s3:smbd: use SMB_BUFFER_SIZE_MIN/MAX to limit lp_max_xmit()

The current limit of 128*1024 causes problems as the value has to be
<= UINT16_MAX otherwise some clients get confused, as they want to
use the MaxBufferSize value from the negprot response (uint32_t)
for the MaxBufferSize value in thet session setup request (uint16_t).
E.g. Windows 7 (as client) sends MaxBufferSize = 0 if the server value
is > UINT16_MAX.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a349b0bef9085fd139640ec92399bc63d8029cb9)

diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 65be50f890468905f96ea40c25ea7d42fd06c575..e7c5aed2a560bd0de76312a90844c43d5f570324 100644 (file)
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -3366,6 +3366,7 @@ void smbd_process(struct tevent_context *ev_ctx,
        const char *remaddr = NULL;
        char *rhost;
        int ret;
+       int tmp;
 
        conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
        if (conn == NULL) {
@@ -3653,7 +3654,11 @@ void smbd_process(struct tevent_context *ev_ctx,
 
        sconn->nbt.got_session = false;
 
-       sconn->smb1.negprot.max_recv = MIN(lp_max_xmit(),BUFFER_SIZE);
+       tmp = lp_max_xmit();
+       tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
+       tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
+
+       sconn->smb1.negprot.max_recv = tmp;
 
        sconn->smb1.sessions.done_sesssetup = false;
        sconn->smb1.sessions.max_send = BUFFER_SIZE;