1 /*
2 Unix SMB/CIFS implementation.
3 Parameter loading functions
4 Copyright (C) Karl Auer 1993-1998
5
6 Largely re-written by Andrew Tridgell, September 1994
7
8 Copyright (C) Simo Sorce 2001
9 Copyright (C) Alexander Bokovoy 2002
10 Copyright (C) Stefan (metze) Metzmacher 2002
11 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
12 Copyright (C) Michael Adam 2008
13 Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
14 Copyright (C) Andrew Bartlett 2011
15
16 This program is free software; you can redistribute it and/or modify
17 it under the terms of the GNU General Public License as published by
18 the Free Software Foundation; either version 3 of the License, or
19 (at your option) any later version.
20
21 This program is distributed in the hope that it will be useful,
22 but WITHOUT ANY WARRANTY; without even the implied warranty of
23 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 GNU General Public License for more details.
25
26 You should have received a copy of the GNU General Public License
27 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 */
29
30 #include "includes.h"
31 #include "lib/param/param.h"
32 #include "lib/param/loadparm.h"
33 #include "lib/param/param_global.h"
34 #include "libcli/auth/ntlm_check.h"
35 #include "libcli/smb/smb_constants.h"
36 #include "libds/common/roles.h"
37 #include "source4/lib/tls/tls.h"
38
39 #ifndef N_
40 #define N_(x) x
41 #endif
42
43 static const struct enum_list enum_protocol[] = {
44 {PROTOCOL_DEFAULT, "default"}, /* the caller decides what this means */
45 {PROTOCOL_SMB2_10, "SMB2"}, /* for now keep PROTOCOL_SMB2_10 */
46 {PROTOCOL_SMB3_11, "SMB3"}, /* for now keep PROTOCOL_SMB3_11 */
47 {PROTOCOL_SMB3_11, "SMB3_11"},
48 {PROTOCOL_SMB3_10, "SMB3_10"},
49 {PROTOCOL_SMB3_02, "SMB3_02"},
50 {PROTOCOL_SMB3_00, "SMB3_00"},
51 {PROTOCOL_SMB2_24, "SMB2_24"},
52 {PROTOCOL_SMB2_22, "SMB2_22"},
53 {PROTOCOL_SMB2_10, "SMB2_10"},
54 {PROTOCOL_SMB2_02, "SMB2_02"},
55 {PROTOCOL_NT1, "NT1"},
56 {PROTOCOL_LANMAN2, "LANMAN2"},
57 {PROTOCOL_LANMAN1, "LANMAN1"},
58 {PROTOCOL_CORE, "CORE"},
59 {PROTOCOL_COREPLUS, "COREPLUS"},
60 {PROTOCOL_COREPLUS, "CORE+"},
61 {-1, NULL}
62 };
63
lpcfg_get_smb_protocol(int type)64 const char* lpcfg_get_smb_protocol(int type)
65 {
66 int i;
67 for (i = 1; enum_protocol[i].value != -1; i++) {
68 if (enum_protocol[i].value == type) {
69 return enum_protocol[i].name;
70 }
71 }
72 return NULL;
73 }
74
75 static const struct enum_list enum_security[] = {
76 {SEC_AUTO, "AUTO"},
77 {SEC_USER, "USER"},
78 {SEC_DOMAIN, "DOMAIN"},
79 {SEC_ADS, "ADS"},
80 {-1, NULL}
81 };
82
83 static const struct enum_list enum_bool_auto[] = {
84 {false, "No"},
85 {false, "False"},
86 {false, "0"},
87 {true, "Yes"},
88 {true, "True"},
89 {true, "1"},
90 {Auto, "Auto"},
91 {-1, NULL}
92 };
93
94 static const struct enum_list enum_csc_policy[] = {
95 {CSC_POLICY_MANUAL, "manual"},
96 {CSC_POLICY_DOCUMENTS, "documents"},
97 {CSC_POLICY_PROGRAMS, "programs"},
98 {CSC_POLICY_DISABLE, "disable"},
99 {-1, NULL}
100 };
101
102 /* Server role options */
103 static const struct enum_list enum_server_role[] = {
104 {ROLE_AUTO, "auto"},
105 {ROLE_STANDALONE, "standalone server"},
