Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 : Test validity of smb.conf
4 : Copyright (C) Karl Auer 1993, 1994-1998
5 :
6 : Extensively modified by Andrew Tridgell, 1995
7 : Converted to popt by Jelmer Vernooij (jelmer@nl.linux.org), 2002
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 : You should have received a copy of the GNU General Public License
20 : along with this program. If not, see <http://www.gnu.org/licenses/>.
21 : */
22 :
23 : /*
24 : * Testbed for loadparm.c/params.c
25 : *
26 : * This module simply loads a specified configuration file and
27 : * if successful, dumps it's contents to stdout. Note that the
28 : * operation is performed with DEBUGLEVEL at 3.
29 : *
30 : * Useful for a quick 'syntax check' of a configuration file.
31 : *
32 : */
33 :
34 : #include "includes.h"
35 : #include "system/filesys.h"
36 : #include "lib/cmdline/cmdline.h"
37 : #include "lib/param/loadparm.h"
38 : #include "lib/crypto/gnutls_helpers.h"
39 : #include "cmdline_contexts.h"
40 :
41 : #include <regex.h>
42 :
43 : /*******************************************************************
44 : Check if a directory exists.
45 : ********************************************************************/
46 :
47 7288 : static bool directory_exist_stat(const char *dname,SMB_STRUCT_STAT *st)
48 : {
49 : SMB_STRUCT_STAT st2;
50 : bool ret;
51 :
52 7288 : if (!st)
53 0 : st = &st2;
54 :
55 7288 : if (sys_stat(dname, st, false) != 0)
56 7280 : return(False);
57 :
58 8 : ret = S_ISDIR(st->st_ex_mode);
59 8 : if(!ret)
60 0 : errno = ENOTDIR;
61 8 : return ret;
62 : }
63 :
64 : struct idmap_config {
65 : const char *domain_name;
66 : const char *backend;
67 : uint32_t high;
68 : uint32_t low;
69 : };
70 :
71 : struct idmap_domains {
72 : struct idmap_config *c;
73 : uint32_t count;
74 : uint32_t size;
75 : };
76 :
77 2 : static bool lp_scan_idmap_found_domain(const char *string,
78 : regmatch_t matches[],
79 : void *private_data)
80 : {
81 2 : bool ok = false;
82 :
83 2 : if (matches[1].rm_so == -1) {
84 0 : fprintf(stderr, "Found match, but no name - invalid idmap config");
85 0 : return false;
86 : }
87 2 : if (matches[1].rm_eo <= matches[1].rm_so) {
88 0 : fprintf(stderr, "Invalid match - invalid idmap config");
89 0 : return false;
90 : }
91 :
92 2 : {
93 2 : struct idmap_domains *d = private_data;
94 2 : struct idmap_config *c = &d->c[d->count];
95 2 : regoff_t len = matches[1].rm_eo - matches[1].rm_so;
96 2 : char domname[len + 1];
97 :
98 2 : if (d->count >= d->size) {
99 0 : return false;
100 : }
101 :
102 2 : memcpy(domname, string + matches[1].rm_so, len);
103 2 : domname[len] = '\0';
104 :
105 2 : c->domain_name = talloc_strdup_upper(d->c, domname);
106 2 : if (c->domain_name == NULL) {
107 0 : return false;
108 : }
109 2 : c->backend = talloc_strdup(d->c, lp_idmap_backend(domname));
110 2 : if (c->backend == NULL) {
111 0 : return false;
112 : }
113 :
114 2 : if (lp_server_role() != ROLE_ACTIVE_DIRECTORY_DC) {
115 2 : ok = lp_idmap_range(domname, &c->low, &c->high);
116 2 : if (!ok) {
117 2 : fprintf(stderr,
118 : "ERROR: Invalid idmap range for domain "
119 : "%s!\n\n",
120 : c->domain_name);
121 2 : return false;
122 : }
123 : }
124 :
125 0 : d->count++;
126 : }
127 :
128 0 : return false; /* Keep scanning */
129 : }
130 :
131 2 : static bool do_idmap_check(void)
132 : {
133 : struct idmap_domains *d;
134 : uint32_t i;
135 2 : bool ok = false;
136 : int rc;
137 :
138 2 : d = talloc_zero(talloc_tos(), struct idmap_domains);
139 2 : if (d == NULL) {
140 0 : return false;
141 : }
142 2 : d->count = 0;
143 2 : d->size = 32;
144 :
145 2 : d->c = talloc_array(d, struct idmap_config, d->size);
