising insecure defaults for the global options.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Ralph Boehme <slow@samba.org>

(cherry picked from commit d60828f6391307a59abaa02b72b6a8acf66b2fef)

---

 source3/winbindd/winbindd_cm.c | 41 +++++++++++++++++++++++++++-------

 1 file changed, 33 insertions(+), 8 deletions(-)

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c

index 6c6dd88a5aa4..5532e0cd0cc8 100644

--- a/source3/winbindd/winbindd_cm.c

+++ b/source3/winbindd/winbindd_cm.c

@@ -2431,6 +2431,8 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,

 	bool retry = false; /* allow one retry attempt for expired session */

 	const char *remote_name = NULL;

 	const struct sockaddr_storage *remote_sockaddr = NULL;

+	bool sealed_pipes = true;

+	bool strong_key = true;

 	if (sid_check_is_our_sam(&domain->sid)) {

 		if (domain->rodc == false || need_rw_dc == false) {

@@ -2610,14 +2612,24 @@ retry:

  anonymous:

+	sealed_pipes = lp_winbind_sealed_pipes();

+	sealed_pipes = lp_parm_bool(-1, "winbind sealed pipes",

+				    domain->name,

+				    sealed_pipes);

+	strong_key = lp_require_strong_key();

+	strong_key = lp_parm_bool(-1, "require strong key",

+				  domain->name,

+				  strong_key);

+

 	/* Finally fall back to anonymous. */

-	if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {

+	if (sealed_pipes || strong_key) {

 		status = NT_STATUS_DOWNGRADE_DETECTED;

 		DEBUG(1, ("Unwilling to make SAMR connection to domain %s "

 			  "without connection level security, "

-			  "must set 'winbind sealed pipes = false' and "

-			  "'require strong key = false' to proceed: %s\n",

-			  domain->name, nt_errstr(status)));

+			  "must set 'winbind sealed pipes:%s = false' and "

+			  "'require strong key:%s = false' to proceed: %s\n",

+			  domain->name, domain->name, domain->name,

+			  nt_errstr(status)));

 		goto done;

 	}

 	status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr,

@@ -2774,6 +2786,8 @@ NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,

 	bool retry = false; /* allow one retry attempt for expired session */

 	const char *remote_name = NULL;

 	const struct sockaddr_storage *remote_sockaddr = NULL;

+	bool sealed_pipes = true;

+	bool strong_key = true;

 retry:

 	result = init_dc_connection_rpc(domain, false);

@@ -2935,13 +2949,24 @@ retry:

 		goto done;

 	}

-	if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {

+	sealed_pipes = lp_winbind_sealed_pipes();

+	sealed_pipes = lp_parm_bool(-1, "winbind sealed pipes",

+				    domain->name,

+				    sealed_pipes);

+	strong_key = lp_require_strong_key();

+	strong_key = lp_parm_bool(-1, "require strong key",

+				  domain->name,

+				  strong_key);

+

+	/* Finally fall back to anonymous. */

+	if (sealed_pipes || strong_key) {

 		result = NT_STATUS_DOWNGRADE_DETECTED;