We are no longer offering accounts on this server. Consider https://gitlab.freedesktop.org/ as a place to host projects.

Commit 6899179e authored by RISCi_ATOM's avatar RISCi_ATOM

update Samba to 3.6.25, based upon 18.06

parent b3a644b6
......@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=samba
PKG_VERSION:=3.6.25
PKG_RELEASE:=7
PKG_RELEASE:=12
PKG_SOURCE_URL:=https://download.samba.org/pub/samba \
https://download.samba.org/pub/samba/stable
......@@ -18,8 +18,7 @@ PKG_HASH:=8f2c8a7f2bd89b0dfd228ed917815852f7c625b2bc0936304ac3ed63aaf83751
PKG_LICENSE:=GPL-3.0
PKG_LICENSE_FILES:=COPYING
PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
PKG_CPE_ID:=cpe:/a:samba:samba
PKG_BUILD_PARALLEL:=1
......@@ -30,19 +29,35 @@ CONFIGURE_PATH:=source3
PKG_BUILD_BIN:=$(PKG_BUILD_DIR)/$(MAKE_PATH)/bin
define Package/samba36-server
define Package/samba/Default
SECTION:=net
CATEGORY:=Network
TITLE:=Samba 3.6 SMB/CIFS server
TITLE:=Samba 3.6 SMB/CIFS
URL:=https://www.samba.org/
MAINTAINER:=Felix Fietkau <nbd@nbd.name>
endef
define Package/samba36-server
$(call Package/samba/Default)
TITLE+= server
DEPENDS:=+USE_GLIBC:librt $(ICONV_DEPENDS)
endef
define Package/samba36-hotplug
$(call Package/samba/Default)
TITLE+= hotplug
DEPENDS:=+block-mount
endef
define Package/samba36-client
SECTION:=net
CATEGORY:=Network
TITLE:=Samba 3.6 SMB/CIFS client
URL:=https://www.samba.org/
$(call Package/samba/Default)
TITLE+= client
DEPENDS:=+libreadline +libncurses
endef
define Package/samba36-net
$(call Package/samba/Default)
TITLE+= net commands
DEPENDS:=+libreadline +libncurses
endef
......@@ -51,7 +66,6 @@ define Package/samba36-server/config
int "Maximum level of compiled-in debug messages"
depends on PACKAGE_samba36-server || PACKAGE_samba36-client
default -1
endef
define Package/samba36-server/description
......@@ -93,6 +107,9 @@ CONFIGURE_ARGS += \
--prefix=/ \
--disable-avahi \
--disable-cups \
--disable-external-libtalloc \
--disable-external-libtdb \
--disable-external-libtevent \
--disable-pie \
--disable-relro \
--disable-static \
......@@ -150,12 +167,26 @@ define Package/samba36-server/install
$(LN) samba_multicall $(1)/usr/sbin/smbpasswd
endef
define Package/samba36-hotplug/install
$(INSTALL_DIR) $(1)/lib/samba
$(INSTALL_DATA) ./files/lib/samba.sh $(1)/lib/samba/samba.sh
$(INSTALL_DIR) $(1)/etc/hotplug.d/block
$(INSTALL_DATA) ./files/samba.hotplug $(1)/etc/hotplug.d/block/60-samba
endef
define Package/samba36-client/install
$(INSTALL_DIR) $(1)/usr/sbin
$(INSTALL_BIN) $(PKG_BUILD_BIN)/smbclient $(1)/usr/sbin
$(INSTALL_BIN) $(PKG_BUILD_BIN)/nmblookup $(1)/usr/sbin
endef
define Package/samba36-net/install
$(INSTALL_DIR) $(1)/usr/sbin
$(INSTALL_BIN) $(PKG_BUILD_BIN)/net $(1)/usr/sbin
endef
$(eval $(call BuildPackage,samba36-client))
$(eval $(call BuildPackage,samba36-server))
$(eval $(call BuildPackage,samba36-hotplug))
$(eval $(call BuildPackage,samba36-net))
#!/bin/sh
#
# Copyright (C) 2018 OpenWrt.org
# Copyright (C) 2018 rosysong@rosinson.com
#
. /lib/functions.sh
FLAG_DEV_TYPE=
FLAG_DEV_MOPT=
FLAG_HAS_SECT=
