summaryrefslogtreecommitdiff
path: root/lib/param
AgeCommit message (Collapse)AuthorFilesLines
2025-08-22param: Add "client smb encryption over quic"Volker Lendecke1-0/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-08-22smbd: Add the "server smb encryption over quic" parameterVolker Lendecke1-0/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-08-22param: Fix whitespaceVolker Lendecke1-8/+8
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-07-17lib/param: allow smb_transport[s]_parse() to handle 'quic'Stefan Metzmacher1-0/+3
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-18docs-xml/smbdotconf: change 'smb ports' into a synonym for 'server smb ↵Stefan Metzmacher2-44/+0
transport' Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-04-18docs-xml/smbdotconf: add 'server smb transport' optionStefan Metzmacher1-0/+10
In the next commits 'smb ports' will become just a synonym for 'server smb transport'... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-04-18docs-xml/smbdotconf: add 'client smb transports' optionStefan Metzmacher2-0/+139
This will replace the use of 'smb ports' for source4 clients. In future it will be used for all smb client connections and it will allow to add other transports as 'quic' or 'smbdirect. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-03-07docs-xml: enable SMB3 Unix Extensions by defaultRalph Boehme1-0/+2
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Fri Mar 7 20:06:31 UTC 2025 on atb-devel-224
2025-02-22docs-xml/smbdotconf: add ft_scanner to 'server service'Stefan Metzmacher1-1/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-01-13docs-xml/smbdotconf: add "client use krb5 netlogon" optionStefan Metzmacher3-0/+26
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-01-02specify some deps on private libs actually used directlyMichael Tokarev1-1/+1
Lots of samba libraries has incomplete dependencies listed in wscript files. This usually is not a problem since the link line includes dependencies of their dependencies of their dependencies, and somewhere down that line all immediate dependencies which are missing are actually present. But sometimes this becomes a problem when a library does not declare direct dependency on at least one private library which it actually uses: in case no private library is listed as direct dependency, private library directory is not put into RUNPATH of the resulting binary, so the binary can not find its own dependencies. Fix a few such places, including some libraries which are a part of public abi (libsmbldap, libndr). Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-11-11param: Add "client netlogon ping protocol"Volker Lendecke2-0/+16
Allow "net ads join" in environments where UDP/389 is blocked. Code will follow. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11param: Remove parameter "cldap port"Volker Lendecke1-1/+0
This was not used consistently across all of our code base, and I don't see a reason why this should ever not be port 389. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-05smbd: add option "smb3 directory leases"Ralph Boehme1-0/+2
By default enabled on non-clustered Samba, disabled on clustered Samba, the reason being the expected additional load caused by forcing strict rename to be enabled. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-10-23Isolate hsm auth value from the cacheDavid Mulder1-0/+3
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2024-10-23Add lp Rust bindingsDavid Mulder1-0/+8
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2024-08-21docs-xml: add 'vfs mkdir use tmp name' optionStefan Metzmacher1-0/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15693 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2024-08-21lib/param: Don't treat a missing include file as an error in handle_include().Pavel Filipenský1-1/+1
Same fix as in commit 09d7690 'samba-tool domain provision -d10' fails if the included file does not exist: lpcfg_load: refreshing parameters from /etc/samba/smb.conf Processing section "[global]" Can't find include file /etc/samba/usershares.conf pm_process() returned No ERROR: Unable to load default file File "/usr/lib64/python3.12/site-packages/samba/netcmd/domain/provision.py", line 183, in run lp = sambaopts.get_loadparm() ^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.12/site-packages/samba/getopt.py", line 282, in get_loadparm self._lp.load_default() Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net> Autobuild-User(master): Martin Schwenke <martins@samba.org> Autobuild-Date(master): Wed Aug 21 00:04:19 UTC 2024 on atb-devel-224
