Re: [PATCH] Security updates for samba 3.6.25

On 29.05.2017 18:57, Michael Tremer wrote:

Hi,

Hi,

thank you for working on this.

No problem - had fun... ;-)

Yes, Arne submitted a patch that at least fixes the security vulnerability.

However, could you split this patch into two with the two remaining changes so that we can merge those?

Done. I pushed the - hopefully last - remaining patches.

Best, Matthias

Best, -Michael

On Sun, 2017-05-28 at 11:22 +0200, Matthias Fischer wrote:

...

Based on:

https://anonscm.debian.org/cgit/pkg-samba/samba.git/commit/?h=wheezy&id=... fd8eb45526e44cd0b2ae8a5b1a058ec647

https://www.samba.org/samba/history/security.html

https://www.samba.org/samba/samba/ftp/patches/security/

Fixes current CVE-2017-7494 and some more...

Removed three 'unrecognized' configure-options.

Some 'lfs'-tuning was made, too.

I altered 'PAK_VER' from "64" to "65" - if not necessary, please change back.

Best, Matthias

Signed-off-by: Matthias Fischer matthias.fischer@ipfire.org

lfs/samba | 22 +- .../samba/CVE-2017-2619-race-condition-fix.patch | 1150 ++++++++++++++++++++ .../CVE-2017-2619-regression-bug-12721-fix.patch | 179 +++ src/patches/samba/CVE-2017-2619-tests.patch | 296 +++++ src/patches/samba/samba-3.6.25-CVE-2017-7494.patch | 14 + .../samba/samba-3.6.25-security-2015-12-16.patch | 255 +++++ 6 files changed, 1909 insertions(+), 7 deletions(-) create mode 100644 src/patches/samba/CVE-2017-2619-race-condition-fix.patch create mode 100644 src/patches/samba/CVE-2017-2619-regression-bug-12721- fix.patch create mode 100644 src/patches/samba/CVE-2017-2619-tests.patch create mode 100644 src/patches/samba/samba-3.6.25-CVE-2017-7494.patch create mode 100644 src/patches/samba/samba-3.6.25-security-2015-12-16.patch

diff --git a/lfs/samba b/lfs/samba index 076152f48..445646464 100644 --- a/lfs/samba +++ b/lfs/samba @@ -1,7 +1,7 @@ ############################################################################# ## # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2016 IPFire Team info@ipfire.org # +# Copyright (C) 2007-2017 IPFire Team info@ipfire.org # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 64 +PAK_VER = 65

DEPS = "cups krb5"

@@ -54,7 +54,7 @@ download :$(patsubst %,$(DIR_DL)/%,$(objects))

md5 : $(subst %,%_MD5,$(objects))

-dist: +dist: @$(PAK)

############################################################################# ## @@ -88,6 +88,17 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/samba/CVE-2016- 2118-v3-6.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/samba/CVE-2015- 5370-v3-6.patch

• # Apply Debian CVE patches
• cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/samba/CVE-2017-

2619-race-condition-fix.patch

• cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/samba/CVE-2017-

2619-regression-bug-12721-fix.patch

• cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/samba/CVE-2017-

2619-tests.patch

• # Fixes CVE-2015-5252 - Samba
• cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/samba/samba-

3.6.25-security-2015-12-16.patch

• # Fixes CVE-2017-7494 - Samba
• cd $(DIR_APP) && patch -Np0 < $(DIR_SRC)/src/patches/samba/samba-

3.6.25-CVE-2017-7494.patch

• cd $(DIR_APP)/source3 && ./autogen.sh cd $(DIR_APP)/source3 && ./configure \ --prefix=/usr \

@@ -102,10 +113,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --with-libsmbclient \ --with-libsmbsharemodes \ --with-sendfile-support \

• --without-smbwrapper \
  

• --with-mmap \
  

  --with-fhs \

• --with-vfs \
  

  --with-winbind \ --disable-swat \ --enable-cups \

@@ -119,8 +127,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) #cd $(DIR_APP)/source3 && install -v -m755 nsswitch/libnss_winbind.so /lib #cd $(DIR_APP)/source3 && ln -v -sf libnss_winbind.so /lib/libnss_winbind.so.2 #cd $(DIR_APP)/source3 && ln -v -sf libnss_wins.so /lib/libnss_wins.so.2

• -mkdir -p /var/ipfire/samba cd $(DIR_APP)/source3 && install -v -m644

../examples/smb.conf.default /var/ipfire/samba

• -mkdir -p /var/ipfire/samba cp -vrf $(DIR_SRC)/config/samba/* /var/ipfire/samba/ chown nobody:nobody -R /var/ipfire/samba/ cp -vfp /var/ipfire/samba/default.global /var/ipfire/samba/global

diff --git a/src/patches/samba/CVE-2017-2619-race-condition-fix.patch b/src/patches/samba/CVE-2017-2619-race-condition-fix.patch new file mode 100644 index 000000000..a96d6be3b --- /dev/null +++ b/src/patches/samba/CVE-2017-2619-race-condition-fix.patch @@ -0,0 +1,1150 @@ +Description: This patch is a consolidation of several patches described by the Git commit summaries below +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-261 9 +bug: https://bugzilla.samba.org/show_bug.cgi?id=12496

+From ec1bca1d5315549e945c93cbf5e3abdb695de782 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 20 Mar 2017 11:32:19 -0700 +Subject: [PATCH 01/15] CVE-2017-2619: s3/smbd: re-open directory after

• dptr_CloseDir()

+dptr_CloseDir() will close and invalidate the fsp's file descriptor, we +have to reopen it.

+Bug: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Ralph Bohme slow@samba.org +Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/open.c | 2 +-
• source3/smbd/proto.h | 2 ++
• source3/smbd/smb2_find.c | 17 +++++++++++++++++
• 3 files changed, 20 insertions(+), 1 deletion(-)

+From 2bb9a3d35f6a0cc43a30638594969c4860ffd5a5 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Tue, 28 Feb 2017 09:24:07 -0800 +Subject: [PATCH 02/15] s3: vfs: dirsort doesn't handle opendir of "."

• correctly.

+Needs to store $cwd path for correct sorting.

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12499

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/modules/vfs_dirsort.c | 4 ++++
• 1 file changed, 4 insertions(+)

+From 327d09ba641046f68daa5b2bb98f09530294cb0d Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 13 Mar 2017 13:44:42 -0700 +Subject: [PATCH 03/15] s3: VFS: vfs_streams_xattr.c: Make streams_xattr_open()

• store the same path as streams_xattr_recheck().

+If the open is changing directories, fsp->fsp_name->base_name +will be the full path from the share root, whilst +smb_fname will be relative to the $cwd.

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12546

+Back-ported from a24ba3e4083200ec9885363efc5769f43183fb6b

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/modules/vfs_streams_xattr.c | 9 ++++++++-
• 1 file changed, 8 insertions(+), 1 deletion(-)

+From 27871d3bfb0857ad3306aabdce6f9b55e32fff3d Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 13 Mar 2017 13:54:04 -0700 +Subject: [PATCH 04/15] vfs_streams_xattr: use fsp, not base_fsp

+The base_fsp's fd is always -1 as it's closed after being openend in +create_file_unixpath().

+Additionally in streams_xattr_open force using of SMB_VFS_FSETXATTR() by +sticking the just created fd into the fsp (and removing it afterwards).

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12591

+Back-ported from 021189e32ba507832b5e821e5cda8a2889225955.

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/modules/vfs_streams_xattr.c | 205 +++++++++++++++++-----------------

--

• 1 file changed, 99 insertions(+), 106 deletions(-)

+From a419b277c5994459c956ebdd324679e728ebae10 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 19 Dec 2016 11:55:56 -0800 +Subject: [PATCH 05/15] s3: smbd: Create wrapper function for OpenDir in

• preparation for making robust.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/dir.c | 15 ++++++++++++++-
• 1 file changed, 14 insertions(+), 1 deletion(-)

+From e47e3c40b5fc8f52fe70c3e1edf5489ac8b4badf Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 19 Dec 2016 16:25:26 -0800 +Subject: [PATCH 06/15] s3: smbd: Opendir_internal() early return if

• SMB_VFS_OPENDIR failed.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/dir.c | 14 +++++++-------
• 1 file changed, 7 insertions(+), 7 deletions(-)

+From 45e41b709b6c2e67acb99f29aa05b61b53091e57 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 19 Dec 2016 16:35:00 -0800 +Subject: [PATCH 07/15] s3: smbd: Create and use open_dir_safely(). Use from

• OpenDir().