106 {ROLE_STANDALONE, "standalone"},
107 {ROLE_DOMAIN_MEMBER, "member server"},
108 {ROLE_DOMAIN_MEMBER, "member"},
109 {ROLE_DOMAIN_PDC, "classic primary domain controller"},
110 {ROLE_DOMAIN_BDC, "classic backup domain controller"},
111 {ROLE_ACTIVE_DIRECTORY_DC, "active directory domain controller"},
112 {ROLE_ACTIVE_DIRECTORY_DC, "domain controller"},
113 {ROLE_ACTIVE_DIRECTORY_DC, "dc"},
114 {-1, NULL}
115 };
116
117 /* SMB signing types. */
118 static const struct enum_list enum_smb_signing_vals[] = {
119 {SMB_SIGNING_DEFAULT, "default"},
120 {SMB_SIGNING_OFF, "No"},
121 {SMB_SIGNING_OFF, "False"},
122 {SMB_SIGNING_OFF, "0"},
123 {SMB_SIGNING_OFF, "Off"},
124 {SMB_SIGNING_OFF, "disabled"},
125 {SMB_SIGNING_IF_REQUIRED, "if_required"},
126 {SMB_SIGNING_IF_REQUIRED, "Yes"},
127 {SMB_SIGNING_IF_REQUIRED, "True"},
128 {SMB_SIGNING_IF_REQUIRED, "1"},
129 {SMB_SIGNING_IF_REQUIRED, "On"},
130 {SMB_SIGNING_IF_REQUIRED, "enabled"},
131 {SMB_SIGNING_IF_REQUIRED, "auto"},
132 {SMB_SIGNING_DESIRED, "desired"},
133 {SMB_SIGNING_REQUIRED, "required"},
134 {SMB_SIGNING_REQUIRED, "mandatory"},
135 {SMB_SIGNING_REQUIRED, "force"},
136 {SMB_SIGNING_REQUIRED, "forced"},
137 {SMB_SIGNING_REQUIRED, "enforced"},
138 {-1, NULL}
139 };
140
141 static const struct enum_list enum_mdns_name_values[] = {
142 {MDNS_NAME_NETBIOS, "netbios"},
143 {MDNS_NAME_MDNS, "mdns"},
144 {-1, NULL}
145 };
146
147 static const struct enum_list enum_tls_verify_peer_vals[] = {
148 {TLS_VERIFY_PEER_NO_CHECK,
149 TLS_VERIFY_PEER_NO_CHECK_STRING},
150 {TLS_VERIFY_PEER_CA_ONLY,
151 TLS_VERIFY_PEER_CA_ONLY_STRING},
152 {TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE,
153 TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE_STRING},
154 {TLS_VERIFY_PEER_CA_AND_NAME,
155 TLS_VERIFY_PEER_CA_AND_NAME_STRING},
156 {TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE,
157 TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE_STRING},
158 {-1, NULL}
159 };
160
161 /* DNS update options. */
162 static const struct enum_list enum_dns_update_settings[] = {
163 {DNS_UPDATE_OFF, "disabled"},
164 {DNS_UPDATE_OFF, "No"},
165 {DNS_UPDATE_OFF, "False"},
166 {DNS_UPDATE_OFF, "0"},
167 {DNS_UPDATE_OFF, "Off"},
168 {DNS_UPDATE_ON, "nonsecure and secure"},
169 {DNS_UPDATE_ON, "nonsecure"},
170 {DNS_UPDATE_SIGNED, "secure only"},
171 {DNS_UPDATE_SIGNED, "secure"},
172 {DNS_UPDATE_SIGNED, "signed"},
173 {-1, NULL}
174 };
175
176 /*
177 Do you want session setups at user level security with a invalid
178 password to be rejected or allowed in as guest? WinNT rejects them
179 but it can be a pain as it means "net view" needs to use a password
180
181 You have 3 choices in the setting of map_to_guest:
182
183 "Never" means session setups with an invalid password
184 are rejected. This is the default.
185
186 "Bad User" means session setups with an invalid password
187 are rejected, unless the username does not exist, in which case it
188 is treated as a guest login
189
190 "Bad Password" means session setups with an invalid password
191 are treated as a guest login
192
193 Note that map_to_guest only has an effect in user or server
194 level security.
