From 5eb1ecd737dc4efb00074c40aa76e121f78f49d1 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 11 Aug 2021 11:25:37 +0530 Subject: [PATCH 01/46] Exclude PyDSDB library files Following library files are built without AD DC but has dependency on other components which are only available with DC: /usr/lib64/python3.9/site-packages/samba/dsdb.cpython-39-x86_64-linux-gnu.so /usr/lib64/python3.9/site-packages/samba/dsdb_dns.cpython-39-x86_64-linux-gnu.so Therefore we remove those from buildroot. resolves: #1991353 --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 2ab345f..b180f57 100644 --- a/samba.spec +++ b/samba.spec @@ -1201,6 +1201,8 @@ for i in \ %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ %{python3_sitearch}/samba/dnsserver.py \ %{python3_sitearch}/samba/domain_update.py \ + %{python3_sitearch}/samba/dsdb.*.so + %{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/forest_update.py \ %{python3_sitearch}/samba/kcc/__init__.py \ %{python3_sitearch}/samba/kcc/debug.py \ From 736516acc4ace22bd9916bba07a344a851ecc938 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 11 Aug 2021 11:26:39 +0530 Subject: [PATCH 02/46] Move `samba-tool` from samba-dc to samba-common-tools sub-package samba-tool is now built in a non AD DC environment and has been improved to prevent crashes due to import errors. See the following commits in upstream: * https://git.samba.org/?p=samba.git;a=commit;h=779d0f02718b3812024bafcd5477ec3039c7a0cf * https://git.samba.org/?p=samba.git;a=commit;h=fb5fe30e824d2d511188053ce04cf797b769727a * https://git.samba.org/?p=samba.git;a=commit;h=f241fe5d46e8dd2b3265be7eddbd6686a6f920db * https://git.samba.org/?p=samba.git;a=commit;h=a45ea91cd7e8335319c96ea5bda02014f584df63 related: #1991353 --- samba.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index b180f57..3b2523b 100644 --- a/samba.spec +++ b/samba.spec @@ -1193,7 +1193,6 @@ for i in \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ - %{_mandir}/man8/samba-tool.8 \ %{_mandir}/man8/samba-gpupdate.8 \ %{_libdir}/samba/ldb/ildap.so \ %{_libdir}/samba/ldb/ldbsamba_extensions.so \ @@ -1854,6 +1853,7 @@ fi %{_bindir}/net %{_bindir}/pdbedit %{_bindir}/profiles +%{_bindir}/samba-tool %{_bindir}/smbcontrol %{_bindir}/smbpasswd %{_bindir}/testparm @@ -1862,13 +1862,13 @@ fi %{_mandir}/man1/testparm.1* %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* +%{_mandir}/man8/samba-tool.8* %{_mandir}/man8/smbpasswd.8* ### DC %if %{with dc} || %{with testsuite} %files dc %{_unitdir}/samba.service -%{_bindir}/samba-tool %{_sbindir}/samba %{_sbindir}/samba_dnsupdate %{_sbindir}/samba_downgrade_db @@ -1936,7 +1936,6 @@ fi %{_mandir}/man8/samba.8* %{_mandir}/man8/samba_downgrade_db.8* %{_mandir}/man8/samba-gpupdate.8* -%{_mandir}/man8/samba-tool.8* %dir %{_datadir}/samba/admx %{_datadir}/samba/admx/samba.admx %dir %{_datadir}/samba/admx/en-US From e2cae66a51e2e4d4c69412b0c67720cf6f088756 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 10 Aug 2021 14:39:45 +0200 Subject: [PATCH 03/46] Require libs packages to be updated before restarting winbindd --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index 3b2523b..033a8fa 100644 --- a/samba.spec +++ b/samba.spec @@ -812,9 +812,12 @@ Summary: Samba winbind Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires(post): %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires(post): %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} %if %{with libwbclient} From 9c6ca357c2903327fe86c0f017fcf4d85fff76e5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 10 Aug 2021 15:23:24 +0200 Subject: [PATCH 04/46] Use more CPUs for re-linking during the install step if possible --- samba.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 033a8fa..bbbdccc 100644 --- a/samba.spec +++ b/samba.spec @@ -1103,7 +1103,8 @@ pushd pidl popd %install -%make_install +# Do not use %%make_install, make is just a wrapper around waf in Samba! +%{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} install -d -m 0755 %{buildroot}/usr/{sbin,bin} install -d -m 0755 %{buildroot}%{_libdir}/security From 4e6b80c7bee562c37f1bf32aa542e4563c28e34b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 10 Aug 2021 15:51:28 +0200 Subject: [PATCH 05/46] Document how to build with fedpkg --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index bbbdccc..15573f1 100644 --- a/samba.spec +++ b/samba.spec @@ -2,12 +2,16 @@ # # To build and run the tests use: # +# fedpkg local --with testsuite +# or # rpmbuild --rebuild --with testsuite samba.src.rpm # %bcond_with testsuite # Build with internal talloc, tevent, tdb and ldb. # +# fedpkg local --with=testsuite --with=includelibs +# or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # %bcond_with includelibs From c68c1e920fced94cd5c0e4bd81aaee92f7e7fe77 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Thu, 12 Aug 2021 16:23:20 +0530 Subject: [PATCH 06/46] Fix inclusion of PyDSDB library files Commit cc8c80c04bab6ec65a12dbe779bfb12b2b6f793a removed the following PyDSDB library files from buildroot: * /usr/lib64/python3.9/site-packages/samba/dsdb.cpython-39-x86_64-linux-gnu.so * /usr/lib64/python3.9/site-packages/samba/dsdb_dns.cpython-39-x86_64-linux-gnu.so This was done under the impression that their dependency on libdnsserver-common-samba4.so was not built in a non AD DC environment. But in reality it was also conditionally removed from the buildroot. Apart from including PyDSDB back into python3-samba, we avoid removing libdnsserver-common-samba4.so from buildroot and subsequently include it in samba-libs to satisfy all dependencies. Additionally we remove PyDSDB listing from %files section of python3-samba-dc sub-package. --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 15573f1..1da51f3 100644 --- a/samba.spec +++ b/samba.spec @@ -1196,7 +1196,6 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ %{_libdir}/samba/libdfs-server-ad-samba4.so \ - %{_libdir}/samba/libdnsserver-common-samba4.so \ %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ @@ -2168,6 +2167,7 @@ fi %{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libauth-unix-token-samba4.so %{_libdir}/samba/libdcerpc-samba4.so +%{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so @@ -2350,6 +2350,8 @@ fi %{python3_sitearch}/samba/descriptor.py %{python3_sitearch}/samba/dnsresolver.py %{python3_sitearch}/samba/drs_utils.py +%{python3_sitearch}/samba/dsdb.*.so +%{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py %{python3_sitearch}/samba/gpclass.py @@ -2541,8 +2543,6 @@ fi %{python3_sitearch}/samba/dcerpc/dnsserver.*.so %{python3_sitearch}/samba/dckeytab.*.so -%{python3_sitearch}/samba/dsdb.*.so -%{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/domain_update.py %{python3_sitearch}/samba/forest_update.py %{python3_sitearch}/samba/ms_forest_updates_markdown.py From 9eec8f559aefe1ca0522daf48b3c2828bbfa504e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Aug 2021 14:41:44 +0200 Subject: [PATCH 07/46] Add missing Requires in samba-common-tools for samba-tool --- samba.spec | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index 1da51f3..b1d4937 100644 --- a/samba.spec +++ b/samba.spec @@ -119,7 +119,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 4 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -461,6 +461,13 @@ Requires: samba-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +# samba-tool needs python3-samba +Requires: python3-%{samba} = %{samba_depver} +# samba-tool needs tdbbackup +Requires: tdb-tools +# samba-tool needs mdb_copy +Requires: lmdb + Provides: bundled(libreplace) %description common-tools @@ -482,10 +489,6 @@ Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -# samba-tool needs tdbbackup -Requires: tdb-tools -# samba-tool needs mdb_copy -Requires: lmdb Requires: ldb-tools Requires: python3-setproctitle # Force using libldb version to be the same as build version @@ -4006,6 +4009,9 @@ fi %endif %changelog +* Thu Aug 12 2021 Andreas Schneider - 4.15.0rc2-4 +- Package samba-tool correctly + * Mon Aug 09 2021 Guenther Deschner - 4.15.0rc2-3 - Update to Samba 4.15.0rc2 - resolves: #1991634 From 587d842150662bdda56fa2cdf7d9253ea9a7b8f3 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 13 Aug 2021 09:12:01 -0700 Subject: [PATCH 08/46] Fix samba-common-tools dependency It was literally "python3-%{samba}", which obviously didn't work. --- samba.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index b1d4937..230cfcf 100644 --- a/samba.spec +++ b/samba.spec @@ -119,7 +119,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 4 +%global baserelease 5 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -462,7 +462,7 @@ Requires: libwbclient = %{samba_depver} %endif # samba-tool needs python3-samba -Requires: python3-%{samba} = %{samba_depver} +Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools # samba-tool needs mdb_copy @@ -4009,10 +4009,13 @@ fi %endif %changelog -* Thu Aug 12 2021 Andreas Schneider - 4.15.0rc2-4 +* Fri Aug 13 2021 Adam Williamson - 4.15.0-0.5.rc2 +- Fix samba-common-tools dependency + +* Thu Aug 12 2021 Andreas Schneider - 4.15.0-0.4.rc2 - Package samba-tool correctly -* Mon Aug 09 2021 Guenther Deschner - 4.15.0rc2-3 +* Mon Aug 09 2021 Guenther Deschner - 4.15.0-0.3.rc2 - Update to Samba 4.15.0rc2 - resolves: #1991634 From 517ac654555463d917923e6d8502e6934940d35c Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Thu, 12 Aug 2021 20:43:41 +0530 Subject: [PATCH 09/46] Remove duplicate listing for libdnsserver-common-samba4.so libdnsserver-common-samba4.so is already getting packaged in samba-libs sub-package(see 68140d413f26c4fbcaab6a0094e363411f5f35bc) and samba-dc-libs pulls in samba-libs. Therefore removing it from samba-dc-libs. --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 230cfcf..5880a08 100644 --- a/samba.spec +++ b/samba.spec @@ -1988,7 +1988,6 @@ fi %endif %{_libdir}/libdcerpc-server.so.* -%{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libdsdb-module-samba4.so %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so %{_libdir}/samba/libscavenge-dns-records-samba4.so From 31f031d2c27fcd228380b3bde8ede4e0087ed3d7 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Mon, 16 Aug 2021 13:21:01 +0530 Subject: [PATCH 10/46] Revert "Exclude PyDSDB library files" This reverts commit cc8c80c04bab6ec65a12dbe779bfb12b2b6f793a. --- samba.spec | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 5880a08..9110f2a 100644 --- a/samba.spec +++ b/samba.spec @@ -119,7 +119,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 5 +%global baserelease 6 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -1210,8 +1210,6 @@ for i in \ %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ %{python3_sitearch}/samba/dnsserver.py \ %{python3_sitearch}/samba/domain_update.py \ - %{python3_sitearch}/samba/dsdb.*.so - %{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/forest_update.py \ %{python3_sitearch}/samba/kcc/__init__.py \ %{python3_sitearch}/samba/kcc/debug.py \ @@ -4008,6 +4006,9 @@ fi %endif %changelog +* Mon Aug 16 2021 Anoop C S - 4.15.0-0.6.rc2 +- Avoid removing PyDSDB library files from buildroot for non AD DC build + * Fri Aug 13 2021 Adam Williamson - 4.15.0-0.5.rc2 - Fix samba-common-tools dependency From cc8f1ab0bc3a827ac06fc2c631efdeffb56151c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 25 Aug 2021 13:24:34 +0200 Subject: [PATCH 11/46] Add ceph and etcd mutex helpers for CTDB Guenther --- samba-ctdb-etcd-reclock.patch | 30 +++++++++++++++ samba.spec | 69 ++++++++++++++++++++++++++++++++++- 2 files changed, 97 insertions(+), 2 deletions(-) create mode 100644 samba-ctdb-etcd-reclock.patch diff --git a/samba-ctdb-etcd-reclock.patch b/samba-ctdb-etcd-reclock.patch new file mode 100644 index 0000000..2a55408 --- /dev/null +++ b/samba-ctdb-etcd-reclock.patch @@ -0,0 +1,30 @@ +From 939aed0498269df3c1e012f3b68c314b583f25bd Mon Sep 17 00:00:00 2001 +From: Martin Schwenke +Date: Tue, 27 Apr 2021 15:46:14 +1000 +Subject: [PATCH] utils: Use Python 3 + +Due to the number of flake8 and pylint warnings it is unclear if the +source has Python 3 incompatibilities. These will be cleaned up in +subsequent commits. + +Signed-off-by: "L.P.H. van Belle" +Reviewed-by: Martin Schwenke +Reviewed-by: David Disseldorp +Reviewed-by: Jose A. Rivera +--- + ctdb/utils/etcd/ctdb_etcd_lock | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ctdb/utils/etcd/ctdb_etcd_lock b/ctdb/utils/etcd/ctdb_etcd_lock +index 000c6bb7208..7f5194eff0a 100755 +--- a/ctdb/utils/etcd/ctdb_etcd_lock ++++ b/ctdb/utils/etcd/ctdb_etcd_lock +@@ -1,4 +1,4 @@ +-#!/usr/bin/python ++#!/usr/bin/env python3 + # + # This program is free software: you can redistribute it and/or modify + # it under the terms of the GNU General Public License as published by +-- +2.31.1 + diff --git a/samba.spec b/samba.spec index 9110f2a..9752b92 100644 --- a/samba.spec +++ b/samba.spec @@ -46,18 +46,21 @@ %bcond_without winexe %endif -# Build vfs_ceph module by default on 64bit Fedora +# Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 %bcond_without vfs_cephfs +%bcond_without ceph_mutex %else %bcond_with vfs_cephfs +%bcond_with ceph_mutex #endifarch %endif %else %bcond_with vfs_cephfs +%bcond_with ceph_mutex #endif fedora %endif @@ -117,9 +120,16 @@ %bcond_with pcp_pmda %endif +# Build the etcd helpers by default on Fedora +%if 0%{?fedora} +%bcond_without etcd_mutex +%else +%bcond_with etcd_mutex +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 6 +%global baserelease 7 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -189,6 +199,7 @@ Source14: samba.pamd Source201: README.downgrade Patch0: samba-s4u.patch +Patch1: samba-ctdb-etcd-reclock.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -299,6 +310,12 @@ BuildRequires: liburing-devel >= 0.4 %if %{with pcp_pmda} BuildRequires: pcp-libs-devel %endif +%if %{with ceph_mutex} +BuildRequires: librados-devel +%endif +%if %{with etcd_mutex} +BuildRequires: python3-etcd +%endif %if %{with dc} || %{with testsuite} # Add python3-iso8601 to avoid that the @@ -998,6 +1015,31 @@ Performance Co-Pilot (PCP) support for CTDB #endif with pcp_pmda %endif +%if %{with etcd_mutex} + +%package -n ctdb-etcd-mutex +Summary: CTDB ETCD mutex helper +Requires: ctdb = %{samba_depver} +Requires: python3-etcd + +%description -n ctdb-etcd-mutex +Support for using an existing ETCD cluster as a mutex helper for CTDB + +#endif with etcd_mutex +%endif + +%if %{with ceph_mutex} + +%package -n ctdb-ceph-mutex +Summary: CTDB ceph mutex helper +Requires: ctdb = %{samba_depver} + +%description -n ctdb-ceph-mutex +Support for using an existing CEPH cluster as a mutex helper for CTDB + +#endif with ceph_mutex +%endif + #endif with clustering %endif @@ -1090,6 +1132,12 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %endif %if %{with pcp_pmda} --enable-pmda \ +%endif +%if %{with ceph_mutex} + --enable-ceph-reclock \ +%endif +%if %{with etcd_mutex} + --enable-etcd-reclock \ %endif --with-profiling-data \ --with-systemd \ @@ -3995,6 +4043,20 @@ fi #endif with pcp_pmda %endif +%if %{with etcd_mutex} +%files -n ctdb-etcd-mutex +%{_libexecdir}/ctdb/ctdb_etcd_lock +%{_mandir}/man7/ctdb-etcd.7.gz +#endif with etcd_mutex +%endif + +%if %{with ceph_mutex} +%files -n ctdb-ceph-mutex +%{_libexecdir}/ctdb/ctdb_mutex_ceph_rados_helper +%{_mandir}/man7/ctdb_mutex_ceph_rados_helper.7.gz +#endif with ceph_mutex +%endif + #endif with clustering %endif @@ -4006,6 +4068,9 @@ fi %endif %changelog +* Wed Aug 25 2021 Guenther Deschner - 4.15.0-0.7.rc2 +- Add ceph and etcd mutex helpers for CTDB + * Mon Aug 16 2021 Anoop C S - 4.15.0-0.6.rc2 - Avoid removing PyDSDB library files from buildroot for non AD DC build From 9d6b8a93a5180323f038ebe19d332ef593bed76f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 26 Aug 2021 13:16:50 +0200 Subject: [PATCH 12/46] Update to Samba 4.15.0rc3 resolves: #1998024 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index ba9b72a..d38fc2e 100644 --- a/.gitignore +++ b/.gitignore @@ -257,3 +257,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc1.tar.asc /samba-4.15.0rc2.tar.xz /samba-4.15.0rc2.tar.asc +/samba-4.15.0rc3.tar.xz +/samba-4.15.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 9752b92..29513ba 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 7 +%global baserelease 8 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4068,6 +4068,10 @@ fi %endif %changelog +* Thu Aug 26 2021 Guenther Deschner - 4.15.0-0.8.rc3 +- Update to Samba 4.15.0rc3 +- resolves: #1998024 + * Wed Aug 25 2021 Guenther Deschner - 4.15.0-0.7.rc2 - Add ceph and etcd mutex helpers for CTDB diff --git a/sources b/sources index d31e6c6..a810c11 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc2.tar.xz) = 5ff2f44c068babd3e37751e4cb52fd73d7c4da8f8d11fb6952206bc970b1206b0af3705991493a0ce1dcbe61d2c9ef6625b6a9b601f77324d5faaa0a9ac4e7d3 -SHA512 (samba-4.15.0rc2.tar.asc) = 8ee5488a0d226d72ae8a84898715ca8f27e7f83dfbc712a52d52e740b08aabd66155c091f92c3ac1a4c58d489ffa6f91a7f293cccb5fba3b878f81fb11da40ff +SHA512 (samba-4.15.0rc3.tar.xz) = 4f3fd39b22cbc08001f1b9f4295a1acba22b6d0c82235704d35667329e608b844f5b793e39fd84e3b4bd7956ae7991c2958031531c673ddbde593799e6af5d47 +SHA512 (samba-4.15.0rc3.tar.asc) = 6f8d7a69d643208c2dbfd4423b5351319c4a8361cac2ea5fa378787a885d63794018ec96334a847a5aaf2e0ad494846164a2a13aab7ffe1b9f35afa671c531d8 From 1b7a85261318b890494b56cf251b95b561b5ef3e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 1 Sep 2021 13:47:44 +0200 Subject: [PATCH 13/46] Update to Samba 4.15.0rc4 resolves: #2000079 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index d38fc2e..fcd6170 100644 --- a/.gitignore +++ b/.gitignore @@ -259,3 +259,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc2.tar.asc /samba-4.15.0rc3.tar.xz /samba-4.15.0rc3.tar.asc +/samba-4.15.0rc4.tar.xz +/samba-4.15.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index 29513ba..d9dd415 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 8 +%global baserelease 9 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4068,6 +4068,10 @@ fi %endif %changelog +* Wed Sep 01 2021 Guenther Deschner - 4.15.0-0.9.rc4 +- Update to Samba 4.15.0rc4 +- resolves: #2000079 + * Thu Aug 26 2021 Guenther Deschner - 4.15.0-0.8.rc3 - Update to Samba 4.15.0rc3 - resolves: #1998024 diff --git a/sources b/sources index a810c11..3aacdc3 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc3.tar.xz) = 4f3fd39b22cbc08001f1b9f4295a1acba22b6d0c82235704d35667329e608b844f5b793e39fd84e3b4bd7956ae7991c2958031531c673ddbde593799e6af5d47 -SHA512 (samba-4.15.0rc3.tar.asc) = 6f8d7a69d643208c2dbfd4423b5351319c4a8361cac2ea5fa378787a885d63794018ec96334a847a5aaf2e0ad494846164a2a13aab7ffe1b9f35afa671c531d8 +SHA512 (samba-4.15.0rc4.tar.xz) = 0fc9fce786b539dec7dd93e6403d5ff4e67e7cb17a4b064e6af23c98e4b122b1ce12653c5dcb7aa4317d91b729f98864988981456a8344e0ff7eb66bf8956104 +SHA512 (samba-4.15.0rc4.tar.asc) = dd2823db2b2b16d0a0c3cb61410320812eeae38f4a76b83951dec8d72e2821043af960aae3929d132a33aa7d7cf1f481446ed32738393192050b147d07116664 From 22b551a53488c6ccbe494e9ff0e14df1d30d2bd7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 3 Sep 2021 09:07:20 +0200 Subject: [PATCH 14/46] We need python3-cryptography for krb5 tests --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index d9dd415..678fc7f 100644 --- a/samba.spec +++ b/samba.spec @@ -360,6 +360,7 @@ BuildRequires: ldb-tools BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-setproctitle +BuildRequires: python3-cryptography BuildRequires: tdb-tools %endif From 06819eabeba79ff0af83548a2360422a034e3c47 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 3 Sep 2021 09:07:37 +0200 Subject: [PATCH 15/46] The testsuite requires lmdb-devel --- samba.