146 2 : if (d->c == NULL) {
147 0 : goto done;
148 : }
149 :
150 2 : rc = lp_wi_scan_global_parametrics("idmapconfig\\(.*\\):backend",
151 : 2,
152 : lp_scan_idmap_found_domain,
153 : d);
154 2 : if (rc != 0) {
155 0 : fprintf(stderr,
156 : "FATAL: wi_scan_global_parametrics failed: %d",
157 : rc);
158 : }
159 :
160 2 : for (i = 0; i < d->count; i++) {
161 0 : struct idmap_config *c = &d->c[i];
162 : uint32_t j;
163 :
164 0 : for (j = 0; j < d->count && j != i; j++) {
165 0 : struct idmap_config *x = &d->c[j];
166 :
167 0 : if ((c->low >= x->low && c->low <= x->high) ||
168 0 : (c->high >= x->low && c->high <= x->high)) {
169 : /* Allow overlapping ranges for idmap_ad */
170 0 : ok = strequal(c->backend, x->backend);
171 0 : if (ok) {
172 0 : ok = strequal(c->backend, "ad");
173 0 : if (ok) {
174 0 : fprintf(stderr,
175 : "NOTE: The idmap_ad "
176 : "range for the domain "
177 : "%s overlaps with the "
178 : "range of %s.\n\n",
179 : c->domain_name,
180 : x->domain_name);
181 0 : continue;
182 : }
183 : }
184 :
185 0 : fprintf(stderr,
186 : "ERROR: The idmap range for the domain "
187 : "%s (%s) overlaps with the range of "
188 : "%s (%s)!\n\n",
189 : c->domain_name,
190 : c->backend,
191 : x->domain_name,
192 : x->backend);
193 0 : ok = false;
194 0 : goto done;
195 : }
196 : }
197 : }
198 :
199 2 : ok = true;
200 2 : done:
201 2 : TALLOC_FREE(d);
202 2 : return ok;
203 : }
204 :
205 : /***********************************************
206 : Here we do a set of 'hard coded' checks for bad
207 : configuration settings.
208 : ************************************************/
209 :
210 1822 : static int do_global_checks(void)
211 : {
212 1822 : int ret = 0;
213 : SMB_STRUCT_STAT st;
214 : const char *socket_options;
215 1820 : const struct loadparm_substitution *lp_sub =
216 2 : loadparm_s3_global_substitution();
217 :
218 1822 : fprintf(stderr, "\n");
219 :
220 1822 : if (lp_security() >= SEC_DOMAIN && !lp_encrypt_passwords()) {
221 0 : fprintf(stderr, "ERROR: in 'security=domain' mode the "
222 : "'encrypt passwords' parameter must always be "
223 : "set to 'true'.\n\n");
224 0 : ret = 1;
225 : }
226 :
227 1822 : if (lp_security() == SEC_ADS) {
228 0 : const char *workgroup = lp_workgroup();
229 0 : const char *realm = lp_realm();
230 :
231 0 : if (workgroup == NULL || strlen(workgroup) == 0) {
232 0 : fprintf(stderr,
233 : "ERROR: The 'security=ADS' mode requires "
234 : "'workgroup' parameter to be set!\n\n ");
235 0 : ret = 1;
236 : }
237 :
238 0 : if (realm == NULL || strlen(realm) == 0) {
239 0 : fprintf(stderr,
240 : "ERROR: The 'security=ADS' mode requires "
241 : "'realm' parameter to be set!\n\n ");
242 0 : ret = 1;
243 : }
244 : }
245 :
246 :
247 1822 : if (lp_we_are_a_wins_server() && lp_wins_server_list()) {
248 0 : fprintf(stderr, "ERROR: both 'wins support = true' and "
249 : "'wins server = <server list>' cannot be set in "
250 : "the smb.conf file. nmbd will abort with this "
251 : "setting.\n\n");
252 0 : ret = 1;
253 : }
254 :
255 1822 : if (strequal(lp_workgroup(), lp_netbios_name())) {
256 0 : fprintf(stderr, "WARNING: 'workgroup' and 'netbios name' "
257 : "must differ.\n\n");
258 : }
259 :
260 1822 : if (lp_client_ipc_signing() == SMB_SIGNING_IF_REQUIRED
261 1822 : || lp_client_ipc_signing() == SMB_SIGNING_OFF) {
262 0 : fprintf(stderr, "WARNING: The 'client ipc signing' value "
263 : "%s SMB signing is not used when contacting a "
264 : "domain controller or other server. "
265 : "This setting is not recommended; please be "
266 : "aware of the security implications when using "
267 : "this configuration setting.\n\n",
268 0 : lp_client_ipc_signing() == SMB_SIGNING_OFF ?
