1
0
mirror of https://github.com/samba-team/samba.git synced 2025-07-29 15:42:04 +03:00
Commit Graph

1980 Commits

Author SHA1 Message Date
8a0a7359fa s3: smbd: Quiet log messages from usershares for an unknown share.
No need to log missing shares/sharenames at debug level zero.

Keep the debug level zero for all other usershare problems.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14590

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Rowland penny <rpenny@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Dec  4 20:54:06 UTC 2020 on sn-devel-184
2020-12-04 20:54:06 +00:00
ccb7d44482 loadparm: Simplify lp_get_async_dns_timeout()
Use MAX, and per README.Coding we don't need the intermediate
variable. This can be inspected in the debugger directly.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-11-30 22:24:37 +00:00
7b52c2db26 s3:param:service - ensure registry shares loaded before home check
Registry shares should be loaded and checked prior to checking home
directories. This ensures that an explicitly defined service takes
priority over home directories (same behavior as non-registry shares).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14543

Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Jeremy Alison <jra@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Oct 22 00:30:38 UTC 2020 on sn-devel-184
2020-10-22 00:30:38 +00:00
d4d8218b96 s3:include: Move loadparm prototypes to own header file
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-09 19:16:46 +00:00
c2ac923c6a s3: safe_string: do not include string_wrappers.h
Rather than have safe_string.h #include string_wrappers.h, make users of
string_wrappers.h include it explicitly.

includes.h now no longer includes string_wrappers.h transitively. Still
allow includes.h to #include safe_string.h for now so that as many
modules as possible get the safety checks in it.

Signed-off-by: Matthew DeVore <matvore@google.com>
Reviewed-by: David Mulder <dmulder@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-28 00:56:34 +00:00
5a733c3c1b docs-xml: Add 'client smb encrypt'
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-08-19 16:22:40 +00:00
58e31f7874 s3:smbd: Use 'enum smb_encryption_setting' values
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-08-19 16:22:40 +00:00
bd5a888746 param: Add 'server smb encrypt' parameter
And this also makes 'smb encrypt' a synonym of that.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-08-19 16:22:40 +00:00
32eb7f3966 Remove depracated "ldap ssl ads" smb.conf option
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14462

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Isaac Boukris <iboukris@samba.org>
Autobuild-Date(master): Tue Aug 11 10:53:05 UTC 2020 on sn-devel-184
2020-08-11 10:53:05 +00:00
8a140391d6 s3: Parameters. Add 'async dns timeout' parameter. Default to 10. Minimum value 1.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-08-07 06:34:37 +00:00
d308650145 tls: Use NORMAL:-VERS-SSL3.0 as the default configuration
This seems to be really broken in GnuTLS and the documentation is also
not correct.

This partially reverts 53e3a959b9

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14408

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul  1 14:56:33 UTC 2020 on sn-devel-184
2020-07-01 14:56:33 +00:00
53e3a959b9 s3:lib:tls: Use better priority lists for modern GnuTLS
We should use the default priority list. That is a good practice,
because TLS protocol hardening and phasing out of legacy algorithms,
is easier to co-ordinate when happens at a single place. See crypto
policies of Fedora.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14408

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jun 17 17:42:02 UTC 2020 on sn-devel-184
2020-06-17 17:42:02 +00:00
13a2f70a4d Fix clang 9 missing-field-initializer warnings
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-05-08 09:31:31 +00:00
3149ea0a8a CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decode
Add search request size limits to ldap_decode calls.

The ldap server uses the smb.conf variable
"ldap max search request size" which defaults to 250Kb.
For cldap the limit is hard coded as 4096.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-05-04 02:59:32 +00:00
d7e5213818 CVE-2020-10704: smb.conf: Add max ldap request sizes
Add two new smb.conf parameters to control the maximum permitted ldap
request size.

Adds:
   ldap max anonymous request size       default 250Kb
   ldap max authenticated request size   default 16Mb

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-05-04 02:59:32 +00:00
7d09c1cc87 lib:param: Add lp(cfg)_weak_crypto()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-03-19 20:46:41 +00:00
4d4443d1e5 loadparm: check for AD DC required VFS modules
When Samba is running as a domain controller and the "vfs objects"
parameter is not set, then the dfs_samba4 and acl_xattr modules are
automatically enabled.
However, if the "vfs objects" is defined, then the setting is left
as-is. This means that attempts to us other VFS modules have the side
effect of disabling the dfs_samba4 and acl_xattr modules, causing
unexpected behaviour, which is then blamed on the VFS modules that were
explicitly defined.