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 678fc7f..fc4720c 100644 --- a/samba.spec +++ b/samba.spec @@ -346,7 +346,9 @@ BuildRequires: python3-tdb >= %{tdb_version} BuildRequires: libldb-devel >= %{ldb_version} BuildRequires: python3-ldb >= %{ldb_version} BuildRequires: python3-ldb-devel >= %{ldb_version} -%else +%endif + +%if %{with includelibs} || %{with testsuite} # lmdb-devel is required for the mdb ldb module, if samba is configured # to build includelibs we need lmdb-devel for building that module on our own BuildRequires: lmdb-devel From 980763e0d8ba23dda1a545d37c49819efa2b8f4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 7 Sep 2021 12:21:08 +0200 Subject: [PATCH 16/46] Update to Samba 4.15.0rc5 resolves: #2001827 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index fcd6170..3ff73e5 100644 --- a/.gitignore +++ b/.gitignore @@ -261,3 +261,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc3.tar.asc /samba-4.15.0rc4.tar.xz /samba-4.15.0rc4.tar.asc +/samba-4.15.0rc5.tar.xz +/samba-4.15.0rc5.tar.asc diff --git a/samba.spec b/samba.spec index fc4720c..d0800f8 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 9 +%global baserelease 10 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc4 +%global pre_release rc5 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4071,6 +4071,10 @@ fi %endif %changelog +* Tue Sep 07 2021 Guenther Deschner - 4.15.0-0.10.rc5 +- Update to Samba 4.15.0rc5 +- resolves: #2001827 + * Wed Sep 01 2021 Guenther Deschner - 4.15.0-0.9.rc4 - Update to Samba 4.15.0rc4 - resolves: #2000079 diff --git a/sources b/sources index 3aacdc3..aa7540e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc4.tar.xz) = 0fc9fce786b539dec7dd93e6403d5ff4e67e7cb17a4b064e6af23c98e4b122b1ce12653c5dcb7aa4317d91b729f98864988981456a8344e0ff7eb66bf8956104 -SHA512 (samba-4.15.0rc4.tar.asc) = dd2823db2b2b16d0a0c3cb61410320812eeae38f4a76b83951dec8d72e2821043af960aae3929d132a33aa7d7cf1f481446ed32738393192050b147d07116664 +SHA512 (samba-4.15.0rc5.tar.xz) = 53b79354a441e4a29ed7e807e0f18d4249b8ee0f99bf034947dd4c4674f68eb2b795832130025ab214cc3ad2deaa771b202131addc0b563a2d4310b7809e698d +SHA512 (samba-4.15.0rc5.tar.asc) = 0eea9c233c98bd52ad91a2c7bcf384d3dbe5b7017bf76dd29b083256ed95e78b6538d25d93b04710c4684d077755179a813dda82470301b8f87f63b61a6f2461 From 1a5ca895d7f8ba582fb41b57d4761ef96d69ed65 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 9 Sep 2021 09:58:04 +0200 Subject: [PATCH 17/46] Update to Samba 4.15.0rc6 resolves: #2002546 Guenther --- .gitignore | 2 ++ samba-s4u.patch | 69 ++++++++++++++++++++++++------------------------- samba.spec | 12 +++++++-- sources | 4 +-- 4 files changed, 48 insertions(+), 39 deletions(-) diff --git a/.gitignore b/.gitignore index 3ff73e5..3b7fe64 100644 --- a/.gitignore +++ b/.gitignore @@ -263,3 +263,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc4.tar.asc /samba-4.15.0rc5.tar.xz /samba-4.15.0rc5.tar.asc +/samba-4.15.0rc6.tar.xz +/samba-4.15.0rc6.tar.asc diff --git a/samba-s4u.patch b/samba-s4u.patch index 83ed873..bb323f3 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,22 +1,21 @@ -From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001 +From 7c4125deb1e03917f0a2353740f2c0e9e6cf87c5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support +Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider --- - source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++--------- - source4/kdc/mit_samba.c | 47 ++---- - source4/kdc/mit_samba.h | 6 +- - wscript_configure_system_mitkrb5 | 3 + - 6 files changed, 91 insertions(+), 115 deletions(-) + source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++++------------ + source4/kdc/mit_samba.c | 47 ++----- + source4/kdc/mit_samba.h | 6 +- + 3 files changed, 86 insertions(+), 115 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index 9197551ed61..944324d9a2f 100644 +index ac9865aac60..17d4c4028b9 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, krb5_keyblock *krbtgt_key, krb5_timestamp authtime, krb5_authdata **tgt_auth_data, @@ -37,7 +36,7 @@ index 9197551ed61..944324d9a2f 100644 mit_ctx = ks_get_context(context); if (mit_ctx == NULL) { -@@ -230,41 +234,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -233,41 +237,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = krb5_pac_parse(context, authdata[0]->contents, authdata[0]->length, @@ -107,7 +106,7 @@ index 9197551ed61..944324d9a2f 100644 if (code != 0) { goto done; } -@@ -272,17 +278,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -275,17 +281,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = mit_samba_reget_pac(mit_ctx, context, flags, @@ -134,18 +133,18 @@ index 9197551ed61..944324d9a2f 100644 return code; } -@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -310,7 +321,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krb5_authdata ***signed_auth_data) { - #endif krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; + krb5_const_principal pac_client; krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -318,24 +329,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; - #endif - /* FIXME: We don't support S4U yet */ - if (flags & KRB5_KDB_FLAGS_S4U) { @@ -179,7 +178,7 @@ index 9197551ed61..944324d9a2f 100644 client, server, krbtgt, -@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -347,14 +355,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, if (code != 0) { goto done; } @@ -209,7 +208,7 @@ index 9197551ed61..944324d9a2f 100644 } if (pac == NULL) { -@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -363,7 +385,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, } code = krb5_pac_sign(context, pac, authtime, client_princ, @@ -218,7 +217,7 @@ index 9197551ed61..944324d9a2f 100644 if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -389,11 +411,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -230,7 +229,7 @@ index 9197551ed61..944324d9a2f 100644 done: krb5_pac_free(context, pac); -@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, +@@ -416,32 +433,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -265,10 +264,10 @@ index 9197551ed61..944324d9a2f 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 54dcd545ea1..f23327c9613 100644 +index 0a0d3a98315..5f35c6025bf 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -493,7 +493,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -276,7 +275,7 @@ index 54dcd545ea1..f23327c9613 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -641,7 +640,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -285,7 +284,7 @@ index 54dcd545ea1..f23327c9613 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -963,41 +962,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -362,12 +361,13 @@ index ba824557bd5..5aadf206443 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.25.4 +2.31.1 -From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001 + +From b2ada81ed9f89f6b38fb0a9e54811408676671d0 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build +Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -375,7 +375,7 @@ Pair-Programmed-With: Andreas Schneider lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ lib/krb5_wrap/krb5_samba.h | 2 - source4/auth/kerberos/kerberos_util.c | 11 -- - 4 files changed, 185 insertions(+), 14 deletions(-) + 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c index 20ce86c708d..e72ab3c30f7 100644 @@ -574,7 +574,7 @@ index 20ce86c708d..e72ab3c30f7 100644 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index ca9a893e4f7..3264ce5eb3b 100644 +index 9550447b2c5..ee3931c7544 100644 --- a/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -639,14 +639,13 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.25.4 +2.31.1 - -From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001 +From bc5e97074739d29320a3e890575353fbfd452047 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code +Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code --- source4/heimdal/lib/hdb/hdb.h | 1 + @@ -696,10 +695,10 @@ index a560a1cd84b..c27b6a8ef4c 100644 ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index f23327c9613..4084e893cc2 100644 +index 5f35c6025bf..20ee2c2b89e 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, +@@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { sflags |= SDB_F_CANON; } @@ -722,5 +721,5 @@ index c929acccce6..a9115ec23d7 100644 void sdb_free_entry(struct sdb_entry_ex *e); void free_sdb_entry(struct sdb_entry *s); -- -2.25.4 +2.31.1 diff --git a/samba.spec b/samba.spec index d0800f8..9a183c7 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 10 +%global baserelease 11 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc5 +%global pre_release rc6 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -2813,6 +2813,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc @@ -2832,6 +2833,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py +%{python3_sitearch}/samba/tests/dcerpc/lsa.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py %{python3_sitearch}/samba/tests/dcerpc/misc.py %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py @@ -2901,6 +2903,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc @@ -2919,6 +2922,7 @@ fi %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py @@ -4071,6 +4075,10 @@ fi %endif %changelog +* Thu Sep 09 2021 Guenther Deschner - 4.15.0-0.11.rc6 +- Update to Samba 4.15.0rc6 +- resolves: #2002546 + * Tue Sep 07 2021 Guenther Deschner - 4.15.0-0.10.rc5 - Update to Samba 4.15.0rc5 - resolves: #2001827 diff --git a/sources b/sources index aa7540e..944c241 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc5.tar.xz) = 53b79354a441e4a29ed7e807e0f18d4249b8ee0f99bf034947dd4c4674f68eb2b795832130025ab214cc3ad2deaa771b202131addc0b563a2d4310b7809e698d -SHA512 (samba-4.15.0rc5.tar.asc) = 0eea9c233c98bd52ad91a2c7bcf384d3dbe5b7017bf76dd29b083256ed95e78b6538d25d93b04710c4684d077755179a813dda82470301b8f87f63b61a6f2461 +SHA512 (samba-4.15.0rc6.tar.xz) = 9b3c7e2f34e672072da9fcfc5613079f884ab7120d19f09f18c74262eddc342bff00796ed1b0c30ba1a8b8dc2b22cdba9909baca82da91bd9352de334c1ef271 +SHA512 (samba-4.15.0rc6.tar.asc) = 5aa243b3dc68890feef77d44d2beae2401a9827219fe84a53d564e1e6b56175e46282c7e0c6ac932fd535bc1bf4b8a5403da4281a0bb7919543e2a464b9e8c89 From bcfd64e7938f153e519a312ef73b19ee5247649d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 13 Sep 2021 17:31:33 +0200 Subject: [PATCH 18/46] Update to Samba 4.15.0rc7 resolves: #2003740 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3b7fe64..9c56e55 100644 --- a/.gitignore +++ b/.gitignore @@ -265,3 +265,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc5.tar.asc /samba-4.15.0rc6.tar.xz /samba-4.15.0rc6.tar.asc +/samba-4.15.0rc7.tar.xz +/samba-4.15.0rc7.tar.asc diff --git a/samba.spec b/samba.spec index 9a183c7..36cfb7a 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 11 +%global baserelease 12 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc6 +%global pre_release rc7 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4075,6 +4075,10 @@ fi %endif %changelog +* Mon Sep 13 2021 Guenther Deschner - 4.15.0-0.12.rc7 +- Update to Samba 4.15.0rc7 +- resolves: #2003740 + * Thu Sep 09 2021 Guenther Deschner - 4.15.0-0.11.rc6 - Update to Samba 4.15.0rc6 - resolves: #2002546 diff --git a/sources b/sources index 944c241..ec69424 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc6.tar.xz) = 9b3c7e2f34e672072da9fcfc5613079f884ab7120d19f09f18c74262eddc342bff00796ed1b0c30ba1a8b8dc2b22cdba9909baca82da91bd9352de334c1ef271 -SHA512 (samba-4.15.0rc6.tar.asc) = 5aa243b3dc68890feef77d44d2beae2401a9827219fe84a53d564e1e6b56175e46282c7e0c6ac932fd535bc1bf4b8a5403da4281a0bb7919543e2a464b9e8c89 +SHA512 (samba-4.15.0rc7.tar.xz) = 0c99c56b0f335f0def3cc7b5fd75509284644c77f4c61b783887251d622c6aa65ed15bf6093a012e5119915f5d85f85bd970562b5f5f124b4d08729a3f80cab2 +SHA512 (samba-4.15.0rc7.tar.asc) = 4847ab608122c71330ee694e66b7ceb54342458f292d0541356c4756705f465d64233408fc6400b04b312c688df352a4ec469e25f1aefac6d19fe284963e978f From d08fbf834ac0f351f35f72b42088c196dac977b9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 20 Sep 2021 11:30:25 +0200 Subject: [PATCH 19/46] Update to Samba 4.15.0 resolves: #2005817 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9c56e55..1738d1e 100644 --- a/.gitignore +++ b/.gitignore @@ -267,3 +267,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc6.tar.asc /samba-4.15.0rc7.tar.xz /samba-4.15.0rc7.tar.asc +/samba-4.15.0.tar.xz +/samba-4.15.0.tar.asc diff --git a/samba.spec b/samba.spec index 36cfb7a..2077c18 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 12 +%global baserelease 13 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc7 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4075,6 +4075,10 @@ fi %endif %changelog +* Mon Sep 20 2021 Guenther Deschner - 4.15.0-13 +- Update to Samba 4.15.0 +- resolves: #2005817 + * Mon Sep 13 2021 Guenther Deschner - 4.15.0-0.12.rc7 - Update to Samba 4.15.0rc7 - resolves: #2003740 diff --git a/sources b/sources index ec69424..2e78289 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc7.tar.xz) = 0c99c56b0f335f0def3cc7b5fd75509284644c77f4c61b783887251d622c6aa65ed15bf6093a012e5119915f5d85f85bd970562b5f5f124b4d08729a3f80cab2 -SHA512 (samba-4.15.0rc7.tar.asc) = 4847ab608122c71330ee694e66b7ceb54342458f292d0541356c4756705f465d64233408fc6400b04b312c688df352a4ec469e25f1aefac6d19fe284963e978f +SHA512 (samba-4.15.0.tar.xz) = 2fe016ec75a2c788c648466a3bac13a6cdbc158c2f8c18e4fdf09f6ac48b376e6545ab264be92820582ae9fa778010bc639d0b00afacf47a42c002fa291aac5d +SHA512 (samba-4.15.0.tar.asc) = bf1a80c70869ef3c35dde774d5965b8aea4b8be01edc1fd46e1a3bdf972fd3ef17354de726d1d159cb54c92869fbb09b92814c41c3508de67694245aa93d5bc7 From 5e125866b26b90542ba0643b4932fac6a91db5fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 27 Oct 2021 16:10:52 +0200 Subject: [PATCH 20/46] Update to Samba 4.15.1 resolves: #2017847 Guenther --- .gitignore | 2 ++ samba.spec | 14 +++++++++++--- sources | 4 ++-- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 1738d1e..4140b12 100644 --- a/.gitignore +++ b/.gitignore @@ -269,3 +269,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc7.tar.asc /samba-4.15.0.tar.xz /samba-4.15.0.tar.asc +/samba-4.15.1.tar.xz +/samba-4.15.1.tar.asc diff --git a/samba.spec b/samba.spec index 2077c18..b04f8d0 100644 --- a/samba.spec +++ b/samba.spec @@ -129,13 +129,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 13 +%global baserelease 0 -%global samba_version 4.15.0 +%global samba_version 4.15.1 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 -%global ldb_version 2.4.0 +%global ldb_version 2.4.1 # This should be rc1 or nil %global pre_release %nil @@ -2912,6 +2912,8 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc @@ -2931,6 +2933,8 @@ fi %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py +%{python3_sitearch}/samba/tests/krb5/rodc_tests.py +%{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py @@ -4075,6 +4079,10 @@ fi %endif %changelog +* Wed Oct 27 2021 Guenther Deschner - 4.15.1-0 +- Update to Samba 4.15.1 +- resolves: #2017847 + * Mon Sep 20 2021 Guenther Deschner - 4.15.0-13 - Update to Samba 4.15.0 - resolves: #2005817 diff --git a/sources b/sources index 2e78289..ac5f2eb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0.tar.xz) = 2fe016ec75a2c788c648466a3bac13a6cdbc158c2f8c18e4fdf09f6ac48b376e6545ab264be92820582ae9fa778010bc639d0b00afacf47a42c002fa291aac5d -SHA512 (samba-4.15.0.tar.asc) = bf1a80c70869ef3c35dde774d5965b8aea4b8be01edc1fd46e1a3bdf972fd3ef17354de726d1d159cb54c92869fbb09b92814c41c3508de67694245aa93d5bc7 +SHA512 (samba-4.15.1.tar.xz) = 7422c4ed625411f8a4765f8e21f3b8e0c9d68f259cc25ed9f47e6243e849722ad6fa907fad989f19715ca799bc249cda4ef8a8bb930120d61851143072ef7558 +SHA512 (samba-4.15.1.tar.asc) = 0fd0a9761b2dcbd43600490a32d462f50dcd42232a79e40c3a29df5630c9df412bdfac7aeb0eb34b8ce7a9a01ba8e0da612f5771fa9d45f12d77a4ae5c875d82 From 1820608e708e51536b3795f825a00ff0133dbbca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 5 Nov 2021 15:00:31 +0100 Subject: [PATCH 21/46] Fix winexe core dump resolves: #2020376 Guenther --- samba-4.15.1-winexe.patch | 61 +++++++++++++++++++++++++++++++++++++++ samba.spec | 7 ++++- 2 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 samba-4.15.1-winexe.patch diff --git a/samba-4.15.1-winexe.patch b/samba-4.15.1-winexe.patch new file mode 100644 index 0000000..38460b3 --- /dev/null +++ b/samba-4.15.1-winexe.patch @@ -0,0 +1,61 @@ +From 3d02bf10d7738fe604b524863764de3ca1faa081 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Deschner?= +Date: Thu, 4 Nov 2021 22:22:44 +0100 +Subject: [PATCH] s3-winexe: Fix winexe core dump (use-after-free) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14893 + +Guenther + +Signed-off-by: Guenther Deschner +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Günther Deschner +Autobuild-Date(master): Fri Nov 5 11:43:57 UTC 2021 on sn-devel-184 + +(cherry picked from commit e9495d2ed28a26899dc3dd77bdfe56e284980218) +--- + examples/winexe/winexe.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c +index 3e0813a4091..59fb9dbdebb 100644 +--- a/examples/winexe/winexe.c ++++ b/examples/winexe/winexe.c +@@ -220,8 +220,6 @@ static void parse_args(int argc, const char *argv[], + *port_str = '\0'; + } + +- poptFreeContext(pc); +- + if (options->runas == NULL && options->runas_file != NULL) { + struct cli_credentials *runas_cred; + const char *user; +@@ -253,9 +251,19 @@ static void parse_args(int argc, const char *argv[], + + options->credentials = samba_cmdline_get_creds(); + +- options->hostname = argv_new[0] + 2; ++ options->hostname = talloc_strdup(mem_ctx, argv_new[0] + 2); ++ if (options->hostname == NULL) { ++ DBG_ERR("Out of memory\n"); ++ exit(1); ++ } + options->port = port; +- options->cmd = argv_new[1]; ++ options->cmd = talloc_strdup(mem_ctx, argv_new[1]); ++ if (options->cmd == NULL) { ++ DBG_ERR("Out of memory\n"); ++ exit(1); ++ } ++ ++ poptFreeContext(pc); + + options->flags = flag_interactive; + if (flag_reinstall) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index b04f8d0..501250c 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.1 %global talloc_version 2.3.3 @@ -200,6 +200,7 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch +Patch2: samba-4.15.1-winexe.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4079,6 +4080,10 @@ fi %endif %changelog +* Fri Nov 05 2021 Guenther Deschner - 4.15.1-1 +- Fix winexe core dump +- resolves: #2020376 + * Wed Oct 27 2021 Guenther Deschner - 4.15.1-0 - Update to Samba 4.15.1 - resolves: #2017847 From 9b67814f9aff55b687aa8ec2b66e9786b1f1a2fe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 9 Nov 2021 19:20:55 +0100 Subject: [PATCH 22/46] Update to Samba 4.15.2 resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 resolves: #2021625 Guenther --- .gitignore | 2 + samba-s4u.patch | 134 +++++++++++++++++++----------------------------- samba.spec | 28 +++++++++- sources | 4 +- 4 files changed, 83 insertions(+), 85 deletions(-) diff --git a/.gitignore b/.gitignore index 4140b12..b2f1c52 100644 --- a/.gitignore +++ b/.gitignore @@ -271,3 +271,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0.tar.asc /samba-4.15.1.tar.xz /samba-4.15.1.tar.asc +/samba-4.15.2.tar.xz +/samba-4.15.2.tar.asc diff --git a/samba-s4u.patch b/samba-s4u.patch index bb323f3..8e84d96 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,4 +1,4 @@ -From 7c4125deb1e03917f0a2353740f2c0e9e6cf87c5 Mon Sep 17 00:00:00 2001 +From 0b196043f08ea4c025f19c4519175a3a73e1d185 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support @@ -6,13 +6,13 @@ Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider --- - source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++++------------ - source4/kdc/mit_samba.c | 47 ++----- + source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------ + source4/kdc/mit_samba.c | 47 ++------- source4/kdc/mit_samba.h | 6 +- - 3 files changed, 86 insertions(+), 115 deletions(-) + 3 files changed, 71 insertions(+), 106 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index ac9865aac60..17d4c4028b9 100644 +index f35210669c2..b1c7c5dcc5e 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c @@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, @@ -133,16 +133,15 @@ index ac9865aac60..17d4c4028b9 100644 return code; } -@@ -310,7 +321,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_authdata ***signed_auth_data) - { +@@ -314,6 +325,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krb5_authdata **pac_auth_data = NULL; krb5_authdata **authdata = NULL; -- krb5_boolean is_as_req; + krb5_boolean is_as_req; + krb5_const_principal pac_client; krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -318,24 +329,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -325,11 +337,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; @@ -151,13 +150,13 @@ index ac9865aac60..17d4c4028b9 100644 - return KRB5_KDB_DBTYPE_NOSUP; - } - -- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); -- -- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { -- code = ks_get_pac(context, client, client_key, &pac); -- if (code != 0) { -- goto done; -- } + is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); + + /* +@@ -390,6 +397,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + ks_client_princ = client->princ; + } + + /* In protocol transition, we are currently not provided with the tgt + * client name to verify the PAC, we could