+Hardens OpenDir against TOC/TOU races.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/dir.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++++--

---

• 1 file changed, 59 insertions(+), 7 deletions(-)

+From 720abcec65b04fdac1052a14898180c8cc816464 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 19 Dec 2016 12:13:20 -0800 +Subject: [PATCH 08/15] s3: smbd: OpenDir_fsp() use early returns.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/dir.c | 34 +++++++++++++++++++++-------------
• 1 file changed, 21 insertions(+), 13 deletions(-)

+From 5070f319bbb7dda87766621a83691910414d06a1 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 19 Dec 2016 12:15:59 -0800 +Subject: [PATCH 09/15] s3: smbd: OpenDir_fsp() - Fix memory leak on error.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/dir.c | 2 +-
• 1 file changed, 1 insertion(+), 1 deletion(-)

+From 65d37759f8b4979bc0c0833e0a5eecd277dfa604 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 19 Dec 2016 12:32:07 -0800 +Subject: [PATCH 10/15] s3: smbd: Move the reference counting and destructor

• setup to just before retuning success.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/dir.c | 10 +++++-----
• 1 file changed, 5 insertions(+), 5 deletions(-)

+From 5a821d791aba90643ddf7a3c29dad4f6621ef185 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 19 Dec 2016 12:35:32 -0800 +Subject: [PATCH 11/15] s3: smbd: Correctly fallback to open_dir_safely if

• FDOPENDIR not supported on system.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/dir.c | 15 +++++++--------
• 1 file changed, 7 insertions(+), 8 deletions(-)

+From 597aa3b99a2790133a4839260607b0a8df41c8e3 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Thu, 15 Dec 2016 12:52:13 -0800 +Subject: [PATCH 12/15] s3: smbd: Remove O_NOFOLLOW guards. We insist on

• O_NOFOLLOW existing.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/open.c | 4 +---
• 1 file changed, 1 insertion(+), 3 deletions(-)

+From 563af2ffec05a2c0b54897e2d28ac7e1adb66e0f Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Thu, 15 Dec 2016 12:56:08 -0800 +Subject: [PATCH 13/15] s3: smbd: Move special handling of symlink errno's into

• a utility function.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/open.c | 30 ++++++++++++++++++++++++++++--
• 1 file changed, 28 insertions(+), 2 deletions(-)

+From b34a67cd3a996804ba7bf90e86cf9e22edf60eb3 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Thu, 15 Dec 2016 13:04:46 -0800 +Subject: [PATCH 14/15] s3: smbd: Add the core functions to prevent symlink

• open races.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/open.c | 242

++++++++++++++++++++++++++++++++++++++++++++++++++++

• 1 file changed, 242 insertions(+)

+From 5920309d2f62dd24fc50530c92dd68077f96a6d2 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Thu, 15 Dec 2016 13:06:31 -0800 +Subject: [PATCH 15/15] s3: smbd: Use the new non_widelink_open() function.

+CVE-2017-2619

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

+Signed-off-by: Jeremy Allison jra@samba.org +---

• source3/smbd/open.c | 23 ++++++++++++++++++++++-
• 1 file changed, 22 insertions(+), 1 deletion(-)

+--- samba-3.6.6.orig/source3/smbd/open.c ++++ samba-3.6.6/source3/smbd/open.c +@@ -187,10 +187,277 @@

• }

/**************************************************************************** ++ Handle differing symlink errno's ++**************************************************************************** / ++ ++static int link_errno_convert(int err) ++{ ++#if defined(ENOTSUP) && defined(OSF1) ++ /* handle special Tru64 errno */ ++ if (err == ENOTSUP) { ++ err = ELOOP; ++ } ++#endif /* ENOTSUP */ ++#ifdef EFTYPE ++ /* fix broken NetBSD errno */ ++ if (err == EFTYPE) { ++ err = ELOOP; ++ } ++#endif /* EFTYPE */ ++ /* fix broken FreeBSD errno */ ++ if (err == EMLINK) { ++ err = ELOOP; ++ } ++ return err; ++} ++ ++static int non_widelink_open(struct connection_struct *conn, ++ const char *conn_rootdir, ++ files_struct *fsp, ++ struct smb_filename *smb_fname, ++ int flags, ++ mode_t mode, ++ unsigned int link_depth); ++ ++/***************************************************************************

++ Follow a symlink in userspace. ++**************************************************************************** / ++ ++static int process_symlink_open(struct connection_struct *conn, ++ const char *conn_rootdir, ++ files_struct *fsp, ++ struct smb_filename *smb_fname, ++ int flags, ++ mode_t mode, ++ unsigned int link_depth) ++{ ++ int fd = -1; ++ char *link_target = NULL; ++ int link_len = -1; ++ char *oldwd = NULL; ++ size_t rootdir_len = 0; ++ char *resolved_name = NULL; ++ bool matched = false; ++ int saved_errno = 0; ++ ++ /* ++ * Ensure we don't get stuck in a symlink loop. ++ */ ++ link_depth++; ++ if (link_depth >= 20) { ++ errno = ELOOP; ++ goto out; ++ } ++ ++ /* Allocate space for the link target. */ ++ link_target = talloc_array(talloc_tos(), char, PATH_MAX); ++ if (link_target == NULL) { ++ errno = ENOMEM; ++ goto out; ++ } ++ ++ /* Read the link target. */ ++ link_len = SMB_VFS_READLINK(conn, ++ smb_fname->base_name, ++ link_target, ++ PATH_MAX - 1); ++ if (link_len == -1) { ++ goto out; ++ } ++ ++ /* Ensure it's at least null terminated. */ ++ link_target[link_len] = '\0'; ++ ++ /* Convert to an absolute path. */ ++ resolved_name = SMB_VFS_REALPATH(conn, link_target); ++ if (resolved_name == NULL) { ++ goto out; ++ } ++ ++ /* ++ * We know conn_rootdir starts with '/' and ++ * does not end in '/'. FIXME ! Should we ++ * smb_assert this ? ++ */ ++ rootdir_len = strlen(conn_rootdir); ++ ++ matched = (strncmp(conn_rootdir, resolved_name, rootdir_len) == 0); ++ if (!matched) { ++ errno = EACCES; ++ goto out; ++ } ++ ++ /* ++ * Turn into a path relative to the share root. ++ */ ++ if (resolved_name[rootdir_len] == '\0') { ++ /* Link to the root of the share. */ ++ smb_fname->base_name = talloc_strdup(talloc_tos(), "."); ++ if (smb_fname->base_name == NULL) { ++ errno = ENOMEM; ++ goto out; ++ } ++ } else if (resolved_name[rootdir_len] == '/') { ++ smb_fname->base_name = &resolved_name[rootdir_len+1]; ++ } else { ++ errno = EACCES; ++ goto out; ++ } ++ ++ oldwd = vfs_GetWd(talloc_tos(), conn); ++ if (oldwd == NULL) { ++ goto out; ++ } ++ ++ /* Ensure we operate from the root of the share. */ ++ if (vfs_ChDir(conn, conn_rootdir) == -1) { ++ goto out; ++ } ++ ++ /* And do it all again.. */ ++ fd = non_widelink_open(conn, ++ conn_rootdir, ++ fsp, ++ smb_fname, ++ flags, ++ mode, ++ link_depth); ++ if (fd == -1) { ++ saved_errno = errno; ++ } ++ ++ out: ++ ++ SAFE_FREE(resolved_name); ++ TALLOC_FREE(link_target); ++ if (oldwd != NULL) { ++ int ret = vfs_ChDir(conn, oldwd); ++ if (ret == -1) { ++ smb_panic("unable to get back to old directory\n"); ++ } ++ TALLOC_FREE(oldwd); ++ } ++ if (saved_errno != 0) { ++ errno = saved_errno; ++ } ++ return fd; ++} ++ ++/***************************************************************************

++ Non-widelink open. ++**************************************************************************** / ++ ++static int non_widelink_open(struct connection_struct *conn, ++ const char *conn_rootdir, ++ files_struct *fsp, ++ struct smb_filename *smb_fname, ++ int flags, ++ mode_t mode, ++ unsigned int link_depth) ++{ ++ NTSTATUS status; ++ int fd = -1; ++ struct smb_filename *smb_fname_rel = NULL; ++ int saved_errno = 0; ++ char *oldwd = NULL; ++ char *parent_dir = NULL; ++ const char *final_component = NULL; ++ ++ if (!parent_dirname(talloc_tos(), ++ smb_fname->base_name, ++ &parent_dir, ++ &final_component)) { ++ goto out; ++ } ++ ++ oldwd = vfs_GetWd(talloc_tos(), conn); ++ if (oldwd == NULL) { ++ goto out; ++ } ++ ++ /* Pin parent directory in place. */ ++ if (vfs_ChDir(conn, parent_dir) == -1) { ++ goto out; ++ } ++ ++ /* Ensure the relative path is below the share. */ ++ status = check_reduced_name(conn, final_component); ++ if (!NT_STATUS_IS_OK(status)) { ++ saved_errno = map_errno_from_nt_status(status); ++ goto out; ++ } ++ ++ status = create_synthetic_smb_fname(talloc_tos(), ++ final_component, ++ smb_fname->stream_name, ++ &smb_fname->st, ++ &smb_fname_rel); ++ if (!NT_STATUS_IS_OK(status)) { ++ saved_errno = map_errno_from_nt_status(status); ++ goto out; ++ } ++ ++ flags |= O_NOFOLLOW; ++ ++ { ++ struct smb_filename *tmp_name = fsp->fsp_name; ++ fsp->fsp_name = smb_fname_rel; ++ fd = SMB_VFS_OPEN(conn, smb_fname_rel, fsp, flags, mode); ++ fsp->fsp_name = tmp_name; ++ } ++ ++ if (fd == -1) { ++ saved_errno = link_errno_convert(errno); ++ if (saved_errno == ELOOP) { ++ if (fsp->posix_open) { ++ /* Never follow symlinks on posix open. */ ++ goto out; ++ } ++ if (!lp_symlinks(SNUM(conn))) { ++ /* Explicitly no symlinks. */ ++ goto out; ++ } ++ /* ++ * We have a symlink. Follow in userspace ++ * to ensure it's under the share definition. ++ */ ++ fd = process_symlink_open(conn, ++ conn_rootdir, ++ fsp, ++ smb_fname_rel, ++ flags, ++ mode, ++ link_depth); ++ if (fd == -1) { ++ saved_errno = ++ link_errno_convert(errno); ++ } ++ } ++ } ++ ++ out: ++ ++ TALLOC_FREE(parent_dir); ++ TALLOC_FREE(smb_fname_rel); ++ ++ if (oldwd != NULL) { ++ int ret = vfs_ChDir(conn, oldwd); ++ if (ret == -1) { ++ smb_panic("unable to get back to old directory\n"); ++ } ++ TALLOC_FREE(oldwd); ++ } ++ if (saved_errno != 0) { ++ errno = saved_errno; ++ } ++ return fd; ++} ++ ++/***************************************************************************

