diff options
| author | Samuel Cabrero <scabrero@suse.de> | 2022-12-21 15:53:04 +0100 |
|---|---|---|
| committer | Andreas Schneider <asn@cryptomilk.org> | 2023-01-09 14:23:35 +0000 |
| commit | 8141eae47aad849741beb138fae866c772e4ec4c (patch) | |
| tree | ff7e2d9ff61790bf5e7634a9b116804415d8afc7 /source3 | |
| parent | 7779050a6765a37cc0c6438309e512782220dcb3 (diff) | |
| download | samba-8141eae47aad849741beb138fae866c772e4ec4c.tar.gz | |
CVE-2022-38023 s3:rpc_server/netlogon: 'server schannel != yes' warning to dcesrv_interface_netlogon_bind
Follow s4 netlogon server changes and move the checks to the RPC bind
hook. Next commits will remove the s3 netr_creds_server_step_check()
function.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Diffstat (limited to 'source3')
| -rw-r--r-- | source3/rpc_server/netlogon/srv_netlog_nt.c | 39 |
1 files changed, 28 insertions, 11 deletions
diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c index ba169fbbe52..6570991a21e 100644 --- a/source3/rpc_server/netlogon/srv_netlog_nt.c +++ b/source3/rpc_server/netlogon/srv_netlog_nt.c @@ -1079,7 +1079,6 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p, enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NONE; uint16_t opnum = dce_call->pkt.u.request.opnum; const char *opname = "<unknown>"; - static bool warned_global_once = false; if (creds_out != NULL) { *creds_out = NULL; @@ -1141,16 +1140,6 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p, return NT_STATUS_ACCESS_DENIED; } - if (!schannel_global_required && !warned_global_once) { - /* - * We want admins to notice their misconfiguration! - */ - DBG_ERR("CVE-2020-1472(ZeroLogon): " - "Please configure 'server schannel = yes', " - "See https://bugzilla.samba.org/show_bug.cgi?id=14497\n"); - warned_global_once = true; - } - if (auth_type == DCERPC_AUTH_TYPE_SCHANNEL) { DBG_ERR("CVE-2020-1472(ZeroLogon): " "%s request (opnum[%u]) WITH schannel from " @@ -2995,5 +2984,33 @@ NTSTATUS _netr_DsrUpdateReadOnlyServerDnsRecords(struct pipes_struct *p, return NT_STATUS_NOT_IMPLEMENTED; } +/* + * Define the bind function that will be used by ndr_netlogon_scompat.c, + * included at the bottom of this file. + */ +#define DCESRV_INTERFACE_NETLOGON_BIND(context, iface) \ + dcesrv_interface_netlogon_bind(context, iface) + +static NTSTATUS dcesrv_interface_netlogon_bind(struct dcesrv_connection_context *context, + const struct dcesrv_interface *iface) +{ + struct loadparm_context *lp_ctx = context->conn->dce_ctx->lp_ctx; + int schannel = lpcfg_server_schannel(lp_ctx); + bool schannel_global_required = (schannel == true); + static bool warned_global_schannel_once = false; + + if (!schannel_global_required && !warned_global_schannel_once) { + /* + * We want admins to notice their misconfiguration! + */ + D_ERR("CVE-2020-1472(ZeroLogon): " + "Please configure 'server schannel = yes' (the default), " + "See https://bugzilla.samba.org/show_bug.cgi?id=14497\n"); + warned_global_schannel_once = true; + } + + return NT_STATUS_OK; +} + /* include the generated boilerplate */ #include "librpc/gen_ndr/ndr_netlogon_scompat.c" |