samba_dev_filter() { # <devname> <[path,/dev/]>
case $1 in
${2}mtdblock*|\
${2}ubi*)
FLAG_DEV_TYPE="mtd"
;;
${2}loop*|\
${2}mmcblk*|\
${2}sd*|\
${2}hd*|\
${2}md*|\
${2}nvme*|\
${2}vd*|\
${2}xvd*)
FLAG_DEV_TYPE="not-mtd"
;;
*)
[ -b ${2}${1} ] && FLAG_DEV_TYPE="not-mtd"
[ -b /dev/mapper/$1 ] && FLAG_DEV_TYPE="not-mtd"
;;
esac
}
samba_cfg_lookup() { # <section> <name>
config_get name $1 name
[ "$name" = "$2" ] || return
FLAG_HAS_SECT=y
}
samba_cfg_delete() { # <section> <name>
config_get name $1 name
[ "$name" = "$2" ] || return
uci -q delete samba.$1
}
samba_find_mount_point() { # <devname>
# search mount point in /proc/mounts
while read l; do
local d=$(echo $l | awk '/^\/dev/ {print $1}')
[ "$d" = "/dev/$1" ] || continue
FLAG_DEV_MOPT=$(echo $l | awk '/^\/dev/ {print $2}')
break
done < /proc/mounts
}
_samba_add_section() { # <devname> <mount point>
uci -q batch <<-EOF
add samba sambashare
set samba.@sambashare[-1].browseable='yes'
set samba.@sambashare[-1].name='$1'
set samba.@sambashare[-1].path='$2'
set samba.@sambashare[-1].users='root'
set samba.@sambashare[-1].read_only='no'
set samba.@sambashare[-1].guest_ok='yes'
set samba.@sambashare[-1].create_mask='0755'
set samba.@sambashare[-1].dir_mask='0755'
EOF
}
samba_add_section() { # <devname> [<mount point>]
FLAG_HAS_SECT=
FLAG_DEV_MOPT=
config_foreach samba_cfg_lookup sambashare $1
[ -z "$FLAG_HAS_SECT" ] || return
samba_find_mount_point $1
[ -n "$FLAG_DEV_MOPT" ] || return
[ -n "$2" -a "$2" = "$FLAG_DEV_MOPT" ] || \
_samba_add_section $1 $FLAG_DEV_MOPT
}
samba_delete_section() { # <devname>
config_foreach samba_cfg_delete sambashare $1
}
config samba
option 'name' 'Lede'
option 'name' 'OpenWrt'
option 'workgroup' 'WORKGROUP'
option 'description' 'Lede'
option 'description' 'OpenWrt'
option 'homes' '1'
. /lib/samba/samba.sh
samba_dev_filter $DEVNAME
[ "$FLAG_DEV_TYPE" = "not-mtd" ] || exit
config_load samba
case $ACTION in
add) samba_add_section $DEVNAME;;
remove) samba_delete_section $DEVNAME;;
esac
uci commit samba
......@@ -15,12 +15,7 @@ smb_header() {
for net in $samba_iface; do
local device
network_is_up $net || continue
network_get_device device "$net" && {
local subnet
network_get_subnet subnet "$net" && echo -n "$subnet "
network_get_subnet6 subnet "$net" && echo -n "$subnet "
}
network_get_device device "$net"
echo -n "${device:-$net} "
done
)
......@@ -28,9 +23,9 @@ smb_header() {
local name workgroup description charset
local hostname="$(uci_get system.@system[0].hostname)"
config_get name $1 name "${hostname:-Lede}"
config_get workgroup $1 workgroup "${hostname:-Lede}"
config_get description $1 description "Samba on ${hostname:-Lede}"
config_get name $1 name "${hostname:-OpenWrt}"
config_get workgroup $1 workgroup "${hostname:-OpenWrt}"
config_get description $1 description "Samba on ${hostname:-OpenWrt}"
config_get charset $1 charset "UTF-8"
mkdir -p /var/etc
......@@ -106,6 +101,7 @@ start_service() {
init_config
procd_open_instance
procd_add_mdns "smb" "tcp" "445"
procd_set_param command /usr/sbin/smbd -F
procd_set_param respawn
procd_set_param file /var/etc/smb.conf
......