• fd support routines - attempt to do a dos_open.

****************************************************************************/

+-static NTSTATUS fd_open(struct connection_struct *conn, ++NTSTATUS fd_open(struct connection_struct *conn,

•     files_struct *fsp,
  

•     int flags,
  

•     mode_t mode)
  

+@@ -198,8 +465,7 @@

• struct smb_filename *smb_fname = fsp->fsp_name;
• NTSTATUS status = NT_STATUS_OK;

+-#ifdef O_NOFOLLOW +- /* ++ /*

• * Never follow symlinks on a POSIX client. The
  

• * client should be doing this.
  

• */
  

+@@ -207,12 +473,33 @@

• if (fsp->posix_open || !lp_symlinks(SNUM(conn))) {

• flags |= O_NOFOLLOW;
  

• }

+-#endif

+- fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, mode); ++ /* Ensure path is below share definition. */ ++ if (!lp_widelinks(SNUM(conn))) { ++ const char *conn_rootdir = SMB_VFS_CONNECTPATH(conn, ++ smb_fname->base_name); ++ if (conn_rootdir == NULL) { ++ return NT_STATUS_NO_MEMORY; ++ } ++ /* ++ * Only follow symlinks within a share ++ * definition. ++ */ ++ fsp->fh->fd = non_widelink_open(conn, ++ conn_rootdir, ++ fsp, ++ smb_fname, ++ flags, ++ mode, ++ 0); ++ } else { ++ fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, mode); ++ } ++

• if (fsp->fh->fd == -1) {

+- status = map_nt_error_from_unix(errno); +- if (errno == EMFILE) { ++ int posix_errno = link_errno_convert(errno); ++ status = map_nt_error_from_unix(posix_errno); ++ if (posix_errno == EMFILE) {

• 	static time_t last_warned = 0L;
  

• 	if (time((time_t *) NULL) > last_warned) {
  

+--- samba-3.6.6.orig/source3/smbd/proto.h ++++ samba-3.6.6/source3/smbd/proto.h +@@ -592,6 +592,8 @@

• 		const struct security_token *token,
  

• 		uint32_t access_desired,
  

• 		uint32_t *access_granted);
  

++NTSTATUS fd_open(struct connection_struct *conn, files_struct *fsp, ++ int flags, mode_t mode);

• NTSTATUS fd_close(files_struct *fsp);
• void change_file_owner_to_parent(connection_struct *conn,

• 		 const char *inherit_from_dir,
  

+--- samba-3.6.6.orig/source3/smbd/smb2_find.c ++++ samba-3.6.6/source3/smbd/smb2_find.c +@@ -24,6 +24,7 @@

• #include "../libcli/smb/smb_common.h"
• #include "trans2.h"
• #include "../lib/util/tevent_ntstatus.h"

++#include "system/filesys.h"

• static struct tevent_req *smbd_smb2_find_send(TALLOC_CTX *mem_ctx,

• 			      struct tevent_context *ev,
  

+@@ -300,7 +301,23 @@

• }
• if (in_flags & SMB2_CONTINUE_FLAG_REOPEN) {

++ int flags; ++

• dptr_CloseDir(fsp);
  

++ ++ /* ++ * dptr_CloseDir() will close and invalidate the fsp's file ++ * descriptor, we have to reopen it. ++ */ ++ ++ flags = O_RDONLY; ++#ifdef O_DIRECTORY ++ flags |= O_DIRECTORY; ++#endif ++ status = fd_open(conn, fsp, flags, 0); ++ if (tevent_req_nterror(req, status)) { ++ return tevent_req_post(req, ev); ++ }

• }
• if (fsp->dptr == NULL) {

+--- samba-3.6.6.orig/source3/modules/vfs_dirsort.c ++++ samba-3.6.6/source3/modules/vfs_dirsort.c +@@ -141,6 +141,10 @@

• return NULL;
  

• }

++ if (ISDOT(data->smb_fname->base_name)) { ++ data->smb_fname->base_name = vfs_GetWd(data, handle->conn); ++ } ++

• /* Open the underlying directory and count the number of entries */
• data->source_directory = SMB_VFS_NEXT_OPENDIR(handle, fname, mask,

• 				      attr);
  

+--- samba-3.6.6.orig/source3/modules/vfs_streams_xattr.c ++++ samba-3.6.6/source3/modules/vfs_streams_xattr.c +@@ -229,7 +229,7 @@

• return -1;
  

• }

+- sbuf->st_ex_size = get_xattr_size(handle->conn, fsp->base_fsp, ++ sbuf->st_ex_size = get_xattr_size(handle->conn, fsp,

• 			io->base, io->xattr_name);
  

• if (sbuf->st_ex_size == -1) {

• return -1;
  

+@@ -364,6 +364,7 @@

• char *xattr_name = NULL;
• int baseflags;
• int hostfd = -1;

++ int ret;

• DEBUG(10, ("streams_xattr_open called for %s\n",

•    smb_fname_str_dbg(smb_fname)));
  

+@@ -375,133 +376,125 @@

• /* If the default stream is requested, just open the base file. */
• if (is_ntfs_default_stream_smb_fname(smb_fname)) {

• char *tmp_stream_name;
  

+- int ret;

• tmp_stream_name = smb_fname->stream_name;
  

• smb_fname->stream_name = NULL;
  

• ret = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags,
  

mode);

+- smb_fname->stream_name = tmp_stream_name; +- +- return ret; +- } ++ smb_fname->stream_name = tmp_stream_name;

+- status = streams_xattr_get_name(talloc_tos(), smb_fname-

...

stream_name,

+- &xattr_name); +- if (!NT_STATUS_IS_OK(status)) { +- errno = map_errno_from_nt_status(status); +- goto fail; +- } ++ return ret; ++ }

+- /* Create an smb_filename with stream_name == NULL. */ +- status = create_synthetic_smb_fname(talloc_tos(), +- smb_fname->base_name, +- NULL, NULL, +- &smb_fname_base); +- if (!NT_STATUS_IS_OK(status)) { +- errno = map_errno_from_nt_status(status); +- goto fail; +- } ++ status = streams_xattr_get_name(talloc_tos(), smb_fname-

...

stream_name,

++ &xattr_name); ++ if (!NT_STATUS_IS_OK(status)) { ++ errno = map_errno_from_nt_status(status); ++ goto fail; ++ }

+- /* +- * We use baseflags to turn off nasty side-effects when opening the +- * underlying file. +- */ +- baseflags = flags; +- baseflags &= ~O_TRUNC; +- baseflags &= ~O_EXCL; +- baseflags &= ~O_CREAT; +- +- hostfd = SMB_VFS_OPEN(handle->conn, smb_fname_base, fsp, +- baseflags, mode); +- +- TALLOC_FREE(smb_fname_base); +- +- /* It is legit to open a stream on a directory, but the base +- * fd has to be read-only. +- */ +- if ((hostfd == -1) && (errno == EISDIR)) { +- baseflags &= ~O_ACCMODE; +- baseflags |= O_RDONLY; +- hostfd = SMB_VFS_OPEN(handle->conn, smb_fname, fsp, baseflags, +- mode); +- } ++ /* Create an smb_filename with stream_name == NULL. */ ++ status = create_synthetic_smb_fname(talloc_tos(), ++ smb_fname->base_name, ++ NULL, NULL, ++ &smb_fname_base); ++ if (!NT_STATUS_IS_OK(status)) { ++ errno = map_errno_from_nt_status(status); ++ goto fail; ++ }

+- if (hostfd == -1) { +- goto fail; +- } ++ /* ++ * We use baseflags to turn off nasty side-effects when opening the ++ * underlying file. ++ */ ++ baseflags = flags; ++ baseflags &= ~O_TRUNC; ++ baseflags &= ~O_EXCL; ++ baseflags &= ~O_CREAT;

+- status = get_ea_value(talloc_tos(), handle->conn, NULL, +- smb_fname->base_name, xattr_name, &ea); ++ hostfd = SMB_VFS_OPEN(handle->conn, smb_fname_base, fsp, ++ baseflags, mode);

+- DEBUG(10, ("get_ea_value returned %s\n", nt_errstr(status))); ++ TALLOC_FREE(smb_fname_base);

+- if (!NT_STATUS_IS_OK(status) +- && !NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) { +- /* +- * The base file is not there. This is an error even if we got +- * O_CREAT, the higher levels should have created the base +- * file for us. ++ /* It is legit to open a stream on a directory, but the base ++ * fd has to be read-only.

