Changeset 920 for trunk/server/source3/param/loadparm.c

Timestamp:

Jun 9, 2016, 2:23:12 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: apply latest security patches to trunk

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/param/loadparm.c (modified) (18 diffs)

trunk/server/source3/param/loadparm.c

@@ -65 +65 @@
 #include "dbwrap.h"
 #include "smbldap.h"
+#include "../lib/util/bitmap.h"
 
 #ifdef HAVE_SYS_SYSCTL_H
@@ -219 +220 @@
         bool bWinbindRefreshTickets;
         bool bWinbindOfflineLogon;
+        bool bWinbindSealedPipes;
         bool bWinbindNormalizeNames;
         bool bWinbindRpcOnly;
@@ -340 +342 @@
         bool bLanmanAuth;
         bool bNTLMAuth;
+        bool bRawNTLMv2Auth;
         bool bUseSpnego;
         bool bClientLanManAuth;
@@ -357 +360 @@
         bool bHostnameLookups;
         bool bUnixExtensions;
+        bool bAllowDcerpcAuthLevelConnect;
         bool bDisableNetbios;
         char * szDedicatedKeytabFile;
@@ -369 +373 @@
         int name_cache_timeout;
         int client_signing;
+        int client_ipc_signing;
         int server_signing;
         int client_ldap_sasl_wrapping;
@@ -1387 +1392 @@
         },
         {
+                .label          = "raw NTLMv2 auth",
+                .type           = P_BOOL,
+                .p_class        = P_GLOBAL,
+                .ptr            = &Globals.bRawNTLMv2Auth,
+                .special        = NULL,
+                .enum_list      = NULL,
+                .flags          = FLAG_ADVANCED,
+        },
+        {
                 .label          = "client NTLMv2 auth",
                 .type           = P_BOOL,
@@ -2295 +2309 @@
         },
         {
+                .label          = "allow dcerpc auth level connect",
+                .type           = P_BOOL,
+                .p_class        = P_GLOBAL,
+                .ptr            = &Globals.bAllowDcerpcAuthLevelConnect,
+                .special        = NULL,
+                .enum_list      = NULL,
+                .flags          = FLAG_ADVANCED,
+        },
+        {
                 .label          = "use spnego",
                 .type           = P_BOOL,
@@ -2308 +2331 @@
                 .p_class        = P_GLOBAL,
                 .ptr            = &Globals.client_signing,
+                .special        = NULL,
+                .enum_list      = enum_smb_signing_vals,
+                .flags          = FLAG_ADVANCED,
+        },
+        {
+                .label          = "client ipc signing",
+                .type           = P_ENUM,
+                .p_class        = P_GLOBAL,
+                .ptr            = &Globals.client_ipc_signing,
                 .special        = NULL,
                 .enum_list      = enum_smb_signing_vals,
@@ -4754 +4786 @@
                 .p_class        = P_GLOBAL,
                 .ptr            = &Globals.bWinbindOfflineLogon,
+                .special        = NULL,
+                .enum_list      = NULL,
+                .flags          = FLAG_ADVANCED,
+        },
+        {
+                .label          = "winbind sealed pipes",
+                .type           = P_BOOL,
+                .p_class        = P_GLOBAL,
+                .ptr            = &Globals.bWinbindSealedPipes,
                 .special        = NULL,
                 .enum_list      = NULL,
@@ -5381 +5422 @@
         Globals.bLanmanAuth = False;    /* Do NOT use the LanMan hash, even if it is supplied */
         Globals.bNTLMAuth = True;       /* Do use NTLMv1 if it is supplied by the client (otherwise NTLMv2) */
+        Globals.bRawNTLMv2Auth = false; /* Allow NTLMv2 without NTLMSSP */
         Globals.bClientNTLMv2Auth = True; /* Client should always use use NTLMv2, as we can't tell that the server supports it, but most modern servers do */
         /* Note, that we will also use NTLM2 session security (which is different), if it is available */
+
+        Globals.bAllowDcerpcAuthLevelConnect = false; /* we don't allow this by default */
 
         Globals.map_to_guest = 0;       /* By Default, "Never" */
@@ -5425 +5469 @@
         Globals.ldap_debug_threshold = 10;
 
+        Globals.client_ldap_sasl_wrapping = ADS_AUTH_SASL_SIGN;
+
         /* This is what we tell the afs client. in reality we set the token 
          * to never expire, though, when this runs out the afs client will 
@@ -5489 +5535 @@
         Globals.bWinbindRefreshTickets = False;
         Globals.bWinbindOfflineLogon = False;
+        Globals.bWinbindSealedPipes = True;
 
         Globals.iIdmapCacheTime = 86400 * 7; /* a week by default */
@@ -5501 +5548 @@
 
         Globals.client_signing = Auto;
+        Globals.client_ipc_signing = Required;
         Globals.server_signing = False;
 
@@ -5754 +5802 @@
 FN_GLOBAL_STRING(lp_check_password_script, &Globals.szCheckPasswordScript)
 
+FN_GLOBAL_BOOL(lp_allow_dcerpc_auth_level_connect, &Globals.bAllowDcerpcAuthLevelConnect)
 FN_GLOBAL_STRING(lp_wins_hook, &Globals.szWINSHook)
 FN_GLOBAL_CONST_STRING(lp_template_homedir, &Globals.szTemplateHomedir)
@@ -5767 +5816 @@
 FN_GLOBAL_BOOL(lp_winbind_refresh_tickets, &Globals.bWinbindRefreshTickets)
 FN_GLOBAL_BOOL(lp_winbind_offline_logon, &Globals.bWinbindOfflineLogon)
+FN_GLOBAL_BOOL(lp_winbind_sealed_pipes, &Globals.bWinbindSealedPipes)
 FN_GLOBAL_BOOL(lp_winbind_normalize_names, &Globals.bWinbindNormalizeNames)
 FN_GLOBAL_BOOL(lp_winbind_rpc_only, &Globals.bWinbindRpcOnly)
@@ -5863 +5913 @@
 FN_GLOBAL_BOOL(lp_lanman_auth, &Globals.bLanmanAuth)
 FN_GLOBAL_BOOL(lp_ntlm_auth, &Globals.bNTLMAuth)
+FN_GLOBAL_BOOL(lp_raw_ntlmv2_auth, &Globals.bRawNTLMv2Auth)
 FN_GLOBAL_BOOL(lp_client_plaintext_auth, &Globals.bClientPlaintextAuth)
 FN_GLOBAL_BOOL(lp_client_lanman_auth, &Globals.bClientLanManAuth)
@@ -6101 +6152 @@
 FN_GLOBAL_INTEGER(lp_name_cache_timeout, &Globals.name_cache_timeout)
 FN_GLOBAL_INTEGER(lp_client_signing, &Globals.client_signing)
+FN_GLOBAL_INTEGER(lp_client_ipc_signing, &Globals.client_ipc_signing)
 FN_GLOBAL_INTEGER(lp_server_signing, &Globals.server_signing)
 FN_GLOBAL_INTEGER(lp_client_ldap_sasl_wrapping, &Globals.client_ldap_sasl_wrapping)
@@ -9753 +9805 @@
         }
 #endif
+
+        if (!lp_is_in_client()) {
+                switch (lp_client_ipc_signing()) {
+                case Required:
+                        lp_set_cmdline("client signing", "mandatory");
+                        break;
+                case Auto:
+                        lp_set_cmdline("client signing", "auto");
+                        break;
+                case False:
+                        lp_set_cmdline("client signing", "disabled");
+                        break;
+                }
+        }
+
         init_iconv();