......@@ -5,24 +5,16 @@
server string = |DESCRIPTION|
unix charset = |CHARSET|
workgroup = |WORKGROUP|
local master = no
browseable = yes
bind interfaces only = yes
deadtime = 30
domain master = yes
encrypt passwords = yes
enable core files = no
guest ok = yes
invalid users = root
load printers = no
local master = no
map to guest = Bad User
max protocol = SMB2
min receivefile size = 16384
null passwords = yes
passdb backend = smbpasswd
preferred master = yes
security = user
smb passwd file = /etc/samba/smbpasswd
syslog = 2
use sendfile = yes
writeable = yes
bind interfaces only = yes
From: =?utf-8?q?Guido_G=C3=BCnther?= <agx@sigxcpu.org>
Date: Wed, 28 Dec 2016 19:21:49 +0100
Subject: security-CVE-2016-2125: Don't pass GSS_C_DELEG_FLAG by default
This is a backport of upstream commits
b1a056f77e793efc45df34ab7bf78fbec1bf8a59
b83897ae49fdee1fda73c10c7fe73362bfaba690 (code not used in wheezy)
3106964a640ddf6a3c08c634ff586a814f94dff8 (code not used in wheezy)
---
source3/librpc/crypto/gse.c | 1 -
source3/libsmb/clifsinfo.c | 2 +-
source4/auth/gensec/gensec_gssapi.c | 2 +-
source4/scripting/bin/nsupdate-gss | 2 +-
4 files changed, 3 insertions(+), 4 deletions(-)
--- a/source3/librpc/crypto/gse.c
+++ b/source3/librpc/crypto/gse.c
@@ -162,7 +162,6 @@ static NTSTATUS gse_context_init(TALLOC_
memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG |
- GSS_C_DELEG_FLAG |
GSS_C_DELEG_POLICY_FLAG |
GSS_C_REPLAY_FLAG |
GSS_C_SEQUENCE_FLAG;
--- a/source3/libsmb/clifsinfo.c
+++ b/source3/libsmb/clifsinfo.c
@@ -726,7 +726,7 @@ static NTSTATUS make_cli_gss_blob(TALLOC
&es->s.gss_state->gss_ctx,
srv_name,
GSS_C_NO_OID, /* default OID. */
- GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_FLAG,
+ GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_POLICY_FLAG,
GSS_C_INDEFINITE, /* requested ticket lifetime. */
NULL, /* no channel bindings */
p_tok_in,
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -172,7 +172,7 @@ static NTSTATUS gensec_gssapi_start(stru
if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "mutual", true)) {
gensec_gssapi_state->want_flags |= GSS_C_MUTUAL_FLAG;
}
- if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", true)) {
+ if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", false)) {
gensec_gssapi_state->want_flags |= GSS_C_DELEG_FLAG;
}
if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "replay", true)) {
--- a/source4/scripting/bin/nsupdate-gss
+++ b/source4/scripting/bin/nsupdate-gss
@@ -178,7 +178,7 @@ sub negotiate_tkey($$$$)
my $flags =
GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG |
GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG |
- GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG;
+ GSS_C_INTEG_FLAG;
$status = GSSAPI::Cred::acquire_cred(undef, 120, undef, GSS_C_INITIATE,
From: =?utf-8?q?Guido_G=C3=BCnther?= <agx@sigxcpu.org>
Date: Wed, 20 Sep 2017 20:02:03 +0200
Subject: CVE-2017-12163: s3:smbd: Prevent client short SMB1 write from
writing server memory to file.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13020
Author: Jeremy Allison <jra@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
---
source3/smbd/reply.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 50 insertions(+)
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -3979,6 +3979,9 @@ void reply_writebraw(struct smb_request
}
/* Ensure we don't write bytes past the end of this packet. */
+ /*
+ * This already protects us against CVE-2017-12163.