•  */
  

+- DEBUG(10, ("streams_xattr_open: base file %s not around, " +- "returning ENOENT\n", smb_fname->base_name)); +- errno = ENOENT; +- goto fail; +- } ++ if ((hostfd == -1) && (errno == EISDIR)) { ++ baseflags &= ~O_ACCMODE; ++ baseflags |= O_RDONLY; ++ hostfd = SMB_VFS_OPEN(handle->conn, smb_fname, fsp, baseflags, ++ mode); ++ }

+- if (!NT_STATUS_IS_OK(status)) { +- /* +- * The attribute does not exist +- */ ++ if (hostfd == -1) { ++ goto fail; ++ } ++ ++ status = get_ea_value(talloc_tos(), handle->conn, NULL, ++ smb_fname->base_name, xattr_name, &ea);

+- if (flags & O_CREAT) { ++ DEBUG(10, ("get_ea_value returned %s\n", nt_errstr(status))); ++ ++ if (!NT_STATUS_IS_OK(status) ++ && !NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {

• 	/*
  

+- * Darn, xattrs need at least 1 byte ++ * The base file is not there. This is an error even if we got ++ * O_CREAT, the higher levels should have created the base ++ * file for us.

• 	 */
  

+- char null = '\0'; ++ DEBUG(10, ("streams_xattr_open: base file %s not around, " ++ "returning ENOENT\n", smb_fname-

...

base_name));

++ errno = ENOENT; ++ goto fail; ++ }

+- DEBUG(10, ("creating attribute %s on file %s\n", +- xattr_name, smb_fname->base_name)); ++ if (!NT_STATUS_IS_OK(status)) { ++ /* ++ * The attribute does not exist ++ */

++ if (flags & O_CREAT) { ++ /* ++ * Darn, xattrs need at least 1 byte ++ */ ++ char null = '\0'; ++ ++ DEBUG(10, ("creating attribute %s on file %s\n", ++ xattr_name, smb_fname-

...

base_name));

++ ++ fsp->fh->fd = hostfd; ++ ret = SMB_VFS_FSETXATTR(fsp, xattr_name, ++ &null, sizeof(null), ++ flags & O_EXCL ? XATTR_CREATE : 0); ++ fsp->fh->fd = -1; ++ if (ret != 0) { ++ goto fail; ++ } ++ } ++ } ++ ++ if (flags & O_TRUNC) { ++ char null = '\0';

• 	if (fsp->base_fsp->fh->fd != -1) {
  

+- if (SMB_VFS_FSETXATTR( +- fsp->base_fsp, xattr_name, +- &null, sizeof(null), +- flags & O_EXCL ? XATTR_CREATE : 0) == -1) { ++ if (SMB_VFS_FSETXATTR( ++ fsp->base_fsp, xattr_name, ++ &null, sizeof(null), ++ flags & O_EXCL ? XATTR_CREATE : 0) == -1) {

• 			goto fail;
  

• 		}
  

• 	} else {
  

+- if (SMB_VFS_SETXATTR( +- handle->conn, smb_fname->base_name, +- xattr_name, &null, sizeof(null), +- flags & O_EXCL ? XATTR_CREATE : 0) == -1) { ++ if (SMB_VFS_SETXATTR( ++ handle->conn, smb_fname-

...

base_name,

++ xattr_name, &null, sizeof(null), ++ flags & O_EXCL ? XATTR_CREATE : 0) == -1) {

• 			goto fail;
  

• 		}
  

• 	}
  

• }
  

+- } +- +- if (flags & O_TRUNC) { +- char null = '\0'; +- if (fsp->base_fsp->fh->fd != -1) { +- if (SMB_VFS_FSETXATTR( +- fsp->base_fsp, xattr_name, +- &null, sizeof(null), +- flags & O_EXCL ? XATTR_CREATE : 0) == -1) { +- goto fail; +- } +- } else { +- if (SMB_VFS_SETXATTR( +- handle->conn, smb_fname->base_name, +- xattr_name, &null, sizeof(null), +- flags & O_EXCL ? XATTR_CREATE : 0) == -1) { +- goto fail; +- } +- } +- }

+- sio = (struct stream_io *)VFS_ADD_FSP_EXTENSION(handle, fsp, ++ sio = (struct stream_io *)VFS_ADD_FSP_EXTENSION(handle, fsp,

• 					struct stream_io,
  

• 					NULL);
  

•     if (sio == NULL) {
  

+@@ -511,8 +504,15 @@

•     sio->xattr_name = talloc_strdup(VFS_MEMCTX_FSP_EXTENSION(handle,
  

fsp),

• 			xattr_name);
  

++ /* ++ * sio->base needs to be a copy of fsp->fsp_name->base_name, ++ * making it identical to streams_xattr_recheck(). If the ++ * open is changing directories, fsp->fsp_name->base_name ++ * will be the full path from the share root, whilst ++ * smb_fname will be relative to the $cwd. ++ */

•     sio->base = talloc_strdup(VFS_MEMCTX_FSP_EXTENSION(handle, fsp),
  

+- smb_fname->base_name); ++ fsp->fsp_name->base_name);

• sio->fsp_name_ptr = fsp->fsp_name;
• sio->handle = handle;
• sio->fsp = fsp;

+@@ -861,7 +861,7 @@

• return -1;
  

• }

+- status = get_ea_value(talloc_tos(), handle->conn, fsp->base_fsp, ++ status = get_ea_value(talloc_tos(), handle->conn, fsp,

• 	      sio->base, sio->xattr_name, &ea);
  

• if (!NT_STATUS_IS_OK(status)) {

• return -1;
  

+@@ -885,13 +885,13 @@

•     memcpy(ea.value.data + offset, data, n);
  

+- if (fsp->base_fsp->fh->fd != -1) { +- ret = SMB_VFS_FSETXATTR(fsp->base_fsp, ++ if (fsp->fh->fd != -1) { ++ ret = SMB_VFS_FSETXATTR(fsp,

• 		sio->xattr_name,
  

• 		ea.value.data, ea.value.length, 0);
  

• } else {

• ret = SMB_VFS_SETXATTR(fsp->conn,
  

+- fsp->base_fsp->fsp_name->base_name, ++ fsp->fsp_name->base_name,

• 		sio->xattr_name,
  

• 		ea.value.data, ea.value.length, 0);
  

• }

+@@ -925,7 +925,7 @@

• return -1;
  

• }

+- status = get_ea_value(talloc_tos(), handle->conn, fsp->base_fsp, ++ status = get_ea_value(talloc_tos(), handle->conn, fsp,

• 	      sio->base, sio->xattr_name, &ea);
  

• if (!NT_STATUS_IS_OK(status)) {

• return -1;
  

+@@ -970,7 +970,7 @@

• return -1;
  

• }

+- status = get_ea_value(talloc_tos(), handle->conn, fsp->base_fsp, ++ status = get_ea_value(talloc_tos(), handle->conn, fsp,

• 	      sio->base, sio->xattr_name, &ea);
  

• if (!NT_STATUS_IS_OK(status)) {

• return -1;
  

+@@ -995,13 +995,13 @@

• ea.value.length = offset + 1;
• ea.value.data[offset] = 0;

+- if (fsp->base_fsp->fh->fd != -1) { +- ret = SMB_VFS_FSETXATTR(fsp->base_fsp, ++ if (fsp->fh->fd != -1) { ++ ret = SMB_VFS_FSETXATTR(fsp,

• 		sio->xattr_name,
  

• 		ea.value.data, ea.value.length, 0);
  

• } else {

• ret = SMB_VFS_SETXATTR(fsp->conn,
  

+- fsp->base_fsp->fsp_name->base_name, ++ fsp->fsp_name->base_name,

• 		sio->xattr_name,
  

• 		ea.value.data, ea.value.length, 0);
  

• }

+--- samba-3.6.6.orig/source3/smbd/dir.c ++++ samba-3.6.6/source3/smbd/dir.c +@@ -1358,7 +1358,8 @@

• Open a directory.
• ********************************************************************/

+-struct smb_Dir *OpenDir(TALLOC_CTX *mem_ctx, connection_struct *conn, ++static struct smb_Dir *OpenDir_internal(TALLOC_CTX *mem_ctx, ++ connection_struct *conn,

