97 lines
3.2 KiB
Diff
97 lines
3.2 KiB
Diff
From 9944df6ef1e421331ea1ca773f7e5652262d5d1b Mon Sep 17 00:00:00 2001
|
|
From: Gary Lockyer <gary@catalyst.net.nz>
|
|
Date: Tue, 7 Apr 2020 09:09:01 +1200
|
|
Subject: [PATCH 5/8] CVE-2020-10704: smb.conf: Add max ldap request sizes
|
|
|
|
Add two new smb.conf parameters to control the maximum permitted ldap
|
|
request size.
|
|
|
|
Adds:
|
|
ldap max anonymous request size default 250Kb
|
|
ldap max authenticated request size default 16Mb
|
|
|
|
Credit to OSS-Fuzz
|
|
|
|
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
|
|
|
|
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
---
|
|
.../smbdotconf/ldap/ldapmaxanonrequest.xml | 18 ++++++++++++++++++
|
|
.../smbdotconf/ldap/ldapmaxauthrequest.xml | 18 ++++++++++++++++++
|
|
lib/param/loadparm.c | 5 +++++
|
|
source3/param/loadparm.c | 3 +++
|
|
4 files changed, 44 insertions(+)
|
|
create mode 100644 docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml
|
|
create mode 100644 docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml
|
|
|
|
--- /dev/null
|
|
+++ b/docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml
|
|
@@ -0,0 +1,18 @@
|
|
+<samba:parameter name="ldap max anonymous request size"
|
|
+ context="G"
|
|
+ type="integer"
|
|
+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
+<description>
|
|
+ <para>
|
|
+ This parameter specifies the maximum permitted size (in bytes)
|
|
+ for an LDAP request received on an anonymous connection.
|
|
+ </para>
|
|
+
|
|
+ <para>
|
|
+ If the request size exceeds this limit the request will be
|
|
+ rejected.
|
|
+ </para>
|
|
+</description>
|
|
+<value type="default">256000</value>
|
|
+<value type="example">500000</value>
|
|
+</samba:parameter>
|
|
--- /dev/null
|
|
+++ b/docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml
|
|
@@ -0,0 +1,18 @@
|
|
+<samba:parameter name="ldap max authenticated request size"
|
|
+ context="G"
|
|
+ type="integer"
|
|
+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
+<description>
|
|
+ <para>
|
|
+ This parameter specifies the maximum permitted size (in bytes)
|
|
+ for an LDAP request received on an authenticated connection.
|
|
+ </para>
|
|
+
|
|
+ <para>
|
|
+ If the request size exceeds this limit the request will be
|
|
+ rejected.
|
|
+ </para>
|
|
+</description>
|
|
+<value type="default">16777216</value>
|
|
+<value type="example">4194304</value>
|
|
+</samba:parameter>
|
|
--- a/lib/param/loadparm.c
|
|
+++ b/lib/param/loadparm.c
|
|
@@ -3027,6 +3027,11 @@ struct loadparm_context *loadparm_init(T
|
|
|
|
lpcfg_do_global_parameter(lp_ctx, "debug encryption", "no");
|
|
|
|
+ lpcfg_do_global_parameter(
|
|
+ lp_ctx, "ldap max anonymous request size", "256000");
|
|
+ lpcfg_do_global_parameter(
|
|
+ lp_ctx, "ldap max authenticated request size", "16777216");
|
|
+
|
|
for (i = 0; parm_table[i].label; i++) {
|
|
if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) {
|
|
lp_ctx->flags[i] |= FLAG_DEFAULT;
|
|
--- a/source3/param/loadparm.c
|
|
+++ b/source3/param/loadparm.c
|
|
@@ -956,6 +956,9 @@ static void init_globals(struct loadparm
|
|
Globals.prefork_backoff_increment = 10;
|
|
Globals.prefork_maximum_backoff = 120;
|
|
|
|
+ Globals.ldap_max_anonymous_request_size = 256000;
|
|
+ Globals.ldap_max_authenticated_request_size = 16777216;
|
|
+
|
|
/* Now put back the settings that were set with lp_set_cmdline() */
|
|
apply_lp_set_cmdline();
|
|
}
|