probably skip the name + * verification and just verify the signatures, but since we don't @@ -165,59 +164,31 @@ index ac9865aac60..17d4c4028b9 100644 + if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { + pac_client = server->princ; + } else { -+ pac_client = client_princ; - } - -- if (!is_as_req) { -+ /* TGS request */ -+ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) { - code = ks_verify_pac(context, - flags, -- client_princ, -+ pac_client, - client, - server, - krbtgt, -@@ -347,14 +355,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (code != 0) { - goto done; - } -+ -+ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */ -+ if (pac == NULL) { -+ code = KRB5_KDB_DBTYPE_NOSUP; -+ goto done; -+ } - } - -- if (pac == NULL && client != NULL) { -+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { -+ krb5_pac_free(context, pac); -+ pac = NULL; ++ pac_client = ks_client_princ; + } - -+ /* AS request or local realm protocol transition */ -+ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) || -+ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) { - code = ks_get_pac(context, client, client_key, &pac); - if (code != 0) { - goto done; - } -+ /* We require a pac! */ -+ SMB_ASSERT(pac != NULL); ++ + if (client_entry == NULL) { + client_entry = client; } +@@ -454,7 +471,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (pac == NULL) { -@@ -363,7 +385,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - } - - code = krb5_pac_sign(context, pac, authtime, client_princ, + code = ks_verify_pac(context, + flags, +- ks_client_princ, ++ pac_client, + client_entry, + server, + krbtgt, +@@ -494,7 +511,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + is_as_req ? "AS-REQ" : "TGS-REQ", + client_name); + code = krb5_pac_sign(context, pac, authtime, ks_client_princ, - server_key, krbtgt_key, &pac_data); + server_key, krbtgt_key, &pac_data); if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -389,11 +411,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -520,12 +537,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -226,10 +197,11 @@ index ac9865aac60..17d4c4028b9 100644 - } - - code = 0; - +- done: - krb5_pac_free(context, pac); -@@ -416,32 +433,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + if (client_entry != NULL && client_entry != client) { + ks_free_principal(context, client_entry); +@@ -551,32 +562,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -264,10 +236,10 @@ index ac9865aac60..17d4c4028b9 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 0a0d3a98315..5f35c6025bf 100644 +index 4239332f0d9..acc3cba6254 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -493,7 +493,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -501,7 +501,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -275,7 +247,7 @@ index 0a0d3a98315..5f35c6025bf 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -641,7 +640,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -665,7 +664,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -284,7 +256,7 @@ index 0a0d3a98315..5f35c6025bf 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -963,41 +962,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -987,41 +986,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -337,7 +309,7 @@ index 0a0d3a98315..5f35c6025bf 100644 static krb5_error_code mit_samba_change_pwd_error(krb5_context context, diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h -index ba824557bd5..5aadf206443 100644 +index 636c77ec97c..9cb00c9610e 100644 --- a/source4/kdc/mit_samba.h +++ b/source4/kdc/mit_samba.h @@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, @@ -361,10 +333,10 @@ index ba824557bd5..5aadf206443 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.31.1 +2.33.1 -From b2ada81ed9f89f6b38fb0a9e54811408676671d0 Mon Sep 17 00:00:00 2001 +From 992d38fa35c01f2f0bdb39d387fa29e8eb8d3d37 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build @@ -378,10 +350,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index 20ce86c708d..e72ab3c30f7 100644 +index fff5b4e2a22..791b417d5ba 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c -@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, +@@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return 0; } @@ -574,7 +546,7 @@ index 20ce86c708d..e72ab3c30f7 100644 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index 9550447b2c5..ee3931c7544 100644 +index eab67f6d969..b5385c69a33 100644 --- a/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -639,10 +611,10 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.31.1 +2.33.1 -From bc5e97074739d29320a3e890575353fbfd452047 Mon Sep 17 00:00:00 2001 +From f1951b501ca0fb3e613f04437c99dc1bbf204609 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code @@ -655,7 +627,7 @@ Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code 4 files changed, 11 insertions(+), 2 deletions(-) diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h -index 6a09ecb6fe1..bc5211fef35 100644 +index 5ef9d9565f3..dafaffc6c2d 100644 --- a/source4/heimdal/lib/hdb/hdb.h +++ b/source4/heimdal/lib/hdb/hdb.h @@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; @@ -667,7 +639,7 @@ index 6a09ecb6fe1..bc5211fef35 100644 /* hdb_capability_flags */ #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index a560a1cd84b..c27b6a8ef4c 100644 +index aff74f2ee71..d16b4c3329a 100644 --- a/source4/kdc/db-glue.c +++ b/source4/kdc/db-glue.c @@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, @@ -695,7 +667,7 @@ index a560a1cd84b..c27b6a8ef4c 100644 ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 5f35c6025bf..20ee2c2b89e 100644 +index acc3cba6254..f0b9df8b613 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c @@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, @@ -721,5 +693,5 @@ index c929acccce6..a9115ec23d7 100644 void sdb_free_entry(struct sdb_entry_ex *e); void free_sdb_entry(struct sdb_entry *s); -- -2.31.1 +2.33.1 diff --git a/samba.spec b/samba.spec index 501250c..4817ea7 100644 --- a/samba.spec +++ b/samba.spec @@ -129,9 +129,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 0 -%global samba_version 4.15.1 +%global samba_version 4.15.2 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -2669,6 +2669,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc @@ -2690,6 +2691,8 @@ fi %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc @@ -2861,6 +2864,7 @@ fi %{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py +%{python3_sitearch}/samba/tests/dsdb_api.py %{python3_sitearch}/samba/tests/dsdb_dns.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py @@ -2901,6 +2905,7 @@ fi %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ +%{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc @@ -2916,12 +2921,15 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/alias_tests.py %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py @@ -2937,8 +2945,10 @@ fi %{python3_sitearch}/samba/tests/krb5/rodc_tests.py %{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py +%{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py +%{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py %{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py @@ -2946,6 +2956,8 @@ fi %{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_referrals.py +%{python3_sitearch}/samba/tests/ldap_spn.py +%{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py %{python3_sitearch}/samba/tests/lsa_string.py @@ -4080,6 +4092,18 @@ fi %endif %changelog +* Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 +- Update to Samba 4.15.2 +- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 +- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 +- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 +- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 +- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 +- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 +- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 +- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 +- resolves: #2021625 + * Fri Nov 05 2021 Guenther Deschner - 4.15.1-1 - Fix winexe core dump - resolves: #2020376 diff --git a/sources b/sources index ac5f2eb..0516493 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.1.tar.xz) = 7422c4ed625411f8a4765f8e21f3b8e0c9d68f259cc25ed9f47e6243e849722ad6fa907fad989f19715ca799bc249cda4ef8a8bb930120d61851143072ef7558 -SHA512 (samba-4.15.1.tar.asc) = 0fd0a9761b2dcbd43600490a32d462f50dcd42232a79e40c3a29df5630c9df412bdfac7aeb0eb34b8ce7a9a01ba8e0da612f5771fa9d45f12d77a4ae5c875d82 +SHA512 (samba-4.15.2.tar.xz) = d9aaabbf45ba0293dbda137a21f04d5fa533be07c3826de816513d8e2ae0ef6e6109ce4045dd74bcd5375364f6de5fa8ace6ae4b3c419bfffe55fa2bfeeb0d5d +SHA512 (samba-4.15.2.tar.asc) = 732cc215c047988d4bce3d2ea981474f0cca44dd5a22030f49343aa3a37f6003bb84b116f7cdb0c8c4fd492354c107350f78101d7186fcb6027906ab1c92cf31 From 6d5fffe14f812ccc1ce4c8b8cdad415ea7d82f1c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 14:45:45 +0100 Subject: [PATCH 23/46] Fix winbind trusted domain regression related: #2021716 Guenther --- ...a-4.15-fix-winbind-no-trusted-domain.patch | 41 +++++++++++++++++++ samba.spec | 7 +++- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 samba-4.15-fix-winbind-no-trusted-domain.patch diff --git a/samba-4.15-fix-winbind-no-trusted-domain.patch b/samba-4.15-fix-winbind-no-trusted-domain.patch new file mode 100644 index 0000000..4924872 --- /dev/null +++ b/samba-4.15-fix-winbind-no-trusted-domain.patch @@ -0,0 +1,41 @@ +From 2edaf32b4204b9fe363c441c25b6989fe76911a4 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Tue, 9 Nov 2021 20:50:20 +0100 +Subject: [PATCH] s3:winbindd: fix "allow trusted domains = no" regression + +add_trusted_domain() should only reject domains +based on is_allowed_domain(), which now also +checks "allow trusted domains = no", if we don't +have an explicit trust to the domain (SEC_CHAN_NULL). + +We use at least SEC_CHAN_LOCAL for local domains like +BUILTIN. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14899 + +Signed-off-by: Stefan Metzmacher + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Wed Nov 10 11:21:31 UTC 2021 on sn-devel-184 + +(cherry picked from commit a7f6c60cb037b4bc9eee276236539b8282213935) +--- + source3/winbindd/winbindd_util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c +index 42ddbfd2f44..9d54e462c42 100644 +--- a/source3/winbindd/winbindd_util.c ++++ b/source3/winbindd/winbindd_util.c +@@ -134,7 +134,7 @@ static NTSTATUS add_trusted_domain(const char *domain_name, + return NT_STATUS_INVALID_PARAMETER; + } + +- if (!is_allowed_domain(domain_name)) { ++ if (secure_channel_type == SEC_CHAN_NULL && !is_allowed_domain(domain_name)) { + return NT_STATUS_NO_SUCH_DOMAIN; + } + +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 4817ea7..dd53d8c 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.2 %global talloc_version 2.3.3 @@ -201,6 +201,7 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch Patch2: samba-4.15.1-winexe.patch +Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4092,6 +4093,10 @@ fi %endif %changelog +* Thu Nov 11 2021 Guenther Deschner - 4.15.2-1 +- Fix winbind trusted domain regression +- related: #2021716 + * Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 - Update to Samba 4.15.2 - resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 From 7541e08a52c236d6feeddaa92f222cbfdb886ee1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 16:01:38 +0100 Subject: [PATCH 24/46] Fix logfile handling Guenther --- samba-4.15-logfile.patch | 981 +++++++++++++++++++++++++++++++++++++++ samba.spec | 2 + 2 files changed, 983 insertions(+) create mode 100644 samba-4.15-logfile.patch diff --git a/samba-4.15-logfile.patch b/samba-4.15-logfile.patch new file mode 100644 index 0000000..6300639 --- /dev/null +++ b/samba-4.15-logfile.patch @@ -0,0 +1,981 @@ +From 96d6bd4feb27b9b003aac44ef2ab7ef0a288272d Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Wed, 10 Nov 2021 20:18:07 +0100 +Subject: [PATCH 1/8] source3: move lib/substitute.c functions out of proto.h + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + source3/auth/auth_generic.c | 1 + + source3/auth/auth_ntlmssp.c | 1 + + source3/auth/auth_util.c | 1 + + source3/include/proto.h | 33 ----------- + source3/lib/substitute.c | 1 + + source3/lib/substitute.h | 63 +++++++++++++++++++++ + source3/modules/vfs_expand_msdfs.c | 1 + + source3/modules/vfs_full_audit.c | 1 + + source3/modules/vfs_recycle.c | 1 + + source3/modules/vfs_unityed_media.c | 1 + + source3/modules/vfs_virusfilter_utils.c | 1 + + source3/nmbd/nmbd.c | 1 + + source3/nmbd/nmbd_synclists.c | 1 + + source3/param/loadparm.c | 1 + + source3/passdb/passdb.c | 1 + + source3/passdb/pdb_ldap.c | 1 + + source3/printing/print_generic.c | 1 + + source3/printing/printing.c | 1 + + source3/rpc_server/lsa/srv_lsa_nt.c | 1 + + source3/rpc_server/netlogon/srv_netlog_nt.c | 1 + + source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 1 + + source3/smbd/ipc.c | 1 + + source3/smbd/lanman.c | 1 + + source3/smbd/message.c | 1 + + source3/smbd/msdfs.c | 1 + + source3/smbd/process.c | 1 + + source3/smbd/reply.c | 1 + + source3/smbd/server.c | 1 + + source3/smbd/service.c | 1 + + source3/smbd/sesssetup.c | 1 + + source3/smbd/share_access.c | 1 + + source3/smbd/smb2_server.c | 1 + + source3/smbd/smb2_sesssetup.c | 1 + + source3/smbd/trans2.c | 1 + + source3/smbd/uid.c | 1 + + source3/torture/torture.c | 1 + + source3/utils/net_sam.c | 1 + + source3/winbindd/wb_getpwsid.c | 1 + + source3/winbindd/winbindd.c | 1 + + 39 files changed, 100 insertions(+), 33 deletions(-) + create mode 100644 source3/lib/substitute.h + +diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c +index fc7a7549e8e..ff51307e43a 100644 +--- a/source3/auth/auth_generic.c ++++ b/source3/auth/auth_generic.c +@@ -36,6 +36,7 @@ + #include "auth/credentials/credentials.h" + #include "lib/param/loadparm.h" + #include "librpc/gen_ndr/dcerpc.h" ++#include "source3/lib/substitute.h" + + static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx, + TALLOC_CTX *mem_ctx, +diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c +index 676aa9d892c..f2deca09aa6 100644 +--- a/source3/auth/auth_ntlmssp.c ++++ b/source3/auth/auth_ntlmssp.c +@@ -25,6 +25,7 @@ + #include "auth.h" + #include "libcli/security/security.h" + #include "lib/util/tevent_ntstatus.h" ++#include "source3/lib/substitute.h" + + NTSTATUS auth3_generate_session_info(struct auth4_context *auth_context, + TALLOC_CTX *mem_ctx, +diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c +index dec854d85c3..4527dedc49d 100644 +--- a/source3/auth/auth_util.c ++++ b/source3/auth/auth_util.c +@@ -38,6 +38,7 @@ + #include "rpc_client/util_netlogon.h" + #include "source4/auth/auth.h" + #include "auth/auth_util.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_AUTH +diff --git a/source3/include/proto.h b/source3/include/proto.h +index eb45179aebb..a96c2c8d110 100644 +--- a/source3/include/proto.h ++++ b/source3/include/proto.h +@@ -139,39 +139,6 @@ int smbrun_no_sanitize(const char *cmd, int *outfd, char * const *env); + int smbrun(const char *cmd, int *outfd, char * const *env); + int smbrunsecret(const char *cmd, const char *secret); + +-/* The following definitions come from lib/substitute.c */ +- +-bool set_local_machine_name(const char *local_name, bool perm); +-const char *get_local_machine_name(void); +-bool set_remote_machine_name(const char *remote_name, bool perm); +-const char *get_remote_machine_name(void); +-void sub_set_smb_name(const char *name); +-void set_current_user_info(const char *smb_name, const char *unix_name, +- const char *domain); +-void sub_set_socket_ids(const char *peeraddr, const char *peername, +- const char *sockaddr); +-const char *get_current_username(void); +-void standard_sub_basic(const char *smb_name, const char *domain_name, +- char *str, size_t len); +-char *talloc_sub_basic(TALLOC_CTX *mem_ctx, const char *smb_name, +- const char *domain_name, const char *str); +-char *talloc_sub_specified(TALLOC_CTX *mem_ctx, +- const char *input_string, +- const char *username, +- const char *grpname, +- const char *domain, +- uid_t uid, +- gid_t gid); +-char *talloc_sub_advanced(TALLOC_CTX *mem_ctx, +- const char *servicename, const char *user, +- const char *connectpath, gid_t gid, +- const char *str); +-char *talloc_sub_full(TALLOC_CTX *mem_ctx, +- const char *servicename, const char *user, +- const char *connectpath, gid_t gid, +- const char *smb_name, const char *domain_name, +- const char *str); +- + /* The following definitions come from lib/sysquotas.c */ + + int sys_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp); +diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c +index b98a0acf1cb..a941b89f82a 100644 +--- a/source3/lib/substitute.c ++++ b/source3/lib/substitute.c +@@ -20,6 +20,7 @@ + + + #include "includes.h" ++#include "substitute.h" + #include "system/passwd.h" + #include "secrets.h" + #include "auth.h" +diff --git a/source3/lib/substitute.h b/source3/lib/substitute.h +new file mode 100644 +index 00000000000..2056d163dd7 +--- /dev/null ++++ b/source3/lib/substitute.h +@@ -0,0 +1,63 @@ ++/* ++ Unix SMB/CIFS implementation. ++ string substitution functions ++ Copyright (C) Andrew Tridgell 1992-2000 ++ Copyright (C) Gerald Carter 2006 ++ ++ This program is free software; you can redistribute it and/or modify ++ it under the terms of the GNU General Public License as published by ++ the Free Software Foundation; either version 3 of the License, or ++ (at your option) any later version. ++ ++ This program is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ GNU General Public License for more details. ++ ++ You should have received a copy of the GNU General Public License ++ along with this program. If not, see . ++*/ ++ ++#ifndef SUBSTITUTE_H ++#define SUBSTITUTE_H ++ ++bool set_local_machine_name(const char *local_name, bool perm); ++const char *get_local_machine_name(void); ++bool set_remote_machine_name(const char *remote_name, bool perm); ++const char *get_remote_machine_name(void); ++void sub_set_socket_ids(const char *peeraddr, const char *peername, ++ const char *sockaddr); ++void set_current_user_info(const char *smb_name, ++ const char *unix_name, ++ const char *domain); ++const char *get_current_username(void); ++void standard_sub_basic(const char *smb_name, ++ const char *domain_name, ++ char *str, ++ size_t len); ++char *talloc_sub_basic(TALLOC_CTX *mem_ctx, ++ const char *smb_name, ++ const char *domain_name, ++ const char *str); ++char *talloc_sub_specified(TALLOC_CTX *mem_ctx, ++ const char *input_string, ++ const char *username, ++ const char *grpname, ++ const char *domain, ++ uid_t uid, ++ gid_t gid); ++char *talloc_sub_advanced(TALLOC_CTX *ctx, ++ const char *servicename, ++ const char *user, ++ const char *connectpath, ++ gid_t gid, ++ const char *str); ++char *talloc_sub_full(TALLOC_CTX *ctx, ++ const char *servicename, ++ const char *user, ++ const char *connectpath, ++ gid_t gid, ++ const char *smb_name, ++ const char *domain_name, ++ const char *str); ++#endif +diff --git a/source3/modules/vfs_expand_msdfs.c b/source3/modules/vfs_expand_msdfs.c +index 34e7051dca5..fe3c6f47462 100644 +--- a/source3/modules/vfs_expand_msdfs.c ++++ b/source3/modules/vfs_expand_msdfs.c +@@ -25,6 +25,7 @@ + #include "auth.h" + #include "../lib/tsocket/tsocket.h" + #include "msdfs.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_VFS +diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c +index ceda99d4568..c8dbc8c07bb 100644 +--- a/source3/modules/vfs_full_audit.c ++++ b/source3/modules/vfs_full_audit.c +@@ -73,6 +73,7 @@ + #include "passdb/machine_sid.h" + #include "lib/util/tevent_ntstatus.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + static int vfs_full_audit_debug_level = DBGC_VFS; + +diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c +index 1c18f232c32..7cbc938a57c 100644 +--- a/source3/modules/vfs_recycle.c ++++ b/source3/modules/vfs_recycle.c +@@ -27,6 +27,7 @@ + #include "system/filesys.h" + #include "../librpc/gen_ndr/ndr_netlogon.h" + #include "auth.h" ++#include "source3/lib/substitute.h" + + #define ALLOC_CHECK(ptr, label) do { if ((ptr) == NULL) { DEBUG(0, ("recycle.bin: out of memory!