+ */
if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
error_to_writebrawerr(req);
@@ -4080,6 +4083,11 @@ void reply_writebraw(struct smb_request
exit_server_cleanly("secondary writebraw failed");
}
+ /*
+ * We are not vulnerable to CVE-2017-12163
+ * here as we are guarenteed to have numtowrite
+ * bytes available - we just read from the client.
+ */
nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
if (nwritten == -1) {
TALLOC_FREE(buf);
@@ -4161,6 +4169,7 @@ void reply_writeunlock(struct smb_reques
connection_struct *conn = req->conn;
ssize_t nwritten = -1;
size_t numtowrite;
+ size_t remaining;
SMB_OFF_T startpos;
const char *data;
NTSTATUS status = NT_STATUS_OK;
@@ -4193,6 +4202,17 @@ void reply_writeunlock(struct smb_reques
startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
data = (const char *)req->buf + 3;
+ /*
+ * Ensure client isn't asking us to write more than
+ * they sent. CVE-2017-12163.
+ */
+ remaining = smbreq_bufrem(req, data);
+ if (numtowrite > remaining) {
+ reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+ END_PROFILE(SMBwriteunlock);
+ return;
+ }
+
if (!fsp->print_file && numtowrite > 0) {
init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
@@ -4274,6 +4294,7 @@ void reply_write(struct smb_request *req
{
connection_struct *conn = req->conn;
size_t numtowrite;
+ size_t remaining;
ssize_t nwritten = -1;
SMB_OFF_T startpos;
const char *data;
@@ -4314,6 +4335,17 @@ void reply_write(struct smb_request *req
startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
data = (const char *)req->buf + 3;
+ /*
+ * Ensure client isn't asking us to write more than
+ * they sent. CVE-2017-12163.
+ */
+ remaining = smbreq_bufrem(req, data);
+ if (numtowrite > remaining) {
+ reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+ END_PROFILE(SMBwrite);
+ return;
+ }
+
if (!fsp->print_file) {
init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
@@ -4525,6 +4557,9 @@ void reply_write_and_X(struct smb_reques
return;
}
} else {
+ /*
+ * This already protects us against CVE-2017-12163.
+ */
if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
smb_doff + numtowrite > smblen) {
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -4894,6 +4929,7 @@ void reply_writeclose(struct smb_request
{
connection_struct *conn = req->conn;
size_t numtowrite;
+ size_t remaining;
ssize_t nwritten = -1;
NTSTATUS close_status = NT_STATUS_OK;
SMB_OFF_T startpos;
@@ -4927,6 +4963,17 @@ void reply_writeclose(struct smb_request
mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
data = (const char *)req->buf + 1;
+ /*
+ * Ensure client isn't asking us to write more than
+ * they sent. CVE-2017-12163.
+ */
+ remaining = smbreq_bufrem(req, data);
+ if (numtowrite > remaining) {
+ reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+ END_PROFILE(SMBwriteclose);
+ return;
+ }
+
if (!fsp->print_file) {
init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
@@ -5497,6 +5544,9 @@ void reply_printwrite(struct smb_request
numtowrite = SVAL(req->buf, 1);
+ /*
+ * This already protects us against CVE-2017-12163.
+ */
if (req->buflen < numtowrite + 3) {
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
END_PROFILE(SMBsplwr);
From: =?utf-8?q?Guido_G=C3=BCnther?= <agx@sigxcpu.org>
Date: Wed, 20 Sep 2017 20:01:34 +0200
Subject: CVE-2017-12150
These are the three upstream patches
From: Stefan Metzmacher <metze@samba.org>
Subject: CVE-2017-12150: s3:lib: get_cmdline_auth_info_signing_state use Required for smb_encrypt
This is an addition to the fixes for CVE-2015-5296.