2024-07-16lib:param: Add missing return code checkAndreas Schneider1-0/+3
"Error: NEGATIVE_RETURNS (CWE-394): samba-4.20.0rc2/lib/param/loadparm.c:1275: negative_return_fn: Function ""lpcfg_map_parameter(""printing"")"" returns a negative number. samba-4.20.0rc2/lib/param/loadparm.c:1275: assign: Assigning: ""parm_num"" = ""lpcfg_map_parameter(""printing"")"". samba-4.20.0rc2/lib/param/loadparm.c:1278: negative_returns: Using variable ""parm_num"" as an index to array ""parm_table"". 1276| } 1277| 1278|-> if (!lp_set_enum_parm(&parm_table[parm_num], pszParmValue, (int*)ptr)) { 1279| return false; 1280| }" Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2024-05-22docs-xml: Add smb.conf option 'dns hostname'Andreas Schneider1-0/+37
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23smbdotconf: finally remove unused "client use spnego principal" optionStefan Metzmacher1-1/+0
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23smbdotconf: add client ldap sasl wrapping = {starttls,ldaps}Stefan Metzmacher1-0/+2
In order to use SASL authentitation within a TLS connection we now provide "client ldap sasl wrapping = starttls" or "client ldap sasl wrapping = ldaps". Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:ldap_server: add support for tls channel bindingsStefan Metzmacher2-0/+3
ldap server require strong auth = allow_sasl_over_tls is now an alias for 'allow_sasl_without_tls_channel_bindings' and should be avoided and changed to 'yes' or 'allow_sasl_without_tls_channel_bindings'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-15smbdotconf: Enable "winbind debug traceid" by defaultPavel Filipenský1-0/+1
The traceid debug header field is a useful feature, let's make it default. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15631 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org> Autobuild-Date(master): Mon Apr 15 18:47:41 UTC 2024 on atb-devel-224
2023-12-15VERSION: move COPYRIGHT_STARTUP_MESSAGE as SAMBA_COPYRIGHT_STRING into version.hStefan Metzmacher1-0/+1
We also prodive a samba_copyright_string() helper similar to samba_version_string(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=15377 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Björn Jacke <bjacke@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Dec 15 10:44:42 UTC 2023 on atb-devel-224
2023-10-25lib:param: Set a memory context for the globals if not initialized yetAndreas Schneider2-1/+14
Typically once the smb.conf starts to be loaded, loadparm_s3_init_globals() will be called and a memory context for strings on the static Globals will be created. But we might call lpcfg_set_cmdline() before we load the smb.conf file, so we (via a helper pointer) call loadparm_s3_init_globals() to get that initialisation done earlier, ensuring that all allocations on Globals is done on a memory context that we can later TALLOC_FREE() before exit(). Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-10CVE-2023-42669 s4-rpc_server: Disable rpcecho server by defaultAndrew Bartlett1-1/+1
The rpcecho server is useful in development and testing, but should never have been allowed into production, as it includes the facility to do a blocking sleep() in the single-threaded rpc worker. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15474 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26docs-xml: Add new parameter "acl claims evaluation"Andrew Bartlett3-0/+16
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-09-25lib: Avoid a tdb handle leakVolker Lendecke1-0/+5
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2023-09-25lib: Modernize tdb_fetch_lifetime()Volker Lendecke1-24/+31
Just came across this, avoid mallocs. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2023-06-21docs-xml/smbdotconf: also allow 2012[_R2] for 'ad dc functional level'Stefan Metzmacher1-0/+2
We may not jump to 2016 directly... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-14param: Remove reference to unrecognized parameter ‘directory name cache ↵Joseph Sutton1-2/+0
size’ This parameter was removed in commit c37d6be2db8ee30d632275e7b1c156a8b5d791a7. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16param: Add new parameter "ad dc functional level"Andrew Bartlett2-0/+11
This allows the new unsupported functional levels to be unlocked, but with an smb.conf option that is easily seen. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-04-25Add ROLE_IPA_DC into two more placesAlexander Bokovoy1-0/+1
Missed two more places originally when introduced ROLE_IPA_DC. Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Alexander Bokovoy <ab@samba.org> Autobuild-Date(master): Tue Apr 25 07:46:36 UTC 2023 on atb-devel-224