\n")); errno = ENOMEM; goto label; } } while(0) + +diff --git a/source3/modules/vfs_unityed_media.c b/source3/modules/vfs_unityed_media.c +index 62a1456b996..fbd4d968172 100644 +--- a/source3/modules/vfs_unityed_media.c ++++ b/source3/modules/vfs_unityed_media.c +@@ -62,6 +62,7 @@ + #include "../lib/tsocket/tsocket.h" + #include "lib/util/smb_strtox.h" + #include ++#include "source3/lib/substitute.h" + + #define UM_PARAM_TYPE_NAME "unityed_media" + +diff --git a/source3/modules/vfs_virusfilter_utils.c b/source3/modules/vfs_virusfilter_utils.c +index c7f8089ffc7..b8b44eb203b 100644 +--- a/source3/modules/vfs_virusfilter_utils.c ++++ b/source3/modules/vfs_virusfilter_utils.c +@@ -25,6 +25,7 @@ struct iovec; + #include "lib/util/iov_buf.h" + #include + #include "lib/tsocket/tsocket.h" ++#include "source3/lib/substitute.h" + + int virusfilter_debug_class = DBGC_VFS; + +diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c +index 44121e9915c..7470897587e 100644 +--- a/source3/nmbd/nmbd.c ++++ b/source3/nmbd/nmbd.c +@@ -29,6 +29,7 @@ + #include "util_cluster.h" + #include "lib/gencache.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + int ClientNMB = -1; + int ClientDGRAM = -1; +diff --git a/source3/nmbd/nmbd_synclists.c b/source3/nmbd/nmbd_synclists.c +index a65cbb87e0e..d291927fbc8 100644 +--- a/source3/nmbd/nmbd_synclists.c ++++ b/source3/nmbd/nmbd_synclists.c +@@ -33,6 +33,7 @@ + #include "libsmb/clirap.h" + #include "../libcli/smb/smbXcli_base.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + struct sync_record { + struct sync_record *next, *prev; +diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c +index f54c08cc4a5..b56fd20e410 100644 +--- a/source3/param/loadparm.c ++++ b/source3/param/loadparm.c +@@ -76,6 +76,7 @@ + #include "lib/crypto/gnutls_helpers.h" + #include "lib/util/string_wrappers.h" + #include "auth/credentials/credentials.h" ++#include "source3/lib/substitute.h" + + #ifdef HAVE_SYS_SYSCTL_H + #include +diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c +index 068c5a5ea70..863f260ea90 100644 +--- a/source3/passdb/passdb.c ++++ b/source3/passdb/passdb.c +@@ -33,6 +33,7 @@ + #include "auth/credentials/credentials.h" + #include "lib/param/param.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_PASSDB +diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c +index e6d8a84c60f..93da28b1941 100644 +--- a/source3/passdb/pdb_ldap.c ++++ b/source3/passdb/pdb_ldap.c +@@ -56,6 +56,7 @@ + #include "lib/util_sid_passdb.h" + #include "lib/util/smb_strtox.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_PASSDB +diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c +index 743c311bbd5..8798a4cf34a 100644 +--- a/source3/printing/print_generic.c ++++ b/source3/printing/print_generic.c +@@ -20,6 +20,7 @@ + #include "includes.h" + #include "printing.h" + #include "smbd/proto.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/printing/printing.c b/source3/printing/printing.c +index 499334df03f..67d798fbb21 100644 +--- a/source3/printing/printing.c ++++ b/source3/printing/printing.c +@@ -40,6 +40,7 @@ + #include "lib/util/string_wrappers.h" + #include "lib/global_contexts.h" + #include "source3/printing/rap_jobid.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index d6d606ddeca..57f981cb358 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -53,6 +53,7 @@ + #include "librpc/rpc/dcesrv_core.h" + #include "librpc/rpc/dcerpc_helper.h" + #include "lib/param/loadparm.h" ++#include "source3/lib/substitute.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c +index eaacd8dbc6a..2906fa3f30f 100644 +--- a/source3/rpc_server/netlogon/srv_netlog_nt.c ++++ b/source3/rpc_server/netlogon/srv_netlog_nt.c +@@ -49,6 +49,7 @@ + #include "lib/param/param.h" + #include "libsmb/dsgetdcname.h" + #include "lib/util/util_str_escape.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c +index 8576e9d2ce2..fc27a459634 100644 +--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c ++++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c +@@ -42,6 +42,7 @@ + #include "messages.h" + #include "serverid.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + extern const struct generic_mapping file_generic_mapping; + +diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c +index f1c8ea0c2ed..cf3b7c91c22 100644 +--- a/source3/smbd/ipc.c ++++ b/source3/smbd/ipc.c +@@ -29,6 +29,7 @@ + #include "smbd/globals.h" + #include "smbprofile.h" + #include "rpc_server/srv_pipe_hnd.h" ++#include "source3/lib/substitute.h" + + #define NERR_notsupported 50 + +diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c +index 9194113e768..eb8148753b9 100644 +--- a/source3/smbd/lanman.c ++++ b/source3/smbd/lanman.c +@@ -45,6 +45,7 @@ + #include "rpc_server/rpc_ncacn_np.h" + #include "lib/util/string_wrappers.h" + #include "source3/printing/rap_jobid.h" ++#include "source3/lib/substitute.h" + + #ifdef CHECK_TYPES + #undef CHECK_TYPES +diff --git a/source3/smbd/message.c b/source3/smbd/message.c +index b9728946889..7185bec1289 100644 +--- a/source3/smbd/message.c ++++ b/source3/smbd/message.c +@@ -27,6 +27,7 @@ + #include "smbd/smbd.h" + #include "smbd/globals.h" + #include "smbprofile.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c +index 995ed815d90..fd002e98071 100644 +--- a/source3/smbd/msdfs.c ++++ b/source3/smbd/msdfs.c +@@ -34,6 +34,7 @@ + #include "librpc/gen_ndr/ndr_dfsblobs.h" + #include "lib/tsocket/tsocket.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + /********************************************************************** + Parse a DFS pathname of the form \hostname\service\reqpath +diff --git a/source3/smbd/process.c b/source3/smbd/process.c +index 03409742752..5015c143a04 100644 +--- a/source3/smbd/process.c ++++ b/source3/smbd/process.c +@@ -46,6 +46,7 @@ + #include "libcli/smb/smbXcli_base.h" + #include "lib/util/time_basic.h" + #include "smb1_utils.h" ++#include "source3/lib/substitute.h" + + /* Internal message queue for deferred opens. */ + struct pending_message_list { +diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c +index 042e7f2329e..f85d1122a07 100644 +--- a/source3/smbd/reply.c ++++ b/source3/smbd/reply.c +@@ -50,6 +50,7 @@ + #include "libcli/smb/smb2_posix.h" + #include "lib/util/string_wrappers.h" + #include "source3/printing/rap_jobid.h" ++#include "source3/lib/substitute.h" + + /**************************************************************************** + Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext +diff --git a/source3/smbd/server.c b/source3/smbd/server.c +index d7f5b4b73c0..d02ff1bd883 100644 +--- a/source3/smbd/server.c ++++ b/source3/smbd/server.c +@@ -60,6 +60,7 @@ + #include "rpc_server/fssd.h" + #include "rpc_server/mdssd.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + #ifdef CLUSTER_SUPPORT + #include "ctdb_protocol.h" +diff --git a/source3/smbd/service.c b/source3/smbd/service.c +index afdea38b016..ef7c14d92d0 100644 +--- a/source3/smbd/service.c ++++ b/source3/smbd/service.c +@@ -34,6 +34,7 @@ + #include "lib/afs/afs_funcs.h" + #include "lib/util_path.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + bool canonicalize_connect_path(connection_struct *conn) + { +diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c +index 2bd527ce80e..1705b8920b6 100644 +--- a/source3/smbd/sesssetup.c ++++ b/source3/smbd/sesssetup.c +@@ -34,6 +34,7 @@ + #include "auth/gensec/gensec.h" + #include "../libcli/smb/smb_signing.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + /**************************************************************************** + Add the standard 'Samba' signature to the end of the session setup. +diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c +index debe4fc6385..c44c4bd8c69 100644 +--- a/source3/smbd/share_access.c ++++ b/source3/smbd/share_access.c +@@ -23,6 +23,7 @@ + #include "../libcli/security/security.h" + #include "passdb/lookup_sid.h" + #include "auth.h" ++#include "source3/lib/substitute.h" + + /* + * We dropped NIS support in 2021, but need to keep configs working. +diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c +index f359db0729d..f6b376e5a07 100644 +--- a/source3/smbd/smb2_server.c ++++ b/source3/smbd/smb2_server.c +@@ -33,6 +33,7 @@ + #include "lib/util/iov_buf.h" + #include "auth.h" + #include "libcli/smb/smbXcli_base.h" ++#include "source3/lib/substitute.h" + + #if defined(LINUX) + /* SIOCOUTQ TIOCOUTQ are the same */ +diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c +index 38049e8535f..14b806bc007 100644 +--- a/source3/smbd/smb2_sesssetup.c ++++ b/source3/smbd/smb2_sesssetup.c +@@ -28,6 +28,7 @@ + #include "../lib/tsocket/tsocket.h" + #include "../libcli/security/security.h" + #include "../lib/util/tevent_ntstatus.h" ++#include "source3/lib/substitute.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c +index cd6b61429c5..a86ac3228e3 100644 +--- a/source3/smbd/trans2.c ++++ b/source3/smbd/trans2.c +@@ -45,6 +45,7 @@ + #include "smb1_utils.h" + #include "libcli/smb/smb2_posix.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #define DIR_ENTRY_SAFETY_MARGIN 4096 + +diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c +index b0d7f21c200..52918c4f181 100644 +--- a/source3/smbd/uid.c ++++ b/source3/smbd/uid.c +@@ -26,6 +26,7 @@ + #include "passdb/lookup_sid.h" + #include "auth.h" + #include "../auth/auth_util.h" ++#include "source3/lib/substitute.h" + + /* what user is current? */ + extern struct current_user current_user; +diff --git a/source3/torture/torture.c b/source3/torture/torture.c +index 79a9c65073c..d3e0e3cf095 100644 +--- a/source3/torture/torture.c ++++ b/source3/torture/torture.c +@@ -51,6 +51,7 @@ + #include "lib/param/param.h" + #include "auth/gensec/gensec.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #include + #include +diff --git a/source3/utils/net_sam.c b/source3/utils/net_sam.c +index 6a2c6c861f9..17cc47b2ddd 100644 +--- a/source3/utils/net_sam.c ++++ b/source3/utils/net_sam.c +@@ -33,6 +33,7 @@ + #include "idmap.h" + #include "lib/util/smb_strtox.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + /* + * Set a user's data +diff --git a/source3/winbindd/wb_getpwsid.c b/source3/winbindd/wb_getpwsid.c +index fb0351ec201..7f168bdda7a 100644 +--- a/source3/winbindd/wb_getpwsid.c ++++ b/source3/winbindd/wb_getpwsid.c +@@ -22,6 +22,7 @@ + #include "librpc/gen_ndr/ndr_winbind_c.h" + #include "../libcli/security/security.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + struct wb_getpwsid_state { + struct tevent_context *ev; +diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c +index 25d8b723010..290454619a4 100644 +--- a/source3/winbindd/winbindd.c ++++ b/source3/winbindd/winbindd.c +@@ -51,6 +51,7 @@ + #include "lib/gencache.h" + #include "rpc_server/rpc_config.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_WINBIND +-- +2.33.1 + + +From 1184733a1628c1187a215956195ca806419db16d Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Thu, 11 Nov 2021 05:23:09 +0100 +Subject: [PATCH 2/8] samba-bgqd: fix startup and logging + +Let samba-bgqd use the new POPT_COMMON_DAEMON infrastructure. + +The calls to setup_logging() can safely be removed as this is already taken care +of by samba_cmdline_init(). + +To avoid a logfile basename of ".log" when using "%m", we add a call to +set_remote_machine_name(). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + source3/printing/samba-bgqd.c | 35 ++++++++++------------------------- + 1 file changed, 10 insertions(+), 25 deletions(-) + +diff --git a/source3/printing/samba-bgqd.c b/source3/printing/samba-bgqd.c +index 8ac6ec525b2..2cd6a8e007a 100644 +--- a/source3/printing/samba-bgqd.c ++++ b/source3/printing/samba-bgqd.c +@@ -40,6 +40,7 @@ + #include "source3/lib/util_procid.h" + #include "source3/auth/proto.h" + #include "source3/printing/queue_process.h" ++#include "source3/lib/substitute.h" + + static void watch_handler(struct tevent_req *req) + { +@@ -235,6 +236,7 @@ static int closeall_except_fd_params( + + int main(int argc, const char *argv[]) + { ++ struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = NULL; + const struct loadparm_substitution *lp_sub = + loadparm_s3_global_substitution(); + const char *progname = getprogname(); +@@ -245,8 +247,6 @@ int main(int argc, const char *argv[]) + struct tevent_req *watch_req = NULL; + struct tevent_signal *sigterm_handler = NULL; + struct bq_state *bq = NULL; +- int foreground = 0; +- int no_process_group = 0; + int log_stdout = 0; + int ready_signal_fd = -1; + int watch_fd = -1; +@@ -259,21 +259,7 @@ int main(int argc, const char *argv[]) + struct poptOption long_options[] = { + POPT_AUTOHELP + POPT_COMMON_SAMBA +- { +- .longName = "foreground", +- .shortName = 'F', +- .argInfo = POPT_ARG_NONE, +- .arg = &foreground, +- .descrip = "Run daemon in foreground " +- "(for daemontools, etc.)", +- }, +- { +- .longName = "no-process-group", +- .shortName = '\0', +- .argInfo = POPT_ARG_NONE, +- .arg = &no_process_group, +- .descrip = "Don't create a new process group" , +- }, ++ POPT_COMMON_DAEMON + + /* + * File descriptor to write the PID of the helper +@@ -311,6 +297,7 @@ int main(int argc, const char *argv[]) + frame = talloc_stackframe(); + + umask(0); ++ set_remote_machine_name("smbd-bgqd", true); + + ok = samba_cmdline_init(frame, + SAMBA_CMDLINE_CONFIG_SERVER, +@@ -320,6 +307,8 @@ int main(int argc, const char *argv[]) + exit(ENOMEM); + } + ++ cmdline_daemon_cfg = samba_cmdline_get_daemon_cfg(); ++ + pc = samba_popt_get_context(progname, + argc, + argv, +@@ -340,16 +329,12 @@ int main(int argc, const char *argv[]) + + log_stdout = (debug_get_log_type() == DEBUG_STDOUT); + +- if (foreground) { ++ if (!cmdline_daemon_cfg->fork) { + daemon_status(progname, "Starting process ... "); + } else { +- become_daemon(true, no_process_group, log_stdout); +- } +- +- if (log_stdout) { +- setup_logging(progname, DEBUG_STDOUT); +- } else { +- setup_logging(progname, DEBUG_FILE); ++ become_daemon(true, ++ cmdline_daemon_cfg->no_process_group, ++ log_stdout); + } + + BlockSignals(true, SIGPIPE); +-- +2.33.1 + + +From 1a0a1ccbe888332ea134b16bfac0d0d011bf1f4c Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Wed, 10 Nov 2021 18:27:08 +0100 +Subject: [PATCH 3/8] winbindd: remove is_default_dyn_LOGFILEBASE() logic + +Handling of -l commandline parameter is already implemented by lib/cmdline/. + +is_default_dyn_LOGFILEBASE() == true is the default case and this causes us to +temporarily overwrite the configured logfile with LOGFILEBASE/log.winbindd until +winbindd_reload_services_file() restores it. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + source3/winbindd/winbindd.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c +index 290454619a4..58c5ffbced4 100644 +--- a/source3/winbindd/winbindd.c ++++ b/source3/winbindd/winbindd.c +@@ -1717,15 +1717,6 @@ int main(int argc, const char **argv) + + poptFreeContext(pc); + +- if (is_default_dyn_LOGFILEBASE()) { +- char *lfile = NULL; +- if (asprintf(&lfile,"%s/log.winbindd", +- get_dyn_LOGFILEBASE()) > 0) { +- lp_set_logfile(lfile); +- SAFE_FREE(lfile); +- } +- } +- + reopen_logs(); + + DEBUG(0,("winbindd version %s started.\n", samba_version_string())); +-- +2.33.1 + + +From bcbf9fb6669933cc3dcf1f615d2885c542a08035 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Wed, 10 Nov 2021 14:13:11 +0100 +Subject: [PATCH 4/8] lib/debug: fix fd check before dup'ing to stderr + +Before I added per-class logfile and we had only one fd for the logfile the code +looked like this: + + /* Take over stderr to catch output into logs */ + if (state.fd > 0) { + if (dup2(state.fd, 2) == -1) { + /* Close stderr too, if dup2 can't point it - + at the logfile. There really isn't much + that can be done on such a fundamental + failure... */ + close_low_fd(2); + } + } + +In the current code the equivalent to state.fd is dbgc_config[DBGC_ALL].fd. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/util/debug.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/lib/util/debug.c b/lib/util/debug.c +index 4fd17679227..b271608621a 100644 +--- a/lib/util/debug.c ++++ b/lib/util/debug.c +@@ -1125,7 +1125,6 @@ bool reopen_logs_internal(void) + { + struct debug_backend *b = NULL; + mode_t oldumask; +- int new_fd = 0; + size_t i; + bool ok; + +@@ -1190,7 +1189,7 @@ bool reopen_logs_internal(void) + * If log file was opened or created successfully, take over stderr to + * catch output into logs. + */ +- if (new_fd != -1) { ++ if (dbgc_config[DBGC_ALL].fd > 0) { + if (dup2(dbgc_config[DBGC_ALL].fd, 2) == -1) { + /* Close stderr too, if dup2 can't point it - + at the logfile. There really isn't much +-- +2.33.1 + + +From 9f76bd48d87eb03c66dfe942b4a84e997a8fe8ba Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 19:41:50 +0100 +Subject: [PATCH 5/8] lib/debug: in debug_set_logfile() call + reopen_logs_internal() + +This simplifies the logging API for callers that typically would want to set +logging by just setup_logging() once without bothering that typically +configuration is loaded (via some lpcfg_load*() or lp_load*() varient) which +will only then pick up the configured logfile from smb.conf without actually +applying the new logifle to the logging subsytem. + +Therefor our daemons will additionally call reopen_logs() explicitly in their +startup code after config is loaded, eg + + setup_logging(getprogname(), DEBUG_FILE); + ... + lpcfg_load(lp_ctx, config_file); + ... + reopen_logs(); + +By calling reopen_logs_internal() implicitly from debug_set_logfile() there's no +need to call reopen_logs() explicitly anymore to apply the logfile. + +As reopen_logs() will also apply other logging configuration options, we have to +keep the explicit calls in the daemon code. But at least this allows consistent +logging setup wrt to the logfile in the new cmdline library. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/util/debug.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/util/debug.c b/lib/util/debug.c +index b271608621a..171b5e15008 100644 +--- a/lib/util/debug.c ++++ b/lib/util/debug.c +@@ -1018,6 +1018,8 @@ void debug_set_logfile(const char *name) + } + TALLOC_FREE(dbgc_config[DBGC_ALL].logfile); + dbgc_config[DBGC_ALL].logfile = talloc_strdup(NULL, name); ++ ++ reopen_logs_internal(); + } + + static void debug_close_fd(int fd) +-- +2.33.1 + + +From b80911bc1a306cac479ee3feabdcea124946cdde Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 12:08:47 +0100 +Subject: [PATCH 6/8] lib/cmdline: fix indentation + +s/whitespace/tab/ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/cmdline/cmdline_s3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/cmdline/cmdline_s3.c b/lib/cmdline/cmdline_s3.c +index 1f8d9ed5eb5..639d403aed3 100644 +--- a/lib/cmdline/cmdline_s3.c ++++ b/lib/cmdline/cmdline_s3.c +@@ -55,7 +55,7 @@ static bool _samba_cmdline_load_config_s3(void) + case SAMBA_CMDLINE_CONFIG_CLIENT: + ok = lp_load_client(config_file); + break; +- case SAMBA_CMDLINE_CONFIG_SERVER: ++ case SAMBA_CMDLINE_CONFIG_SERVER: + { + const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = + samba_cmdline_get_daemon_cfg(); +-- +2.33.1 + + +From a6b6b0b6e6dfcd2c8e2c2085d20cd16c51e3b379 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 12:09:16 +0100 +Subject: [PATCH 7/8] lib/cmdline: remember config_type in samba_cmdline_init() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/cmdline/cmdline_s4.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c +index 61c1b96ba8d..6ef6f59db49 100644 +--- a/lib/cmdline/cmdline_s4.c ++++ b/lib/cmdline/cmdline_s4.c +@@ -25,6 +25,7 @@ + #include "cmdline_private.h" + + static bool _require_smbconf; ++static enum samba_cmdline_config_type _config_type; + + static bool _samba_cmdline_load_config_s4(void) + { +@@ -81,6 +82,7 @@ bool samba_cmdline_init(TALLOC_CTX *mem_ctx, + return false; + } + _require_smbconf = require_smbconf; ++ _config_type = config_type; + + creds = cli_credentials_init(mem_ctx); + if (creds == NULL) { +-- +2.33.1 + + +From e1d6ab1b0dbd8ff30019edf804c4766b066db4b7 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 12:09:43 +0100 +Subject: [PATCH 8/8] lib/cmdline: setup default file logging for servers + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 +RN: samba process doesn't log to logfile + +Signed-off-by: Ralph Boehme +--- + lib/cmdline/cmdline_s4.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c +index 6ef6f59db49..29e9f34bbe2 100644 +--- a/lib/cmdline/cmdline_s4.c ++++ b/lib/cmdline/cmdline_s4.c +@@ -44,6 +44,20 @@ static bool _samba_cmdline_load_config_s4(void) + } + } + ++ switch (_config_type) { ++ case SAMBA_CMDLINE_CONFIG_SERVER: { ++ const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = ++ samba_cmdline_get_daemon_cfg(); ++ ++ if (!cmdline_daemon_cfg->interactive) { ++ setup_logging(getprogname(), DEBUG_FILE); ++ } ++ break; ++ } ++ default: ++ break; ++ } ++ + config_file = get_dyn_CONFIGFILE(); + ok = lpcfg_load(lp_ctx, config_file); + if (!ok) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index dd53d8c..334c508 100644 --- a/samba.spec +++ b/samba.spec @@ -202,6 +202,7 @@ Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch Patch2: samba-4.15.1-winexe.patch Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch +Patch4: samba-4.15-logfile.