Ralph Boehme 6ae63d42f5 s3/smbd: ensure global "smb encrypt = off" is effective for SMB 3.1.1 clients ...

If encryption is disabled globally, per definition we shouldn't allow
enabling encryption on individual shares.

The behaviour of setting

[Global]
  smb encrypt = off

[share]
  smb encrypt = required

must be to completely deny access to the share "share".

This was working correctly for clients when using SMB 3 dialects <
3.1.1, but not for 3.1.1 with a negprot encryption context.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

2017-01-27 22:00:17 +01:00

..

auth

auth: Remove auth_wbc

2017-01-09 14:34:11 +01:00

build

waf: improve iconv checks

2014-01-03 05:04:44 +01:00

client

s3:client: don't use cli->use_kerberos && cli->got_kerberos_mechanism in smbspool.c

2017-01-27 08:09:15 +01:00

exports

…

groupdb

Update smbrun to allow for settings environment variables.

2016-10-13 04:26:26 +02:00

include

s3:libsmb: use a local got_kerberos_mechanism variable in cli_session_creds_prepare_krb5()

2017-01-27 08:09:15 +01:00

intl

lang_tdb: don't leak lock_path or data_path onto talloc tos

2014-11-03 23:46:05 +01:00

lib

s3/lib: Use ms_fnmatch_protocol in mask_match

2017-01-22 18:30:12 +01:00

libads

libads: Use "all_zero" where appropriate

2017-01-03 16:04:28 +01:00

libgpo

libgpo: apply some const.

2017-01-06 12:28:19 +01:00

libnet

libnet: Use "all_zero" where appropriate

2017-01-03 16:04:28 +01:00

librpc

librpc: Use "all_zero" where appropriate

2017-01-03 16:04:28 +01:00

libsmb

s3:libsmb: use a local got_kerberos_mechanism variable in cli_session_creds_prepare_krb5()

2017-01-27 08:09:15 +01:00

locale

s3: fix encryption help messages

2015-12-22 02:22:50 +01:00

locking

s3/locking: Avoid a talloc for nonexisting fetch_share_mode_unlocked

2017-01-22 18:30:11 +01:00

modules

vfs_default: unlock the right file in copy chunk

2017-01-21 17:00:54 +01:00

nmbd

nmbd: xfile->stdio

2016-12-11 11:17:24 +01:00

param

rpc_server: Allow to configure the port range for RPC services

2017-01-27 08:09:15 +01:00

passdb

passdb: Remove pdb_wbc_sam

2017-01-09 18:15:19 +01:00

printing

s3-spoolss: Fix architecture handling in spoolss_DeletePrinterDriverEx call

2017-01-12 15:35:13 +01:00

profile

s3-profile: reduce dependencies of smbprofile.h

2016-03-28 20:45:16 +02:00

registry

werror: replace WERR_OBJECT_PATH_INVALID with WERR_BAD_PATHNAME in source3/registry/reg_api_regf.c

2016-09-28 00:04:24 +02:00

rpc_client

spoolss: allow truncated driver version in spoolss_driver_version_to_qword()

2017-01-12 15:35:13 +01:00

rpc_server

rpc_server: Allow to configure the port range for RPC services

2017-01-27 08:09:15 +01:00

rpcclient

s3:popt_common: let POPT_COMMON_CREDENTIALS imply logfile and conffile loading

2016-12-20 01:11:25 +01:00

script

s3:tests: Set missing directories for test_registry_upgrade.sh

2016-11-16 00:20:06 +01:00

selftest

selftest/Samba3: use "server min protocol = SMB3_00" for "ktest"

2017-01-27 12:03:39 +01:00

services

Update smbrun to allow for settings environment variables.

2016-10-13 04:26:26 +02:00

smbd

s3/smbd: ensure global "smb encrypt = off" is effective for SMB 3.1.1 clients

2017-01-27 22:00:17 +01:00

torture

lib: Add lib/util/server_id.h

2017-01-22 18:30:11 +01:00

utils

lib: Add lib/util/server_id.h

2017-01-22 18:30:11 +01:00

web

swat: Remove swat.

2013-05-18 16:32:38 +02:00

winbindd

winbind: Don't add duplicate IDs in wbinfo -r

2017-01-24 02:36:19 +01:00

.clang_complete

lib: Remove tdb_compat

2015-03-17 11:30:52 +01:00

.dmallocrc

…

.indent.pro

…

change-log

…

Doxyfile

…

mainpage.dox

…

smbadduser.in

…

wscript

passdb: Remove pdb_wbc_sam

2017-01-09 18:15:19 +01:00

wscript_build

wscript: remove executable bits for all wscript* files

2017-01-11 20:21:01 +01:00

wscript_configure_system_ncurses

Transition to waf 1.8: wrapped conf.check_cfg

2015-03-16 03:00:07 +01:00