• 	const char *name,
  

• 	const char *mask,
  

• 	uint32 attr)
  

+@@ -1370,27 +1371,21 @@

• return NULL;
  

• }

+- dirp->conn = conn; +- dirp->name_cache_size = lp_directory_name_cache_size(SNUM(conn)); +- +- dirp->dir_path = talloc_strdup(dirp, name); +- if (!dirp->dir_path) { +- errno = ENOMEM; ++ dirp->dir = SMB_VFS_OPENDIR(conn, name, mask, attr); ++ if (!dirp->dir) { ++ DEBUG(5,("OpenDir: Can't open %s. %s\n", name, ++ strerror(errno) ));

• goto fail;
  

• }

++ dirp->conn = conn; ++ dirp->name_cache_size = lp_directory_name_cache_size(SNUM(conn)); ++

• if (sconn && !sconn->using_smb2) {

• sconn->searches.dirhandles_open++;
  

• }
• talloc_set_destructor(dirp, smb_Dir_destructor);

+- dirp->dir = SMB_VFS_OPENDIR(conn, dirp->dir_path, mask, attr); +- if (!dirp->dir) { +- DEBUG(5,("OpenDir: Can't open %s. %s\n", dirp->dir_path, +- strerror(errno) )); +- goto fail; +- } +-

• return dirp;
• fail:

+@@ -1398,6 +1393,76 @@

• return NULL;
• }

++/***************************************************************************

++ Open a directory handle by pathname, ensuring it's under the share path. ++**************************************************************************** / ++ ++static struct smb_Dir *open_dir_safely(TALLOC_CTX *ctx, ++ connection_struct *conn, ++ const char *name, ++ const char *wcard, ++ uint32_t attr) ++{ ++ struct smb_Dir *dir_hnd = NULL; ++ char *saved_dir = vfs_GetWd(ctx, conn); ++ NTSTATUS status; ++ ++ if (saved_dir == NULL) { ++ return NULL; ++ } ++ ++ if (vfs_ChDir(conn, name) == -1) { ++ goto out; ++ } ++ ++ /* ++ * Now the directory is pinned, use ++ * REALPATH to ensure we can access it. ++ */ ++ status = check_name(conn, "."); ++ if (!NT_STATUS_IS_OK(status)) { ++ goto out; ++ } ++ ++ dir_hnd = OpenDir_internal(ctx, ++ conn, ++ ".", ++ wcard, ++ attr); ++ ++ if (dir_hnd == NULL) { ++ goto out; ++ } ++ ++ /* ++ * OpenDir_internal only gets "." as the dir name. ++ * Store the real dir name here. ++ */ ++ ++ dir_hnd->dir_path = talloc_strdup(dir_hnd, name); ++ if (!dir_hnd->dir_path) { ++ errno = ENOMEM; ++ } ++ ++ out: ++ ++ vfs_ChDir(conn, saved_dir); ++ TALLOC_FREE(saved_dir); ++ return dir_hnd; ++} ++ ++struct smb_Dir *OpenDir(TALLOC_CTX *mem_ctx, connection_struct *conn, ++ const char *name, ++ const char *mask, ++ uint32_t attr) ++{ ++ return open_dir_safely(mem_ctx, ++ conn, ++ name, ++ mask, ++ attr); ++} ++

• /*******************************************************************
• Open a directory from an fsp.
• ********************************************************************/

+@@ -1411,7 +1476,17 @@

• struct smbd_server_connection *sconn = conn->sconn;
• if (!dirp) {

+- return NULL; ++ goto fail; ++ } ++ ++ if (!fsp->is_directory) { ++ errno = EBADF; ++ goto fail; ++ } ++ ++ if (fsp->fh->fd == -1) { ++ errno = EBADF; ++ goto fail;

• }
• dirp->conn = conn;

+@@ -1423,36 +1498,33 @@

• goto fail;
  

• }

+- if (sconn && !sconn->using_smb2) { +- sconn->searches.dirhandles_open++; +- } +- talloc_set_destructor(dirp, smb_Dir_destructor); +- +- if (fsp->is_directory && fsp->fh->fd != -1) { +- dirp->dir = SMB_VFS_FDOPENDIR(fsp, mask, attr); +- if (dirp->dir != NULL) { +- dirp->fsp = fsp; +- } else { +- DEBUG(10,("OpenDir_fsp: SMB_VFS_FDOPENDIR on %s returned " +- "NULL (%s)\n", +- dirp->dir_path, +- strerror(errno))); +- if (errno != ENOSYS) { +- return NULL; +- } ++ dirp->dir = SMB_VFS_FDOPENDIR(fsp, mask, attr); ++ if (dirp->dir != NULL) { ++ dirp->fsp = fsp; ++ } else { ++ DEBUG(10,("OpenDir_fsp: SMB_VFS_FDOPENDIR on %s returned " ++ "NULL (%s)\n", ++ dirp->dir_path, ++ strerror(errno))); ++ if (errno != ENOSYS) { ++ goto fail;

• }
  

• }
• if (dirp->dir == NULL) {

+- /* FDOPENDIR didn't work. Use OPENDIR instead. */ +- dirp->dir = SMB_VFS_OPENDIR(conn, dirp->dir_path, mask, attr); ++ /* FDOPENDIR is not supported. Use OPENDIR instead. */ ++ TALLOC_FREE(dirp); ++ return open_dir_safely(mem_ctx, ++ conn, ++ fsp->fsp_name->base_name, ++ mask, ++ attr);

• }

+- if (!dirp->dir) { +- DEBUG(5,("OpenDir_fsp: Can't open %s. %s\n", dirp->dir_path, +- strerror(errno) )); +- goto fail; ++ if (sconn && !sconn->using_smb2) { ++ sconn->searches.dirhandles_open++;

• }

++ talloc_set_destructor(dirp, smb_Dir_destructor);

• return dirp;

diff --git a/src/patches/samba/CVE-2017-2619-regression-bug-12721-fix.patch b/src/patches/samba/CVE-2017-2619-regression-bug-12721-fix.patch new file mode 100644 index 000000000..cefdd86ea --- /dev/null +++ b/src/patches/samba/CVE-2017-2619-regression-bug-12721-fix.patch @@ -0,0 +1,179 @@ +bug: https://bugzilla.samba.org/show_bug.cgi?id=12721 +Description: This patch is a consolidation of several patches described by the Git commit summaries below

+From 5d4ef6ff0970c93fed49e51a01e63cb67d49d087 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 27 Mar 2017 10:46:47 -0700 +Subject: [PATCH 1/3] s3: smbd: Fix incorrect logic exposed by fix for the

• security bug 12496 (CVE-2017-2619).

+In a UNIX filesystem, the names "." and ".." by definition can *never* +be symlinks - they are already reserved names.

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

+Signed-off-by: Jeremy Allison jra@samba.org +Reviewed-by: Uri Simchoni uri@samba.org +(cherry picked from commit ae17bebd250bdde5614b2ac17e53512f19fe9b68) +---

• source3/smbd/vfs.c | 7 +++++--
• 1 file changed, 5 insertions(+), 2 deletions(-)

+From 71500662d1098d17657b0148a0aa06cd69482c7d Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 27 Mar 2017 17:04:58 -0700 +Subject: [PATCH 2/3] s3: smbd: Fix "follow symlink = no" regression part 2.

+Add an extra paramter to cwd_name to check_reduced_name().

+If cwd_name == NULL then fname is a client given path relative +to the root path of the share.

+If cwd_name != NULL then fname is a client given path relative +to cwd_name. cwd_name is relative to the root path of the share.

+Not yet used, logic added in the next commit.

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

+Signed-off-by: Jeremy Allison jra@samba.org +Reviewed-by: Ralph Boehme slow@samba.org +(cherry picked from commit 83e30cb48859b412b76572b6a3ba84d8fde167af) +---

• source3/smbd/filename.c | 2 +-
• source3/smbd/open.c | 2 +-
• source3/smbd/proto.h | 4 +++-
• source3/smbd/vfs.c | 10 +++++++++-
• 4 files changed, 14 insertions(+), 4 deletions(-)

+From e3fd46264b82ffc22424ee7364b3fd2c0fc14a7e Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 27 Mar 2017 17:09:38 -0700 +Subject: [PATCH 3/3] s3: smbd: Fix "follow symlink = no" regression part 2.

+Use the cwd_name parameter to reconstruct the original +client name for symlink testing.

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

+Signed-off-by: Jeremy Allison jra@samba.org +Reviewed-by: Ralph Boehme slow@samba.org +(cherry picked from commit e182a4d39e86c9694e255efdf6ee2ea3ccb9af4a) +---

• source3/smbd/vfs.c | 23 +++++++++++++++++++++++
• 1 file changed, 23 insertions(+)

+--- samba-3.6.6.orig/source3/smbd/vfs.c ++++ samba-3.6.6/source3/smbd/vfs.c +@@ -894,11 +894,20 @@

• /*******************************************************************
• Reduce a file name, removing .. elements and checking that
• it is below dir in the heirachy. This uses realpath.