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4096,6 +4097,7 @@ fi * Thu Nov 11 2021 Guenther Deschner - 4.15.2-1 - Fix winbind trusted domain regression - related: #2021716 +- Fix logfile handling * Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 - Update to Samba 4.15.2 From 2fae3a09765248adbeb737d39408e5f29f4b5f91 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 18:53:23 +0100 Subject: [PATCH 25/46] Fix smbclient -N failures in container setups Guenther --- samba-4.15.2-smbclient_anonymous.patch | 58 ++++++++++++++++++++++++++ samba.spec | 6 ++- 2 files changed, 62 insertions(+), 2 deletions(-) create mode 100644 samba-4.15.2-smbclient_anonymous.patch diff --git a/samba-4.15.2-smbclient_anonymous.patch b/samba-4.15.2-smbclient_anonymous.patch new file mode 100644 index 0000000..477ddef --- /dev/null +++ b/samba-4.15.2-smbclient_anonymous.patch @@ -0,0 +1,58 @@ +From 61fd63d70578043de9f3bff1c3267c499dbf50a0 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Nov 2021 12:06:51 +0100 +Subject: [PATCH] auth:creds: Guess the username first via getpwuid(my_id) + +If we have a container, we often don't have USER or LOGNAME set. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14883 + +Tested-by: Anoop C S +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit c28be4067463e582e378df402f812e510883d606) +--- + auth/credentials/credentials.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 02a3cf3b354..c5a6ba6940c 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -30,6 +30,7 @@ + #include "tevent.h" + #include "param/param.h" + #include "system/filesys.h" ++#include "system/passwd.h" + + /** + * Create a new credentials structure +@@ -1159,6 +1160,7 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, + { + const char *error_string; + const char *env = NULL; ++ struct passwd *pwd = NULL; + bool ok; + + if (lp_ctx != NULL) { +@@ -1168,6 +1170,17 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, + } + } + ++ pwd = getpwuid(getuid()); ++ if (pwd != NULL) { ++ size_t len = strlen(pwd->pw_name); ++ ++ if (len > 0 && len <= 1024) { ++ (void)cli_credentials_parse_string(cred, ++ pwd->pw_name, ++ CRED_GUESS_ENV); ++ } ++ } ++ + env = getenv("LOGNAME"); + if (env != NULL) { + size_t len = strlen(env); +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 334c508..3915d5a 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.15.2 %global talloc_version 2.3.3 @@ -203,6 +203,7 @@ Patch1: samba-ctdb-etcd-reclock.patch Patch2: samba-4.15.1-winexe.patch Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch Patch4: samba-4.15-logfile.patch +Patch5: samba-4.15.2-smbclient_anonymous.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4094,10 +4095,11 @@ fi %endif %changelog -* Thu Nov 11 2021 Guenther Deschner - 4.15.2-1 +* Thu Nov 11 2021 Guenther Deschner - 4.15.2-2 - Fix winbind trusted domain regression - related: #2021716 - Fix logfile handling +- Fix smbclient -N failures in container setups * Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 - Update to Samba 4.15.2 From 8c19b76cfe8445666f442bc99155e818187cbb0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 13 Nov 2021 00:15:32 +0100 Subject: [PATCH 26/46] Fix IPA DC schannel support Guenther --- samba-4.15-ipa-dc-schannel.patch | 45 ++++++++++++++++++++++++++++++++ samba.spec | 6 ++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 samba-4.15-ipa-dc-schannel.patch diff --git a/samba-4.15-ipa-dc-schannel.patch b/samba-4.15-ipa-dc-schannel.patch new file mode 100644 index 0000000..d315a5d --- /dev/null +++ b/samba-4.15-ipa-dc-schannel.patch @@ -0,0 +1,45 @@ +From 3fc4d1d3998f3956a84c855cb60a9dcb335e1f59 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Fri, 12 Nov 2021 19:06:01 +0200 +Subject: [PATCH] IPA DC: add missing checks + +When introducing FreeIPA support, two places were forgotten: + + - schannel gensec module needs to be aware of IPA DC + - _lsa_QueryInfoPolicy should treat IPA DC as PDC + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903 + +Signed-off-by: Alexander Bokovoy +--- + auth/gensec/schannel.c | 1 + + source3/rpc_server/lsa/srv_lsa_nt.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c +index 0cdae141ead..6ebbe8f3179 100644 +--- a/auth/gensec/schannel.c ++++ b/auth/gensec/schannel.c +@@ -1080,6 +1080,7 @@ static NTSTATUS schannel_server_start(struct gensec_security *gensec_security) + case ROLE_DOMAIN_BDC: + case ROLE_DOMAIN_PDC: + case ROLE_ACTIVE_DIRECTORY_DC: ++ case ROLE_IPA_DC: + return NT_STATUS_OK; + default: + return NT_STATUS_NOT_IMPLEMENTED; +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index 8d71b5252ab..ea92a22cbc9 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -683,6 +683,7 @@ NTSTATUS _lsa_QueryInfoPolicy(struct pipes_struct *p, + switch (lp_server_role()) { + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: ++ case ROLE_IPA_DC: + name = get_global_sam_name(); + sid = dom_sid_dup(p->mem_ctx, get_global_sam_sid()); + if (!sid) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 3915d5a..a5a3106 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 3 %global samba_version 4.15.2 %global talloc_version 2.3.3 @@ -204,6 +204,7 @@ Patch2: samba-4.15.1-winexe.patch Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch Patch4: samba-4.15-logfile.patch Patch5: samba-4.15.2-smbclient_anonymous.patch +Patch6: samba-4.15-ipa-dc-schannel.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4095,6 +4096,9 @@ fi %endif %changelog +* Sat Nov 13 2021 Guenther Deschner - 4.15.2-3 +- Fix IPA DC schannel support + * Thu Nov 11 2021 Guenther Deschner - 4.15.2-2 - Fix winbind trusted domain regression - related: #2021716 From e4d7f7f64c9027efcb69c2b3cc24f958a6a01885 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 8 Dec 2021 17:57:04 +0100 Subject: [PATCH 27/46] Update to Samba 4.15.3 resolves: #2030382 pfilipen --- .gitignore | 2 + ...a-4.15-fix-winbind-no-trusted-domain.patch | 41 - samba-4.15-ipa-dc-schannel.patch | 45 - samba-4.15-logfile.patch | 981 ------------------ samba-4.15.1-winexe.patch | 61 -- samba-4.15.2-smbclient_anonymous.patch | 58 -- samba.spec | 15 +- sources | 4 +- 8 files changed, 12 insertions(+), 1195 deletions(-) delete mode 100644 samba-4.15-fix-winbind-no-trusted-domain.patch delete mode 100644 samba-4.15-ipa-dc-schannel.patch delete mode 100644 samba-4.15-logfile.patch delete mode 100644 samba-4.15.1-winexe.patch delete mode 100644 samba-4.15.2-smbclient_anonymous.patch diff --git a/.gitignore b/.gitignore index b2f1c52..23cef85 100644 --- a/.gitignore +++ b/.gitignore @@ -273,3 +273,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.1.tar.asc /samba-4.15.2.tar.xz /samba-4.15.2.tar.asc +/samba-4.15.3.tar.xz +/samba-4.15.3.tar.asc diff --git a/samba-4.15-fix-winbind-no-trusted-domain.patch b/samba-4.15-fix-winbind-no-trusted-domain.patch deleted file mode 100644 index 4924872..0000000 --- a/samba-4.15-fix-winbind-no-trusted-domain.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 2edaf32b4204b9fe363c441c25b6989fe76911a4 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Tue, 9 Nov 2021 20:50:20 +0100 -Subject: [PATCH] s3:winbindd: fix "allow trusted domains = no" regression - -add_trusted_domain() should only reject domains -based on is_allowed_domain(), which now also -checks "allow trusted domains = no", if we don't -have an explicit trust to the domain (SEC_CHAN_NULL). - -We use at least SEC_CHAN_LOCAL for local domains like -BUILTIN. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14899 - -Signed-off-by: Stefan Metzmacher - -Autobuild-User(master): Stefan Metzmacher -Autobuild-Date(master): Wed Nov 10 11:21:31 UTC 2021 on sn-devel-184 - -(cherry picked from commit a7f6c60cb037b4bc9eee276236539b8282213935) ---- - source3/winbindd/winbindd_util.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c -index 42ddbfd2f44..9d54e462c42 100644 ---- a/source3/winbindd/winbindd_util.c -+++ b/source3/winbindd/winbindd_util.c -@@ -134,7 +134,7 @@ static NTSTATUS add_trusted_domain(const char *domain_name, - return NT_STATUS_INVALID_PARAMETER; - } - -- if (!is_allowed_domain(domain_name)) { -+ if (secure_channel_type == SEC_CHAN_NULL && !is_allowed_domain(domain_name)) { - return NT_STATUS_NO_SUCH_DOMAIN; - } - --- -2.33.1 - diff --git a/samba-4.15-ipa-dc-schannel.patch b/samba-4.15-ipa-dc-schannel.patch deleted file mode 100644 index d315a5d..0000000 --- a/samba-4.15-ipa-dc-schannel.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 3fc4d1d3998f3956a84c855cb60a9dcb335e1f59 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Fri, 12 Nov 2021 19:06:01 +0200 -Subject: [PATCH] IPA DC: add missing checks - -When introducing FreeIPA support, two places were forgotten: - - - schannel gensec module needs to be aware of IPA DC - - _lsa_QueryInfoPolicy should treat IPA DC as PDC - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903 - -Signed-off-by: Alexander Bokovoy ---- - auth/gensec/schannel.c | 1 + - source3/rpc_server/lsa/srv_lsa_nt.c | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c -index 0cdae141ead..6ebbe8f3179 100644 ---- a/auth/gensec/schannel.c -+++ b/auth/gensec/schannel.c -@@ -1080,6 +1080,7 @@ static NTSTATUS schannel_server_start(struct gensec_security *gensec_security) - case ROLE_DOMAIN_BDC: - case ROLE_DOMAIN_PDC: - case ROLE_ACTIVE_DIRECTORY_DC: -+ case ROLE_IPA_DC: - return NT_STATUS_OK; - default: - return NT_STATUS_NOT_IMPLEMENTED; -diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c -index 8d71b5252ab..ea92a22cbc9 100644 ---- a/source3/rpc_server/lsa/srv_lsa_nt.c -+++ b/source3/rpc_server/lsa/srv_lsa_nt.c -@@ -683,6 +683,7 @@ NTSTATUS _lsa_QueryInfoPolicy(struct pipes_struct *p, - switch (lp_server_role()) { - case ROLE_DOMAIN_PDC: - case ROLE_DOMAIN_BDC: -+ case ROLE_IPA_DC: - name = get_global_sam_name(); - sid = dom_sid_dup(p->mem_ctx, get_global_sam_sid()); - if (!sid) { --- -2.33.1 - diff --git a/samba-4.15-logfile.patch b/samba-4.15-logfile.patch deleted file mode 100644 index 6300639..0000000 --- a/samba-4.15-logfile.patch +++ /dev/null @@ -1,981 +0,0 @@ -From 96d6bd4feb27b9b003aac44ef2ab7ef0a288272d Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Wed, 10 Nov 2021 20:18:07 +0100 -Subject: [PATCH 1/8] source3: move lib/substitute.c functions out of proto.h - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - source3/auth/auth_generic.c | 1 + - source3/auth/auth_ntlmssp.c | 1 + - source3/auth/auth_util.c | 1 + - source3/include/proto.h | 33 ----------- - source3/lib/substitute.c | 1 + - source3/lib/substitute.h | 63 +++++++++++++++++++++ - source3/modules/vfs_expand_msdfs.c | 1 + - source3/modules/vfs_full_audit.c | 1 + - source3/modules/vfs_recycle.c | 1 + - source3/modules/vfs_unityed_media.c | 1 + - source3/modules/vfs_virusfilter_utils.c | 1 + - source3/nmbd/nmbd.c | 1 + - source3/nmbd/nmbd_synclists.c | 1 + - source3/param/loadparm.c | 1 + - source3/passdb/passdb.c | 1 + - source3/passdb/pdb_ldap.c | 1 + - source3/printing/print_generic.c | 1 + - source3/printing/printing.c | 1 + - source3/rpc_server/lsa/srv_lsa_nt.c | 1 + - source3/rpc_server/netlogon/srv_netlog_nt.c | 1 + - source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 1 + - source3/smbd/ipc.c | 1 + - source3/smbd/lanman.c | 1 + - source3/smbd/message.c | 1 + - source3/smbd/msdfs.c | 1 + - source3/smbd/process.c | 1 + - source3/smbd/reply.c | 1 + - source3/smbd/server.c | 1 + - source3/smbd/service.c | 1 + - source3/smbd/sesssetup.c | 1 + - source3/smbd/share_access.c | 1 + - source3/smbd/smb2_server.c | 1 + - source3/smbd/smb2_sesssetup.c | 1 + - source3/smbd/trans2.c | 1 + - source3/smbd/uid.c | 1 + - source3/torture/torture.c | 1 + - source3/utils/net_sam.c | 1 + - source3/winbindd/wb_getpwsid.c | 1 + - source3/winbindd/winbindd.c | 1 + - 39 files changed, 100 insertions(+), 33 deletions(-) - create mode 100644 source3/lib/substitute.h - -diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c -index fc7a7549e8e..ff51307e43a 100644 ---- a/source3/auth/auth_generic.c -+++ b/source3/auth/auth_generic.c -@@ -36,6 +36,7 @@ - #include "auth/credentials/credentials.h" - #include "lib/param/loadparm.h" - #include "librpc/gen_ndr/dcerpc.h" -+#include "source3/lib/substitute.h" - - static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx, - TALLOC_CTX *mem_ctx, -diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c -index 676aa9d892c..f2deca09aa6 100644 ---- a/source3/auth/auth_ntlmssp.c -+++ b/source3/auth/auth_ntlmssp.c -@@ -25,6 +25,7 @@ - #include "auth.h" - #include "libcli/security/security.h" - #include "lib/util/tevent_ntstatus.h" -+#include "source3/lib/substitute.h" - - NTSTATUS auth3_generate_session_info(struct auth4_context *auth_context, - TALLOC_CTX *mem_ctx, -diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c -index dec854d85c3..4527dedc49d 100644 ---- a/source3/auth/auth_util.c -+++ b/source3/auth/auth_util.c -@@ -38,6 +38,7 @@ - #include "rpc_client/util_netlogon.h" - #include "source4/auth/auth.h" - #include "auth/auth_util.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_AUTH -diff --git a/source3/include/proto.h b/source3/include/proto.h -index eb45179aebb..a96c2c8d110 100644 ---- a/source3/include/proto.h -+++ b/source3/include/proto.h -@@ -139,39 +139,6 @@ int smbrun_no_sanitize(const char *cmd, int *outfd, char * const *env); - int smbrun(const char *cmd, int *outfd, char * const *env); - int smbrunsecret(const char *cmd, const char *secret); - --/* The following definitions come from lib/substitute.c */ -- --bool set_local_machine_name(const char *local_name, bool perm); --const char *get_local_machine_name(void); --bool set_remote_machine_name(const char *remote_name, bool perm); --const char *get_remote_machine_name(void); --void sub_set_smb_name(const char *name); --void set_current_user_info(const char *smb_name, const char *unix_name, -- const char *domain); --void sub_set_socket_ids(const char *peeraddr, const char *peername, -- const char *sockaddr); --const char *get_current_username(void); --void standard_sub_basic(const char *smb_name, const char *domain_name, -- char *str, size_t len); --char *talloc_sub_basic(TALLOC_CTX *mem_ctx, const char *smb_name, -- const char *domain_name, const char *str); --char *talloc_sub_specified(TALLOC_CTX *mem_ctx, -- const char *input_string, -- const char *username, -- const char *grpname, -- const char *domain, -- uid_t uid, -- gid_t gid); --char *talloc_sub_advanced(TALLOC_CTX *mem_ctx, -- const char *servicename, const char *user, -- const char *connectpath, gid_t gid, -- const char *str); --char *talloc_sub_full(TALLOC_CTX *mem_ctx, -- const char *servicename, const char *user, -- const char *connectpath, gid_t gid, -- const char *smb_name, const char *domain_name, -- const char *str); -- - /* The following definitions come from lib/sysquotas.c */ - - int sys_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp); -diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c -index b98a0acf1cb..a941b89f82a 100644 ---- a/source3/lib/substitute.c -+++ b/source3/lib/substitute.c -@@ -20,6 +20,7 @@ - - - #include "includes.h" -+#include "substitute.h" - #include "system/passwd.h" - #include "secrets.h" - #include "auth.h" -diff --git a/source3/lib/substitute.h b/source3/lib/substitute.h -new file mode 100644 -index 00000000000..2056d163dd7 ---- /dev/null -+++ b/source3/lib/substitute.h -@@ -0,0 +1,63 @@ -+/* -+ Unix SMB/CIFS implementation. -+ string substitution functions -+ Copyright (C) Andrew Tridgell 1992-2000 -+ Copyright (C) Gerald Carter 2006 -+ -+ This program is free software; you can redistribute it and/or modify -+ it under the terms of the GNU General Public License as published by -+ the Free Software Foundation; either version 3 of the License, or -+ (at your option) any later version. -+ -+ This program is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ GNU General Public License for more details. -+ -+ You should have received a copy of the GNU General Public License -+ along with this program. If not, see . -+*/ -+ -+#ifndef SUBSTITUTE_H -+#define SUBSTITUTE_H -+ -+bool set_local_machine_name(const char *local_name, bool perm); -+const char *get_local_machine_name(void); -+bool set_remote_machine_name(const char *remote_name, bool perm); -+const char *get_remote_machine_name(void); -+void sub_set_socket_ids(const char *peeraddr, const char *peername, -+ const char *sockaddr); -+void set_current_user_info(const char *smb_name, -+ const char *unix_name, -+ const char *domain); -+const char *get_current_username(void); -+void standard_sub_basic(const char *smb_name, -+ const char *domain_name, -+ char *str, -+ size_t len); -+char *talloc_sub_basic(TALLOC_CTX *mem_ctx, -+ const char *smb_name, -+ const char *domain_name, -+ const char *str); -+char *talloc_sub_specified(TALLOC_CTX *mem_ctx, -+ const char *input_string, -+ const char *username, -+ const char *grpname, -+ const char *domain, -+ uid_t uid, -+ gid_t gid); -+char *talloc_sub_advanced(TALLOC_CTX *ctx, -+ const char *servicename, -+ const char *user, -+ const char *connectpath, -+ gid_t gid, -+ const char *str); -+char *talloc_sub_full(TALLOC_CTX *ctx, -+ const char *servicename, -+ const char *user, -+ const char *connectpath, -+ gid_t gid, -+ const char *smb_name, -+ const char *domain_name, -+ const char *str); -+#endif -diff --git a/source3/modules/vfs_expand_msdfs.c b/source3/modules/vfs_expand_msdfs.c -index 34e7051dca5..fe3c6f47462 100644 ---- a/source3/modules/vfs_expand_msdfs.c -+++ b/source3/modules/vfs_expand_msdfs.c -@@ -25,6 +25,7 @@ - #include "auth.h" - #include "../lib/tsocket/tsocket.h" - #include "msdfs.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_VFS -diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c -index ceda99d4568..c8dbc8c07bb 100644 ---- a/source3/modules/vfs_full_audit.c -+++ b/source3/modules/vfs_full_audit.c -@@ -73,6 +73,7 @@ - #include "passdb/machine_sid.h" - #include "lib/util/tevent_ntstatus.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - static int vfs_full_audit_debug_level = DBGC_VFS; - -diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c -index 1c18f232c32..7cbc938a57c 100644 ---- a/source3/modules/vfs_recycle.c -+++ b/source3/modules/vfs_recycle.c -@@ -27,6 +27,7 @@ - #include "system/filesys.h" - #include "../librpc/gen_ndr/ndr_netlogon.h" - #include "auth.h" -+#include "source3/lib/substitute.h" - - #define ALLOC_CHECK(ptr, label) do { if ((ptr) == NULL) { DEBUG(0, ("recycle.bin: out of memory!\n")); errno = ENOMEM; goto label; } } while(0) - -diff --git a/source3/modules/vfs_unityed_media.c b/source3/modules/vfs_unityed_media.c -index 62a1456b996..fbd4d968172 100644 ---- a/source3/modules/vfs_unityed_media.c -+++ b/source3/modules/vfs_unityed_media.c -@@ -62,6 +62,7 @@ - #include "../lib/tsocket/tsocket.h" - #include "lib/util/smb_strtox.h" - #include -+#include "source3/lib/substitute.h" - - #define UM_PARAM_TYPE_NAME "unityed_media" - -diff --git a/source3/modules/vfs_virusfilter_utils.c b/source3/modules/vfs_virusfilter_utils.c -index c7f8089ffc7..b8b44eb203b 100644 ---- a/source3/modules/vfs_virusfilter_utils.c -+++ b/source3/modules/vfs_virusfilter_utils.c -@@ -25,6 +25,7 @@ struct iovec; - #include "lib/util/iov_buf.h" - #include - #include "lib/tsocket/tsocket.h" -+#include "source3/lib/substitute.h" - - int virusfilter_debug_class = DBGC_VFS; - -diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c -index 44121e9915c..7470897587e 100644 ---- a/source3/nmbd/nmbd.c -+++ b/source3/nmbd/nmbd.c -@@ -29,6 +29,7 @@ - #include "util_cluster.h" - #include "lib/gencache.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - int ClientNMB = -1; - int ClientDGRAM = -1; -diff --git a/source3/nmbd/nmbd_synclists.c b/source3/nmbd/nmbd_synclists.c -index a65cbb87e0e..d291927fbc8 100644 ---- a/source3/nmbd/nmbd_synclists.c -+++ b/source3/nmbd/nmbd_synclists.c -@@ -33,6 +33,7 @@ - #include "libsmb/clirap.h" - #include "../libcli/smb/smbXcli_base.