CVE-2022-38023 s3:rpc_server/netlogon: implement "server schannel require seal[:COMPU...

By default we'll now require schannel connections with
privacy/sealing/encryption.

But we allow exceptions for specific computer/trust accounts.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 23bbe7f5106950f4b540b6f773b114caf836b20f..e881aecc0040b87e26a010cf7c9e9b95ea75f9c2 100755 (executable)
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -217,6 +217,20 @@ sub setup_nt4_dc
        server require schannel:schannel11\$ = no
        server require schannel:torturetest\$ = no
 
+       server schannel require seal:schannel0\$ = no
+       server schannel require seal:schannel1\$ = no
+       server schannel require seal:schannel2\$ = no
+       server schannel require seal:schannel3\$ = no
+       server schannel require seal:schannel4\$ = no
+       server schannel require seal:schannel5\$ = no
+       server schannel require seal:schannel6\$ = no
+       server schannel require seal:schannel7\$ = no
+       server schannel require seal:schannel8\$ = no
+       server schannel require seal:schannel9\$ = no
+       server schannel require seal:schannel10\$ = no
+       server schannel require seal:schannel11\$ = no
+       server schannel require seal:torturetest\$ = no
+
        rpc_server:epmapper = external
        rpc_server:spoolss = external
        rpc_server:lsarpc = external

diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
index 74bfa66fae2a0b5f98428bf0324ee5578b2a9c7f..31e56b4a60028b46f46a9b71c08d40c62f7268e7 100644 (file)
--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
@@ -1079,14 +1079,22 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
        bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
        bool schannel_required = schannel_global_required;
        bool schannel_explicitly_set = false;
+       bool seal_global_required = (lp_server_schannel_require_seal() == true) ? true:false;
+       bool seal_required = seal_global_required;
+       bool seal_explicitly_set = false;
        int CVE_2020_1472_warn_level = lp_parm_int(GLOBAL_SECTION_SNUM,
                "CVE_2020_1472", "warn_about_unused_debug_level", DBGLVL_ERR);
        int CVE_2020_1472_error_level = lp_parm_int(GLOBAL_SECTION_SNUM,
                "CVE_2020_1472", "error_debug_level", DBGLVL_ERR);
+       int CVE_2022_38023_warn_level = lp_parm_int(GLOBAL_SECTION_SNUM,
+               "CVE_2022_38023", "warn_about_unused_debug_level", DBGLVL_ERR);
+       int CVE_2022_38023_error_level = lp_parm_int(GLOBAL_SECTION_SNUM,
+               "CVE_2022_38023", "error_debug_level", DBGLVL_ERR);
        unsigned int dbg_lvl = DBGLVL_DEBUG;
        const char *opname = "<unknown>";
        const char *reason = "<unknown>";
        static bool warned_global_schannel_once = false;
+       static bool warned_global_seal_once = false;
 
        if (opnum < ndr_table_netlogon.num_calls) {
                opname = ndr_table_netlogon.calls[opnum].name;
@@ -1123,6 +1131,20 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
                return status;
        }
 
+       /*
+        * We don't use lp_parm_bool(), as we
+        * need the explicit_opt pointer in order to
+        * adjust the debug messages.
+        */
+       explicit_opt = lp_parm_const_string(GLOBAL_SECTION_SNUM,
+                                           "server schannel require seal",
+                                           creds->account_name,
+                                           NULL);
+       if (explicit_opt != NULL) {
+               seal_required = lp_bool(explicit_opt);
+       }
+       seal_explicitly_set = explicit_opt != NULL;
+
        /*
         * We don't use lp_parm_bool(), as we
         * need the explicit_opt pointer in order to
@@ -1138,7 +1160,96 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
        }
        schannel_explicitly_set = explicit_opt != NULL;
 