195 */
196
197 static const struct enum_list enum_map_to_guest[] = {
198 {NEVER_MAP_TO_GUEST, "Never"},
199 {MAP_TO_GUEST_ON_BAD_USER, "Bad User"},
200 {MAP_TO_GUEST_ON_BAD_PASSWORD, "Bad Password"},
201 {MAP_TO_GUEST_ON_BAD_UID, "Bad Uid"},
202 {-1, NULL}
203 };
204
205 /* Config backend options */
206
207 static const struct enum_list enum_config_backend[] = {
208 {CONFIG_BACKEND_FILE, "file"},
209 {CONFIG_BACKEND_REGISTRY, "registry"},
210 {-1, NULL}
211 };
212
213 static const struct enum_list enum_smbd_profiling_level[] = {
214 {0, "off"}, {1, "count"}, {2, "on"}, {-1, NULL}
215 };
216
217
218 /* ADS kerberos ticket verification options */
219
220 static const struct enum_list enum_kerberos_method[] = {
221 {KERBEROS_VERIFY_SECRETS, "default"},
222 {KERBEROS_VERIFY_SECRETS, "secrets only"},
223 {KERBEROS_VERIFY_SECRETS, "secretsonly"},
224 {KERBEROS_VERIFY_SYSTEM_KEYTAB, "system keytab"},
225 {KERBEROS_VERIFY_SYSTEM_KEYTAB, "systemkeytab"},
226 {KERBEROS_VERIFY_DEDICATED_KEYTAB, "dedicated keytab"},
227 {KERBEROS_VERIFY_DEDICATED_KEYTAB, "dedicatedkeytab"},
228 {KERBEROS_VERIFY_SECRETS_AND_KEYTAB, "secrets and keytab"},
229 {KERBEROS_VERIFY_SECRETS_AND_KEYTAB, "secretsandkeytab"},
230 {-1, NULL}
231 };
232
233 /* Kerberos encryption types selection options */
234
235 static const struct enum_list enum_kerberos_encryption_types_vals[] = {
236 {KERBEROS_ETYPES_ALL, "all"},
237 {KERBEROS_ETYPES_STRONG, "strong"},
238 {KERBEROS_ETYPES_LEGACY, "legacy"},
239 {-1, NULL}
240 };
241
242 static const struct enum_list enum_printing[] = {
243 {PRINT_SYSV, "sysv"},
244 {PRINT_AIX, "aix"},
245 {PRINT_HPUX, "hpux"},
246 {PRINT_BSD, "bsd"},
247 {PRINT_QNX, "qnx"},
248 {PRINT_PLP, "plp"},
249 {PRINT_LPRNG, "lprng"},
250 #ifdef HAVE_CUPS
251 {PRINT_CUPS, "cups"},
252 #endif
253 #ifdef HAVE_IPRINT
254 {PRINT_IPRINT, "iprint"},
255 #endif
256 {PRINT_LPRNT, "nt"},
257 {PRINT_LPROS2, "os2"},
258 #if defined(DEVELOPER) || defined(ENABLE_SELFTEST)
259 {PRINT_TEST, "test"},
260 {PRINT_VLP, "vlp"},
261 #endif /* DEVELOPER */
262 {-1, NULL}
263 };
264
265 static const struct enum_list enum_ldap_sasl_wrapping[] = {
266 {0, "plain"},
267 {ADS_AUTH_SASL_SIGN, "sign"},
268 {ADS_AUTH_SASL_SEAL, "seal"},
269 {-1, NULL}
270 };
271
272 static const struct enum_list enum_ldap_server_require_strong_auth_vals[] = {
273 { LDAP_SERVER_REQUIRE_STRONG_AUTH_NO, "No" },
274 { LDAP_SERVER_REQUIRE_STRONG_AUTH_NO, "False" },
275 { LDAP_SERVER_REQUIRE_STRONG_AUTH_NO, "0" },
276 { LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS,
277 "allow_sasl_over_tls" },
278 { LDAP_SERVER_REQUIRE_STRONG_AUTH_YES, "Yes" },
279 { LDAP_SERVER_REQUIRE_STRONG_AUTH_YES, "True" },
280 { LDAP_SERVER_REQUIRE_STRONG_AUTH_YES, "1" },
281 {-1, NULL}
282 };
283
284 static const struct enum_list enum_ldap_ssl[] = {
285 {LDAP_SSL_OFF, "no"},
286 {LDAP_SSL_OFF, "off"},
287 {LDAP_SSL_START_TLS, "start tls"},
288 {LDAP_SSL_START_TLS, "start_tls"},
289 {-1, NULL}
290 };
291
292 /* LDAP Dereferencing Alias types */
