From 8ee232f2dc40d15713acd40b3fa5177925ab6d61 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Tue, 15 Mar 2016 23:52:30 +0100 Subject: [PATCH] CVE-2016-2115: docs-xml: always default "client ipc signing" to "mandatory" BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756 Signed-off-by: Stefan Metzmacher Reviewed-by: Alexander Bokovoy --- docs-xml/smbdotconf/security/clientipcsigning.xml | 11 +---------- lib/param/loadparm.c | 6 +----- source3/param/loadparm.c | 6 +----- 3 files changed, 3 insertions(+), 20 deletions(-) diff --git a/docs-xml/smbdotconf/security/clientipcsigning.xml b/docs-xml/smbdotconf/security/clientipcsigning.xml index d976f2dc00e..0881c6c020e 100644 --- a/docs-xml/smbdotconf/security/clientipcsigning.xml +++ b/docs-xml/smbdotconf/security/clientipcsigning.xml @@ -11,16 +11,7 @@ and disabled. - The default value is the same as the effective value of - if the effective value of - is - NT1. In any other case the default value is - mandatory. - - Note that the default value will be changed to mandatory - in all cases for Samba 4.5 - - When the effective value of this option is mandatory, SMB signing is required. + When set to mandatory or default, SMB signing is required. When set to auto, SMB signing is offered, but not enforced and if set to disabled, SMB signing is not offered either. diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index b2159b6d9c9..8c2a3714801 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -3212,11 +3212,7 @@ int lpcfg_client_ipc_signing(struct loadparm_context *lp_ctx) { int client_ipc_signing = lpcfg__client_ipc_signing(lp_ctx); if (client_ipc_signing == SMB_SIGNING_DEFAULT) { - int ipc_min_protocol = lpcfg_client_ipc_min_protocol(lp_ctx); - if (ipc_min_protocol >= PROTOCOL_SMB2_02) { - return SMB_SIGNING_REQUIRED; - } - return lpcfg_client_signing(lp_ctx); + return SMB_SIGNING_REQUIRED; } return client_ipc_signing; } diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 09dc217315e..cfbc196bcbe 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -4362,11 +4362,7 @@ int lp_client_ipc_signing(void) { int client_ipc_signing = lp__client_ipc_signing(); if (client_ipc_signing == SMB_SIGNING_DEFAULT) { - int ipc_min_protocol = lp_client_ipc_min_protocol(); - if (ipc_min_protocol >= PROTOCOL_SMB2_02) { - return SMB_SIGNING_REQUIRED; - } - return lp_client_signing(); + return SMB_SIGNING_REQUIRED; } return client_ipc_signing; } -- 2.47.2