sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-20 22:50:26 +03:00
Code

CVE-2023-0225 CVE-2020-25720 s4/dsdb/util: Add functions for dsHeuristics 28, 29

Browse Source 
These are the newly-added AttributeAuthorizationOnLDAPAdd and
BlockOwnerImplicitRights.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15276

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 0af5706b559e89c77123ed174b41fd3d01705aa5)

[abartlet@samba.org This patch is needed for a clean backport of
 CVE-2023-0225 as these constants are used in the acl_modify test
 even when this behaviour is not itself used.]
This commit is contained in:
Joseph Sutton 2022-04-28 20:34:36 +12:00 committed by Jule Anger
parent 6b92716e7f
commit b7af8aa255
2 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libds/common/flags.h
View File

@ -258,6 +258,8 @@
#define DS_HR_KVNOEMUW2K 0x00000011
#define DS_HR_TWENTIETH_CHAR 0x00000014
#define DS_HR_ATTR_AUTHZ_ON_LDAP_ADD 0x0000001C
#define DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS 0x0000001D
#define DS_HR_THIRTIETH_CHAR 0x0000001E
#define DS_HR_FOURTIETH_CHAR 0x00000028
#define DS_HR_FIFTIETH_CHAR 0x00000032

40
source4/dsdb/samdb/ldb_modules/util.c
View File

@ -1433,6 +1433,46 @@ bool dsdb_do_list_object(struct ldb_module *module,
return result;
}
bool dsdb_attribute_authz_on_ldap_add(struct ldb_module *module,
TALLOC_CTX *mem_ctx,
struct ldb_request *parent)
{
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
bool result = false;
const struct ldb_val *hr_val = dsdb_module_find_dsheuristics(module,
tmp_ctx,
parent);
if (hr_val != NULL && hr_val->length >= DS_HR_ATTR_AUTHZ_ON_LDAP_ADD) {
uint8_t val = hr_val->data[DS_HR_ATTR_AUTHZ_ON_LDAP_ADD - 1];
if (val != '0' && val != '2') {
result = true;
}
}
talloc_free(tmp_ctx);
return result;
}
bool dsdb_block_owner_implicit_rights(struct ldb_module *module,
TALLOC_CTX *mem_ctx,
struct ldb_request *parent)
{
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
bool result = false;
const struct ldb_val *hr_val = dsdb_module_find_dsheuristics(module,
tmp_ctx,
parent);
if (hr_val != NULL && hr_val->length >= DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS) {
uint8_t val = hr_val->data[DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS - 1];
if (val != '0' && val != '2') {
result = true;
}
}
talloc_free(tmp_ctx);
return result;
}
/*
show the chain of requests, useful for debugging async requests
*/