293 #define SAMBA_LDAP_DEREF_NEVER 0
294 #define SAMBA_LDAP_DEREF_SEARCHING 1
295 #define SAMBA_LDAP_DEREF_FINDING 2
296 #define SAMBA_LDAP_DEREF_ALWAYS 3
297
298 static const struct enum_list enum_ldap_deref[] = {
299 {SAMBA_LDAP_DEREF_NEVER, "never"},
300 {SAMBA_LDAP_DEREF_SEARCHING, "searching"},
301 {SAMBA_LDAP_DEREF_FINDING, "finding"},
302 {SAMBA_LDAP_DEREF_ALWAYS, "always"},
303 {-1, "auto"}
304 };
305
306 static const struct enum_list enum_ldap_passwd_sync[] = {
307 {LDAP_PASSWD_SYNC_OFF, "no"},
308 {LDAP_PASSWD_SYNC_OFF, "off"},
309 {LDAP_PASSWD_SYNC_ON, "yes"},
310 {LDAP_PASSWD_SYNC_ON, "on"},
311 {LDAP_PASSWD_SYNC_ONLY, "only"},
312 {-1, NULL}
313 };
314
315 static const struct enum_list enum_map_readonly[] = {
316 {MAP_READONLY_NO, "no"},
317 {MAP_READONLY_NO, "false"},
318 {MAP_READONLY_NO, "0"},
319 {MAP_READONLY_YES, "yes"},
320 {MAP_READONLY_YES, "true"},
321 {MAP_READONLY_YES, "1"},
322 {MAP_READONLY_PERMISSIONS, "permissions"},
323 {MAP_READONLY_PERMISSIONS, "perms"},
324 {-1, NULL}
325 };
326
327 static const struct enum_list enum_case[] = {
328 {CASE_LOWER, "lower"},
329 {CASE_UPPER, "upper"},
330 {-1, NULL}
331 };
332
333 static const struct enum_list enum_inherit_owner_vals[] = {
334 {INHERIT_OWNER_NO, "no"},
335 {INHERIT_OWNER_WINDOWS_AND_UNIX, "windows and unix"},
336 {INHERIT_OWNER_WINDOWS_AND_UNIX, "yes"},
337 {INHERIT_OWNER_UNIX_ONLY, "unix only"},
338 {-1, NULL}};
339
340 static const struct enum_list enum_mangled_names[] = {
341 {MANGLED_NAMES_NO, "no"},
342 {MANGLED_NAMES_NO, "false"},
343 {MANGLED_NAMES_NO, "0"},
344 {MANGLED_NAMES_ILLEGAL, "illegal"},
345 {MANGLED_NAMES_YES, "yes"},
346 {MANGLED_NAMES_YES, "true"},
347 {MANGLED_NAMES_YES, "1"},
348 {-1, NULL}
349 };
350
351 static const struct enum_list enum_ntlm_auth[] = {
352 {NTLM_AUTH_DISABLED, "disabled"},
353 {NTLM_AUTH_NTLMV2_ONLY, "ntlmv2-only"},
354 {NTLM_AUTH_NTLMV2_ONLY, "no"},
355 {NTLM_AUTH_NTLMV2_ONLY, "false"},
356 {NTLM_AUTH_NTLMV2_ONLY, "0"},
357 {NTLM_AUTH_ON, "ntlmv1-permitted"},
358 {NTLM_AUTH_ON, "yes"},
359 {NTLM_AUTH_ON, "true"},
360 {NTLM_AUTH_ON, "1"},
361 {NTLM_AUTH_MSCHAPv2_NTLMV2_ONLY, "mschapv2-and-ntlmv2-only"},
362 {-1, NULL}
363 };
364
365 static const struct enum_list enum_spotlight_backend[] = {
366 {SPOTLIGHT_BACKEND_NOINDEX, "noindex"},
367 {SPOTLIGHT_BACKEND_TRACKER, "tracker"},
368 {SPOTLIGHT_BACKEND_ES, "elasticsearch"},
369 {-1, NULL}
370 };
371
372 /* Note: We do not initialise the defaults union - it is not allowed in ANSI C
373 *
374 * NOTE: Handling of duplicated (synonym) parameters:
375 * Parameters that are synonymous are stored in the same variable.
376 * All but the default spelling carry the flag FLAG_SYNONYM.
377 */
378
379 #define GLOBAL_VAR(name) offsetof(struct loadparm_global, name)
380 #define LOCAL_VAR(name) offsetof(struct loadparm_service, name)
381
382 #include "lib/param/param_table_gen.c"
383
num_parameters(void)384 int num_parameters(void)
385 {
386 return (sizeof(parm_table) / sizeof(struct parm_struct));
387 }
388