summaryrefslogtreecommitdiff
path: root/source3/param
Commit message (Collapse)AuthorAgeFilesLines
* tls: Use NORMAL:-VERS-SSL3.0 as the default configurationAndreas Schneider2020-07-011-7/+1
| | | | | | | | | | | | | | | This seems to be really broken in GnuTLS and the documentation is also not correct. This partially reverts 53e3a959b958a3b099df6ecc5f6e294e96bd948e BUG: https://bugzilla.samba.org/show_bug.cgi?id=14408 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Jul 1 14:56:33 UTC 2020 on sn-devel-184
* s3:lib:tls: Use better priority lists for modern GnuTLSAndreas Schneider2020-06-171-2/+9
| | | | | | | | | | | | | | | We should use the default priority list. That is a good practice, because TLS protocol hardening and phasing out of legacy algorithms, is easier to co-ordinate when happens at a single place. See crypto policies of Fedora. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14408 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Jun 17 17:42:02 UTC 2020 on sn-devel-184
* Fix clang 9 missing-field-initializer warningsGary Lockyer2020-05-081-1/+1
| | | | Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decodeGary Lockyer2020-05-041-0/+1
| | | | | | | | | | | | | | | | Add search request size limits to ldap_decode calls. The ldap server uses the smb.conf variable "ldap max search request size" which defaults to 250Kb. For cldap the limit is hard coded as 4096. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2020-10704: smb.conf: Add max ldap request sizesGary Lockyer2020-05-041-0/+3
| | | | | | | | | | | | | | | | | Add two new smb.conf parameters to control the maximum permitted ldap request size. Adds: ldap max anonymous request size default 250Kb ldap max authenticated request size default 16Mb Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* lib:param: Add lp(cfg)_weak_crypto()Andreas Schneider2020-03-191-0/+14
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* loadparm: check for AD DC required VFS modulesDavid Disseldorp2020-01-031-1/+36
| | | | | | | | | | | | | | | | | | | | When Samba is running as a domain controller and the "vfs objects" parameter is not set, then the dfs_samba4 and acl_xattr modules are automatically enabled. However, if the "vfs objects" is defined, then the setting is left as-is. This means that attempts to us other VFS modules have the side effect of disabling the dfs_samba4 and acl_xattr modules, causing unexpected behaviour, which is then blamed on the VFS modules that were explicitly defined. This change ensures that when running as a domain controller, Samba logs an error if the required VFS modules are not enabled by an explicit "vfs objects" definition. Bug: https://bugzilla.samba.org/show_bug.cgi?id=10560 Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Björn Jacke <bjacke@samba.org>
* smbd: Make lp_use_sendfile() static to reply.cVolker Lendecke2019-12-081-20/+0
| | | | | | | | | | | This is the only place where it's used. Also, via smb_signing_is_active it pulls in the dependency on 'cli_smb_common' (which pulls in all of gensec) into the 'smbconf' library. Without this, 'smbconf' is happy with just 'samba-hostconfig' instead of 'cli_smb_common' Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* param: remove now unused lp_string()Ralph Boehme2019-11-272-6/+0
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* param: remove FN_LOCAL_STRINGRalph Boehme2019-11-271-2/+0
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3:param: make "servicename" a substituted optionRalph Boehme2019-11-271-3/+5
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* param: remove now unused FN_GLOBAL_STRING macroRalph Boehme2019-11-271-2/+0
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbdotconf: mark "ldap user suffix" with constant="1"Ralph Boehme2019-11-271-1/+1
| | | | | | | | | Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned directly, variable substitution isn't supported anyway, so we can just mark this const. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbdotconf: mark "ldap machine suffix" with constant="1"Ralph Boehme2019-11-271-1/+1
| | | | | | | | | Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned directly, variable substitution isn't supported anyway, so we can just mark this const. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbdotconf: mark "ldap idmap suffix" with constant="1"Ralph Boehme2019-11-271-1/+1
| | | | | | | | | Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned directly, variable substitution isn't supported anyway, so we can just mark this const. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbdotconf: mark "ldap group suffix" with constant="1"Ralph Boehme2019-11-271-1/+1
| | | | | | | | | Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned directly, variable substitution isn't supported anyway, so we can just mark this const. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbdotconf: mark "usershare path" with substitution="1"Ralph Boehme2019-11-271-1/+1
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbdotconf: mark "defaultservice" with substitution="1"Ralph Boehme2019-11-271-1/+3
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbdotconf: mark "auto services" with substitution="1"Ralph Boehme2019-11-271-1/+3