269 : "ensures" : "may mean");
270 : }
271 :
272 1822 : if (strlen(lp_netbios_name()) > 15) {
273 1817 : fprintf(stderr, "WARNING: The 'netbios name' is too long "
274 : "(max. 15 chars).\n\n");
275 : }
276 :
277 1822 : if (!directory_exist_stat(lp_lock_directory(), &st)) {
278 1820 : fprintf(stderr, "ERROR: lock directory %s does not exist\n\n",
279 : lp_lock_directory());
280 1820 : ret = 1;
281 2 : } else if ((st.st_ex_mode & 0777) != 0755) {
282 2 : fprintf(stderr, "WARNING: lock directory %s should have "
283 : "permissions 0755 for browsing to work\n\n",
284 : lp_lock_directory());
285 : }
286 :
287 1822 : if (!directory_exist_stat(lp_state_directory(), &st)) {
288 1820 : fprintf(stderr, "ERROR: state directory %s does not exist\n\n",
289 : lp_state_directory());
290 1820 : ret = 1;
291 2 : } else if ((st.st_ex_mode & 0777) != 0755) {
292 2 : fprintf(stderr, "WARNING: state directory %s should have "
293 : "permissions 0755 for browsing to work\n\n",
294 : lp_state_directory());
295 : }
296 :
297 1822 : if (!directory_exist_stat(lp_cache_directory(), &st)) {
298 1820 : fprintf(stderr, "ERROR: cache directory %s does not exist\n\n",
299 : lp_cache_directory());
300 1820 : ret = 1;
301 2 : } else if ((st.st_ex_mode & 0777) != 0755) {
302 2 : fprintf(stderr, "WARNING: cache directory %s should have "
303 : "permissions 0755 for browsing to work\n\n",
304 : lp_cache_directory());
305 : }
306 :
307 1822 : if (!directory_exist_stat(lp_pid_directory(), &st)) {
308 1820 : fprintf(stderr, "ERROR: pid directory %s does not exist\n\n",
309 : lp_pid_directory());
310 1820 : ret = 1;
311 : }
312 :
313 1822 : if (lp_passdb_expand_explicit()) {
314 2 : fprintf(stderr, "WARNING: passdb expand explicit = yes is "
315 : "deprecated\n\n");
316 : }
317 :
318 : /*
319 : * Socket options.
320 : */
321 1822 : socket_options = lp_socket_options();
322 3642 : if (socket_options != NULL &&
323 3642 : (strstr(socket_options, "SO_SNDBUF") ||
324 3642 : strstr(socket_options, "SO_RCVBUF") ||
325 3642 : strstr(socket_options, "SO_SNDLOWAT") ||
326 1822 : strstr(socket_options, "SO_RCVLOWAT")))
327 : {
328 0 : fprintf(stderr,
329 : "WARNING: socket options = %s\n"
330 : "This warning is printed because you set one of the\n"
331 : "following options: SO_SNDBUF, SO_RCVBUF, SO_SNDLOWAT,\n"
332 : "SO_RCVLOWAT\n"
333 : "Modern server operating systems are tuned for\n"
334 : "high network performance in the majority of situations;\n"
335 : "when you set 'socket options' you are overriding those\n"
336 : "settings.\n"
337 : "Linux in particular has an auto-tuning mechanism for\n"
338 : "buffer sizes (SO_SNDBUF, SO_RCVBUF) that will be\n"
339 : "disabled if you specify a socket buffer size. This can\n"
340 : "potentially cripple your TCP/IP stack.\n\n"
341 : "Getting the 'socket options' correct can make a big\n"
342 : "difference to your performance, but getting them wrong\n"
343 : "can degrade it by just as much. As with any other low\n"
344 : "level setting, if you must make changes to it, make\n "
345 : "small changes and test the effect before making any\n"
346 : "large changes.\n\n",
347 : socket_options);
348 : }
349 :
350 : /*
351 : * Password server sanity checks.
