From: Daniel Stenberg <daniel@haxx.se>
Date: Sun, 5 Apr 2026 16:23:35 +0000 (+0200)
Subject: [PATCH] protocol: disable connection reuse for SMB(S)
X-Git-Tag: archive/raspbian/7.88.1-10+rpi1+deb12u15^2~8
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=0ce9fd8249b4c87c7be1975a0849aefff08c0225;p=curl.git

[PATCH] protocol: disable connection reuse for SMB(S)

Connections should only be reused when using the same "share" (and
perhaps some additional conditions), but instead of fixing this flaw,
this change completely disables connection reuse for SMB. This protocol
is about to get dropped soon anyway.

Reported-by: Osama Hamad
Closes #21238

Backported-by: Samuel Henrique <samueloph@debian.org>
 * Upstream removes PROTOPT_CONN_REUSE from the SMB and SMBS scheme
   registrations in lib/protocol.c. That flag (and the lib/protocol.c scheme
   registry itself) only exists from upstream commit
   feea96851230c7a5a11feaffa0a5e4a4d30e5e63 ("conncontrol: reuse handling", Nov
   2025) onward, so neither is present in 8.14.1. In 8.14.1 SMB connection
   reuse is instead controlled at runtime via connkeep() / connclose(), and
   lib/smb.c explicitly calls connkeep() in smb_connect() to mark SMB
   connections as eligible for reuse. Replace that connkeep() with a
   connclose() so SMB connections are marked as not-reusable, achieving the
   same effect as the upstream change.

Backported by: Samuel Henrique <samueloph@debian.org>
 * Bookworm 7.88.1: same connkeep() call in smb_connect() at line
   271. Apply the same connkeep() -> connclose() swap; this version
   also lacks PROTOPT_CONN_REUSE so the runtime approach is the
   only way to express "do not reuse this connection".

Gbp-Pq: Name CVE-2026-5773.patch
---

diff --git a/lib/smb.c b/lib/smb.c
index 097874b8..24c319cf 100644
--- a/lib/smb.c
+++ b/lib/smb.c
@@ -267,8 +267,10 @@ static CURLcode smb_connect(struct Curl_easy *data, bool *done)
   if(!smbc->recv_buf)
     return CURLE_OUT_OF_MEMORY;
 
-  /* Multiple requests are allowed with this connection */
-  connkeep(conn, "SMB default");
+  /* SMB does not allow connection reuse: connections should only be reused
+     when using the same "share" (and possibly other conditions), but rather
+     than implementing that, mark every SMB connection as not reusable. */
+  connclose(conn, "SMB does not allow connection reuse");
 
   /* Parse the username, domain, and password */
   slash = strchr(conn->user, '/');