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - struct sync_record { - struct sync_record *next, *prev; -diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index f54c08cc4a5..b56fd20e410 100644 ---- a/source3/param/loadparm.c -+++ b/source3/param/loadparm.c -@@ -76,6 +76,7 @@ - #include "lib/crypto/gnutls_helpers.h" - #include "lib/util/string_wrappers.h" - #include "auth/credentials/credentials.h" -+#include "source3/lib/substitute.h" - - #ifdef HAVE_SYS_SYSCTL_H - #include -diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c -index 068c5a5ea70..863f260ea90 100644 ---- a/source3/passdb/passdb.c -+++ b/source3/passdb/passdb.c -@@ -33,6 +33,7 @@ - #include "auth/credentials/credentials.h" - #include "lib/param/param.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_PASSDB -diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c -index e6d8a84c60f..93da28b1941 100644 ---- a/source3/passdb/pdb_ldap.c -+++ b/source3/passdb/pdb_ldap.c -@@ -56,6 +56,7 @@ - #include "lib/util_sid_passdb.h" - #include "lib/util/smb_strtox.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_PASSDB -diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c -index 743c311bbd5..8798a4cf34a 100644 ---- a/source3/printing/print_generic.c -+++ b/source3/printing/print_generic.c -@@ -20,6 +20,7 @@ - #include "includes.h" - #include "printing.h" - #include "smbd/proto.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/printing/printing.c b/source3/printing/printing.c -index 499334df03f..67d798fbb21 100644 ---- a/source3/printing/printing.c -+++ b/source3/printing/printing.c -@@ -40,6 +40,7 @@ - #include "lib/util/string_wrappers.h" - #include "lib/global_contexts.h" - #include "source3/printing/rap_jobid.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c -index d6d606ddeca..57f981cb358 100644 ---- a/source3/rpc_server/lsa/srv_lsa_nt.c -+++ b/source3/rpc_server/lsa/srv_lsa_nt.c -@@ -53,6 +53,7 @@ - #include "librpc/rpc/dcesrv_core.h" - #include "librpc/rpc/dcerpc_helper.h" - #include "lib/param/loadparm.h" -+#include "source3/lib/substitute.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c -index eaacd8dbc6a..2906fa3f30f 100644 ---- a/source3/rpc_server/netlogon/srv_netlog_nt.c -+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c -@@ -49,6 +49,7 @@ - #include "lib/param/param.h" - #include "libsmb/dsgetdcname.h" - #include "lib/util/util_str_escape.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c -index 8576e9d2ce2..fc27a459634 100644 ---- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c -+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c -@@ -42,6 +42,7 @@ - #include "messages.h" - #include "serverid.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - extern const struct generic_mapping file_generic_mapping; - -diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c -index f1c8ea0c2ed..cf3b7c91c22 100644 ---- a/source3/smbd/ipc.c -+++ b/source3/smbd/ipc.c -@@ -29,6 +29,7 @@ - #include "smbd/globals.h" - #include "smbprofile.h" - #include "rpc_server/srv_pipe_hnd.h" -+#include "source3/lib/substitute.h" - - #define NERR_notsupported 50 - -diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c -index 9194113e768..eb8148753b9 100644 ---- a/source3/smbd/lanman.c -+++ b/source3/smbd/lanman.c -@@ -45,6 +45,7 @@ - #include "rpc_server/rpc_ncacn_np.h" - #include "lib/util/string_wrappers.h" - #include "source3/printing/rap_jobid.h" -+#include "source3/lib/substitute.h" - - #ifdef CHECK_TYPES - #undef CHECK_TYPES -diff --git a/source3/smbd/message.c b/source3/smbd/message.c -index b9728946889..7185bec1289 100644 ---- a/source3/smbd/message.c -+++ b/source3/smbd/message.c -@@ -27,6 +27,7 @@ - #include "smbd/smbd.h" - #include "smbd/globals.h" - #include "smbprofile.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c -index 995ed815d90..fd002e98071 100644 ---- a/source3/smbd/msdfs.c -+++ b/source3/smbd/msdfs.c -@@ -34,6 +34,7 @@ - #include "librpc/gen_ndr/ndr_dfsblobs.h" - #include "lib/tsocket/tsocket.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - /********************************************************************** - Parse a DFS pathname of the form \hostname\service\reqpath -diff --git a/source3/smbd/process.c b/source3/smbd/process.c -index 03409742752..5015c143a04 100644 ---- a/source3/smbd/process.c -+++ b/source3/smbd/process.c -@@ -46,6 +46,7 @@ - #include "libcli/smb/smbXcli_base.h" - #include "lib/util/time_basic.h" - #include "smb1_utils.h" -+#include "source3/lib/substitute.h" - - /* Internal message queue for deferred opens. */ - struct pending_message_list { -diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c -index 042e7f2329e..f85d1122a07 100644 ---- a/source3/smbd/reply.c -+++ b/source3/smbd/reply.c -@@ -50,6 +50,7 @@ - #include "libcli/smb/smb2_posix.h" - #include "lib/util/string_wrappers.h" - #include "source3/printing/rap_jobid.h" -+#include "source3/lib/substitute.h" - - /**************************************************************************** - Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext -diff --git a/source3/smbd/server.c b/source3/smbd/server.c -index d7f5b4b73c0..d02ff1bd883 100644 ---- a/source3/smbd/server.c -+++ b/source3/smbd/server.c -@@ -60,6 +60,7 @@ - #include "rpc_server/fssd.h" - #include "rpc_server/mdssd.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - #ifdef CLUSTER_SUPPORT - #include "ctdb_protocol.h" -diff --git a/source3/smbd/service.c b/source3/smbd/service.c -index afdea38b016..ef7c14d92d0 100644 ---- a/source3/smbd/service.c -+++ b/source3/smbd/service.c -@@ -34,6 +34,7 @@ - #include "lib/afs/afs_funcs.h" - #include "lib/util_path.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - bool canonicalize_connect_path(connection_struct *conn) - { -diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c -index 2bd527ce80e..1705b8920b6 100644 ---- a/source3/smbd/sesssetup.c -+++ b/source3/smbd/sesssetup.c -@@ -34,6 +34,7 @@ - #include "auth/gensec/gensec.h" - #include "../libcli/smb/smb_signing.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - /**************************************************************************** - Add the standard 'Samba' signature to the end of the session setup. -diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c -index debe4fc6385..c44c4bd8c69 100644 ---- a/source3/smbd/share_access.c -+++ b/source3/smbd/share_access.c -@@ -23,6 +23,7 @@ - #include "../libcli/security/security.h" - #include "passdb/lookup_sid.h" - #include "auth.h" -+#include "source3/lib/substitute.h" - - /* - * We dropped NIS support in 2021, but need to keep configs working. -diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c -index f359db0729d..f6b376e5a07 100644 ---- a/source3/smbd/smb2_server.c -+++ b/source3/smbd/smb2_server.c -@@ -33,6 +33,7 @@ - #include "lib/util/iov_buf.h" - #include "auth.h" - #include "libcli/smb/smbXcli_base.h" -+#include "source3/lib/substitute.h" - - #if defined(LINUX) - /* SIOCOUTQ TIOCOUTQ are the same */ -diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c -index 38049e8535f..14b806bc007 100644 ---- a/source3/smbd/smb2_sesssetup.c -+++ b/source3/smbd/smb2_sesssetup.c -@@ -28,6 +28,7 @@ - #include "../lib/tsocket/tsocket.h" - #include "../libcli/security/security.h" - #include "../lib/util/tevent_ntstatus.h" -+#include "source3/lib/substitute.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c -index cd6b61429c5..a86ac3228e3 100644 ---- a/source3/smbd/trans2.c -+++ b/source3/smbd/trans2.c -@@ -45,6 +45,7 @@ - #include "smb1_utils.h" - #include "libcli/smb/smb2_posix.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #define DIR_ENTRY_SAFETY_MARGIN 4096 - -diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c -index b0d7f21c200..52918c4f181 100644 ---- a/source3/smbd/uid.c -+++ b/source3/smbd/uid.c -@@ -26,6 +26,7 @@ - #include "passdb/lookup_sid.h" - #include "auth.h" - #include "../auth/auth_util.h" -+#include "source3/lib/substitute.h" - - /* what user is current? */ - extern struct current_user current_user; -diff --git a/source3/torture/torture.c b/source3/torture/torture.c -index 79a9c65073c..d3e0e3cf095 100644 ---- a/source3/torture/torture.c -+++ b/source3/torture/torture.c -@@ -51,6 +51,7 @@ - #include "lib/param/param.h" - #include "auth/gensec/gensec.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #include - #include -diff --git a/source3/utils/net_sam.c b/source3/utils/net_sam.c -index 6a2c6c861f9..17cc47b2ddd 100644 ---- a/source3/utils/net_sam.c -+++ b/source3/utils/net_sam.c -@@ -33,6 +33,7 @@ - #include "idmap.h" - #include "lib/util/smb_strtox.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - /* - * Set a user's data -diff --git a/source3/winbindd/wb_getpwsid.c b/source3/winbindd/wb_getpwsid.c -index fb0351ec201..7f168bdda7a 100644 ---- a/source3/winbindd/wb_getpwsid.c -+++ b/source3/winbindd/wb_getpwsid.c -@@ -22,6 +22,7 @@ - #include "librpc/gen_ndr/ndr_winbind_c.h" - #include "../libcli/security/security.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - struct wb_getpwsid_state { - struct tevent_context *ev; -diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c -index 25d8b723010..290454619a4 100644 ---- a/source3/winbindd/winbindd.c -+++ b/source3/winbindd/winbindd.c -@@ -51,6 +51,7 @@ - #include "lib/gencache.h" - #include "rpc_server/rpc_config.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_WINBIND --- -2.33.1 - - -From 1184733a1628c1187a215956195ca806419db16d Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Thu, 11 Nov 2021 05:23:09 +0100 -Subject: [PATCH 2/8] samba-bgqd: fix startup and logging - -Let samba-bgqd use the new POPT_COMMON_DAEMON infrastructure. - -The calls to setup_logging() can safely be removed as this is already taken care -of by samba_cmdline_init(). - -To avoid a logfile basename of ".log" when using "%m", we add a call to -set_remote_machine_name(). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - source3/printing/samba-bgqd.c | 35 ++++++++++------------------------- - 1 file changed, 10 insertions(+), 25 deletions(-) - -diff --git a/source3/printing/samba-bgqd.c b/source3/printing/samba-bgqd.c -index 8ac6ec525b2..2cd6a8e007a 100644 ---- a/source3/printing/samba-bgqd.c -+++ b/source3/printing/samba-bgqd.c -@@ -40,6 +40,7 @@ - #include "source3/lib/util_procid.h" - #include "source3/auth/proto.h" - #include "source3/printing/queue_process.h" -+#include "source3/lib/substitute.h" - - static void watch_handler(struct tevent_req *req) - { -@@ -235,6 +236,7 @@ static int closeall_except_fd_params( - - int main(int argc, const char *argv[]) - { -+ struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = NULL; - const struct loadparm_substitution *lp_sub = - loadparm_s3_global_substitution(); - const char *progname = getprogname(); -@@ -245,8 +247,6 @@ int main(int argc, const char *argv[]) - struct tevent_req *watch_req = NULL; - struct tevent_signal *sigterm_handler = NULL; - struct bq_state *bq = NULL; -- int foreground = 0; -- int no_process_group = 0; - int log_stdout = 0; - int ready_signal_fd = -1; - int watch_fd = -1; -@@ -259,21 +259,7 @@ int main(int argc, const char *argv[]) - struct poptOption long_options[] = { - POPT_AUTOHELP - POPT_COMMON_SAMBA -- { -- .longName = "foreground", -- .shortName = 'F', -- .argInfo = POPT_ARG_NONE, -- .arg = &foreground, -- .descrip = "Run daemon in foreground " -- "(for daemontools, etc.)", -- }, -- { -- .longName = "no-process-group", -- .shortName = '\0', -- .argInfo = POPT_ARG_NONE, -- .arg = &no_process_group, -- .descrip = "Don't create a new process group" , -- }, -+ POPT_COMMON_DAEMON - - /* - * File descriptor to write the PID of the helper -@@ -311,6 +297,7 @@ int main(int argc, const char *argv[]) - frame = talloc_stackframe(); - - umask(0); -+ set_remote_machine_name("smbd-bgqd", true); - - ok = samba_cmdline_init(frame, - SAMBA_CMDLINE_CONFIG_SERVER, -@@ -320,6 +307,8 @@ int main(int argc, const char *argv[]) - exit(ENOMEM); - } - -+ cmdline_daemon_cfg = samba_cmdline_get_daemon_cfg(); -+ - pc = samba_popt_get_context(progname, - argc, - argv, -@@ -340,16 +329,12 @@ int main(int argc, const char *argv[]) - - log_stdout = (debug_get_log_type() == DEBUG_STDOUT); - -- if (foreground) { -+ if (!cmdline_daemon_cfg->fork) { - daemon_status(progname, "Starting process ... "); - } else { -- become_daemon(true, no_process_group, log_stdout); -- } -- -- if (log_stdout) { -- setup_logging(progname, DEBUG_STDOUT); -- } else { -- setup_logging(progname, DEBUG_FILE); -+ become_daemon(true, -+ cmdline_daemon_cfg->no_process_group, -+ log_stdout); - } - - BlockSignals(true, SIGPIPE); --- -2.33.1 - - -From 1a0a1ccbe888332ea134b16bfac0d0d011bf1f4c Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Wed, 10 Nov 2021 18:27:08 +0100 -Subject: [PATCH 3/8] winbindd: remove is_default_dyn_LOGFILEBASE() logic - -Handling of -l commandline parameter is already implemented by lib/cmdline/. - -is_default_dyn_LOGFILEBASE() == true is the default case and this causes us to -temporarily overwrite the configured logfile with LOGFILEBASE/log.winbindd until -winbindd_reload_services_file() restores it. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - source3/winbindd/winbindd.c | 9 --------- - 1 file changed, 9 deletions(-) - -diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c -index 290454619a4..58c5ffbced4 100644 ---- a/source3/winbindd/winbindd.c -+++ b/source3/winbindd/winbindd.c -@@ -1717,15 +1717,6 @@ int main(int argc, const char **argv) - - poptFreeContext(pc); - -- if (is_default_dyn_LOGFILEBASE()) { -- char *lfile = NULL; -- if (asprintf(&lfile,"%s/log.winbindd", -- get_dyn_LOGFILEBASE()) > 0) { -- lp_set_logfile(lfile); -- SAFE_FREE(lfile); -- } -- } -- - reopen_logs(); - - DEBUG(0,("winbindd version %s started.\n", samba_version_string())); --- -2.33.1 - - -From bcbf9fb6669933cc3dcf1f615d2885c542a08035 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Wed, 10 Nov 2021 14:13:11 +0100 -Subject: [PATCH 4/8] lib/debug: fix fd check before dup'ing to stderr - -Before I added per-class logfile and we had only one fd for the logfile the code -looked like this: - - /* Take over stderr to catch output into logs */ - if (state.fd > 0) { - if (dup2(state.fd, 2) == -1) { - /* Close stderr too, if dup2 can't point it - - at the logfile. There really isn't much - that can be done on such a fundamental - failure... */ - close_low_fd(2); - } - } - -In the current code the equivalent to state.fd is dbgc_config[DBGC_ALL].fd. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/util/debug.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/lib/util/debug.c b/lib/util/debug.c -index 4fd17679227..b271608621a 100644 ---- a/lib/util/debug.c -+++ b/lib/util/debug.c -@@ -1125,7 +1125,6 @@ bool reopen_logs_internal(void) - { - struct debug_backend *b = NULL; - mode_t oldumask; -- int new_fd = 0; - size_t i; - bool ok; - -@@ -1190,7 +1189,7 @@ bool reopen_logs_internal(void) - * If log file was opened or created successfully, take over stderr to - * catch output into logs. - */ -- if (new_fd != -1) { -+ if (dbgc_config[DBGC_ALL].fd > 0) { - if (dup2(dbgc_config[DBGC_ALL].fd, 2) == -1) { - /* Close stderr too, if dup2 can't point it - - at the logfile. There really isn't much --- -2.33.1 - - -From 9f76bd48d87eb03c66dfe942b4a84e997a8fe8ba Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 19:41:50 +0100 -Subject: [PATCH 5/8] lib/debug: in debug_set_logfile() call - reopen_logs_internal() - -This simplifies the logging API for callers that typically would want to set -logging by just setup_logging() once without bothering that typically -configuration is loaded (via some lpcfg_load*() or lp_load*() varient) which -will only then pick up the configured logfile from smb.conf without actually -applying the new logifle to the logging subsytem. - -Therefor our daemons will additionally call reopen_logs() explicitly in their -startup code after config is loaded, eg - - setup_logging(getprogname(), DEBUG_FILE); - ... - lpcfg_load(lp_ctx, config_file); - ... - reopen_logs(); - -By calling reopen_logs_internal() implicitly from debug_set_logfile() there's no -need to call reopen_logs() explicitly anymore to apply the logfile. - -As reopen_logs() will also apply other logging configuration options, we have to -keep the explicit calls in the daemon code. But at least this allows consistent -logging setup wrt to the logfile in the new cmdline library. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/util/debug.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/lib/util/debug.c b/lib/util/debug.c -index b271608621a..171b5e15008 100644 ---- a/lib/util/debug.c -+++ b/lib/util/debug.c -@@ -1018,6 +1018,8 @@ void debug_set_logfile(const char *name) - } - TALLOC_FREE(dbgc_config[DBGC_ALL].logfile); - dbgc_config[DBGC_ALL].logfile = talloc_strdup(NULL, name); -+ -+ reopen_logs_internal(); - } - - static void debug_close_fd(int fd) --- -2.33.1 - - -From b80911bc1a306cac479ee3feabdcea124946cdde Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 12:08:47 +0100 -Subject: [PATCH 6/8] lib/cmdline: fix indentation - -s/whitespace/tab/ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/cmdline/cmdline_s3.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/cmdline/cmdline_s3.c b/lib/cmdline/cmdline_s3.c -index 1f8d9ed5eb5..639d403aed3 100644 ---- a/lib/cmdline/cmdline_s3.c -+++ b/lib/cmdline/cmdline_s3.c -@@ -55,7 +55,7 @@ static bool _samba_cmdline_load_config_s3(void) - case SAMBA_CMDLINE_CONFIG_CLIENT: - ok = lp_load_client(config_file); - break; -- case SAMBA_CMDLINE_CONFIG_SERVER: -+ case SAMBA_CMDLINE_CONFIG_SERVER: - { - const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = - samba_cmdline_get_daemon_cfg(); --- -2.33.1 - - -From a6b6b0b6e6dfcd2c8e2c2085d20cd16c51e3b379 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 12:09:16 +0100 -Subject: [PATCH 7/8] lib/cmdline: remember config_type in samba_cmdline_init() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/cmdline/cmdline_s4.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c -index 61c1b96ba8d..6ef6f59db49 100644 ---- a/lib/cmdline/cmdline_s4.c -+++ b/lib/cmdline/cmdline_s4.c -@@ -25,6 +25,7 @@ - #include "cmdline_private.h" - - static bool _require_smbconf; -+static enum samba_cmdline_config_type _config_type; - - static bool _samba_cmdline_load_config_s4(void) - { -@@ -81,6 +82,7 @@ bool samba_cmdline_init(TALLOC_CTX *mem_ctx, - return false; - } - _require_smbconf = require_smbconf; -+ _config_type = config_type; - - creds = cli_credentials_init(mem_ctx); - if (creds == NULL) { --- -2.33.1 - - -From e1d6ab1b0dbd8ff30019edf804c4766b066db4b7 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 12:09:43 +0100 -Subject: [PATCH 8/8] lib/cmdline: setup default file logging for servers - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 -RN: samba process doesn't log to logfile - -Signed-off-by: Ralph Boehme ---- - lib/cmdline/cmdline_s4.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c -index 6ef6f59db49..29e9f34bbe2 100644 ---- a/lib/cmdline/cmdline_s4.c -+++ b/lib/cmdline/cmdline_s4.c -@@ -44,6 +44,20 @@ static bool _samba_cmdline_load_config_s4(void) - } - } - -+ switch (_config_type) { -+ case SAMBA_CMDLINE_CONFIG_SERVER: { -+ const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = -+ samba_cmdline_get_daemon_cfg(); -+ -+ if (!cmdline_daemon_cfg->interactive) { -+ setup_logging(getprogname(), DEBUG_FILE); -+ } -+ break; -+ } -+ default: -+ break; -+ } -+ - config_file = get_dyn_CONFIGFILE(); - ok = lpcfg_load(lp_ctx, config_file); - if (!ok) { --- -2.33.1 - diff --git a/samba-4.15.1-winexe.patch b/samba-4.15.1-winexe.patch deleted file mode 100644 index 38460b3..0000000 --- a/samba-4.15.1-winexe.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 3d02bf10d7738fe604b524863764de3ca1faa081 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Thu, 4 Nov 2021 22:22:44 +0100 -Subject: [PATCH] s3-winexe: Fix winexe core dump (use-after-free) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14893 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Fri Nov 5 11:43:57 UTC 2021 on sn-devel-184 - -(cherry picked from commit e9495d2ed28a26899dc3dd77bdfe56e284980218) ---- - examples/winexe/winexe.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c -index 3e0813a4091..59fb9dbdebb 100644 ---- a/examples/winexe/winexe.c -+++ b/examples/winexe/winexe.c -@@ -220,8 +220,6 @@ static void parse_args(int argc, const char *argv[], - *port_str = '\0'; - } - -- poptFreeContext(pc); -- - if (options->runas == NULL && options->runas_file != NULL) { - struct cli_credentials *runas_cred; - const char *user; -@@ -253,9 +251,19 @@ static void parse_args(int argc, const char *argv[], - - options->credentials = samba_cmdline_get_creds(); - -- options->hostname = argv_new[0] + 2; -+ options->hostname = talloc_strdup(mem_ctx, argv_new[0] + 2); -+ if (options->hostname == NULL) { -+ DBG_ERR("Out of memory\n"); -+ exit(1); -+ } - options->port = port; -- options->cmd = argv_new[1]; -+ options->cmd = talloc_strdup(mem_ctx, argv_new[1]); -+ if (options->cmd == NULL) { -+ DBG_ERR("Out of memory\n"); -+ exit(1); -+ } -+ -+ poptFreeContext(pc); - - options->flags = flag_interactive; - if (flag_reinstall) { --- -2.33.1 - diff --git a/samba-4.15.2-smbclient_anonymous.patch b/samba-4.15.2-smbclient_anonymous.patch deleted file mode 100644 index 477ddef..0000000 --- a/samba-4.15.2-smbclient_anonymous.