1From 513bd34e4523e49e742487be32a7239111486a12 Mon Sep 17 00:00:00 2001 2From: Stefan Metzmacher <metze@samba.org> 3Date: Sat, 27 Feb 2016 03:43:58 +0100 4Subject: [PATCH 1/4] CVE-2016-2115: docs-xml: add "client ipc signing" option 5 6BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756 7 8Signed-off-by: Stefan Metzmacher <metze@samba.org> 9Reviewed-by: Ralph Boehme <slow@samba.org> 10--- 11 docs-xml/smbdotconf/security/clientipcsigning.xml | 23 +++++++++++++++++++++++ 12 docs-xml/smbdotconf/security/clientsigning.xml | 3 +++ 13 source3/include/proto.h | 1 + 14 source3/param/loadparm.c | 12 ++++++++++++ 15 4 files changed, 39 insertions(+) 16 create mode 100644 docs-xml/smbdotconf/security/clientipcsigning.xml 17 18--- /dev/null 19+++ b/docs-xml/smbdotconf/security/clientipcsigning.xml 20@@ -0,0 +1,23 @@ 21+<samba:parameter name="client ipc signing" 22+ context="G" 23+ type="enum" 24+ enumlist="enum_smb_signing_vals" 25+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> 26+<description> 27+ <para>This controls whether the client is allowed or required to use SMB signing for IPC$ 28+ connections as DCERPC transport inside of winbind. Possible values 29+ are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis> 30+ and <emphasis>disabled</emphasis>. 31+ </para> 32+ 33+ <para>When set to auto, SMB signing is offered, but not enforced and if set 34+ to disabled, SMB signing is not offered either.</para> 35+ 36+ <para>Connections from winbindd to Active Directory Domain Controllers 37+ always enforce signing.</para> 38+</description> 39+ 40+<related>client signing</related> 41+ 42+<value type="default">mandatory</value> 43+</samba:parameter> 44--- a/docs-xml/smbdotconf/security/clientsigning.xml 45+++ b/docs-xml/smbdotconf/security/clientsigning.xml 46@@ -12,6 +12,9 @@ 47 <para>When set to auto, SMB signing is offered, but not enforced. 48 When set to mandatory, SMB signing is required and if set 49 to disabled, SMB signing is not offered either. 50+ 51+ <para>IPC$ connections for DCERPC e.g. in winbindd, are handled by the 52+ <smbconfoption name="client ipc signing"/> option.</para> 53 </para> 54 </description> 55 56--- a/source3/include/proto.h 57+++ b/source3/include/proto.h 58@@ -1690,9 +1690,11 @@ int lp_winbind_cache_time(void); 59 int lp_winbind_reconnect_delay(void); 60 int lp_winbind_max_clients(void); 61 const char **lp_winbind_nss_info(void); 62+bool lp_winbind_sealed_pipes(void); 63 int lp_algorithmic_rid_base(void); 64 int lp_name_cache_timeout(void); 65 int lp_client_signing(void); 66+int lp_client_ipc_signing(void); 67 int lp_server_signing(void); 68 int lp_client_ldap_sasl_wrapping(void); 69 char *lp_parm_talloc_string(int snum, const char *type, const char *option, const char *def); 70--- a/source3/param/loadparm.c 71+++ b/source3/param/loadparm.c 72@@ -215,6 +215,7 @@ struct global { 73 int winbind_expand_groups; 74 bool bWinbindRefreshTickets; 75 bool bWinbindOfflineLogon; 76+ bool bWinbindSealedPipes; 77 bool bWinbindNormalizeNames; 78 bool bWinbindRpcOnly; 79 bool bCreateKrb5Conf; 80@@ -366,6 +367,7 @@ struct global { 81 int restrict_anonymous; 82 int