samba: update to 4.13.0

[ipfire-2.x.git] / src / patches / samba / CVE-2017-12150-v3-6.patch

diff --git a/src/patches/samba/CVE-2017-12150-v3-6.patch b/src/patches/samba/CVE-2017-12150-v3-6.patch
deleted file mode 100644 (file)
index b221a84..0000000
--- a/src/patches/samba/CVE-2017-12150-v3-6.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From d3198caa7a8910a9ce1eb4104d5b410ef29ac2bb Mon Sep 17 00:00:00 2001
-From: Stefan Metzmacher <metze@samba.org>
-Date: Thu, 3 Nov 2016 17:16:43 +0100
-Subject: [PATCH 1/3] CVE-2017-12150: s3:lib:
- get_cmdline_auth_info_signing_state use Required for smb_encrypt
-
-This is an addition to the fixes for CVE-2015-5296.
-
-It applies to smb2mount -e, smbcacls -e and smbcquotas -e.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997
-
-Signed-off-by: Stefan Metzmacher <metze@samba.org>
-Backported-by: Andreas Schneider <asn@samba.org>
----
- source3/lib/util_cmdline.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c
-index cb0b79a5d30..3178c848b63 100644
---- a/source3/lib/util_cmdline.c
-+++ b/source3/lib/util_cmdline.c
-@@ -122,6 +122,9 @@ bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info,
- 
- int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info)
- {
-+      if (auth_info->smb_encrypt) {
-+              return Required;
-+      }
-       return auth_info->signing_state;
- }
- 
--- 
-2.14.1
-
-
-From bb762a74c81159633f904f8fb67b49bab74a0b9c Mon Sep 17 00:00:00 2001
-From: Stefan Metzmacher <metze@samba.org>
-Date: Mon, 12 Dec 2016 05:49:46 +0100
-Subject: [PATCH 2/3] CVE-2017-12150: libgpo: make use of Required for SMB
- signing in gpo_connect_server()
-
-It's important that we use a signed connection to get the GPOs!
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997
-
-Signed-off-by: Stefan Metzmacher <metze@samba.org>
-Backported-by: Andreas Schneider <asn@samba.org>
----
- libgpo/gpo_fetch.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libgpo/gpo_fetch.c b/libgpo/gpo_fetch.c
-index 3cfe1d5b942..af012e01336 100644
---- a/libgpo/gpo_fetch.c
-+++ b/libgpo/gpo_fetch.c
-@@ -151,7 +151,7 @@ static NTSTATUS gpo_connect_server(ADS_STRUCT *ads, struct loadparm_context *lp_
-                       ads->auth.password,
-                       CLI_FULL_CONNECTION_USE_KERBEROS |
-                       CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS,
--                      Undefined);
-+                      Required);
-       if (!NT_STATUS_IS_OK(result)) {
-               DEBUG(10,("check_refresh_gpo: "
-                               "failed to connect: %s\n",
--- 
-2.14.1
-
-
-From 070b0fb9ebb57cdbc2b82e335de021fb46bc543c Mon Sep 17 00:00:00 2001
-From: Stefan Metzmacher <metze@samba.org>
-Date: Mon, 12 Dec 2016 06:07:56 +0100
-Subject: [PATCH 3/3] CVE-2017-12150: s3:libsmb: only fallback to anonymous if
- authentication was not requested
-
-With forced encryption or required signing we should also don't fallback.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997
-
-Signed-off-by: Stefan Metzmacher <metze@samba.org>
-Backported-by: Andreas Schneider <asn@samba.org>
----
- source3/libsmb/clidfs.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
-index 23e147120f1..120a2c999ce 100644
---- a/source3/libsmb/clidfs.c
-+++ b/source3/libsmb/clidfs.c
-@@ -197,7 +197,9 @@ static struct cli_state *do_connect(TALLOC_CTX *ctx,
-               /* If a password was not supplied then
-                * try again with a null username. */
-               if (password[0] || !username[0] ||
-+                      force_encrypt || client_is_signing_mandatory(c) ||
-                       get_cmdline_auth_info_use_kerberos(auth_info) ||
-+                      get_cmdline_auth_info_use_ccache(auth_info) ||
-                       !NT_STATUS_IS_OK(cli_session_setup(c, "",
-                                               "", 0,
-                                               "", 0,
--- 
-2.14.1
-