++ ++ If cwd_name == NULL then fname is a client given path relative ++ to the root path of the share. ++ ++ If cwd_name != NULL then fname is a client given path relative ++ to cwd_name. cwd_name is relative to the root path of the share.

• ********************************************************************/

+-NTSTATUS check_reduced_name(connection_struct *conn, const char *fname) ++NTSTATUS check_reduced_name(connection_struct *conn, ++ const char *cwd_name, ++ const char *fname)

• {
• char *resolved_name = NULL;

++ char *new_fname = NULL;

• bool allow_symlinks = true;
• bool allow_widelinks = false;

+@@ -1026,8 +1035,11 @@

• 	/* fname can't have changed in resolved_path. */
  

• 	const char *p = &resolved_name[rootdir_len];
  

+- /* *p can be '\0' if fname was "." */ +- if (*p == '\0' && ISDOT(fname)) { ++ /* ++ * UNIX filesystem semantics, names consisting ++ * only of "." or ".." CANNOT be symlinks. ++ */ ++ if (ISDOT(fname) || ISDOTDOT(fname)) {

• 		goto out;
  

• 	}
  

+@@ -1041,11 +1053,32 @@

• 	}
  

• 	p++;
  

++ ++ /* ++ * If cwd_name is present and not ".", ++ * then fname is relative to that, not ++ * the root of the share. Make sure the ++ * path we check is the one the client ++ * sent (cwd_name+fname). ++ */ ++ if (cwd_name != NULL && !ISDOT(cwd_name)) { ++ new_fname = talloc_asprintf(talloc_tos(), ++ "%s/%s", ++ cwd_name, ++ fname); ++ if (new_fname == NULL) { ++ SAFE_FREE(resolved_name); ++ return NT_STATUS_NO_MEMORY; ++ } ++ fname = new_fname; ++ } ++

• 	if (strcmp(fname, p)!=0) {
  

• 		DEBUG(2, ("check_reduced_name: Bad access "
  

• 			"attempt: %s is a symlink\n",
  

• 			fname));
  

• 		SAFE_FREE(resolved_name);
  

++ TALLOC_FREE(new_fname);

• 		return NT_STATUS_ACCESS_DENIED;
  

• 	}
  

• }
  

+@@ -1056,6 +1089,7 @@

• DEBUG(3,("check_reduced_name: %s reduced to %s\n", fname,

•  resolved_name));
  

• SAFE_FREE(resolved_name);

++ TALLOC_FREE(new_fname);

• return NT_STATUS_OK;
• }

+--- samba-3.6.6.orig/source3/smbd/filename.c ++++ samba-3.6.6/source3/smbd/filename.c +@@ -1009,7 +1009,7 @@

• }
• if (!lp_widelinks(SNUM(conn)) || !lp_symlinks(SNUM(conn))) {

+- status = check_reduced_name(conn,name); ++ status = check_reduced_name(conn, NULL, name);

• if (!NT_STATUS_IS_OK(status)) {
  

• 	DEBUG(5,("check_name: name %s failed with
  

%s\n",name,

• 				nt_errstr(status)));
  

+--- samba-3.6.6.orig/source3/smbd/open.c ++++ samba-3.6.6/source3/smbd/open.c +@@ -381,7 +381,7 @@

• }
• /* Ensure the relative path is below the share. */

+- status = check_reduced_name(conn, final_component); ++ status = check_reduced_name(conn, parent_dir, final_component);

• if (!NT_STATUS_IS_OK(status)) {

• saved_errno = map_errno_from_nt_status(status);
  

• goto out;
  

+--- samba-3.6.6.orig/source3/smbd/proto.h ++++ samba-3.6.6/source3/smbd/proto.h +@@ -1179,7 +1179,9 @@

• 	    SMB_STRUCT_STAT *sbuf, char **talloced);
  

• int vfs_ChDir(connection_struct *conn, const char *path);
• char *vfs_GetWd(TALLOC_CTX *ctx, connection_struct *conn);

+-NTSTATUS check_reduced_name(connection_struct *conn, const char *fname); ++NTSTATUS check_reduced_name(connection_struct *conn, ++ const char *cwd_name, ++ const char *fname);

• int vfs_stat_smb_fname(struct connection_struct *conn, const char *fname,

•        SMB_STRUCT_STAT *psbuf);
  

• int vfs_lstat_smb_fname(struct connection_struct *conn, const char *fname,

diff --git a/src/patches/samba/CVE-2017-2619-tests.patch b/src/patches/samba/CVE-2017-2619-tests.patch new file mode 100644 index 000000000..41c84610e --- /dev/null +++ b/src/patches/samba/CVE-2017-2619-tests.patch @@ -0,0 +1,296 @@ +Description: Patches to unit tests associated with CVE-2017-2619 regression +origin: https://attachments.samba.org/attachment.cgi?id=13130

+From 2c6de8584779e413f1e6ff9c933f9281693bfbc0 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 27 Mar 2017 11:48:25 -0700 +Subject: [PATCH 2/6] s3: Test for CVE-2017-2619 regression with "follow

• symlinks = no".

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

+Signed-off-by: Jeremy Allison jra@samba.org +Reviewed-by: Uri Simchoni uri@samba.org

+Back-ported from commit 782172a9bef0040981d20e49519b13dd744df6a0 +---

• selftest/target/Samba3.pm | 7 +++
• source3/script/tests/test_smbclient_s3.sh | 73

+++++++++++++++++++++++++++++++

• 2 files changed, 80 insertions(+)

+diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm +index 01a1c470af0..7765b9efbb2 100644 +--- a/selftest/target/Samba3.pm ++++ b/selftest/target/Samba3.pm +@@ -481,6 +481,9 @@ sub provision($$$$$$)

• my $msdfs_deeppath="$msdfs_shrdir/deeppath";
• push(@dirs,$msdfs_deeppath);

++ my $nosymlinks_shrdir="$shrdir/nosymlinks"; ++ push(@dirs,$nosymlinks_shrdir); ++

• # this gets autocreated by winbindd
• my $wbsockdir="$prefix_abs/winbindd";
• my $wbsockprivdir="$lockdir/winbindd_privileged";

+@@ -695,6 +698,10 @@ sub provision($$$$$$)

• copy = print1
• [print$]
• copy = tmp

++[nosymlinks] ++ copy = tmp ++ path = $nosymlinks_shrdir ++ follow symlinks = no

• ";
• close(CONF);

+diff --git a/source3/script/tests/test_smbclient_s3.sh b/source3/script/tests/test_smbclient_s3.sh +index 772802f77b1..57ef87e4949 100755 +--- a/source3/script/tests/test_smbclient_s3.sh ++++ b/source3/script/tests/test_smbclient_s3.sh +@@ -401,6 +401,75 @@ done

• LOGDIR=$(mktemp -d ${PREFIX}/${LOGDIR_PREFIX}_XXXXXX)

++# Test follow symlinks can't access symlinks ++test_nosymlinks() ++{ ++# Setup test dirs. ++ slink_name="$LOCAL_PATH/nosymlinks/source" ++ slink_target="$LOCAL_PATH/nosymlinks/target" ++ mkdir_target="$LOCAL_PATH/nosymlinks/a" ++ ++ rm -f $slink_target ++ rm -f $slink_name ++ rm -rf $mkdir_target ++ ++ touch $slink_target ++ ln -s $slink_target $slink_name ++ ++# Getting a file through a symlink name should fail. ++ tmpfile=$PREFIX/smbclient_interactive_prompt_commands ++ cat > $tmpfile <<EOF ++get source ++quit ++EOF ++ cmd='CLI_FORCE_INTERACTIVE=yes $SMBCLIENT "$@" -U$USERNAME%$PASSWORD //$SERVER/nosymlinks -I $SERVER_IP $ADDARGS < $tmpfile 2>&1' ++ eval echo "$cmd" ++ out=`eval $cmd` ++ ret=$? ++ rm -f $tmpfile ++ ++ if [ $ret != 0 ] ; then ++ echo "$out" ++ echo "failed accessing nosymlinks with error $ret" ++ false ++ return ++ fi ++ ++ echo "$out" | grep 'NT_STATUS_ACCESS_DENIED' ++ ret=$? ++ if [ $ret != 0 ] ; then ++ echo "$out" ++ echo "failed - should get NT_STATUS_ACCESS_DENIED getting \nosymlinks\source" ++ false ++ fi ++ ++# But we should be able to create and delete directories. ++ cat > $tmpfile <<EOF ++mkdir a ++mkdir a\b ++quit ++EOF ++ cmd='CLI_FORCE_INTERACTIVE=yes $SMBCLIENT "$@" -U$USERNAME%$PASSWORD //$SERVER/nosymlinks -I $SERVER_IP $ADDARGS < $tmpfile 2>&1' ++ eval echo "$cmd" ++ out=`eval $cmd` ++ ret=$? ++ rm -f $tmpfile ++ ++ if [ $ret != 0 ] ; then ++ echo "$out" ++ echo "failed accessing nosymlinks with error $ret" ++ false ++ return ++ fi ++ ++ echo "$out" | grep 'NT_STATUS' ++ ret=$? ++ if [ $ret == 0 ] ; then ++ echo "$out" ++ echo "failed - NT_STATUS_XXXX doing mkdir a; mkdir a\b on \nosymlinks" ++ false ++ fi ++}