+       if (auth_type == DCERPC_AUTH_TYPE_SCHANNEL &&
+           auth_level == DCERPC_AUTH_LEVEL_PRIVACY)
+       {
+               status = NT_STATUS_OK;
+
+               if (schannel_explicitly_set && !schannel_required) {
+                       dbg_lvl = MIN(dbg_lvl, CVE_2020_1472_warn_level);
+               } else if (!schannel_required) {
+                       dbg_lvl = MIN(dbg_lvl, DBGLVL_INFO);
+               }
+               if (seal_explicitly_set && !seal_required) {
+                       dbg_lvl = MIN(dbg_lvl, CVE_2022_38023_warn_level);
+               } else if (!seal_required) {
+                       dbg_lvl = MIN(dbg_lvl, DBGLVL_INFO);
+               }
+
+               DEBUG(dbg_lvl, (
+                     "CVE-2020-1472(ZeroLogon)/CVE-2022-38023: "
+                     "%s request (opnum[%u]) %s schannel from "
+                     "client_account[%s] client_computer_name[%s] %s\n",
+                     opname, opnum, reason,
+                     log_escape(frame, creds->account_name),
+                     log_escape(frame, creds->computer_name),
+                     nt_errstr(status)));
+
+               if (schannel_explicitly_set && !schannel_required) {
+                       DEBUG(CVE_2020_1472_warn_level, (
+                             "CVE-2020-1472(ZeroLogon): "
+                             "Option 'server require schannel:%s = no' not needed for '%s'!\n",
+                             log_escape(frame, creds->account_name),
+                             log_escape(frame, creds->computer_name)));
+               }
+
+               if (seal_explicitly_set && !seal_required) {
+                       DEBUG(CVE_2022_38023_warn_level, (
+                             "CVE-2022-38023: "
+                             "Option 'server schannel require seal:%s = no' not needed for '%s'!\n",
+                             log_escape(frame, creds->account_name),
+                             log_escape(frame, creds->computer_name)));
+               }
+
+               TALLOC_FREE(frame);
+               return status;
+       }
+
        if (auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
+               if (seal_required) {
+                       status = NT_STATUS_ACCESS_DENIED;
+
+                       if (seal_explicitly_set) {
+                               dbg_lvl = DBGLVL_NOTICE;
+                       } else {
+                               dbg_lvl = MIN(dbg_lvl, CVE_2022_38023_error_level);
+                       }
+                       if (schannel_explicitly_set && !schannel_required) {
+                               dbg_lvl = MIN(dbg_lvl, CVE_2022_38023_warn_level);
+                       }
+
+                       DEBUG(dbg_lvl, (
+                             "CVE-2022-38023: "
+                             "%s request (opnum[%u]) %s schannel from "
+                             "from client_account[%s] client_computer_name[%s] %s\n",
+                             opname, opnum, reason,
+                             log_escape(frame, creds->account_name),
+                             log_escape(frame, creds->computer_name),
+                             nt_errstr(status)));
+                       if (seal_explicitly_set) {
+                               D_NOTICE("CVE-2022-38023: Option "
+                                        "'server schannel require seal:%s = yes' "
+                                        "rejects access for client.\n",
+                                        log_escape(frame, creds->account_name));
+                       } else {
+                               DEBUG(CVE_2020_1472_error_level, (
+                                     "CVE-2022-38023: Check if option "
+                                     "'server schannel require seal:%s = no' "
+                                     "might be needed for a legacy client.\n",
+                                     log_escape(frame, creds->account_name)));
+                       }
+                       if (schannel_explicitly_set && !schannel_required) {
+                               DEBUG(CVE_2020_1472_warn_level, (
+                                     "CVE-2020-1472(ZeroLogon): Option "
+                                     "'server require schannel:%s = no' "
+                                     "not needed for '%s'!\n",
+                                     log_escape(frame, creds->account_name),
+                                     log_escape(frame, creds->computer_name)));
+                       }
+                       TALLOC_FREE(frame);
+                       return status;
+               }
+
                status = NT_STATUS_OK;
 
                if (schannel_explicitly_set && !schannel_required) {
@@ -1146,6 +1257,11 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
                } else if (!schannel_required) {
                        dbg_lvl = MIN(dbg_lvl, DBGLVL_INFO);
                }
+               if (seal_explicitly_set && !seal_required) {
+                       dbg_lvl = MIN(dbg_lvl, DBGLVL_INFO);
+               } else if (!seal_required) {
+                       dbg_lvl = MIN(dbg_lvl, CVE_2022_38023_error_level);
+               }
 
                DEBUG(dbg_lvl, (
                      "CVE-2020-1472(ZeroLogon): "
@@ -1155,7 +1271,6 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
                      log_escape(frame, creds->account_name),
                      log_escape(frame, creds->computer_name),
                      nt_errstr(status)));
-
                if (schannel_explicitly_set && !schannel_required) {
                        DEBUG(CVE_2020_1472_warn_level, (
                              "CVE-2020-1472(ZeroLogon): "
@@ -1163,7 +1278,77 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
                              log_escape(frame, creds->account_name),
                              log_escape(frame, creds->computer_name)));
                }
+               if (seal_explicitly_set && !seal_required) {
+                       D_INFO("CVE-2022-38023: "
+                              "Option 'server schannel require seal:%s = no' still needed for '%s'!\n",
+                              log_escape(frame, creds->account_name),
+                              log_escape(frame, creds->computer_name));
+               } else if (!seal_required) {
+                       /*
+                        * admins should set
+                        * server schannel require seal:COMPUTER$ = no
+                        * in order to avoid the level 0 messages.
+                        * Over time they can switch the global value
+                        * to be strict.
+                        */
+                       DEBUG(CVE_2022_38023_error_level, (
+                             "CVE-2022-38023: "
+                             "Please use 'server schannel require seal:%s = no' "
+                             "for '%s' to avoid this warning!\n",
+                             log_escape(frame, creds->account_name),
+                             log_escape(frame, creds->computer_name)));
+               }
+
+               TALLOC_FREE(frame);
+               return status;
+       }
+
+       if (seal_required) {
+               status = NT_STATUS_ACCESS_DENIED;
 