352 : */
353 :
354 1822 : if((lp_security() >= SEC_DOMAIN) && !*lp_password_server()) {
355 : const char *sec_setting;
356 0 : if(lp_security() == SEC_DOMAIN)
357 0 : sec_setting = "domain";
358 0 : else if(lp_security() == SEC_ADS)
359 0 : sec_setting = "ads";
360 : else
361 0 : sec_setting = "";
362 :
363 0 : fprintf(stderr, "ERROR: The setting 'security=%s' requires the "
364 : "'password server' parameter be set to the "
365 : "default value * or a valid password server.\n\n",
366 : sec_setting );
367 0 : ret = 1;
368 : }
369 :
370 1822 : if((lp_security() >= SEC_DOMAIN) && (strcmp(lp_password_server(), "*") != 0)) {
371 : const char *sec_setting;
372 0 : if(lp_security() == SEC_DOMAIN)
373 0 : sec_setting = "domain";
374 0 : else if(lp_security() == SEC_ADS)
375 0 : sec_setting = "ads";
376 : else
377 0 : sec_setting = "";
378 :
379 0 : fprintf(stderr, "WARNING: The setting 'security=%s' should NOT "
380 : "be combined with the 'password server' "
381 : "parameter.\n"
382 : "(by default Samba will discover the correct DC "
383 : "to contact automatically).\n\n",
384 : sec_setting );
385 : }
386 :
387 : /*
388 : * Password chat sanity checks.
389 : */
390 :
391 1822 : if(lp_security() == SEC_USER && lp_unix_password_sync()) {
392 :
393 : /*
394 : * Check that we have a valid lp_passwd_program() if not using pam.
395 : */
396 :
397 : #ifdef WITH_PAM
398 2 : if (!lp_pam_password_change()) {
399 : #endif
400 :
401 4 : if((lp_passwd_program(talloc_tos(), lp_sub) == NULL) ||
402 2 : (strlen(lp_passwd_program(talloc_tos(), lp_sub)) == 0))
403 : {
404 2 : fprintf(stderr,
405 : "ERROR: the 'unix password sync' "
406 : "parameter is set and there is no valid "
407 : "'passwd program' parameter.\n\n");
408 2 : ret = 1;
409 : } else {
410 : const char *passwd_prog;
411 0 : char *truncated_prog = NULL;
412 : const char *p;
413 :
414 0 : passwd_prog = lp_passwd_program(talloc_tos(), lp_sub);
415 0 : p = passwd_prog;
416 0 : next_token_talloc(talloc_tos(),
417 : &p,
418 : &truncated_prog, NULL);
419 0 : if (truncated_prog && access(truncated_prog, F_OK) == -1) {
420 0 : fprintf(stderr,
421 : "ERROR: the 'unix password sync' "
422 : "parameter is set and the "
423 : "'passwd program' (%s) cannot be "
424 : "executed (error was %s).\n\n",
425 : truncated_prog,
426 0 : strerror(errno));
427 0 : ret = 1;
428 : }
429 : }
430 :
431 : #ifdef WITH_PAM
432 : }
433 : #endif
434 :
435 2 : if(lp_passwd_chat(talloc_tos(), lp_sub) == NULL) {
436 0 : fprintf(stderr,
437 : "ERROR: the 'unix password sync' parameter is "
438 : "set and there is no valid 'passwd chat' "
439 : "parameter.\n\n");
440 0 : ret = 1;
441 : }
442 :
443 4 : if ((lp_passwd_program(talloc_tos(), lp_sub) != NULL) &&
444 2 : (strlen(lp_passwd_program(talloc_tos(), lp_sub)) > 0))
445 : {
446 : /* check if there's a %u parameter present */
447 0 : if(strstr_m(lp_passwd_program(talloc_tos(), lp_sub), "%u") == NULL) {
448 0 : fprintf(stderr,
449 : "ERROR: the 'passwd program' (%s) "
450 : "requires a '%%u' parameter.\n\n",
451 : lp_passwd_program(talloc_tos(), lp_sub));
452 0 : ret = 1;
453 : }
454 : }
455 :
456 : /*
457 : * Check that we have a valid script and that it hasn't
458 : * been written to expect the old password.