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 61fd63d70578043de9f3bff1c3267c499dbf50a0 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Nov 2021 12:06:51 +0100 -Subject: [PATCH] auth:creds: Guess the username first via getpwuid(my_id) - -If we have a container, we often don't have USER or LOGNAME set. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14883 - -Tested-by: Anoop C S -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit c28be4067463e582e378df402f812e510883d606) ---- - auth/credentials/credentials.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index 02a3cf3b354..c5a6ba6940c 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -30,6 +30,7 @@ - #include "tevent.h" - #include "param/param.h" - #include "system/filesys.h" -+#include "system/passwd.h" - - /** - * Create a new credentials structure -@@ -1159,6 +1160,7 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, - { - const char *error_string; - const char *env = NULL; -+ struct passwd *pwd = NULL; - bool ok; - - if (lp_ctx != NULL) { -@@ -1168,6 +1170,17 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, - } - } - -+ pwd = getpwuid(getuid()); -+ if (pwd != NULL) { -+ size_t len = strlen(pwd->pw_name); -+ -+ if (len > 0 && len <= 1024) { -+ (void)cli_credentials_parse_string(cred, -+ pwd->pw_name, -+ CRED_GUESS_ENV); -+ } -+ } -+ - env = getenv("LOGNAME"); - if (env != NULL) { - size_t len = strlen(env); --- -2.33.1 - diff --git a/samba.spec b/samba.spec index a5a3106..7f6487a 100644 --- a/samba.spec +++ b/samba.spec @@ -129,9 +129,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 0 -%global samba_version 4.15.2 +%global samba_version 4.15.3 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -200,11 +200,6 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch -Patch2: samba-4.15.1-winexe.patch -Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch -Patch4: samba-4.15-logfile.patch -Patch5: samba-4.15.2-smbclient_anonymous.patch -Patch6: samba-4.15-ipa-dc-schannel.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -2928,6 +2923,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_idmap_nss.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc @@ -2951,6 +2947,7 @@ fi %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py +%{python3_sitearch}/samba/tests/krb5/test_idmap_nss.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py %{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py @@ -4096,6 +4093,10 @@ fi %endif %changelog +* Wed Dec 08 2021 Pavel Filipenský - 4.15.3-0 +- Update to Samba 4.15.3 +- resolves: #2030382 + * Sat Nov 13 2021 Guenther Deschner - 4.15.2-3 - Fix IPA DC schannel support diff --git a/sources b/sources index 0516493..4f508a2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.2.tar.xz) = d9aaabbf45ba0293dbda137a21f04d5fa533be07c3826de816513d8e2ae0ef6e6109ce4045dd74bcd5375364f6de5fa8ace6ae4b3c419bfffe55fa2bfeeb0d5d -SHA512 (samba-4.15.2.tar.asc) = 732cc215c047988d4bce3d2ea981474f0cca44dd5a22030f49343aa3a37f6003bb84b116f7cdb0c8c4fd492354c107350f78101d7186fcb6027906ab1c92cf31 +SHA512 (samba-4.15.3.tar.xz) = c8bf3dd25a79e90bb01a8f74e1961ab5892a62a7a4556a42880911aeb4120b7645b91a20438f98652c1f870b7c699038b745565bcf5f4dba634ce400b5fbe167 +SHA512 (samba-4.15.3.tar.asc) = 9af712fdfd01e701b6a2f7e903c1d750b4697282b00b2b150d4e3014e70a09733910291b7e44abeefd0ce7ad393d500c338145a2a00638d9191777a90be8636c From 7f5f3fde2b13d7f460c44169615f6b0427eecc77 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Dec 2021 19:11:22 +0100 Subject: [PATCH 28/46] Add missing Requires --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 7f6487a..d2891f1 100644 --- a/samba.spec +++ b/samba.spec @@ -601,6 +601,7 @@ Samba VFS module for Ceph distributed storage system integration. Summary: Samba VFS module for io_uring Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-client-libs = %{samba_depver} Provides: bundled(libreplace) @@ -937,6 +938,7 @@ necessary to communicate to the Winbind Daemon Summary: Samba Winexe Windows Binary License: GPLv3 Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} Provides: bundled(libreplace) From ed2bb2590d84522bad998950e6cfe889a315f39a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 15 Dec 2021 12:33:50 +0100 Subject: [PATCH 29/46] Fix resolv_wrapper with glibc 2.34 resolves: #2019669 pfilipen --- samba-glibc-dns.patch | 64 +++++++++++++++++++++++++++++++++++++++++++ samba.spec | 7 ++++- 2 files changed, 70 insertions(+), 1 deletion(-) create mode 100644 samba-glibc-dns.patch diff --git a/samba-glibc-dns.patch b/samba-glibc-dns.patch new file mode 100644 index 0000000..c01d481 --- /dev/null +++ b/samba-glibc-dns.patch @@ -0,0 +1,64 @@ +From e556b4067e0c4036e20fc26523e3b4d6d5c6be42 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 7 Oct 2021 15:55:37 +0200 +Subject: [PATCH] waf: Fix resolv_wrapper with glibc 2.34 + +With glibc 2.34 we are not able to talk to the DNS server via socket_wrapper +anymore. The res_* symbols have been moved from libresolv to libc. We are not +able to intercept any traffic inside of libc. + +Signed-off-by: Andreas Schneider +Reviewed-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +--- + selftest/wscript | 2 +- + third_party/resolv_wrapper/wscript | 13 +++++++++++++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/selftest/wscript b/selftest/wscript +index a6be06c2ae9..85d9338489a 100644 +--- a/selftest/wscript ++++ b/selftest/wscript +@@ -252,7 +252,7 @@ def cmd_testonly(opt): + if os.environ.get('USE_NAMESPACES') is None: + env.OPTIONS += " --socket_wrapper_so_path=" + CONFIG_GET(opt, 'LIBSOCKET_WRAPPER_SO_PATH') + +- if Utils.unversioned_sys_platform() in ('netbsd', 'openbsd', 'sunos'): ++ if not CONFIG_SET(opt, 'HAVE_RESOLV_CONF_SUPPORT'): + env.OPTIONS += " --use-dns-faking" + + if CONFIG_GET(opt, 'USING_SYSTEM_KRB5') and CONFIG_GET(opt, 'MIT_KDC_PATH'): +diff --git a/third_party/resolv_wrapper/wscript b/third_party/resolv_wrapper/wscript +index a7f18389b0f..7e369bd90b5 100644 +--- a/third_party/resolv_wrapper/wscript ++++ b/third_party/resolv_wrapper/wscript +@@ -1,6 +1,7 @@ + #!/usr/bin/env python + + import os ++from waflib import Logs + + VERSION="1.1.7" + +@@ -49,6 +50,18 @@ def configure(conf): + if conf.CONFIG_SET('HAVE_RES_NCLOSE'): + conf.DEFINE('HAVE_RES_NCLOSE_IN_LIBRESOLV', 1) + ++ # If we find res_nquery in libc, we can't do resolv.conf redirect ++ conf.CHECK_FUNCS('res_nquery __res_nquery') ++ if (conf.CONFIG_SET('HAVE_RES_NQUERY') ++ or conf.CONFIG_SET('HAVE___RES_NQUERY')): ++ Logs.warn("Detection for resolv_wrapper: " ++ "Only dns faking will be available") ++ else: ++ if conf.CHECK_FUNCS('res_nquery', lib='resolv'): ++ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) ++ if conf.CHECK_FUNCS('__res_nquery', lib='resolv'): ++ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) ++ + conf.CHECK_FUNCS_IN('res_init __res_init', 'resolv', checklibc=True) + conf.CHECK_FUNCS_IN('res_ninit __res_ninit', 'resolv', checklibc=True) + conf.CHECK_FUNCS_IN('res_close __res_close', 'resolv', checklibc=True) +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index d2891f1..c039a42 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.3 %global talloc_version 2.3.3 @@ -200,6 +200,7 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch +Patch2: samba-glibc-dns.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4095,6 +4096,10 @@ fi %endif %changelog +* Wed Dec 15 2021 Pavel Filipenský - 4.15.3-1 +- Fix resolv_wrapper with glibc 2.34 +- resolves: #2019669 + * Wed Dec 08 2021 Pavel Filipenský - 4.15.3-0 - Update to Samba 4.15.3 - resolves: #2030382 From 73617498fc72c4f61bb7c3921a3a7af7298b3aaf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 19 Jan 2022 20:49:26 +0100 Subject: [PATCH 30/46] Update to Samba 4.15.4 resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 resolves: #2042518 pfilipen --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 23cef85..2fc9487 100644 --- a/.gitignore +++ b/.gitignore @@ -275,3 +275,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.2.tar.asc /samba-4.15.3.tar.xz /samba-4.15.3.tar.asc +/samba-4.15.4.tar.xz +/samba-4.15.4.tar.asc diff --git a/samba.spec b/samba.spec index c039a42..ecc0948 100644 --- a/samba.spec +++ b/samba.spec @@ -129,9 +129,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 0 -%global samba_version 4.15.3 +%global samba_version 4.15.4 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -4096,6 +4096,11 @@ fi %endif %changelog +* Wed Jan 20 2022 Pavel Filipenský - 4.15.4-0 +- Update to Samba 4.15.4 +- resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 +- resolves: #2042518 + * Wed Dec 15 2021 Pavel Filipenský - 4.15.3-1 - Fix resolv_wrapper with glibc 2.34 - resolves: #2019669 diff --git a/sources b/sources index 4f508a2..343898f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.3.tar.xz) = c8bf3dd25a79e90bb01a8f74e1961ab5892a62a7a4556a42880911aeb4120b7645b91a20438f98652c1f870b7c699038b745565bcf5f4dba634ce400b5fbe167 -SHA512 (samba-4.15.3.tar.asc) = 9af712fdfd01e701b6a2f7e903c1d750b4697282b00b2b150d4e3014e70a09733910291b7e44abeefd0ce7ad393d500c338145a2a00638d9191777a90be8636c +SHA512 (samba-4.15.4.tar.xz) = 19aa7edc55d545c42ba9c2d2bb987df63a825c5a1a6fa2a350d6bca41f04fde6f63b643f6e38d32f4d4067c24420e1ca62ef28dc285c70105ca78487e80ee2dc +SHA512 (samba-4.15.4.tar.asc) = 6878efc500f423e7061966954163ef3503e4ab43a527b370a3e26e6992bc9b6a3161e296800b6cd78d5e0d99ac7f1db249d52c2475d035973e2121bc67df6fab From 631e0ebfecea030e52bea858d8bdd3b0d41c13d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 20 Jan 2022 12:31:48 +0100 Subject: [PATCH 31/46] Fix bogus date in %changelog pfilipen --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index ecc0948..e224bae 100644 --- a/samba.spec +++ b/samba.spec @@ -4096,7 +4096,7 @@ fi %endif %changelog -* Wed Jan 20 2022 Pavel Filipenský - 4.15.4-0 +* Thu Jan 20 2022 Pavel Filipenský - 4.15.4-0 - Update to Samba 4.15.4 - resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 - resolves: #2042518 From de8a44ac722b9a8196fd02440454cf152736bed7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 31 Jan 2022 14:31:36 +0100 Subject: [PATCH 32/46] Update to Samba 4.15.5 resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 Guenther --- .gitignore | 2 ++ samba.spec | 8 +++++++- sources | 4 ++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2fc9487..8cb14d0 100644 --- a/.gitignore +++ b/.gitignore @@ -277,3 +277,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.3.tar.asc /samba-4.15.4.tar.xz /samba-4.15.4.tar.asc +/samba-4.15.5.tar.xz +/samba-4.15.5.tar.asc diff --git a/samba.spec b/samba.spec index e224bae..7b25cbb 100644 --- a/samba.spec +++ b/samba.spec @@ -131,7 +131,7 @@ %global baserelease 0 -%global samba_version 4.15.4 +%global samba_version 4.15.5 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -4096,6 +4096,12 @@ fi %endif %changelog +* Mon Jan 31 2022 Guenther Deschner - 4.15.5-0 +- Update to Samba 4.15.5 +- resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 +- resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 +- resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 + * Thu Jan 20 2022 Pavel Filipenský - 4.15.4-0 - Update to Samba 4.15.4 - resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 diff --git a/sources b/sources index 343898f..2e9aecc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.4.tar.xz) = 19aa7edc55d545c42ba9c2d2bb987df63a825c5a1a6fa2a350d6bca41f04fde6f63b643f6e38d32f4d4067c24420e1ca62ef28dc285c70105ca78487e80ee2dc -SHA512 (samba-4.15.4.tar.asc) = 6878efc500f423e7061966954163ef3503e4ab43a527b370a3e26e6992bc9b6a3161e296800b6cd78d5e0d99ac7f1db249d52c2475d035973e2121bc67df6fab +SHA512 (samba-4.15.5.tar.xz) = 8a77254ed40907abeb1c8c5d6234c10499c7bde9c95014383f8b53a29a9a1dd9a578611ef08eb139ac75317ad441a90fed502a30d4571d44abbce1ab02998caf +SHA512 (samba-4.15.5.tar.asc) = 10ae7ad4c628e438d0e433cea0665df7a0e167ca74b9e29e86e6e7350136dcdd9403e29568dc3228feb90a5307f29a5c12993ac85e70378c820fe9480f767585 From c818aff06a9d80c4b86d82dd6e49f085b5ed7cd4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 15 Nov 2021 11:14:50 +0100 Subject: [PATCH 33/46] Always build with quota support We want that the build fails, if we don't have quota support. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 7b25cbb..5679aab 100644 --- a/samba.spec +++ b/samba.spec @@ -1147,6 +1147,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %endif --with-profiling-data \ --with-systemd \ + --with-quotas \ --systemd-install-services \ --with-systemddir=/usr/lib/systemd/system \ --systemd-smb-extra=%{_systemd_extra} \ From 25d5425804476c20831cf0274161c57dd4c54803 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 3 Dec 2021 13:53:38 +0100 Subject: [PATCH 34/46] Remove unneeded lmdb dependency for samba-tool if we don't have a DC --- samba.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 5679aab..3b87271 100644 --- a/samba.spec +++ b/samba.spec @@ -486,8 +486,10 @@ Requires: libwbclient = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools -# samba-tool needs mdb_copy +%if %{with dc} +# samba-tool needs mdb_copy for domain backup or upgrade provision Requires: lmdb +%endif Provides: bundled(libreplace) From 6de304f908c7735a50760e518b3f5adee719ef26 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Jan 2022 15:08:40 +0100 Subject: [PATCH 35/46] Require python3-pyasn1 >= 0.4.8 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 3b87271..fbc4291 100644 --- a/samba.spec +++ b/samba.spec @@ -322,7 +322,7 @@ BuildRequires: python3-etcd # Add python3-iso8601 to avoid that the # version in Samba is being packaged BuildRequires: python3-iso8601 -BuildRequires: python3-pyasn1 +BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} From a3c89d96f4aba2b362fe6513a356ce326ea32d7b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 23 Feb 2022 11:49:53 +0100 Subject: [PATCH 36/46] Fix samba-tool on builds with samba-dc resolves: rhbz#2036443 --- samba.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index fbc4291..38bcc1c 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.5 %global talloc_version 2.3.3 @@ -487,6 +487,8 @@ Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools %if %{with dc} +# samba-tool needs python3-samba-dc on a full build +Requires: python3-%{name}-dc = %{samba_depver} # samba-tool needs mdb_copy for domain backup or upgrade provision Requires: lmdb %endif @@ -4099,6 +4101,9 @@ fi %endif %changelog +* Wed Feb 23 2022 Andreas Schneider - 4.15.5-1 +- resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc + * Mon Jan 31 2022 Guenther Deschner - 4.15.5-0 - Update to Samba 4.15.5 - resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 From 14ac0090bf612493321eb9154513f9d2b8ff603c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 16 Mar 2022 10:51:03 +0100 Subject: [PATCH 37/46] Update to Samba 4.15.6 pfilipen --- .gitignore | 2 ++ samba-glibc-dns.patch | 64 ------------------------------------------- samba.spec | 10 ++++--- sources | 4 +-- 4 files changed, 10 insertions(+), 70 deletions(-) delete mode 100644 samba-glibc-dns.patch diff --git a/.gitignore b/.gitignore index 8cb14d0..518c755 100644 --- a/.gitignore +++ b/.gitignore @@ -279,3 +279,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.4.tar.asc /samba-4.15.5.tar.xz /samba-4.15.5.tar.asc +/samba-4.15.6.tar.xz +/samba-4.15.6.tar.asc diff --git a/samba-glibc-dns.patch b/samba-glibc-dns.patch deleted file mode 100644 index c01d481..0000000 --- a/samba-glibc-dns.patch +++ /dev/null @@ -1,64 +0,0 @@ -From e556b4067e0c4036e20fc26523e3b4d6d5c6be42 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 7 Oct 2021 15:55:37 +0200 -Subject: [PATCH] waf: Fix resolv_wrapper with glibc 2.34 - -With glibc 2.34 we are not able to talk to the DNS server via socket_wrapper -anymore. The res_* symbols have been moved from libresolv to libc. We are not -able to intercept any traffic inside of libc. - -Signed-off-by: Andreas Schneider -Reviewed-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy ---- - selftest/wscript | 2 +- - third_party/resolv_wrapper/wscript | 13 +++++++++++++ - 2 files changed, 14 insertions(+), 1 deletion(-) - -diff --git a/selftest/wscript b/selftest/wscript -index a6be06c2ae9..85d9338489a 100644 ---- a/selftest/wscript -+++ b/selftest/wscript -@@ -252,7 +252,7 @@ def cmd_testonly(opt): - if os.environ.get('USE_NAMESPACES') is None: - env.OPTIONS += " --socket_wrapper_so_path=" + CONFIG_GET(opt, 'LIBSOCKET_WRAPPER_SO_PATH') - -- if Utils.unversioned_sys_platform() in ('netbsd', 'openbsd', 'sunos'): -+ if not CONFIG_SET(opt, 'HAVE_RESOLV_CONF_SUPPORT'): - env.OPTIONS += " --use-dns-faking" - - if CONFIG_GET(opt, 'USING_SYSTEM_KRB5') and CONFIG_GET(opt, 'MIT_KDC_PATH'): -diff --git a/third_party/resolv_wrapper/wscript b/third_party/resolv_wrapper/wscript -index a7f18389b0f..7e369bd90b5 100644 ---- a/third_party/resolv_wrapper/wscript -+++ b/third_party/resolv_wrapper/wscript -@@ -1,6 +1,7 @@ - #!/usr/bin/env python - - import os -+from waflib import Logs - - VERSION="1.1.7" - -@@ -49,6 +50,18 @@ def configure(conf): - if conf.CONFIG_SET('HAVE_RES_NCLOSE'): - conf.DEFINE('HAVE_RES_NCLOSE_IN_LIBRESOLV', 1) - -+ # If we find res_nquery in libc, we can't do resolv.conf redirect -+ conf.CHECK_FUNCS('res_nquery __res_nquery') -+ if (conf.CONFIG_SET('HAVE_RES_NQUERY') -+ or conf.CONFIG_SET('HAVE___RES_NQUERY')): -+ Logs.warn("Detection for resolv_wrapper: " -+ "Only dns faking will be available") -+ else: -+ if conf.CHECK_FUNCS('res_nquery', lib='resolv'): -+ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) -+ if conf.CHECK_FUNCS('__res_nquery', lib='resolv'): -+ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) -+ - conf.CHECK_FUNCS_IN('res_init __res_init', 'resolv', checklibc=True) - conf.CHECK_FUNCS_IN('res_ninit __res_ninit', 'resolv', checklibc=True) - conf.CHECK_FUNCS_IN('res_close __res_close', 'resolv', checklibc=True) --- -2.33.1 - diff --git a/samba.spec b/samba.spec index 38bcc1c..23632c7 100644 --- a/samba.spec +++ b/samba.spec @@ -129,13 +129,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 0 -%global samba_version 4.15.5 +%global samba_version 4.15.6 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 -%global ldb_version 2.4.1 +%global ldb_version 2.4.2 # This should be rc1 or nil %global pre_release %nil @@ -200,7 +200,6 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch -Patch2: samba-glibc-dns.