sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-22 22:04:08 +03:00
Code

CVE-2020-10704: smb.conf: Add max ldap request sizes

Browse Source 
Add two new smb.conf parameters to control the maximum permitted ldap
request size.

Adds:
   ldap max anonymous request size       default 250Kb
   ldap max authenticated request size   default 16Mb

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Gary Lockyer 2020-04-07 09:09:01 +12:00 committed by Gary Lockyer
parent 5d6bcef4b4
commit d7e5213818
4 changed files with 44 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml Normal file
View File

@ -0,0 +1,18 @@
<samba:parameter name="ldap max anonymous request size"
context="G"
type="integer"
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
<description>
<para>
This parameter specifies the maximum permitted size (in bytes)
for an LDAP request received on an anonymous connection.
</para>
<para>
If the request size exceeds this limit the request will be
rejected.
</para>
</description>
<value type="default">256000</value>
<value type="example">500000</value>
</samba:parameter>

18
docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml Normal file
View File

@ -0,0 +1,18 @@
<samba:parameter name="ldap max authenticated request size"
context="G"
type="integer"
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
<description>
<para>
This parameter specifies the maximum permitted size (in bytes)
for an LDAP request received on an authenticated connection.
</para>
<para>
If the request size exceeds this limit the request will be
rejected.
</para>
</description>
<value type="default">16777216</value>
<value type="example">4194304</value>
</samba:parameter>

5
lib/param/loadparm.c
View File

@ -3056,6 +3056,11 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
lpcfg_do_global_parameter(lp_ctx, "spotlight backend", "noindex");
lpcfg_do_global_parameter(
lp_ctx, "ldap max anonymous request size", "256000");
lpcfg_do_global_parameter(
lp_ctx, "ldap max authenticated request size", "16777216");
for (i = 0; parm_table[i].label; i++) {
if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) {
lp_ctx->flags[i] |= FLAG_DEFAULT;

3
source3/param/loadparm.c
View File

@ -956,6 +956,9 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)
Globals.prefork_backoff_increment = 10;
Globals.prefork_maximum_backoff = 120;
Globals.ldap_max_anonymous_request_size = 256000;
Globals.ldap_max_authenticated_request_size = 16777216;
/* Now put back the settings that were set with lp_set_cmdline() */
apply_lp_set_cmdline();
}