459 : */
460 :
461 2 : if(lp_encrypt_passwords()) {
462 2 : if(strstr_m( lp_passwd_chat(talloc_tos(), lp_sub), "%o")!=NULL) {
463 0 : fprintf(stderr,
464 : "ERROR: the 'passwd chat' script [%s] "
465 : "expects to use the old plaintext "
466 : "password via the %%o substitution. With "
467 : "encrypted passwords this is not "
468 : "possible.\n\n",
469 : lp_passwd_chat(talloc_tos(), lp_sub) );
470 0 : ret = 1;
471 : }
472 : }
473 : }
474 :
475 1822 : if (strlen(lp_winbind_separator()) != 1) {
476 2 : fprintf(stderr, "ERROR: the 'winbind separator' parameter must "
477 : "be a single character.\n\n");
478 2 : ret = 1;
479 : }
480 :
481 1822 : if (*lp_winbind_separator() == '+') {
482 0 : fprintf(stderr, "'winbind separator = +' might cause problems "
483 : "with group membership.\n\n");
484 : }
485 :
486 1822 : if (lp_algorithmic_rid_base() < BASE_RID) {
487 : /* Try to prevent admin foot-shooting, we can't put algorithmic
488 : rids below 1000, that's the 'well known RIDs' on NT */
489 2 : fprintf(stderr, "'algorithmic rid base' must be equal to or "
490 : "above %lu\n\n", BASE_RID);
491 : }
492 :
493 1822 : if (lp_algorithmic_rid_base() & 1) {
494 2 : fprintf(stderr, "'algorithmic rid base' must be even.\n\n");
495 : }
496 :
497 1822 : if (lp_server_role() != ROLE_STANDALONE) {
498 2 : const char *default_backends[] = {
499 : "tdb", "tdb2", "ldap", "autorid", "hash"
500 : };
501 : const char *idmap_backend;
502 2 : bool valid_backend = false;
503 : uint32_t i;
504 : bool ok;
505 :
506 2 : idmap_backend = lp_idmap_default_backend();
507 :
508 12 : for (i = 0; i < ARRAY_SIZE(default_backends); i++) {
509 10 : ok = strequal(idmap_backend, default_backends[i]);
510 10 : if (ok) {
511 2 : valid_backend = true;
512 : }
513 : }
514 :
515 2 : if (!valid_backend) {
516 0 : ret = 1;
517 0 : fprintf(stderr, "ERROR: Do not use the '%s' backend "
518 : "as the default idmap backend!\n\n",
519 : idmap_backend);
520 : }
521 :
522 2 : ok = do_idmap_check();
523 2 : if (!ok) {
524 0 : ret = 1;
525 : }
526 : }
527 :
528 : #ifndef HAVE_DLOPEN
529 : if (lp_preload_modules()) {
530 : fprintf(stderr, "WARNING: 'preload modules = ' set while loading "
531 : "plugins not supported.\n\n");
532 : }
533 : #endif
534 :
535 1822 : if (!lp_passdb_backend()) {
536 0 : fprintf(stderr, "ERROR: passdb backend must have a value or be "
537 : "left out\n\n");
538 : }
539 :
540 1822 : if (lp_os_level() > 255) {
541 0 : fprintf(stderr, "WARNING: Maximum value for 'os level' is "
542 : "255!\n\n");
543 : }
544 :
545 1822 : if (strequal(lp_dos_charset(), "UTF8") || strequal(lp_dos_charset(), "UTF-8")) {
546 0 : fprintf(stderr, "ERROR: 'dos charset' must not be UTF8\n\n");
547 0 : ret = 1;
548 : }
549 :
550 1822 : if (!lp_server_schannel()) {
551 0 : fprintf(stderr,
552 : "WARNING: You have configured 'server schannel = no'. "
553 : "Your server is vulernable to \"ZeroLogon\" "
554 : "(CVE-2020-1472)\n\n");
555 : }
556 :
557 1822 : return ret;
558 : }
559 :
560 : /**
561 : * per-share logic tests
562 : */
563 1371 : static void do_per_share_checks(int s)
564 : {
565 1371 : const struct loadparm_substitution *lp_sub =