2023-04-11lib:param: Fix code spellingAndreas Schneider3-6/+6
Best reviewed with: `git show --word-diff`. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-04-06lib/util: Add "debug syslog format = always", which logs to stdout in syslog ↵Andrew Bartlett1-0/+12
style Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-04-05CVE-2023-0922 set default ldap client sasl wrapping to sealRob van der Linde1-1/+1
This avoids sending new or reset passwords in the clear (integrity protected only) from samba-tool in particular. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15315 Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Apr 5 03:08:51 UTC 2023 on atb-devel-224
2023-01-27s3:lib: Change file_modtime() to return an error code and a struct timespec.Jeremy Allison1-8/+2
Removes need for external stat() code when checking for timechange. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Jan 27 08:30:35 UTC 2023 on atb-devel-224
2023-01-26param: Use a higher time resolution for lp_file_list_changed()Andreas Schneider2-7/+11
It is possible that in our test environment one of the config 'include' files change more than once per second. To avoid missing a file update we use a higher time resolution than seconds. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-26lib:param: Remove trailing whitespaces from loadparm.cAndreas Schneider1-6/+6
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2022-12-16s3-librpc: add ads.idl and convert ads_struct to talloc.Günther Deschner2-11/+1
Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-13CVE-2022-37966 param: Add support for new option "kdc supported enctypes"Stefan Metzmacher1-0/+69
This allows admins to disable enctypes completely if required. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 param: let "kdc default domain supportedenctypes = 0" mean ↵Stefan Metzmacher1-4/+0
the default In order to allow better upgrades we need the default value for smb.conf to the same even if the effective default value of the software changes in future. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 param: don't explicitly initialize "kdc force enable rc4 weak ↵Stefan Metzmacher1-4/+0
session keys" to false/"no" This is not squashed in order to allow easier backports... BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 param: Add support for new option "kdc force enable rc4 weak ↵Andrew Bartlett1-0/+4
session keys" Pair-Programmed-With: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-13CVE-2022-37966 param: Add support for new option "kdc default domain ↵Joseph Sutton1-0/+79
supportedenctypes" This matches the Windows registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\KDC\DefaultDomainSupportedEncTypes BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-13CVE-2022-38023 docs-xml/smbdotconf: add "server schannel require ↵Stefan Metzmacher1-0/+1
seal[:COMPUTERACCOUNT]" options BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2022-12-13CVE-2022-38023 docs-xml/smbdotconf: change 'reject md5 clients' default to yesStefan Metzmacher1-0/+1
AES is supported by Windows Server >= 2008R2, Windows (Client) >= 7 and Samba >= 4.0, so there's no reason to allow md5 clients by default. However some third party domain members may need it. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2022-12-13CVE-2022-38023 docs-xml/smbdotconf: change 'reject md5 servers' default to yesStefan Metzmacher1-0/+1
AES is supported by Windows >= 2008R2 and Samba >= 4.0 so there's no reason to allow md5 servers by default. Note the change in netlogon_creds_cli_context_global() is only cosmetic, but avoids confusion while reading the code. Check with: git show -U35 libcli/auth/netlogon_creds_cli.c BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2022-06-26dsdb: Allow password history and password changes without an NT hashAndrew Bartlett3-0/+15
We now allow this to be via the ENCTYPE_AES256_CTS_HMAC_SHA1_96 hash instead which allows us to decouple Samba from the unsalted NT hash for organisations that are willing to take this step (for user accounts). (History checking is limited to the last three passwords only, as ntPwdHistory is limited to NT hash values, and the PrimaryKerberosCtr4 package only stores three sets of keys.) Since we don't store a salt per-key, but only a single salt, the check will fail for a previous password if the account was renamed prior to a newer password being set. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-10 12:52:35 +0000