• testit "smbclient -L $SERVER_IP" $SMBCLIENT -L $SERVER_IP -N -p 139 ||

failed=`expr $failed + 1`

• testit "smbclient -L $SERVER -I $SERVER_IP" $SMBCLIENT -L $SERVER -I

$SERVER_IP -N -p 139 -c quit || failed=`expr $failed + 1` +@@ -445,6 +514,10 @@ testit "ccache access works for smbclient" \

• test_ccache_access || \
  

• failed=`expr $failed + 1`
  

++testit "follow symlinks = no" \ ++ test_nosymlinks || \ ++ failed=`expr $failed + 1` ++

• testit "rm -rf $LOGDIR" \

• rm -rf $LOGDIR || \
  

• failed=`expr $failed + 1`
  

+-- +2.12.0

+From 17865cf188f42850f18f46514643a5b3a43e5707 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 27 Mar 2017 22:07:50 -0700 +Subject: [PATCH 3/6] s3: Fixup test for CVE-2017-2619 regression with "follow

• symlinks = no"

+Use correct bash operators (not string operators). +Add missing "return".

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

+Signed-off-by: Jeremy Allison jra@samba.org +Reviewed-by: Ralph Boehme slow@samba.org +(cherry picked from commit 037297a1c50e90a0092e3b94f472623f41ccc015) +---

• source3/script/tests/test_smbclient_s3.sh | 9 +++++----
• 1 file changed, 5 insertions(+), 4 deletions(-)

+diff --git a/source3/script/tests/test_smbclient_s3.sh b/source3/script/tests/test_smbclient_s3.sh +index 57ef87e4949..bd5714fca6e 100755 +--- a/source3/script/tests/test_smbclient_s3.sh ++++ b/source3/script/tests/test_smbclient_s3.sh +@@ -428,7 +428,7 @@ EOF

• ret=$?
  

• rm -f $tmpfile
  

+- if [ $ret != 0 ] ; then ++ if [ $ret -ne 0 ] ; then

•    echo "$out"
  

•    echo "failed accessing nosymlinks with error $ret"
  

•    false
  

+@@ -437,10 +437,11 @@ EOF

• echo "$out" | grep 'NT_STATUS_ACCESS_DENIED'
  

• ret=$?
  

+- if [ $ret != 0 ] ; then ++ if [ $ret -ne 0 ] ; then

•    echo "$out"
  

•    echo "failed - should get NT_STATUS_ACCESS_DENIED getting
  

\nosymlinks\source"

•    false
  

++ return

• fi
  

• # But we should be able to create and delete directories.

+@@ -455,7 +456,7 @@ EOF

• ret=$?
  

• rm -f $tmpfile
  

+- if [ $ret != 0 ] ; then ++ if [ $ret -ne 0 ] ; then

•    echo "$out"
  

•    echo "failed accessing nosymlinks with error $ret"
  

•    false
  

+@@ -464,7 +465,7 @@ EOF

• echo "$out" | grep 'NT_STATUS'
  

• ret=$?
  

+- if [ $ret == 0 ] ; then ++ if [ $ret -eq 0 ] ; then

• echo "$out"
• echo "failed - NT_STATUS_XXXX doing mkdir a; mkdir a\b on

\nosymlinks"

• false

+-- +2.12.0

+From 9b573af39f3d4995464e30771fa06e0709b5e57b Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Mon, 27 Mar 2017 22:10:29 -0700 +Subject: [PATCH 6/6] s3: Test for CVE-2017-2619 regression with "follow

• symlinks = no" - part 2

+MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit

+Add tests for regular access.

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

+Signed-off-by: Jeremy Allison jra@samba.org +Reviewed-by: Ralph Boehme slow@samba.org

+Autobuild-User(master): Ralph Böhme slow@samba.org +Autobuild-Date(master): Tue Mar 28 17:05:27 CEST 2017 on sn-devel-144

+(cherry picked from commit 4e734fcd1bf82c08aa303ce44e9735acccffcf06) +---

• source3/script/tests/test_smbclient_s3.sh | 37

+++++++++++++++++++++++++++++++

• 1 file changed, 37 insertions(+)

+diff --git a/source3/script/tests/test_smbclient_s3.sh b/source3/script/tests/test_smbclient_s3.sh +index bd5714fca6e..885766f6c16 100755 +--- a/source3/script/tests/test_smbclient_s3.sh ++++ b/source3/script/tests/test_smbclient_s3.sh +@@ -408,14 +408,22 @@ test_nosymlinks()

• slink_name="$LOCAL_PATH/nosymlinks/source"
  

• slink_target="$LOCAL_PATH/nosymlinks/target"
  

• mkdir_target="$LOCAL_PATH/nosymlinks/a"
  

++ dir1="$LOCAL_PATH/nosymlinks/foo" ++ dir2="$LOCAL_PATH/nosymlinks/foo/bar" ++ get_target="$LOCAL_PATH/nosymlinks/foo/bar/testfile"

• rm -f $slink_target
  

• rm -f $slink_name
  

• rm -rf $mkdir_target
  

++ rm -rf $dir1

• touch $slink_target
  

• ln -s $slink_target $slink_name
  

++ mkdir $dir1 ++ mkdir $dir2 ++ touch $get_target ++

• # Getting a file through a symlink name should fail.

• tmpfile=$PREFIX/smbclient_interactive_prompt_commands
  

• cat > $tmpfile <<EOF
  

+@@ -470,6 +478,35 @@ EOF

• echo "failed - NT_STATUS_XXXX doing mkdir a; mkdir a\b on

\nosymlinks"

• false

• fi
  

++ ++# Ensure regular file/directory access also works. ++ cat > $tmpfile <<EOF ++cd foo\bar ++ls ++get testfile - ++quit ++EOF ++ cmd='CLI_FORCE_INTERACTIVE=yes $SMBCLIENT "$@" -U$USERNAME%$PASSWORD //$SERVER/nosymlinks -I $SERVER_IP $ADDARGS < $tmpfile 2>&1' ++ eval echo "$cmd" ++ out=`eval $cmd` ++ ret=$? ++ rm -f $tmpfile ++ ++ if [ $ret -ne 0 ] ; then ++ echo "$out" ++ echo "failed accessing nosymlinks with error $ret" ++ false ++ return ++ fi ++ ++ echo "$out" | grep 'NT_STATUS' ++ ret=$? ++ if [ $ret -eq 0 ] ; then ++ echo "$out" ++ echo "failed - NT_STATUS_XXXX doing cd foo\bar; get testfile on \nosymlinks" ++ false ++ return ++ fi

• }
• testit "smbclient -L $SERVER_IP" $SMBCLIENT -L $SERVER_IP -N -p 139 ||

failed=`expr $failed + 1` +-- +2.12.0

diff --git a/src/patches/samba/samba-3.6.25-CVE-2017-7494.patch b/src/patches/samba/samba-3.6.25-CVE-2017-7494.patch new file mode 100644 index 000000000..54bb1841b --- /dev/null +++ b/src/patches/samba/samba-3.6.25-CVE-2017-7494.patch @@ -0,0 +1,14 @@ +--- source3/rpc_server/srv_pipe.c Sun Feb 22 16:11:32 2015 ++++ source3/rpc_server/srv_pipe.c Fri May 26 17:28:40 2017 +@@ -465,6 +465,11 @@

• const char *pipename = cli_filename;
• NTSTATUS status;

++ if (strchr(pipename, '/')) { ++ DEBUG(1, ("Refusing open on pipe %s\n", pipename)); ++ return false; ++ } ++

• if (strnequal(pipename, "\PIPE\", 6)) {

• pipename += 5;
  

• }

diff --git a/src/patches/samba/samba-3.6.25-security-2015-12-16.patch b/src/patches/samba/samba-3.6.25-security-2015-12-16.patch new file mode 100644 index 000000000..df1057fea --- /dev/null +++ b/src/patches/samba/samba-3.6.25-security-2015-12-16.patch @@ -0,0 +1,255 @@ +From 2e94b6ec10f1d15e24867bab3063bb85f173406a Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Thu, 9 Jul 2015 10:58:11 -0700 +Subject: [PATCH] CVE-2015-5252: s3: smbd: Fix symlink verification (file

• access outside the share).

+Ensure matching component ends in '/' or '\0'.