This change ensures that when running as a domain controller, Samba logs
an error if the required VFS modules are not enabled by an explicit
"vfs objects" definition.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10560

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Björn Jacke <bjacke@samba.org>
2020-01-03 20:55:29 +00:00
61b86d30d0 smbd: Make lp_use_sendfile() static to reply.c
This is the only place where it's used. Also, via
smb_signing_is_active it pulls in the dependency on
'cli_smb_common' (which pulls in all of gensec) into the 'smbconf'
library. Without this, 'smbconf' is happy with just 'samba-hostconfig'
instead of 'cli_smb_common'

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-12-08 20:24:31 +00:00
5114f73ea7 param: remove now unused lp_string()
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:38 +00:00
31b06f412e param: remove FN_LOCAL_STRING
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:37 +00:00
b5c6964a50 s3:param: make "servicename" a substituted option
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:37 +00:00
3e81d9460b param: remove now unused FN_GLOBAL_STRING macro
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:37 +00:00
6f618b7c95 smbdotconf: mark "ldap user suffix" with constant="1"
Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned
directly, variable substitution isn't supported anyway, so we can just mark this
const.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:37 +00:00
9ed8292a7b smbdotconf: mark "ldap machine suffix" with constant="1"
Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned
directly, variable substitution isn't supported anyway, so we can just mark this
const.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:37 +00:00
b48d30e0e1 smbdotconf: mark "ldap idmap suffix" with constant="1"
Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned
directly, variable substitution isn't supported anyway, so we can just mark this
const.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:37 +00:00
71e9c6e48b smbdotconf: mark "ldap group suffix" with constant="1"
Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned
directly, variable substitution isn't supported anyway, so we can just mark this
const.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:36 +00:00
2dae6473fa smbdotconf: mark "usershare path" with substitution="1"
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:36 +00:00
736cb9d80c smbdotconf: mark "defaultservice" with substitution="1"
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:34 +00:00
5e8d600bc6 smbdotconf: mark "auto services" with substitution="1"
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:34 +00:00
8445454008 s3:param: let lp_add_auto_services() take a const char *
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:33 +00:00
8834eafcac smbdotconf: mark "volume" with substitution="1"
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:33 +00:00
b98e1ad771 smbdotconf: mark "printername" with substitution="1"
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:33 +00:00
f7619ac22b smbdotconf: mark "path" with substitution="1"
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:33 +00:00
ef1f0e9ffe param: add FN_{GLOBAL,LOCAL}_SUBSTITUTED_STRING support
Pair-Programmed-With: Ralph Boehme <slow@samba.org>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
2019-11-27 10:25:32 +00:00
3215d357e6 s3:parm: remove unused lp_parm_talloc_string()
Callers should use lp_parm_substituted_string()
directly or just use lp_parm_const_string().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-11-27 10:25:32 +00:00
236857b434 s3:param: split out lp_parm_substituted_string()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-11-27 10:25:31 +00:00
063c4b25b1 s3:param: split out loadparm_s3_global_substitution from lp_string()
The idea is to get rid of the global state that's
currently used for the substitution in lp_string().

In the end all callers need to pass an explicit
const struct loadparm_substitution *sub_ctx,
which contains all relevant information
for the substitution. At that point lp_string() can be removed.

For now we provide loadparm_s3_global_substitution()
for callers to keep the current bahavior unchanged.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-11-27 10:25:31 +00:00
c36dd59318 s3:param: rename lp_string() argument ctx to mem_ctx
Minimizes diff of subsequent patch.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:31 +00:00
1f304fc16c sharesec: Return NTSTATUS from set_share_security
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-11-26 21:28:31 +00:00
3fea05e01f smbd: Remove write cache
Since this was written, our write path has changed significantly. In
particular we have gained very flexible support for async I/O, with the
linux io_uring in the pipeline. Caching stuff in main memory and then
doing a blocking pwrite nowadays does not belong into the core smbd
code. If someone wants it back, it should be doable in a VFS module.