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3:param: let lp_add_auto_services() take a const char *Ralph Boehme2019-11-271-1/+1
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbdotconf: mark "volume" with substitution="1"Ralph Boehme2019-11-271-1/+3
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbdotconf: mark "printername" with substitution="1"Ralph Boehme2019-11-271-2/+5
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbdotconf: mark "path" with substitution="1"Ralph Boehme2019-11-271-1/+3
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* param: add FN_{GLOBAL,LOCAL}_SUBSTITUTED_STRING supportStefan Metzmacher2019-11-271-0/+6
| | | | | | | Pair-Programmed-With: Ralph Boehme <slow@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Signed-off-by: Ralph Boehme <slow@samba.org>
* s3:parm: remove unused lp_parm_talloc_string()Stefan Metzmacher2019-11-271-14/+0
| | | | | | | | Callers should use lp_parm_substituted_string() directly or just use lp_parm_const_string(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3:param: split out lp_parm_substituted_string()Stefan Metzmacher2019-11-271-3/+24
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3:param: split out loadparm_s3_global_substitution from lp_string()Stefan Metzmacher2019-11-271-1/+20
| | | | | | | | | | | | | | | | The idea is to get rid of the global state that's currently used for the substitution in lp_string(). In the end all callers need to pass an explicit const struct loadparm_substitution *sub_ctx, which contains all relevant information for the substitution. At that point lp_string() can be removed. For now we provide loadparm_s3_global_substitution() for callers to keep the current bahavior unchanged. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3:param: rename lp_string() argument ctx to mem_ctxRalph Boehme2019-11-271-3/+3
| | | | | | | Minimizes diff of subsequent patch. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* sharesec: Return NTSTATUS from set_share_securityChristof Schmitt2019-11-261-2/+3
| | | | | Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* smbd: Remove write cacheVolker Lendecke2019-11-131-1/+0
| | | | | | | | | | | | | | | | | Since this was written, our write path has changed significantly. In particular we have gained very flexible support for async I/O, with the linux io_uring in the pipeline. Caching stuff in main memory and then doing a blocking pwrite nowadays does not belong into the core smbd code. If someone wants it back, it should be doable in a VFS module. Removes: "write cache size" parameter. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Nov 13 00:20:55 UTC 2019 on sn-devel-184
* Detect when command line max protocol < min protocolDavid Mulder2019-11-121-0/+14
| | | | | | | | | | | | | | | | Due to the increased default minimum protocol level to SMB2, some users notice that specifying smbclient -m NT1 fails with NT_STATUS_CONNECTION_DISCONNECTED, with no SMB traffic on the wire. Report when the max protocol is set less than the min protocol. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Noel Power <npower@samba.org> Autobuild-User(master): Noel Power <npower@samba.org> Autobuild-Date(master): Tue Nov 12 17:52:28 UTC 2019 on sn-devel-184
* s4-dns: Deprecate BIND9_FLATFILE and remove "rndc command"Andrew Bartlett2019-08-221-2/+0
| | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Aug 22 21:24:00 UTC 2019 on sn-devel-184
* loadparm: fix mem leak found by ASANSwen Schillig2019-08-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | ==24948==ERROR: LeakSanitizer: detected memory leaks Indirect leak of 232 byte(s) in 1 object(s) allocated from: #0 0x7fc44b971c08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08) #1 0x7fc44a2fe7b0 in __talloc_with_prefix ../../lib/talloc/talloc.c:782 #2 0x7fc44a2fe7b0 in __talloc ../../lib/talloc/talloc.c:824 #3 0x7fc44a2fe7b0 in _talloc_named_const ../../lib/talloc/talloc.c:981 #4 0x7fc44a2fe7b0 in _talloc_array ../../lib/talloc/talloc.c:2764 #5 0x7fc44a1239bc in str_list_make_v3 ../../lib/util/util_strlist_v3.c:58 #6 0x7fc44a123e3b in str_list_make_v3_const ../../lib/util/util_strlist_v3.c:127 #7 0x7fc44b14cc1a in init_globals ../../source3/param/loadparm.c:547 #8 0x7fc44b14deef in lp_load_ex ../../source3/param/loadparm.c:3876 #9 0x7fc44b14f97c in lp_load_initial_only ../../source3/param/loadparm.c:4025 #10 0x7fc44b479235 in cmdline_messaging_context ../../source3/lib/cmdline_contexts.c:34 #11 0x557cf59d642c in process_options ../../source3/utils/smbpasswd.c:200 #12 0x557cf59d642c in main ../../source3/utils/smbpasswd.c:633 #13 0x7fc4419f5412 in __libc_start_main (/lib64/libc.so.6+0x24412) Signed-off-by: Swen Schillig <swen@linux.ibm.com> Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Aug 10 20:42:39 UTC 2019 on sn-devel-184
* s3:mdssvc: add noindex backendRalph Boehme2019-08-081-1/+1
| | | | | | | | | | | | | | Add a new default backend that, while allowing mdsvc RPC and search queries from clients, always returns no results. Shares using this backend will behave the same way as shares on a macOS SMB server where indexing is disabled. This change will later also allow us to compile the Spotlight RPC service by default which is a big step in the direction of adding tests to CI. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s3:mdssvc: new option "spotlight backend"Ralph Boehme2019-08-081-0/+1