name_cache_timeout; 83 int client_signing; 84+ int client_ipc_signing; 85 int server_signing; 86 int client_ldap_sasl_wrapping; 87 int iUsershareMaxShares; 88@@ -2319,6 +2321,15 @@ static struct parm_struct parm_table[] = 89 .flags = FLAG_ADVANCED, 90 }, 91 { 92+ .label = "client ipc signing", 93+ .type = P_ENUM, 94+ .p_class = P_GLOBAL, 95+ .ptr = &Globals.client_ipc_signing, 96+ .special = NULL, 97+ .enum_list = enum_smb_signing_vals, 98+ .flags = FLAG_ADVANCED, 99+ }, 100+ { 101 .label = "server signing", 102 .type = P_ENUM, 103 .p_class = P_GLOBAL, 104@@ -4765,6 +4776,15 @@ static struct parm_struct parm_table[] = 105 .flags = FLAG_ADVANCED, 106 }, 107 { 108+ .label = "winbind sealed pipes", 109+ .type = P_BOOL, 110+ .p_class = P_GLOBAL, 111+ .ptr = &Globals.bWinbindSealedPipes, 112+ .special = NULL, 113+ .enum_list = NULL, 114+ .flags = FLAG_ADVANCED, 115+ }, 116+ { 117 .label = "winbind normalize names", 118 .type = P_BOOL, 119 .p_class = P_GLOBAL, 120@@ -5458,6 +5478,7 @@ static void init_globals(bool reinit_glo 121 Globals.szWinbindNssInfo = str_list_make_v3(NULL, "template", NULL); 122 Globals.bWinbindRefreshTickets = False; 123 Globals.bWinbindOfflineLogon = False; 124+ Globals.bWinbindSealedPipes = True; 125 126 Globals.iIdmapCacheTime = 86400 * 7; /* a week by default */ 127 Globals.iIdmapNegativeCacheTime = 120; /* 2 minutes by default */ 128@@ -5470,6 +5491,7 @@ static void init_globals(bool reinit_glo 129 Globals.bClientUseSpnego = True; 130 131 Globals.client_signing = Auto; 132+ Globals.client_ipc_signing = Required; 133 Globals.server_signing = False; 134 135 Globals.bDeferSharingViolations = True; 136@@ -5736,6 +5758,7 @@ FN_GLOBAL_BOOL(lp_winbind_nested_groups, 137 FN_GLOBAL_INTEGER(lp_winbind_expand_groups, &Globals.winbind_expand_groups) 138 FN_GLOBAL_BOOL(lp_winbind_refresh_tickets, &Globals.bWinbindRefreshTickets) 139 FN_GLOBAL_BOOL(lp_winbind_offline_logon, &Globals.bWinbindOfflineLogon) 140+FN_GLOBAL_BOOL(lp_winbind_sealed_pipes, &Globals.bWinbindSealedPipes) 141 FN_GLOBAL_BOOL(lp_winbind_normalize_names, &Globals.bWinbindNormalizeNames) 142 FN_GLOBAL_BOOL(lp_winbind_rpc_only, &Globals.bWinbindRpcOnly) 143 FN_GLOBAL_BOOL(lp_create_krb5_conf, &Globals.bCreateKrb5Conf) 144@@ -6071,6 +6094,7 @@ FN_GLOBAL_LIST(lp_winbind_nss_info, &Glo 145 FN_GLOBAL_INTEGER(lp_algorithmic_rid_base, &Globals.AlgorithmicRidBase) 146 FN_GLOBAL_INTEGER(lp_name_cache_timeout, &Globals.name_cache_timeout) 147 FN_GLOBAL_INTEGER(lp_client_signing, &Globals.client_signing) 148+FN_GLOBAL_INTEGER(lp_client_ipc_signing, &Globals.client_ipc_signing) 149 FN_GLOBAL_INTEGER(lp_server_signing, &Globals.server_signing) 150 FN_GLOBAL_INTEGER(lp_client_ldap_sasl_wrapping, &Globals.client_ldap_sasl_wrapping) 151 152@@ -9700,6 +9724,20 @@ static bool lp_load_ex(const char *pszFn 153 lp_do_parameter(GLOBAL_SECTION_SNUM, "wins server", "127.0.0.1"); 154 } 155 156+ if (!lp_is_in_client()) { 157+ switch (lp_client_ipc_signing()) { 158+ case Required: 159+ lp_set_cmdline("client signing", "mandatory"); 160+ break; 161+ case Auto: 162+ lp_set_cmdline("client signing", "auto"); 163+ break; 164+ case False: 165+ lp_set_cmdline("client signing", "disabled"); 166+ break; 167+ } 168+ } 169+ 170 init_iconv(); 171 172 bAllowIncludeRegistry = true; 173--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c 174+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c 175@@ -2480,7 +2480,7 @@ static bool spoolss_connect_to_client(st 176 "", /* username */ 177 "", /* domain */ 178 "", /* password */ 179- 0, lp_client_signing()); 180+ 0, False); 181 182 if ( !NT_STATUS_IS_OK( ret ) ) { 183 DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n", 184--- /dev/null 185+++ b/docs-xml/smbdotconf/winbind/winbindsealedpipes.xml 186@@ -0,0 +1,15 @@ 187+<samba:parameter name="winbind sealed pipes" 188+ context="G" 189+ type="boolean" 190+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> 191+<description> 192+ <para>This option controls whether any requests from winbindd to domain controllers 193+ pipe will be sealed. Disabling sealing can be useful for debugging 194+ purposes.</para> 195+ 196+ <para>The behavior can be controlled per netbios domain 197+ by using 'winbind sealed pipes:NETBIOSDOMAIN = no' as option.</para> 198+</description> 199+ 200+<value type="default">yes</value> 201+</samba:parameter> 202--- a/source3/winbindd/winbindd_cm.c 203+++ b/source3/winbindd/winbindd_cm.c 204@@ -2384,6 +2384,15 @@ NTSTATUS cm_connect_sam(struct winbindd_ 205 TALLOC_FREE(conn->samr_pipe); 206 207 anonymous: 208+ if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) { 209+ status = NT_STATUS_DOWNGRADE_DETECTED; 210+ DEBUG(1, ("Unwilling to make SAMR connection to domain %s " 211+ "without connection level security, " 212+ "must set 'winbind sealed pipes = false' " 213+ "to proceed: %s\n", 214+ domain->name, nt_errstr(status))); 215+ goto done; 216+ } 217 218 /* Finally fall back to anonymous. */ 219 status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id, 220@@ -2610,6 +2619,16 @@ NTSTATUS cm_connect_lsa(struct winbindd_ 221 222 anonymous: 223 224+ if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) { 225+ result = NT_STATUS_DOWNGRADE_DETECTED; 226+ DEBUG(1, ("Unwilling to make LSA connection to domain %s " 227+ "without connection level security, " 228+ "must set 'winbind sealed pipes = false' " 229+ "to proceed: %s\n", 230+ domain->name, nt_errstr(result))); 231+ goto done; 232+ } 233+ 234 result = cli_rpc_pipe_open_noauth(conn->cli, 235 &ndr_table_lsarpc.syntax_id, 236 &conn->lsa_pipe); 237@@ -2749,7 +2768,18 @@ NTSTATUS cm_connect_netlogon(struct winb 238 239 no_schannel: 240 if ((lp_client_schannel() == False) || 241- ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) { 242+ ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) { 243+ if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) { 244+ result = NT_STATUS_DOWNGRADE_DETECTED; 245+ DEBUG(1, ("Unwilling to make connection to domain %s " 246+ "without connection level security, " 247+ "must set 'winbind sealed pipes = false' " 248+ "to proceed: %s\n", 249+ domain->name, nt_errstr(result))); 250+ TALLOC_FREE(netlogon_pipe); 251+ invalidate_cm_connection(conn); 252+ return result; 253+ } 254 /* 255 * NetSamLogonEx only works for schannel 256 */ 257