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=11395

+Signed-off-by: Jeremy Allison jra@samba.org +Reviewed-by: Volker Lendecke vl@samba.org +---

• source3/smbd/vfs.c | 7 +++++--
• 1 file changed, 5 insertions(+), 2 deletions(-)

+diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c +index 6c56964..bd93b7f 100644 +--- a/source3/smbd/vfs.c ++++ b/source3/smbd/vfs.c +@@ -982,6 +982,7 @@ NTSTATUS check_reduced_name(connection_struct *conn, const char *fname)

• if (!allow_widelinks || !allow_symlinks) {

• const char *conn_rootdir;
  

• size_t rootdir_len;
  

++ bool matched;

• conn_rootdir = SMB_VFS_CONNECTPATH(conn, fname);
  

• if (conn_rootdir == NULL) {
  

+@@ -992,8 +993,10 @@ NTSTATUS check_reduced_name(connection_struct *conn, const char *fname)

• }
  

• rootdir_len = strlen(conn_rootdir);
  

+- if (strncmp(conn_rootdir, resolved_name, +- rootdir_len) != 0) { ++ matched = (strncmp(conn_rootdir, resolved_name, ++ rootdir_len) == 0); ++ if (!matched || (resolved_name[rootdir_len] != '/' && ++ resolved_name[rootdir_len] != '\0')) {

• 	DEBUG(2, ("check_reduced_name: Bad access "
  

• 		"attempt: %s is a symlink outside the "
  

• 		"share path\n", fname));
  

+-- +2.5.0

+From 25139116756cc285a3a5534834cc276ef1b7baaa Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher metze@samba.org +Date: Wed, 30 Sep 2015 21:17:02 +0200 +Subject: [PATCH 1/2] CVE-2015-5296: s3:libsmb: force signing when requiring

• encryption in do_connect()

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=11536

+Signed-off-by: Stefan Metzmacher metze@samba.org +Reviewed-by: Jeremy Allison jra@samba.org +---

• source3/libsmb/clidfs.c | 7 ++++++-
• 1 file changed, 6 insertions(+), 1 deletion(-)

+diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 23e1471..f153b6b 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -98,6 +98,11 @@ static struct cli_state *do_connect(TALLOC_CTX *ctx,

• const char *username;
• const char *password;
• NTSTATUS status;

++ int signing_state = get_cmdline_auth_info_signing_state(auth_info); ++ ++ if (force_encrypt) { ++ signing_state = Required; ++ }

• /* make a copy so we don't modify the global string 'service' */
• servicename = talloc_strdup(ctx,share);

+@@ -132,7 +137,7 @@ static struct cli_state *do_connect(TALLOC_CTX *ctx,

• zero_sockaddr(&ss);
• /* have to open a new connection */

+- c = cli_initialise_ex(get_cmdline_auth_info_signing_state(auth_info)); ++ c = cli_initialise_ex(signing_state);

• if (c == NULL) {

• d_printf("Connection to %s failed\n", server_n);
  

• return NULL;
  

+-- +2.5.0

+From 060adb0abdeda51b8b622c6020b5dea0c8dde1cf Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher metze@samba.org +Date: Wed, 30 Sep 2015 21:17:02 +0200 +Subject: [PATCH 2/2] CVE-2015-5296: s3:libsmb: force signing when requiring

• encryption in SMBC_server_internal()

+BUG: https://bugzilla.samba.org/show_bug.cgi?id=11536

+Signed-off-by: Stefan Metzmacher metze@samba.org +Reviewed-by: Jeremy Allison jra@samba.org +---

• source3/libsmb/libsmb_server.c | 13 +++++++++++--
• 1 file changed, 11 insertions(+), 2 deletions(-)

+diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index 45be660..167f2c9 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -258,6 +258,7 @@ SMBC_server_internal(TALLOC_CTX *ctx,

•     const char *username_used;
  

• NTSTATUS status;
• char *newserver, *newshare;

++ int signing_state = Undefined;

• zero_sockaddr(&ss);
• ZERO_STRUCT(c);

+@@ -404,8 +405,12 @@ again:

• zero_sockaddr(&ss);

++ if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) { ++ signing_state = Required; ++ } ++

• /* have to open a new connection */

+- if ((c = cli_initialise()) == NULL) { ++ if ((c = cli_initialise_ex(signing_state)) == NULL) {

• errno = ENOMEM;
  

• return NULL;
  

• }

+@@ -750,6 +755,7 @@ SMBC_attr_server(TALLOC_CTX *ctx,

•     ipc_srv = SMBC_find_server(ctx, context, server, "*IPC$",
  

•                                pp_workgroup, pp_username, pp_password);
  

•     if (!ipc_srv) {
  

++ int signing_state = Undefined;

•             /* We didn't find a cached connection.  Get the password */
  

• if (!*pp_password || (*pp_password)[0] == '\0') {
  

+@@ -771,6 +777,9 @@ SMBC_attr_server(TALLOC_CTX *ctx,

•             if (smbc_getOptionUseCCache(context)) {
  

•                     flags |= CLI_FULL_CONNECTION_USE_CCACHE;
  

•             }
  

++ if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) { ++ signing_state = Required; ++ }

•             zero_sockaddr(&ss);
  

•             nt_status = cli_full_connection(&ipc_cli,
  

+@@ -780,7 +789,7 @@ SMBC_attr_server(TALLOC_CTX *ctx,

• 				*pp_workgroup,
  

• 				*pp_password,
  

• 				flags,
  

+- Undefined); ++ signing_state);

•             if (! NT_STATUS_IS_OK(nt_status)) {
  

•                     DEBUG(1,("cli_full_connection failed! (%s)\n",
  

•                              nt_errstr(nt_status)));
  

+-- +2.5.0

+From 8e49de7754f7171a58a1f94dee0f1138dbee3c60 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison jra@samba.org +Date: Fri, 23 Oct 2015 14:54:31 -0700 +Subject: [PATCH] CVE-2015-5299: s3-shadow-copy2: fix missing access check on

• snapdir

+Fix originally from partha@exablox.com

+https://bugzilla.samba.org/show_bug.cgi?id=11529

+Signed-off-by: Jeremy Allison jra@samba.org +Reviewed-by: David Disseldorp ddiss@samba.org +---

• source3/modules/vfs_shadow_copy2.c | 47

++++++++++++++++++++++++++++++++++++++

• 1 file changed, 47 insertions(+)

+diff --git a/source3/modules/vfs_shadow_copy2.c b/source3/modules/vfs_shadow_copy2.c +index fedfb53..16c1ed7 100644 +--- a/source3/modules/vfs_shadow_copy2.c ++++ b/source3/modules/vfs_shadow_copy2.c +@@ -21,6 +21,8 @@

• #include "includes.h"
• #include "smbd/smbd.h"

++#include "smbd/globals.h" ++#include "../libcli/security/security.h"

• #include "system/filesys.h"
• #include "ntioctl.h"

+@@ -764,6 +766,43 @@ static int shadow_copy2_mkdir(vfs_handle_struct *handle, const char *fname, mod

•     SHADOW2_NEXT(MKDIR, (handle, name, mode), int, -1);
  

• }

++static bool check_access_snapdir(struct vfs_handle_struct *handle, ++ const char *path) ++{ ++ struct smb_filename smb_fname; ++ int ret; ++ NTSTATUS status; ++ uint32_t access_granted = 0; ++ ++ ZERO_STRUCT(smb_fname); ++ smb_fname.base_name = talloc_asprintf(talloc_tos(), ++ "%s", ++ path); ++ if (smb_fname.base_name == NULL) { ++ return false; ++ } ++ ++ ret = SMB_VFS_NEXT_STAT(handle, &smb_fname); ++ if (ret != 0 || !S_ISDIR(smb_fname.st.st_ex_mode)) { ++ TALLOC_FREE(smb_fname.base_name); ++ return false; ++ } ++ ++ status = smbd_check_open_rights(handle->conn, ++ &smb_fname, ++ SEC_DIR_LIST, ++ &access_granted); ++ if (!NT_STATUS_IS_OK(status)) { ++ DEBUG(0,("user does not have list permission " ++ "on snapdir %s\n", ++ smb_fname.base_name)); ++ TALLOC_FREE(smb_fname.base_name); ++ return false; ++ } ++ TALLOC_FREE(smb_fname.base_name); ++ return true; ++} ++

• static int shadow_copy2_rmdir(vfs_handle_struct *handle, const char *fname)
• {

•     SHADOW2_NEXT(RMDIR, (handle, name), int, -1);
  

+@@ -877,6 +916,7 @@ static int shadow_copy2_get_shadow_copy2_data(vfs_handle_struct *handle,

• SMB_STRUCT_DIRENT *d;
• TALLOC_CTX *tmp_ctx = talloc_new(handle->data);
• char *snapshot;

++ bool ret;

• snapdir = shadow_copy2_find_snapdir(tmp_ctx, handle);
• if (snapdir == NULL) {

+@@ -886,6 +926,13 @@ static int shadow_copy2_get_shadow_copy2_data(vfs_handle_struct *handle,

• talloc_free(tmp_ctx);
  

• return -1;
  

• }

++ ret = check_access_snapdir(handle, snapdir); ++ if (!ret) { ++ DEBUG(0,("access denied on listing snapdir %s\n", snapdir)); ++ errno = EACCES; ++ talloc_free(tmp_ctx); ++ return -1; ++ }

• p = SMB_VFS_NEXT_OPENDIR(handle, snapdir, NULL, 0);

+-- +2.5.0