Removes: "write cache size" parameter.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Nov 13 00:20:55 UTC 2019 on sn-devel-184
2019-11-13 00:20:55 +00:00
30e8f513a8 Detect when command line max protocol < min protocol
Due to the increased default minimum protocol
level to SMB2, some users notice that
specifying smbclient -m NT1 fails with
NT_STATUS_CONNECTION_DISCONNECTED, with no SMB
traffic on the wire. Report when the max protocol
is set less than the min protocol.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <npower@samba.org>

Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Tue Nov 12 17:52:28 UTC 2019 on sn-devel-184
2019-11-12 17:52:28 +00:00
b4816861f2 s4-dns: Deprecate BIND9_FLATFILE and remove "rndc command"
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Aug 22 21:24:00 UTC 2019 on sn-devel-184
2019-08-22 21:24:00 +00:00
9f193b747f loadparm: fix mem leak found by ASAN
==24948==ERROR: LeakSanitizer: detected memory leaks

Indirect leak of 232 byte(s) in 1 object(s) allocated from:
    #0 0x7fc44b971c08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
    #1 0x7fc44a2fe7b0 in __talloc_with_prefix ../../lib/talloc/talloc.c:782
    #2 0x7fc44a2fe7b0 in __talloc ../../lib/talloc/talloc.c:824
    #3 0x7fc44a2fe7b0 in _talloc_named_const ../../lib/talloc/talloc.c:981
    #4 0x7fc44a2fe7b0 in _talloc_array ../../lib/talloc/talloc.c:2764
    #5 0x7fc44a1239bc in str_list_make_v3 ../../lib/util/util_strlist_v3.c:58
    #6 0x7fc44a123e3b in str_list_make_v3_const ../../lib/util/util_strlist_v3.c:127
    #7 0x7fc44b14cc1a in init_globals ../../source3/param/loadparm.c:547
    #8 0x7fc44b14deef in lp_load_ex ../../source3/param/loadparm.c:3876
    #9 0x7fc44b14f97c in lp_load_initial_only ../../source3/param/loadparm.c:4025
    #10 0x7fc44b479235 in cmdline_messaging_context ../../source3/lib/cmdline_contexts.c:34
    #11 0x557cf59d642c in process_options ../../source3/utils/smbpasswd.c:200
    #12 0x557cf59d642c in main ../../source3/utils/smbpasswd.c:633
    #13 0x7fc4419f5412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Aug 10 20:42:39 UTC 2019 on sn-devel-184
2019-08-10 20:42:39 +00:00
c742ab7a4c s3:mdssvc: add noindex backend
Add a new default backend that, while allowing mdsvc RPC and search queries from
clients, always returns no results.

Shares using this backend will behave the same way as shares on a macOS SMB
server where indexing is disabled.

This change will later also allow us to compile the Spotlight RPC service by
default which is a big step in the direction of adding tests to CI.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-08 20:24:32 +00:00
1b897df4f7 s3:mdssvc: new option "spotlight backend"
Currently there's only the tracker backend, but subsequent commits will add
other backends.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-08 20:24:31 +00:00
4f61a9980d s3/param: clang: Fix 'Value stored to 'bRetval' is never read'
Fixes:

source3/param/loadparm.c:2770:2: warning: Value stored to 'bRetval' is never read <--[clang]
        bRetval = false;
        ^         ~~~~~
source3/param/loadparm.c:3868:2: warning: Value stored to 'bRetval' is never read <--[clang]
        bRetval = false;
        ^         ~~~~~
2 warnings generated.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-16 22:52:24 +00:00
bf5d5fd17c docs/xml: change default for "mangled names" to "illegal"
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-07-08 16:22:38 +00:00
3264b1f317 docs-xml: change "client min protocol" to SMB2_02
It's time to disable SMB1 by default...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-07-08 16:22:38 +00:00
840b8501b4 docs-xml: change "server min protocol" to SMB2_02
SMB2_02 was available with Windows Vista.
It's time to turn SMB1 off by default.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-07-08 16:22:37 +00:00
d6b8cbc8f7 param: change default of "allocation roundup size" to 0
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
2019-07-07 21:32:25 +00:00