<html><head></head><body>Hi,<br><br>Looks like an obvious downgrade attack to me. You're waiting for a CVE if you merge this patch.<br><br><div class="gmail_quote">Le 15 octobre 2019 16:41:17 GMT+03:00, Thomas Guillem <thomas@gllm.fr> a écrit :<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Some samba servers (on Windows 7) implement both SMB2 and SMB1. The problem is<br>that the SMB2 part is not configured like the SMB1 one. Only SMB1 seems to<br>reflect the user configuration (using Windows Settings, not anything<br>complicated like via powershell/regedit).<br><br>If we try to connect to such server via libsmb2, the server will return a<br>SMB2_STATUS_ACCESS_DENIED (0xC0000022) status. Our libsmb2 module will then ask<br>the user for credentials via a dialog. The problem is that no credentials will<br>ever work since only the SMB1 part is configured.<br><br>I tried to differentiate (via wireshark) the negotiation between such server<br>and an other working SMB2 server but could not find anything that could tell us<br>that this ACCESS_DENIED status should be ignored on this specific server (in<br>order to fallback to libdsm).<br><br>The only possible fix is to try libdsm first. VLC will then favor the SMB1<br>protocol over SMB 2&3.<br><br>NB1: libsmb2 is backported to VLC 3.0 for iOS and Android ports. These ports<br>are beta-testing SMB 2&3 support on mobile.<br><br>NB2: We get a lot of angry mail/reviews about SMB1 support broken, I don't<br>think we can drop SMB1 (even if I would love to).<br><br>NB3: We can't drop libsmb2 either for the same reason (we got a *lot* of<br>requests to support it).<hr> modules/access/dsm/access.c | 17 ++++++++++-------<br> modules/access/smb2.c | 14 +++++++-------<br> 2 files changed, 17 insertions(+), 14 deletions(-)<br><br>diff --git a/modules/access/dsm/access.c b/modules/access/dsm/access.c<br>index 776925c9eeb..186a567a72c 100644<br>--- a/modules/access/dsm/access.c<br>+++ b/modules/access/dsm/access.c<br>@@ -69,7 +69,7 @@ vlc_module_begin ()<br> set_shortname( "dsm" )<br> set_description( N_("libdsm SMB input") )<br> set_help(BDSM_HELP)<br>- set_capability( "access", 20 )<br>+ set_capability( "access", 22 )<br> set_category( CAT_INPUT )<br> set_subcategory( SUBCAT_INPUT_ACCESS )<br> add_string( "smb-user", NULL, SMB_USER_TEXT, SMB_USER_LONGTEXT, false )<br>@@ -343,12 +343,6 @@ static int login( stream_t *p_access )<br> <br> if( connect_err == EACCES )<br> {<br>- if (var_Type(p_access, "smb-dialog-failed") != 0)<br>- {<br>- /* A higher priority smb module (likely smb2) already requested<br>- * credentials to the users. It is useless to request it again. */<br>- goto error;<br>- }<br> while( connect_err == EACCES<br> && vlc_credential_get( &credential, p_access, "smb-user", "smb-pwd",<br> SMB_LOGIN_DIALOG_TITLE,<br>@@ -365,6 +359,15 @@ static int login( stream_t *p_access )<br> if( connect_err != 0 )<br> {<br> msg_Err( p_access, "Unable to login" );<br>+<br>+ if (credential.i_get_order == GET_FROM_DIALOG)<br>+ {<br>+ /* Tell other smb modules (likely smb2) that we already<br>+ * requested credential to the users and that it it useless to<br>+ * try again. This avoid to show 2 login dialogs for the same<br>+ * access. */<br>+ var_Create(p_access, "smb-dialog-failed", VLC_VAR_VOID);<br>+ }<br> goto error;<br> }<br> }<br>diff --git a/modules/access/smb2.c b/modules/access/smb2.c<br>index 923e6d57e04..7f9b614d006 100644<br>--- a/modules/access/smb2.c<br>+++ b/modules/access/smb2.c<br>@@ -664,6 +664,13 @@ Open(vlc_object_t *p_obj)<br> NULL);<br> ret = vlc_smb2_open_share(access, smb2_url, &credential);<br> <br>+ if (ret == -1 && var_Type(access, "smb-dialog-failed"))<br>+ {<br>+ /* A higher priority smb module (likely dsm) already requested<br>+ * credentials to the users. It is useless to request it again. */<br>+ goto error;<br>+ }<br>+<br> while (ret == -1<br> && (!sys->error_status || VLC_SMB2_STATUS_DENIED(sys->error_status))<br> && vlc_credential_get(&credential, access, "smb-user", "smb-pwd",<br>@@ -683,13 +690,6 @@ Open(vlc_object_t *p_obj)<br> if (error && *error)<br> vlc_dialog_display_error(access,<br> _("SMB2 operation failed"), "%s", error);<br>- if (credential.i_get_order == GET_FROM_DIALOG)<br>- {<br>- /* Tell other smb modules (likely dsm) that we already requested<br>- * credential to the users and that it it useless to try again.<br>- * This avoid to show 2 login dialogs for the same access. */<br>- var_Create(access, "smb-dialog-failed", VLC_VAR_VOID);<br>- }<br> goto error;<br> }<br> </pre></blockquote></div><br>-- <br>Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma brièveté.</body></html>