566 0 : loadparm_s3_global_substitution();
567 1371 : const char **deny_list = lp_hosts_deny(s);
568 1371 : const char **allow_list = lp_hosts_allow(s);
569 1371 : const char **vfs_objects = NULL;
570 : int i;
571 : static bool uses_fruit;
572 : static bool doesnt_use_fruit;
573 : static bool fruit_mix_warned;
574 :
575 1371 : if(deny_list) {
576 4 : for (i=0; deny_list[i]; i++) {
577 3 : char *hasstar = strchr_m(deny_list[i], '*');
578 3 : char *hasquery = strchr_m(deny_list[i], '?');
579 3 : if(hasstar || hasquery) {
580 0 : fprintf(stderr,
581 : "Invalid character %c in hosts deny list "
582 : "(%s) for service %s.\n\n",
583 0 : hasstar ? *hasstar : *hasquery,
584 0 : deny_list[i],
585 : lp_servicename(talloc_tos(), lp_sub, s));
586 : }
587 : }
588 : }
589 :
590 1371 : if(allow_list) {
591 4 : for (i=0; allow_list[i]; i++) {
592 3 : char *hasstar = strchr_m(allow_list[i], '*');
593 3 : char *hasquery = strchr_m(allow_list[i], '?');
594 3 : if(hasstar || hasquery) {
595 0 : fprintf(stderr,
596 : "Invalid character %c in hosts allow "
597 : "list (%s) for service %s.\n\n",
598 0 : hasstar ? *hasstar : *hasquery,
599 0 : allow_list[i],
600 : lp_servicename(talloc_tos(), lp_sub, s));
601 : }
602 : }
603 : }
604 :
605 1371 : if(lp_level2_oplocks(s) && !lp_oplocks(s)) {
606 0 : fprintf(stderr, "Invalid combination of parameters for service "
607 : "%s. Level II oplocks can only be set if oplocks "
608 : "are also set.\n\n",
609 : lp_servicename(talloc_tos(), lp_sub, s));
610 : }
611 :
612 1371 : if (!lp_store_dos_attributes(s) && lp_map_hidden(s)
613 0 : && !(lp_create_mask(s) & S_IXOTH))
614 : {
615 0 : fprintf(stderr,
616 : "Invalid combination of parameters for service %s. Map "
617 : "hidden can only work if create mask includes octal "
618 : "01 (S_IXOTH).\n\n",
619 : lp_servicename(talloc_tos(), lp_sub, s));
620 : }
621 1371 : if (!lp_store_dos_attributes(s) && lp_map_hidden(s)
622 0 : && (lp_force_create_mode(s) & S_IXOTH))
623 : {
624 0 : fprintf(stderr,
625 : "Invalid combination of parameters for service "
626 : "%s. Map hidden can only work if force create mode "
627 : "excludes octal 01 (S_IXOTH).\n\n",
628 : lp_servicename(talloc_tos(), lp_sub, s));
629 : }
630 1371 : if (!lp_store_dos_attributes(s) && lp_map_system(s)
631 0 : && !(lp_create_mask(s) & S_IXGRP))
632 : {
633 0 : fprintf(stderr,
634 : "Invalid combination of parameters for service "
635 : "%s. Map system can only work if create mask includes "
636 : "octal 010 (S_IXGRP).\n\n",
637 : lp_servicename(talloc_tos(), lp_sub, s));
638 : }
639 1371 : if (!lp_store_dos_attributes(s) && lp_map_system(s)
640 0 : && (lp_force_create_mode(s) & S_IXGRP))
641 : {
642 0 : fprintf(stderr,
643 : "Invalid combination of parameters for service "
644 : "%s. Map system can only work if force create mode "
645 : "excludes octal 010 (S_IXGRP).\n\n",
646 : lp_servicename(talloc_tos(), lp_sub, s));
647 : }
648 1371 : if (lp_printing(s) == PRINT_CUPS && *(lp_print_command(s)) != '\0') {
649 1 : fprintf(stderr,
650 : "Warning: Service %s defines a print command, but "
651 : "parameter is ignored when using CUPS libraries.\n\n",
