CVE-2016-2113: docs-xml: let "tls verify peer" default to "as_strict_as_possible"

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

diff --git a/docs-xml/smbdotconf/security/tlsverifypeer.xml b/docs-xml/smbdotconf/security/tlsverifypeer.xml
index ce6897d3d93de8176412233da583adef98de3af5..4f47dd4db0d32dd971b5f0a7e8eb19ca05c0c4eb 100644 (file)
--- a/docs-xml/smbdotconf/security/tlsverifypeer.xml
+++ b/docs-xml/smbdotconf/security/tlsverifypeer.xml
@@ -41,11 +41,7 @@
        <smbconfoption name="tls crl file"/> needs to be configured.
        Future versions of Samba may implement additional checks.
        </para>
-
-       <para>Note that the default is likely to change from
-       <constant>no_check</constant> to <constant>as_strict_as_possible</constant>
-       with Samba 4.5.</para>
 </description>
 
-<value type="default">no_check</value>
+<value type="default">as_strict_as_possible</value>
 </samba:parameter>

diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index 0730d514da59677de9406355bdce4a1a2aadbc7d..f6c2cfb86918a1b3fee7e4097703980130430509 100644 (file)
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -2554,7 +2554,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
        lpcfg_do_global_parameter(lp_ctx, "min wins ttl", "21600");
 
        lpcfg_do_global_parameter(lp_ctx, "tls enabled", "True");
-       lpcfg_do_global_parameter(lp_ctx, "tls verify peer", "no_check");
+       lpcfg_do_global_parameter(lp_ctx, "tls verify peer", "as_strict_as_possible");
        lpcfg_do_global_parameter(lp_ctx, "tls keyfile", "tls/key.pem");
        lpcfg_do_global_parameter(lp_ctx, "tls certfile", "tls/cert.pem");
        lpcfg_do_global_parameter(lp_ctx, "tls cafile", "tls/ca.pem");

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index f5d5c53dc5790667f2184318db780951c3543e53..ee890b0aa49671d27bae0c4204b3468ec0fbeb6d 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -834,7 +834,7 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)
        Globals.dcerpc_endpoint_servers = (const char **)str_list_make_v3(NULL, "epmapper wkssvc rpcecho samr netlogon lsarpc spoolss drsuapi dssetup unixinfo browser eventlog6 backupkey dnsserver", NULL);
 
        Globals.tls_enabled = true;
-       Globals.tls_verify_peer = TLS_VERIFY_PEER_NO_CHECK;
+       Globals.tls_verify_peer = TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE;
 
        lpcfg_string_set(Globals.ctx, &Globals._tls_keyfile, "tls/key.pem");
        lpcfg_string_set(Globals.ctx, &Globals._tls_certfile, "tls/cert.pem");