CC: samba: fix some security problems

[15.05/openwrt.git] / package / network / services / samba36 / patches / 260-remove_samr.patch

diff --git a/package/network/services/samba36/patches/260-remove_samr.patch b/package/network/services/samba36/patches/260-remove_samr.patch
index 4b80f70..aeca3ed 100644 (file)
--- a/package/network/services/samba36/patches/260-remove_samr.patch
+++ b/package/network/services/samba36/patches/260-remove_samr.patch
@@ -109,7 +109,7 @@
        if (!str1 || !str2 || !UserName || !p) {
                return False;
        }
-@@ -2733,6 +2741,10 @@ static bool api_RNetUserEnum(struct smbd
+@@ -2741,6 +2749,10 @@ static bool api_RNetUserEnum(struct smbd
  
        struct dcerpc_binding_handle *b;
  
@@ -120,18 +120,7 @@
        if (!str1 || !str2 || !p) {
                return False;
        }
-@@ -2979,6 +2991,10 @@ static bool api_SetUserPassword(struct s
-       int min_pwd_length;
-       struct dcerpc_binding_handle *b = NULL;
- 
-+#ifndef SAMR_SUPPORT
-+      return False;
-+#endif
-+
-       /* Skip 2 strings. */
-       p = skip_string(param,tpscnt,np);
-       p = skip_string(param,tpscnt,p);
-@@ -3224,6 +3240,10 @@ static bool api_SamOEMChangePassword(str
+@@ -2979,6 +2991,10 @@ static bool api_SamOEMChangePassword(str
        int bufsize;
        struct dcerpc_binding_handle *b;
  
@@ -142,7 +131,7 @@
        *rparam_len = 4;
        *rparam = smb_realloc_limit(*rparam,*rparam_len);
        if (!*rparam) {
-@@ -4265,6 +4285,10 @@ static bool api_RNetUserGetInfo(struct s
+@@ -4020,6 +4036,10 @@ static bool api_RNetUserGetInfo(struct s
        union samr_UserInfo *info;
        struct dcerpc_binding_handle *b = NULL;
  
@@ -153,3 +142,21 @@
        if (!str1 || !str2 || !UserName || !p) {
                return False;
        }
+--- a/source3/rpc_server/srv_pipe.c
++++ b/source3/rpc_server/srv_pipe.c
+@@ -409,6 +409,7 @@ static bool check_bind_req(struct pipes_
+       context_fns->syntax = *abstract;
+ 
+       context_fns->allow_connect = lp_allow_dcerpc_auth_level_connect();
++#ifdef SAMR_SUPPORT
+       /*
+        * for the samr and the lsarpc interfaces we don't allow "connect"
+        * auth_level by default.
+@@ -417,6 +418,7 @@ static bool check_bind_req(struct pipes_
+       if (ok) {
+               context_fns->allow_connect = false;
+       }
++#endif
+       ok = ndr_syntax_id_equal(abstract, &ndr_table_lsarpc.syntax_id);
+       if (ok) {
+               context_fns->allow_connect = false;