652 : lp_servicename(talloc_tos(), lp_sub, s));
653 : }
654 :
655 1371 : vfs_objects = lp_vfs_objects(s);
656 1371 : if (vfs_objects && str_list_check(vfs_objects, "fruit")) {
657 0 : uses_fruit = true;
658 : } else {
659 1371 : doesnt_use_fruit = true;
660 : }
661 :
662 1371 : if (uses_fruit && doesnt_use_fruit && !fruit_mix_warned) {
663 0 : fruit_mix_warned = true;
664 0 : fprintf(stderr,
665 : "WARNING: some services use vfs_fruit, others don't. Mounting them "
666 : "in conjunction on OS X clients results in undefined behaviour.\n\n");
667 : }
668 1371 : }
669 :
670 1889 : int main(int argc, const char *argv[])
671 : {
672 1889 : const char *config_file = NULL;
673 1887 : const struct loadparm_substitution *lp_sub =
674 2 : loadparm_s3_global_substitution();
675 : int opt;
676 : int s;
677 : static int silent_mode = False;
678 : static int show_all_parameters = False;
679 1889 : int ret = 0;
680 : poptContext pc;
681 : static char *parameter_name = NULL;
682 : static const char *section_name = NULL;
683 : const char *cname;
684 : const char *caddr;
685 : static int show_defaults;
686 : static int skip_logic_checks = 0;
687 1889 : const char *weak_crypo_str = "";
688 : bool ok;
689 :
690 7556 : struct poptOption long_options[] = {
691 : POPT_AUTOHELP
692 : {
693 : .longName = "suppress-prompt",
694 : .shortName = 's',
695 : .argInfo = POPT_ARG_VAL,
696 : .arg = &silent_mode,
697 : .val = 1,
698 : .descrip = "Suppress prompt for enter",
699 : },
700 : {
701 : .longName = "verbose",
702 : .shortName = 'v',
703 : .argInfo = POPT_ARG_NONE,
704 : .arg = &show_defaults,
705 : .val = 1,
706 : .descrip = "Show default options too",
707 : },
708 : {
709 : .longName = "skip-logic-checks",
710 : .shortName = 'l',
711 : .argInfo = POPT_ARG_NONE,
712 : .arg = &skip_logic_checks,
713 : .val = 1,
714 : .descrip = "Skip the global checks",
715 : },
716 : {
717 : .longName = "show-all-parameters",
718 : .shortName = '\0',
719 : .argInfo = POPT_ARG_VAL,
720 : .arg = &show_all_parameters,
721 : .val = True,
722 : .descrip = "Show the parameters, type, possible "
723 : "values",
724 : },
725 : {
726 : .longName = "parameter-name",
727 : .shortName = '\0',
728 : .argInfo = POPT_ARG_STRING,
729 : .arg = ¶meter_name,
730 : .val = 0,
731 : .descrip = "Limit testparm to a named parameter",
732 : },
733 : {
734 : .longName = "section-name",
735 : .shortName = '\0',
736 : .argInfo = POPT_ARG_STRING,
737 : .arg = §ion_name,
738 : .val = 0,
739 : .descrip = "Limit testparm to a named section",
740 : },
741 1889 : POPT_COMMON_DEBUG_ONLY
742 1889 : POPT_COMMON_OPTION_ONLY
743 1889 : POPT_COMMON_VERSION
744 : POPT_TABLEEND
745 : };
746 :
747 1889 : TALLOC_CTX *frame = talloc_stackframe();
748 :
749 1889 : smb_init_locale();
750 :
751 1889 : ok = samba_cmdline_init(frame,
752 : SAMBA_CMDLINE_CONFIG_NONE,
753 : true /* require_smbconf */);
754 1889 : if (!ok) {
755 0 : DBG_ERR("Failed to init cmdline parser!\n");
756 0 : ret = 1;
757 0 : goto done;
758 : }
759 :
760 : /*
761 : * Set the default debug level to 1.
762 : * Allow it to be overridden by the command line,
763 : * not by smb.conf.