| | | | | | | | Currently there's only the tracker backend, but subsequent commits will add other backends. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s3/param: clang: Fix 'Value stored to 'bRetval' is never read'Noel Power2019-07-161-3/+0
| | | | | | | | | | | | | | | Fixes: source3/param/loadparm.c:2770:2: warning: Value stored to 'bRetval' is never read <--[clang] bRetval = false; ^ ~~~~~ source3/param/loadparm.c:3868:2: warning: Value stored to 'bRetval' is never read <--[clang] bRetval = false; ^ ~~~~~ 2 warnings generated. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* docs/xml: change default for "mangled names" to "illegal"Ralph Boehme2019-07-081-1/+1
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* docs-xml: change "client min protocol" to SMB2_02Stefan Metzmacher2019-07-081-1/+1
| | | | | | | It's time to disable SMB1 by default... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* docs-xml: change "server min protocol" to SMB2_02Stefan Metzmacher2019-07-081-1/+1
| | | | | | | | SMB2_02 was available with Windows Vista. It's time to turn SMB1 off by default. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* param: change default of "allocation roundup size" to 0Björn Jacke2019-07-071-1/+0
| | | | | Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org>
* s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundaryShyamsunder Rathi2019-05-161-3/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | For FS_VOLUME_INFO/FS_INFO operation, a maximum of 32 characters are sent back. However, since Samba chops off any share name with >32 bytes at 32, it is possible that a multi-byte share name can get chopped off between a full character. This causes the string decoding for unicode failure which sends back NT_STATUS_ILLEGAL_CHARACTER (EILSEQ) to the client applications. On Windows, Notepad doesn't like it, and refuses to open a file in this case and fails with the following error: Invalid character. For multibyte character sets, only the leading byte is included without the trailing byte. For Unicode character sets, include the characters 0xFFFF and 0xFFFE. Proposed fix: - Find the last starting point of a multibyte codepoint if the character at 32nd byte is a subsequent byte of a MB codepoint. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13947 Signed-off-by: Shyamsunder Rathi <shyam.rathi@nutanix.com> Reviewed-by: Hemanth Thummala <hemanth.thummala@nutanix.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3: squash 'cast between incompatible function types' warningNoel Power2019-05-161-1/+1
| | | | | | | | | | | | | Some functions (e.g. py_smb_savefile) have an extra unecessary *kwargs param in their signatures, these definitions are causing 'cast between incompatible function types' warnings when compiled with -Wcast-function-type. Some other functions have the *kwargs which causes "cast between incompatible function types' warnings which need to be squashed with use of the PY_DISCARD_FUNC_SIG macro. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org>
* smbd: Move deadtime default to parameter definition and man pageChristof Schmitt2019-05-011-1/+1
| | | | | | | | | | The code has a default of one week (10080 minutes) if the parameter is set to 0. Make this the public default of the parameter, instead of hiding it in the code. This change also has the code match the documentation that setting this parameter to 0 disables the check. Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* memcache: Increase size of default memcache to 512kChristof Schmitt2019-04-061-1/+1
| | | | | | | | | | | With the fixed accounting of talloc objects, the default cache size needs to increase. The exact increase required depends on the workloads, going form 256k to 512k seems like a reasonable guess. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13865 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* build: Remove bld.gen_python_environments()Andrew Bartlett2019-03-211-3/+2
| | | | | | | This was part of --extra-python support. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* web_server: Remove the web port smb.conf parameterGarming Sam2019-03-071-2/+0
| | | | | | | | With the removal of the web server, there are not any users of this parameter and so should just be removed. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
* s3:param: Use C99 initializer for poptOption in test_lp_loadAndreas Schneider2019-01-281-2/+8
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* docs-xml: add "smbd getinfo ask sharemode"Ralph Boehme2018-12-061-0/+1
| | | | | | | Counterpart for "smbd search ask sharemode" for getinfo. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* docs-xml: add "smbd search ask sharemode"Ralph Boehme2018-12-061-0/+1
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s3:smbd: Make sure we do not export "/" (root) as home dirAndreas Schneider2018-12-051-1/+5
| | | | | | | | | If "/" (root) is returned as the home directory, prevent exporting it. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13699 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Böhme <slow@samba.org>
View Lorry Controller Status