samba.git/source3/param, branch talloc-2.4.0

s3:params:lp_do_section - protect against NULL deref

2022-12-20T18:49:54+00:00

iServiceIndex may indicate an empty slot in the ServicePtrs
array. In this case, lpcfg_serivce_ok(ServicePtrs[iServiceIndex])
may trigger a NULL deref and crash. Skipping the check
here will cause a scan of the array in add_a_service() and the
NULL slot will be used safely.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15267

Signed-off-by: Andrew Walker 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Tue Dec 20 18:49:54 UTC 2022 on sn-devel-184

s3-librpc: add ads.idl and convert ads_struct to talloc.

2022-12-16T20:38:32+00:00

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Jeremy Allison

CVE-2022-37966 param: let "kdc default domain supportedenctypes = 0" mean the default

2022-12-13T13:07:30+00:00

In order to allow better upgrades we need the default value for smb.conf to the
same even if the effective default value of the software changes in future.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

CVE-2022-37966 param: don't explicitly initialize "kdc force enable rc4 weak session keys" to false/"no"

2022-12-13T13:07:30+00:00

This is not squashed in order to allow easier backports...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

CVE-2022-37966 param: Add support for new option "kdc force enable rc4 weak session keys"

2022-12-13T13:07:29+00:00

Pair-Programmed-With: Joseph Sutton 

Signed-off-by: Andrew Bartlett 
Signed-off-by: Joseph Sutton 
Reviewed-by: Stefan Metzmacher

CVE-2022-37966 param: Add support for new option "kdc default domain supportedenctypes"

2022-12-13T13:07:29+00:00

This matches the Windows registry key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\KDC\DefaultDomainSupportedEncTypes

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Pair-Programmed-With: Andrew Bartlett 

Signed-off-by: Joseph Sutton 
Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

CVE-2022-38023 docs-xml/smbdotconf: add "server schannel require seal[:COMPUTERACCOUNT]" options

2022-12-13T13:07:29+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Ralph Boehme

CVE-2022-38023 docs-xml/smbdotconf: change 'reject md5 clients' default to yes

2022-12-13T13:07:29+00:00

AES is supported by Windows Server >= 2008R2, Windows (Client) >= 7 and Samba >= 4.0,
so there's no reason to allow md5 clients by default.
However some third party domain members may need it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Ralph Boehme

CVE-2022-38023 docs-xml/smbdotconf: change 'reject md5 servers' default to yes

2022-12-13T13:07:29+00:00

AES is supported by Windows >= 2008R2 and Samba >= 4.0 so there's no
reason to allow md5 servers by default.

Note the change in netlogon_creds_cli_context_global() is only cosmetic,
but avoids confusion while reading the code. Check with:

 git show -U35 libcli/auth/netlogon_creds_cli.c

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Ralph Boehme

smbd: Remove a few "extern userdom_struct current_user_info"

2022-12-12T22:14:20+00:00

get_current_username() returns current_user_info.smb_name

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Mon Dec 12 22:14:20 UTC 2022 on sn-devel-184