764 : */
765 1889 : lp_set_cmdline("log level", "1");
766 :
767 1889 : pc = samba_popt_get_context(getprogname(),
768 : argc,
769 : argv,
770 : long_options,
771 : 0);
772 1889 : if (pc == NULL) {
773 0 : DBG_ERR("Failed to setup popt context!\n");
774 0 : ret = 1;
775 0 : goto done;
776 : }
777 :
778 1889 : poptSetOtherOptionHelp(pc, "[OPTION...] <config-file> [host-name] [host-ip]");
779 :
780 1889 : while ((opt = poptGetNextOpt(pc)) != -1) {
781 66 : switch (opt) {
782 0 : case POPT_ERROR_BADOPT:
783 0 : fprintf(stderr, "\nInvalid option %s: %s\n\n",
784 : poptBadOption(pc, 0), poptStrerror(opt));
785 0 : poptPrintUsage(pc, stderr, 0);
786 0 : exit(1);
787 : }
788 : }
789 :
790 1888 : if (show_all_parameters) {
791 0 : show_parameter_list();
792 0 : exit(0);
793 : }
794 :
795 1888 : if (poptPeekArg(pc)) {
796 1888 : config_file = poptGetArg(pc);
797 : } else {
798 0 : config_file = get_dyn_CONFIGFILE();
799 : }
800 :
801 1888 : cname = poptGetArg(pc);
802 1888 : caddr = poptGetArg(pc);
803 :
804 1888 : poptFreeContext(pc);
805 :
806 1888 : if ( cname && ! caddr ) {
807 0 : printf ( "ERROR: You must specify both a machine name and an IP address.\n" );
808 0 : ret = 1;
809 0 : goto done;
810 : }
811 :
812 1892 : fprintf(stderr,"Load smb config files from %s\n",config_file);
813 :
814 1888 : if (!lp_load_with_registry_shares(config_file)) {
815 8 : fprintf(stderr,"Error loading services.\n");
816 8 : ret = 1;
817 8 : goto done;
818 : }
819 :
820 1884 : fprintf(stderr,"Loaded services file OK.\n");
821 :
822 1880 : if (samba_gnutls_weak_crypto_allowed()) {
823 1875 : weak_crypo_str = "allowed";
824 : } else {
825 1 : weak_crypo_str = "disallowed";
826 : }
827 1884 : fprintf(stderr, "Weak crypto is %s\n", weak_crypo_str);
828 :
829 1880 : if (skip_logic_checks == 0) {
830 1822 : ret = do_global_checks();
831 : }
832 :
833 1881880 : for (s=0;s<1000;s++) {
834 1880000 : if (VALID_SNUM(s) && (skip_logic_checks == 0)) {
835 1371 : do_per_share_checks(s);
836 : }
837 : }
838 :
839 :
840 1880 : if (!section_name && !parameter_name) {
841 504 : fprintf(stderr,
842 : "Server role: %s\n\n",
843 504 : server_role_str(lp_server_role()));
844 : }
845 :
846 1880 : if (!cname) {
847 1880 : if (!silent_mode) {
848 0 : fprintf(stderr,"Press enter to see a dump of your service definitions\n");
849 0 : fflush(stdout);
850 0 : getc(stdin);
851 : }
852 1880 : if (parameter_name || section_name) {
853 1376 : bool isGlobal = False;
854 1376 : s = GLOBAL_SECTION_SNUM;
855 :
856 1376 : if (!section_name) {
857 4 : section_name = GLOBAL_NAME;
858 4 : isGlobal = True;
859 1766 : } else if ((isGlobal=!strwicmp(section_name, GLOBAL_NAME)) == 0 &&
860 394 : (s=lp_servicenumber(section_name)) == -1) {
861 0 : fprintf(stderr,"Unknown section %s\n",
862 : section_name);
863 0 : ret = 1;
864 0 : goto done;
865 : }
866 1376 : if (parameter_name) {
867 1376 : if (!dump_a_parameter( s, parameter_name, stdout, isGlobal)) {
868 0 : fprintf(stderr,"Parameter %s unknown for section %s\n",
869 : parameter_name, section_name);
870 0 : ret = 1;
871 0 : goto done;
872 : }
873 : } else {
874 0 : if (isGlobal == True)
875 0 : lp_dump(stdout, show_defaults, 0);
876 : else
877 0 : lp_dump_one(stdout, show_defaults, s);
878 : }
879 1372 : goto done;
880 : }
881 :
882 504 : lp_dump(stdout, show_defaults, lp_numservices());
883 : }
884 :
885 504 : if(cname && caddr){
886 : /* this is totally ugly, a real `quick' hack */
887 0 : for (s=0;s<1000;s++) {
888 0 : if (VALID_SNUM(s)) {
889 0 : if (allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1), cname, caddr)
890 0 : && allow_access(lp_hosts_deny(s), lp_hosts_allow(s), cname, caddr)) {
891 0 : fprintf(stderr,"Allow connection from %s (%s) to %s\n",
892 : cname,caddr,lp_servicename(talloc_tos(), lp_sub, s));
893 : } else {
894 0 : fprintf(stderr,"Deny connection from %s (%s) to %s\n",
895 : cname,caddr,lp_servicename(talloc_tos(), lp_sub, s));
896 : }
897 : }
898 : }
899 : }
900 :
901 504 : done:
902 1888 : gfree_loadparm();
903 1888 : TALLOC_FREE(frame);
904 1884 : return ret;
905 : }
906 :
|