It applies to smb2mount -e, smbcacls -e and smbcquotas -e.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997
From: Stefan Metzmacher <metze@samba.org>
Subject: CVE-2017-12150: libgpo: make use of Required for SMB signing in gpo_connect_server()
It's important that we use a signed connection to get the GPOs!
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Backported-by: Andreas Schneider <asn@samba.org>
From: Stefan Metzmacher <metze@samba.org>
Subject: CVE-2017-12150: s3:libsmb: only fallback to anonymous if authentication was not requested
With forced encryption or required signing we should also don't fallback.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997
---
libgpo/gpo_fetch.c | 2 +-
source3/lib/util_cmdline.c | 3 +++
source3/libsmb/clidfs.c | 2 ++
3 files changed, 6 insertions(+), 1 deletion(-)
--- a/libgpo/gpo_fetch.c
+++ b/libgpo/gpo_fetch.c
@@ -151,7 +151,7 @@ static NTSTATUS gpo_connect_server(ADS_S
ads->auth.password,
CLI_FULL_CONNECTION_USE_KERBEROS |
CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS,
- Undefined);
+ Required);
if (!NT_STATUS_IS_OK(result)) {
DEBUG(10,("check_refresh_gpo: "
"failed to connect: %s\n",
--- a/source3/lib/util_cmdline.c
+++ b/source3/lib/util_cmdline.c
@@ -122,6 +122,9 @@ bool set_cmdline_auth_info_signing_state
int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info)
{
+ if (auth_info->smb_encrypt) {
+ return Required;
+ }
return auth_info->signing_state;
}
--- a/source3/libsmb/clidfs.c
+++ b/source3/libsmb/clidfs.c
@@ -202,7 +202,9 @@ static struct cli_state *do_connect(TALL
/* If a password was not supplied then
* try again with a null username. */
if (password[0] || !username[0] ||
+ force_encrypt || client_is_signing_mandatory(c) ||
get_cmdline_auth_info_use_kerberos(auth_info) ||
+ get_cmdline_auth_info_use_ccache(auth_info) ||
!NT_STATUS_IS_OK(cli_session_setup(c, "",
"", 0,
"", 0,
From 6cc45e3452194f312e04109cfdae047eb0719c7c Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Tue, 2 Jan 2018 15:56:03 -0800
Subject: [PATCH] CVE-2018-1050: s3: RPC: spoolss server. Protect against null
pointer derefs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11343
Signed-off-by: Jeremy Allison <jra@samba.org>
---
source3/rpc_server/spoolss/srv_spoolss_nt.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
@@ -176,6 +176,11 @@ static void prune_printername_cache(void
static const char *canon_servername(const char *servername)
{
const char *pservername = servername;
+
+ if (servername == NULL) {
+ return "";
+ }
+
while (*pservername == '\\') {
pservername++;
}
@@ -2080,6 +2085,10 @@ WERROR _spoolss_DeletePrinterDriver(stru
return WERR_ACCESS_DENIED;
}
+ if (r->in.architecture == NULL || r->in.driver == NULL) {
+ return WERR_INVALID_ENVIRONMENT;
+ }
+
/* check that we have a valid driver name first */
if ((version = get_version_id(r->in.architecture)) == -1)
@@ -2225,6 +2234,10 @@ WERROR _spoolss_DeletePrinterDriverEx(st
return WERR_ACCESS_DENIED;
}
+ if (r->in.architecture == NULL || r->in.driver == NULL) {
+ return WERR_INVALID_ENVIRONMENT;
+ }
+
/* check that we have a valid driver name first */
if (get_version_id(r->in.architecture) == -1) {
/* this is what NT returns */
......@@ -51,7 +51,7 @@
d_printf(_("Usage:\n"));
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -5208,7 +5208,11 @@ void reply_printopen(struct smb_request
@@ -5255,7 +5255,11 @@ void reply_printopen(struct smb_request
return;
}
......@@ -64,7 +64,7 @@