+               if (seal_explicitly_set) {
+                       dbg_lvl = MIN(dbg_lvl, DBGLVL_NOTICE);
+               } else {
+                       dbg_lvl = MIN(dbg_lvl, CVE_2022_38023_error_level);
+               }
+               if (!schannel_explicitly_set) {
+                       dbg_lvl = MIN(dbg_lvl, CVE_2020_1472_error_level);
+               } else if (schannel_required) {
+                       dbg_lvl = MIN(dbg_lvl, DBGLVL_NOTICE);
+               }
+
+               DEBUG(dbg_lvl, (
+                     "CVE-2020-1472(ZeroLogon)/CVE-2022-38023: "
+                     "%s request (opnum[%u]) %s schannel from "
+                     "from client_account[%s] client_computer_name[%s] %s\n",
+                     opname, opnum, reason,
+                     log_escape(frame, creds->account_name),
+                     log_escape(frame, creds->computer_name),
+                     nt_errstr(status)));
+               if (seal_explicitly_set) {
+                       D_NOTICE("CVE-2022-38023: Option "
+                                "'server schannel require seal:%s = yes' "
+                                "rejects access for client.\n",
+                                log_escape(frame, creds->account_name));
+               } else {
+                       DEBUG(CVE_2022_38023_error_level, (
+                             "CVE-2022-38023: Check if option "
+                             "'server schannel require seal:%s = no' "
+                             "might be needed for a legacy client.\n",
+                             log_escape(frame, creds->account_name)));
+               }
+               if (!schannel_explicitly_set) {
+                       DEBUG(CVE_2020_1472_error_level, (
+                             "CVE-2020-1472(ZeroLogon): Check if option "
+                             "'server require schannel:%s = no' "
+                             "might be needed for a legacy client.\n",
+                             log_escape(frame, creds->account_name)));
+               } else if (schannel_required) {
+                       D_NOTICE("CVE-2022-38023: Option "
+                                "'server require schannel:%s = yes' "
+                                "also rejects access for client.\n",
+                                log_escape(frame, creds->account_name));
+               }
                TALLOC_FREE(frame);
                return status;
        }
@@ -1176,6 +1361,9 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
                } else {
                        dbg_lvl = MIN(dbg_lvl, CVE_2020_1472_error_level);
                }
+               if (!seal_explicitly_set) {
+                       dbg_lvl = MIN(dbg_lvl, CVE_2022_38023_error_level);
+               }
 
                DEBUG(dbg_lvl, (
                      "CVE-2020-1472(ZeroLogon)/CVE-2022-38023: "
@@ -1197,6 +1385,13 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
                              "might be needed for a legacy client.\n",
                              log_escape(frame, creds->account_name)));
                }
+               if (!seal_explicitly_set) {
+                       DEBUG(CVE_2022_38023_error_level, (
+                             "CVE-2022-38023: Check if option "
+                             "'server schannel require seal:%s = no' "
+                             "might be needed for a legacy client.\n",
+                             log_escape(frame, creds->account_name)));
+               }
                TALLOC_FREE(frame);
                return status;
        }
@@ -1211,8 +1406,24 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
                warned_global_schannel_once = true;
        }
 
+       if (!seal_global_required && !warned_global_seal_once) {
+               /*
+                * We want admins to notice their misconfiguration!
+                */
+               DBG_ERR("CVE-2022-38023 (and others): "
+                       "Please configure 'server schannel require seal = yes' (the default), "
+                       "See https://bugzilla.samba.org/show_bug.cgi?id=15240\n");
+               warned_global_seal_once = true;
+       }
+
        status = NT_STATUS_OK;
 
+       if (seal_explicitly_set) {
+               dbg_lvl = MIN(dbg_lvl, DBGLVL_INFO);
+       } else {
+               dbg_lvl = MIN(dbg_lvl, CVE_2022_38023_error_level);
+       }
+
        if (schannel_explicitly_set) {
                dbg_lvl = MIN(dbg_lvl, DBGLVL_INFO);
        } else {
@@ -1228,6 +1439,28 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
              log_escape(frame, creds->computer_name),
              nt_errstr(status)));
 
+       if (seal_explicitly_set) {
+               D_INFO("CVE-2022-38023: Option "
+                      "'server schannel require seal:%s = no' "
+                      "still needed for '%s'!\n",
+                      log_escape(frame, creds->account_name),
+                      log_escape(frame, creds->computer_name));
+       } else {
+               /*
+                * admins should set
+                * server schannel require seal:COMPUTER$ = no
+                * in order to avoid the level 0 messages.
+                * Over time they can switch the global value
+                * to be strict.
+                */
+               DEBUG(CVE_2022_38023_error_level, (
+                     "CVE-2022-38023: Please use "
+                      "'server schannel require seal:%s = no' "
+                     "for '%s' to avoid this warning!\n",
+                     log_escape(frame, creds->account_name),
+                     log_escape(frame, creds->computer_name)));
+       }
+
        if (schannel_explicitly_set) {
                D_INFO("CVE-2020-1472(ZeroLogon): Option "
                       "'server require schannel:%s = no' "
@@ -1251,7 +1484,7 @@ static NTSTATUS netr_check_schannel(struct pipes_struct *p,
        }
 
        TALLOC_FREE(frame);
-       return NT_STATUS_OK;
+       return status;
 }
 
 static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p,