diff options
| author | Gary Lockyer <gary@catalyst.net.nz> | 2020-04-07 09:09:01 +1200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2020-04-22 12:50:42 +0200 |
| commit | 48a3bdd7703ad3952f45e04c4f0a8d289ae74190 (patch) | |
| tree | d3f0caf373872457e75a4dbaa2e34a3b6b9bab5f | |
| parent | 4aeb07ef49e4e8734fc5f5cd092bbf165e9cc9f3 (diff) | |
| download | samba-48a3bdd7703ad3952f45e04c4f0a8d289ae74190.tar.gz | |
CVE-2020-10704: smb.conf: Add max ldap request sizes
Add two new smb.conf parameters to control the maximum permitted ldap
request size.
Adds:
ldap max anonymous request size default 250Kb
ldap max authenticated request size default 16Mb
Credit to OSS-Fuzz
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
| -rw-r--r-- | docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml | 18 | ||||
| -rw-r--r-- | docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml | 18 | ||||
| -rw-r--r-- | lib/param/loadparm.c | 5 | ||||
| -rw-r--r-- | source3/param/loadparm.c | 3 |
4 files changed, 44 insertions, 0 deletions
diff --git a/docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml b/docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml new file mode 100644 index 00000000000..61bdcec674d --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml @@ -0,0 +1,18 @@ +<samba:parameter name="ldap max anonymous request size" + context="G" + type="integer" + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> +<description> + <para> + This parameter specifies the maximum permitted size (in bytes) + for an LDAP request received on an anonymous connection. + </para> + + <para> + If the request size exceeds this limit the request will be + rejected. + </para> +</description> +<value type="default">256000</value> +<value type="example">500000</value> +</samba:parameter> diff --git a/docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml b/docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml new file mode 100644 index 00000000000..c5934f73f95 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml @@ -0,0 +1,18 @@ +<samba:parameter name="ldap max authenticated request size" + context="G" + type="integer" + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> +<description> + <para> + This parameter specifies the maximum permitted size (in bytes) + for an LDAP request received on an authenticated connection. + </para> + + <para> + If the request size exceeds this limit the request will be + rejected. + </para> +</description> +<value type="default">16777216</value> +<value type="example">4194304</value> +</samba:parameter> diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index 611c1b240af..2eed5aa082d 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -3041,6 +3041,11 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) lpcfg_do_global_parameter(lp_ctx, "spotlight backend", "noindex"); + lpcfg_do_global_parameter( + lp_ctx, "ldap max anonymous request size", "256000"); + lpcfg_do_global_parameter( + lp_ctx, "ldap max authenticated request size", "16777216"); + for (i = 0; parm_table[i].label; i++) { if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { lp_ctx->flags[i] |= FLAG_DEFAULT; diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index ce41477097a..dd51042c125 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -955,6 +955,9 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) Globals.prefork_backoff_increment = 10; Globals.prefork_maximum_backoff = 120; + Globals.ldap_max_anonymous_request_size = 256000; + Globals.ldap_max_authenticated_request_size = 16777216; + /* Now put back the settings that were set with lp_set_cmdline() */ apply_lp_set_cmdline(); } |