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4101,6 +4100,9 @@ fi %endif %changelog +* Wed Mar 16 2022 Pavel Filipenský - 4.15.6-0 +- Update to Samba 4.15.6 + * Wed Feb 23 2022 Andreas Schneider - 4.15.5-1 - resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc diff --git a/sources b/sources index 2e9aecc..eb4e013 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.5.tar.xz) = 8a77254ed40907abeb1c8c5d6234c10499c7bde9c95014383f8b53a29a9a1dd9a578611ef08eb139ac75317ad441a90fed502a30d4571d44abbce1ab02998caf -SHA512 (samba-4.15.5.tar.asc) = 10ae7ad4c628e438d0e433cea0665df7a0e167ca74b9e29e86e6e7350136dcdd9403e29568dc3228feb90a5307f29a5c12993ac85e70378c820fe9480f767585 +SHA512 (samba-4.15.6.tar.xz) = 472cbca58819550b0b48672754e3167137ed8aac29238bb822524acb51c2f96c76130a2a023a5895d3fffa8aeda3ed93c4c393776b0395a1e3508940b2d4f24f +SHA512 (samba-4.15.6.tar.asc) = c283372251b4de89b9464c74d507e047b1de46b0f59f94fba40988716aa1ed1eb939e0f0844826f06c48847744acf134135bbf79817d966e77e5516d23543fdb From babae4f58f1da2daa27b188a513cc4ce40ec7a10 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 2 Feb 2022 14:36:43 +0100 Subject: [PATCH 38/46] There is no such thing like .el9rhgs Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 23632c7..f74c59e 100644 --- a/samba.spec +++ b/samba.spec @@ -66,7 +66,7 @@ # Build vfs_gluster module by default on 64bit Fedora %global is_rhgs 0 -%if "%{dist}" == ".el8rhgs" || "%{dist}" == ".el9rhgs" +%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs" %global is_rhgs 1 %endif From 6b35d6b0ed38db73a33db8c58aac725cd8ab50f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 26 Apr 2022 20:02:36 +0200 Subject: [PATCH 39/46] Update to Samba 4.15.7 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 518c755..2d930b6 100644 --- a/.gitignore +++ b/.gitignore @@ -281,3 +281,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.5.tar.asc /samba-4.15.6.tar.xz /samba-4.15.6.tar.asc +/samba-4.15.7.tar.xz +/samba-4.15.7.tar.asc diff --git a/samba.spec b/samba.spec index f74c59e..f0d93fb 100644 --- a/samba.spec +++ b/samba.spec @@ -131,7 +131,7 @@ %global baserelease 0 -%global samba_version 4.15.6 +%global samba_version 4.15.7 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -4100,6 +4100,9 @@ fi %endif %changelog +* Tue Apr 26 2022 Guenther Deschner - 4.15.7-0 +- Update to Samba 4.15.7 + * Wed Mar 16 2022 Pavel Filipenský - 4.15.6-0 - Update to Samba 4.15.6 diff --git a/sources b/sources index eb4e013..e2a4b44 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.6.tar.xz) = 472cbca58819550b0b48672754e3167137ed8aac29238bb822524acb51c2f96c76130a2a023a5895d3fffa8aeda3ed93c4c393776b0395a1e3508940b2d4f24f -SHA512 (samba-4.15.6.tar.asc) = c283372251b4de89b9464c74d507e047b1de46b0f59f94fba40988716aa1ed1eb939e0f0844826f06c48847744acf134135bbf79817d966e77e5516d23543fdb +SHA512 (samba-4.15.7.tar.xz) = 2773be32e2bad8e7210ad87f746e6fffa73802abb712f2ab82b6f3c86bf93594e9223e627e3d29ca21d0f79e0e15e0619b250648b5f7cb067ac8f0bd95671306 +SHA512 (samba-4.15.7.tar.asc) = 379e89e26a7643da383a72ce3495b01dd783527d9fa16df3967d9800e3d094dba782a763d43d5d78355696f16db78b5d09db6c08a9b895044069006fd8cf0f49 From 5699cd2f3d5ecd7f0a1a56abc152d3a4ee3bcfa8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 28 Jun 2022 11:34:41 +0200 Subject: [PATCH 40/46] Update to Samba 4.15.8 pfilipen --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2d930b6..a2a1a1e 100644 --- a/.gitignore +++ b/.gitignore @@ -283,3 +283,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.6.tar.asc /samba-4.15.7.tar.xz /samba-4.15.7.tar.asc +/samba-4.15.8.tar.xz +/samba-4.15.8.tar.asc diff --git a/samba.spec b/samba.spec index f0d93fb..19becb4 100644 --- a/samba.spec +++ b/samba.spec @@ -131,7 +131,7 @@ %global baserelease 0 -%global samba_version 4.15.7 +%global samba_version 4.15.8 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -4100,6 +4100,9 @@ fi %endif %changelog +* Tue Jun 28 2022 Pavel Filipenský - 4.15.8-0 +- Update to Samba 4.15.8 + * Tue Apr 26 2022 Guenther Deschner - 4.15.7-0 - Update to Samba 4.15.7 diff --git a/sources b/sources index e2a4b44..2c90338 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.7.tar.xz) = 2773be32e2bad8e7210ad87f746e6fffa73802abb712f2ab82b6f3c86bf93594e9223e627e3d29ca21d0f79e0e15e0619b250648b5f7cb067ac8f0bd95671306 -SHA512 (samba-4.15.7.tar.asc) = 379e89e26a7643da383a72ce3495b01dd783527d9fa16df3967d9800e3d094dba782a763d43d5d78355696f16db78b5d09db6c08a9b895044069006fd8cf0f49 +SHA512 (samba-4.15.8.tar.asc) = cdfa733821554edb8cce5519bfadbe2ed3b06db6dc9799f617b7a83e3969ea65283b5a1bce81b37e90760722ee2e02b91a47ea4e03114981a5cf80a618123c4f +SHA512 (samba-4.15.8.tar.xz) = 754bcdc3dea45f58a9d00ed8cf3f4a2da9196421f7e6cf532dff75d060e097fc81b2f1df504431b53ad08379d5f854fc10a84b7daf60c6a76a147c49e8285fae From 945ae5bb6d963dbaad97b1afc0e964fde54636d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 28 Jun 2022 20:48:23 +0200 Subject: [PATCH 41/46] Fix ldb version requirement Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 19becb4..ca1079e 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 -%global ldb_version 2.4.2 +%global ldb_version 2.4.3 # This should be rc1 or nil %global pre_release %nil From 163b8baf5e057c22220d16d6a1ab3c3e79569b18 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 28 Jun 2022 21:06:52 +0200 Subject: [PATCH 42/46] Add new dlz_bind9_18.so module Guenther --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index ca1079e..e2f10a0 100644 --- a/samba.spec +++ b/samba.spec @@ -2057,6 +2057,7 @@ fi %{_libdir}/samba/bind9/dlz_bind9_12.so %{_libdir}/samba/bind9/dlz_bind9_14.so %{_libdir}/samba/bind9/dlz_bind9_16.so +%{_libdir}/samba/bind9/dlz_bind9_18.so #endif with dc %endif From 12f268eb60043ca3780e8fa745c2a1b4db18217e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 27 Jul 2022 15:19:02 +0200 Subject: [PATCH 43/46] Update to Samba 4.15.9 resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745 resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746 Guenther --- .gitignore | 2 + samba-s4u.patch | 115 +++++++++++++----------------------------------- samba.spec | 12 ++++- sources | 4 +- 4 files changed, 44 insertions(+), 89 deletions(-) diff --git a/.gitignore b/.gitignore index a2a1a1e..3657bf8 100644 --- a/.gitignore +++ b/.gitignore @@ -285,3 +285,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.7.tar.asc /samba-4.15.8.tar.xz /samba-4.15.8.tar.asc +/samba-4.15.9.tar.xz +/samba-4.15.9.tar.asc diff --git a/samba-s4u.patch b/samba-s4u.patch index 8e84d96..9e02ff7 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,4 +1,4 @@ -From 0b196043f08ea4c025f19c4519175a3a73e1d185 Mon Sep 17 00:00:00 2001 +From cfdb01091c4ad005654da9b4a64251a6d02ea637 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support @@ -12,10 +12,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 71 insertions(+), 106 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index f35210669c2..b1c7c5dcc5e 100644 +index dada3b79144..677ec1007c9 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -197,13 +197,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, krb5_keyblock *krbtgt_key, krb5_timestamp authtime, krb5_authdata **tgt_auth_data, @@ -36,7 +36,7 @@ index f35210669c2..b1c7c5dcc5e 100644 mit_ctx = ks_get_context(context); if (mit_ctx == NULL) { -@@ -233,41 +237,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -235,41 +239,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = krb5_pac_parse(context, authdata[0]->contents, authdata[0]->length, @@ -106,7 +106,7 @@ index f35210669c2..b1c7c5dcc5e 100644 if (code != 0) { goto done; } -@@ -275,17 +281,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -277,17 +283,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = mit_samba_reget_pac(mit_ctx, context, flags, @@ -133,7 +133,7 @@ index f35210669c2..b1c7c5dcc5e 100644 return code; } -@@ -314,6 +325,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -316,6 +327,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krb5_authdata **pac_auth_data = NULL; krb5_authdata **authdata = NULL; krb5_boolean is_as_req; @@ -141,7 +141,7 @@ index f35210669c2..b1c7c5dcc5e 100644 krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -325,11 +337,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -327,11 +339,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; @@ -153,7 +153,7 @@ index f35210669c2..b1c7c5dcc5e 100644 is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); /* -@@ -390,6 +397,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -392,6 +399,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, ks_client_princ = client->princ; } @@ -170,7 +170,7 @@ index f35210669c2..b1c7c5dcc5e 100644 if (client_entry == NULL) { client_entry = client; } -@@ -454,7 +471,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -456,7 +473,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, code = ks_verify_pac(context, flags, @@ -179,7 +179,7 @@ index f35210669c2..b1c7c5dcc5e 100644 client_entry, server, krbtgt, -@@ -494,7 +511,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -497,7 +514,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, is_as_req ? "AS-REQ" : "TGS-REQ", client_name); code = krb5_pac_sign(context, pac, authtime, ks_client_princ, @@ -188,7 +188,7 @@ index f35210669c2..b1c7c5dcc5e 100644 if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -520,12 +537,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -523,12 +540,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -201,7 +201,7 @@ index f35210669c2..b1c7c5dcc5e 100644 done: if (client_entry != NULL && client_entry != client) { ks_free_principal(context, client_entry); -@@ -551,32 +562,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, +@@ -554,32 +565,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -236,10 +236,10 @@ index f35210669c2..b1c7c5dcc5e 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 4239332f0d9..acc3cba6254 100644 +index ef4e8c2ed38..962fd05e1ac 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -501,7 +501,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -247,7 +247,7 @@ index 4239332f0d9..acc3cba6254 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -665,7 +664,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -688,7 +687,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -256,7 +256,7 @@ index 4239332f0d9..acc3cba6254 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -987,41 +986,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -1080,41 +1079,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -309,10 +309,10 @@ index 4239332f0d9..acc3cba6254 100644 static krb5_error_code mit_samba_change_pwd_error(krb5_context context, diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h -index 636c77ec97c..9cb00c9610e 100644 +index 4431e82a1b2..9370ab533af 100644 --- a/source4/kdc/mit_samba.h +++ b/source4/kdc/mit_samba.h -@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -57,7 +57,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -320,7 +320,7 @@ index 636c77ec97c..9cb00c9610e 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -73,9 +72,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -74,9 +73,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, DATA_BLOB *e_data); int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -333,10 +333,10 @@ index 636c77ec97c..9cb00c9610e 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.33.1 +2.37.1 -From 992d38fa35c01f2f0bdb39d387fa29e8eb8d3d37 Mon Sep 17 00:00:00 2001 +From 6e985cf7d5f29292c5f2dd2de75867dd30ef3df6 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build @@ -350,10 +350,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index fff5b4e2a22..791b417d5ba 100644 +index 610efcc9b87..96686147006 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c -@@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, +@@ -2697,6 +2697,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return 0; } @@ -611,66 +611,23 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.33.1 +2.37.1 -From f1951b501ca0fb3e613f04437c99dc1bbf204609 Mon Sep 17 00:00:00 2001 +From 3a9c224f229128451c878b262a716d48cb9f75d6 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code --- - source4/heimdal/lib/hdb/hdb.h | 1 + - source4/kdc/db-glue.c | 8 ++++++-- - source4/kdc/mit_samba.c | 3 +++ - source4/kdc/sdb.h | 1 + - 4 files changed, 11 insertions(+), 2 deletions(-) + source4/kdc/mit_samba.c | 3 +++ + 1 file changed, 3 insertions(+) -diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h -index 5ef9d9565f3..dafaffc6c2d 100644 ---- a/source4/heimdal/lib/hdb/hdb.h -+++ b/source4/heimdal/lib/hdb/hdb.h -@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; - #define HDB_F_ALL_KVNOS 2048 /* we want all the keys, live or not */ - #define HDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ - #define HDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ -+#define HDB_F_FORCE_CANON 16384 /* force canonicalition */ - - /* hdb_capability_flags */ - #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 -diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index aff74f2ee71..d16b4c3329a 100644 ---- a/source4/kdc/db-glue.c -+++ b/source4/kdc/db-glue.c -@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, - } - } - -- } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { -+ } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { // was this supposed to be || ? - ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); - if (ret) { - krb5_clear_error_message(context); - goto out; - } -- } else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) { -+ } else if (((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) || (flags & SDB_F_FORCE_CANON)){ - /* - * SDB_F_CANON maps from the canonicalize flag in the - * packet, and has a different meaning between AS-REQ - * and TGS-REQ. We only change the principal in the AS-REQ case -+ * -+ * The SDB_F_FORCE_CANON if for the new MIT kdc code that wants -+ * the canonical name in all lookups, and takes care to canonicalize -+ * only when appropriate. - */ - ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); - if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index acc3cba6254..f0b9df8b613 100644 +index 962fd05e1ac..9dc1bdf870b 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, +@@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { sflags |= SDB_F_CANON; } @@ -680,18 +637,6 @@ index acc3cba6254..f0b9df8b613 100644 if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY | KRB5_KDB_FLAG_INCLUDE_PAC)) { /* -diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h -index c929acccce6..a9115ec23d7 100644 ---- a/source4/kdc/sdb.h -+++ b/source4/kdc/sdb.h -@@ -116,6 +116,7 @@ struct sdb_entry_ex { - #define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */ - #define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ - #define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ -+#define SDB_F_FORCE_CANON 16384 /* force canonicalition */ - - void sdb_free_entry(struct sdb_entry_ex *e); - void free_sdb_entry(struct sdb_entry *s); -- -2.33.1 +2.37.1 diff --git a/samba.spec b/samba.spec index e2f10a0..8d048a9 100644 --- a/samba.spec +++ b/samba.spec @@ -131,11 +131,11 @@ %global baserelease 0 -%global samba_version 4.15.8 +%global samba_version 4.15.9 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 -%global ldb_version 2.4.3 +%global ldb_version 2.4.4 # This should be rc1 or nil %global pre_release %nil @@ -2921,6 +2921,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc @@ -2946,6 +2947,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py +%{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py @@ -4101,6 +4103,12 @@ fi %endif %changelog +* Wed Jul 27 2022 Guenther Deschner - 4.15.9-0 +- resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 +- resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 +- resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745 +- resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746 + * Tue Jun 28 2022 Pavel Filipenský - 4.15.8-0 - Update to Samba 4.15.8 diff --git a/sources b/sources index 2c90338..0a7f943 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.8.tar.asc) = cdfa733821554edb8cce5519bfadbe2ed3b06db6dc9799f617b7a83e3969ea65283b5a1bce81b37e90760722ee2e02b91a47ea4e03114981a5cf80a618123c4f -SHA512 (samba-4.15.8.tar.xz) = 754bcdc3dea45f58a9d00ed8cf3f4a2da9196421f7e6cf532dff75d060e097fc81b2f1df504431b53ad08379d5f854fc10a84b7daf60c6a76a147c49e8285fae +SHA512 (samba-4.15.9.tar.xz) = eea088cc5debad291e6334f480770b27d973ae330069b0e4ec7e02fc5721e444fb5c9d58f560c181768f6ffea850be6ff602c0cd6404e6a85950024495072ce6 +SHA512 (samba-4.15.9.tar.asc) = 358fcc91b56cc84606179f5bdd88e2e7d24b5a44796da54b0f12a8d0e4641c0851c95e86a2a0c24c8bf3503af7b874887fcb28f84779b4a7bb65cf5a8220e6f6 From a62dadcdcaf52f37038316738701d39c259c229b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 28 Sep 2022 18:38:17 +0200 Subject: [PATCH 44/46] Update to Samba 4.15.10 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 3657bf8..522f743 100644 --- a/.gitignore +++ b/.gitignore @@ -287,3 +287,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.8.tar.asc /samba-4.15.9.tar.xz /samba-4.15.9.tar.asc +/samba-4.15.10.tar.xz +/samba-4.15.10.tar.asc diff --git a/samba.spec b/samba.spec index 8d048a9..ac81984 100644 --- a/samba.spec +++ b/samba.spec @@ -131,7 +131,7 @@ %global baserelease 0 -%global samba_version 4.15.9 +%global samba_version 4.15.10 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -4103,6 +4103,9 @@ fi %endif %changelog +* Wed Sep 28 2022 Guenther Deschner - 4.15.10-0 +- Update to Samba 4.15.10 + * Wed Jul 27 2022 Guenther Deschner - 4.15.9-0 - resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 - resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 diff --git a/sources b/sources index 0a7f943..65b69a0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.9.tar.xz) = eea088cc5debad291e6334f480770b27d973ae330069b0e4ec7e02fc5721e444fb5c9d58f560c181768f6ffea850be6ff602c0cd6404e6a85950024495072ce6 -SHA512 (samba-4.15.9.tar.asc) = 358fcc91b56cc84606179f5bdd88e2e7d24b5a44796da54b0f12a8d0e4641c0851c95e86a2a0c24c8bf3503af7b874887fcb28f84779b4a7bb65cf5a8220e6f6 +SHA512 (samba-4.15.10.tar.xz) = 1f26ebf99a08088ca35fd64fba0df8cf317217ec588eb9b301870f629e83cc58727a3a2ae323b2e7997ff278e94003e9d72cf5b3a08ee56ee1afce06d50d5257 +SHA512 (samba-4.15.10.tar.asc) = 09697b52109fee43804e90df2024940c59e049c2ef31e109acf8adaedded587e3ffef92de02124ad33d048ac6ccad152d784d9eba8610398a651bb19cc195f65 From e3df474408218c781bb38b588c8a9a1041640ced Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 27 Oct 2022 00:59:08 +0200 Subject: [PATCH 45/46] Update to version 4.15.11 resolves: #2137774, #2137777 - Security fixes for CVE-2022-3437 Guenther --- .gitignore | 2 ++ samba.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 522f743..0ed7c9f 100644 --- a/.gitignore +++ b/.gitignore @@ -289,3 +289,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.9.tar.asc /samba-4.15.10.tar.xz /samba-4.15.10.tar.asc +/samba-4.15.11.tar.xz +/samba-4.15.11.tar.asc diff --git a/samba.spec b/samba.spec index ac81984..9e58f9e 100644 --- a/samba.spec +++ b/samba.spec @@ -131,7 +131,7 @@ %global baserelease 0 -%global samba_version 4.15.10 +%global samba_version 4.15.11 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -4103,6 +4103,10 @@ fi %endif %changelog +* Wed Oct 26 2022 Guenther Deschner - 4.15.11-0 +- Update to version 4.15.11 +- resolves: #2137774, #2137777 - Security fixes for CVE-2022-3437 + * Wed Sep 28 2022 Guenther Deschner - 4.15.10-0 - Update to Samba 4.15.10 diff --git a/sources b/sources index 65b69a0..75f390d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.10.tar.xz) = 1f26ebf99a08088ca35fd64fba0df8cf317217ec588eb9b301870f629e83cc58727a3a2ae323b2e7997ff278e94003e9d72cf5b3a08ee56ee1afce06d50d5257 -SHA512 (samba-4.15.10.tar.asc) = 09697b52109fee43804e90df2024940c59e049c2ef31e109acf8adaedded587e3ffef92de02124ad33d048ac6ccad152d784d9eba8610398a651bb19cc195f65 +SHA512 (samba-4.15.11.tar.xz) = aa63a09f1d27e8562df13e740a40ece36a6f570bede3845a2a18420d2029b4f413235df331f93403cda8413aea6d713116b5a3e4825338959025c3fcb8356f84 +SHA512 (samba-4.15.11.tar.asc) = 387b223a4f3f2b57bf922b459ccb1a1fe29ed68301f1c9e46df0e2ce64667a1eb8edd9462ef995a5dac21b8d4a756e7cac534256e34bc77804fd51e08d6d64a8 From 37bcb6ae22037be48c09cfe5ac2e77c2bf307e51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 16 Nov 2022 00:46:34 +0100 Subject: [PATCH 46/46] Update to version 4.15.12 resolves: #2140960, #2143115 - Security fixes for CVE-2022-42898 Guenther --- .gitignore | 2 ++ samba.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 0ed7c9f..0f57b7d 100644 --- a/.gitignore +++ b/.gitignore @@ -291,3 +291,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.10.tar.asc /samba-4.15.11.tar.xz /samba-4.15.11.tar.asc +/samba-4.15.12.tar.xz +/samba-4.15.12.tar.asc diff --git a/samba.spec b/samba.spec index 9e58f9e..dced273 100644 --- a/samba.spec +++ b/samba.spec @@ -131,7 +131,7 @@ %global baserelease 0 -%global samba_version 4.15.11 +%global samba_version 4.15.12 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -4103,6 +4103,10 @@ fi %endif %changelog +* Tue Nov 15 2022 Guenther Deschner - 4.15.12-0 +- Update to version 4.15.12 +- resolves: #2140960, #2143115 - Security fixes for CVE-2022-42898 + * Wed Oct 26 2022 Guenther Deschner - 4.15.11-0 - Update to version 4.15.11 - resolves: #2137774, #2137777 - Security fixes for CVE-2022-3437 diff --git a/sources b/sources index 75f390d..8c09d46 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.11.tar.xz) = aa63a09f1d27e8562df13e740a40ece36a6f570bede3845a2a18420d2029b4f413235df331f93403cda8413aea6d713116b5a3e4825338959025c3fcb8356f84 -SHA512 (samba-4.15.11.tar.asc) = 387b223a4f3f2b57bf922b459ccb1a1fe29ed68301f1c9e46df0e2ce64667a1eb8edd9462ef995a5dac21b8d4a756e7cac534256e34bc77804fd51e08d6d64a8 +SHA512 (samba-4.15.12.tar.xz) = c3d678944828f718a589630cf19998c8c917d8e93041fc46c07946ecd98ba8656086ca5b8881a1ab7c5a8d8ab4a66c7953e86bd99d67aeac2760e4151ffc0de2 +SHA512 (samba-4.15.12.tar.asc) = ac841370c230d0132c5e3ec8c0c1c87f9ba863fd45f6e48f191d50069c8a77cb924ace4166c5f594eda40f8b56f07b0c0501dbf92e38ee3455ccb5c88fa23fb6