diff --git a/.gitignore b/.gitignore index 105b67b..302c057 100644 --- a/.gitignore +++ b/.gitignore @@ -199,3 +199,33 @@ samba-3.6.0pre1.tar.gz /samba-4.12.0rc4.tar.asc /samba-4.12.0.tar.xz /samba-4.12.0.tar.asc +/samba-4.12.1.tar.xz +/samba-4.12.1.tar.asc +/samba-4.12.2.tar.xz +/samba-4.12.2.tar.asc +/samba-4.12.3.tar.xz +/samba-4.12.3.tar.asc +/samba-4.12.4.tar.xz +/samba-4.12.4.tar.asc +/samba-4.12.5.tar.xz +/samba-4.12.5.tar.asc +/samba-4.12.6.tar.xz +/samba-4.12.6.tar.asc +/samba-4.12.7.tar.xz +/samba-4.12.7.tar.asc +/samba-4.12.8.tar.xz +/samba-4.12.8.tar.asc +/samba-4.12.9.tar.xz +/samba-4.12.9.tar.asc +/samba-4.12.10.tar.xz +/samba-4.12.10.tar.asc +/samba-4.12.11.tar.xz +/samba-4.12.11.tar.asc +/samba-4.12.12.tar.xz +/samba-4.12.12.tar.asc +/samba-4.12.13.tar.xz +/samba-4.12.13.tar.asc +/samba-4.12.14.tar.xz +/samba-4.12.14.tar.asc +/samba-4.12.15.tar.xz +/samba-4.12.15.tar.asc diff --git a/gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg b/gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg deleted file mode 100644 index a61ebc4..0000000 Binary files a/gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg and /dev/null differ diff --git a/new_mit_118.patch b/new_mit_118.patch deleted file mode 100644 index 78177ef..0000000 --- a/new_mit_118.patch +++ /dev/null @@ -1,174 +0,0 @@ -From 04b262f686b5b16ba659ade1e4b5778e2b219f0a Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Mon, 16 Sep 2019 16:40:12 +0300 -Subject: [PATCH 1/2] Adapt sign_authdata in our KDB module for krb5 v1.18 - -Signed-off-by: Isaac Boukris ---- - source4/kdc/mit-kdb/kdb_samba.c | 2 +- - source4/kdc/mit-kdb/kdb_samba.h | 21 +++++++++++++++++++++ - source4/kdc/mit-kdb/kdb_samba_policies.c | 24 ++++++++++++++++++++++++ - 3 files changed, 46 insertions(+), 1 deletion(-) - -diff --git a/source4/kdc/mit-kdb/kdb_samba.c b/source4/kdc/mit-kdb/kdb_samba.c -index c5157d6ed1b..02bbdca9f54 100644 ---- a/source4/kdc/mit-kdb/kdb_samba.c -+++ b/source4/kdc/mit-kdb/kdb_samba.c -@@ -139,7 +139,7 @@ static void kdb_samba_db_free_principal_e_data(krb5_context context, - - kdb_vftabl kdb_function_table = { - .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION, -- .min_ver = 1, -+ .min_ver = KRB5_KDB_DAL_MAJOR_VERSION == 6 ? 1 : 0, - - .init_library = kdb_samba_init_library, - .fini_library = kdb_samba_fini_library, -diff --git a/source4/kdc/mit-kdb/kdb_samba.h b/source4/kdc/mit-kdb/kdb_samba.h -index 22ef9085b6a..ad4f6e27573 100644 ---- a/source4/kdc/mit-kdb/kdb_samba.h -+++ b/source4/kdc/mit-kdb/kdb_samba.h -@@ -114,6 +114,7 @@ krb5_error_code kdb_samba_dbekd_encrypt_key_data(krb5_context context, - - /* from kdb_samba_policies.c */ - -+#if KRB5_KDB_API_VERSION < 10 - krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - unsigned int flags, - krb5_const_principal client_princ, -@@ -127,6 +128,26 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_timestamp authtime, - krb5_authdata **tgt_auth_data, - krb5_authdata ***signed_auth_data); -+#else -+krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, -+ unsigned int flags, -+ krb5_const_principal client_princ, -+ krb5_const_principal server_princ, -+ krb5_db_entry *client, -+ krb5_db_entry *server, -+ krb5_db_entry *krbtgt, -+ krb5_db_entry *local_krbtgt, -+ krb5_keyblock *client_key, -+ krb5_keyblock *server_key, -+ krb5_keyblock *krbtgt_key, -+ krb5_keyblock *local_krbtgt_key, -+ krb5_keyblock *session_key, -+ krb5_timestamp authtime, -+ krb5_authdata **tgt_auth_data, -+ void *authdata_info, -+ krb5_data ***auth_indicators, -+ krb5_authdata ***signed_auth_data); -+#endif - - krb5_error_code kdb_samba_db_check_policy_as(krb5_context context, - krb5_kdc_req *kdcreq, -diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index fc80329f221..e2f7174b0c2 100644 ---- a/source4/kdc/mit-kdb/kdb_samba_policies.c -+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -287,6 +287,7 @@ done: - return code; - } - -+#if KRB5_KDB_API_VERSION < 10 - krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - unsigned int flags, - krb5_const_principal client_princ, -@@ -301,6 +302,29 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_authdata **tgt_auth_data, - krb5_authdata ***signed_auth_data) - { -+#else -+krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, -+ unsigned int flags, -+ krb5_const_principal client_princ, -+ krb5_const_principal server_princ, -+ krb5_db_entry *client, -+ krb5_db_entry *server, -+ krb5_db_entry *krbtgt, -+ krb5_db_entry *local_krbtgt, -+ krb5_keyblock *client_key, -+ krb5_keyblock *server_key, -+ krb5_keyblock *krbtgt_key, -+ krb5_keyblock *local_krbtgt_key, -+ krb5_keyblock *session_key, -+ krb5_timestamp authtime, -+ krb5_authdata **tgt_auth_data, -+ void *authdata_info, -+ krb5_data ***auth_indicators, -+ krb5_authdata ***signed_auth_data) -+{ -+ krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; -+ krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; -+#endif - krb5_const_principal ks_client_princ; - krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; --- -2.24.1 - - -From c968ec07fa403ed919dcda7b3087e0d10d1e7a32 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 16 Jan 2020 22:00:21 +0100 -Subject: [PATCH 2/2] Sign and verify PAC with ticket principal instead of - canon principal - -With MIT library 1.18 the KDC no longer set -KRB5_KDB_FLAG_CANONICALIZE for enterprise principals which allows -us to not canonicalize them (like in Windwos / Heimdal). - -However, it now breaks the PAC signature verification as it was -wrongly done using canonical client rather than ticket client name. - -Signed-off-by: Isaac Boukris ---- - source4/kdc/mit-kdb/kdb_samba_policies.c | 12 ++---------- - 1 file changed, 2 insertions(+), 10 deletions(-) - -diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index e2f7174b0c2..6a5f06a8a8c 100644 ---- a/source4/kdc/mit-kdb/kdb_samba_policies.c -+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -325,20 +325,12 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; - krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; - #endif -- krb5_const_principal ks_client_princ; - krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; - krb5_error_code code; - krb5_pac pac = NULL; - krb5_data pac_data; - -- /* Prefer canonicalised name from client entry */ -- if (client != NULL) { -- ks_client_princ = client->princ; -- } else { -- ks_client_princ = client_princ; -- } -- - is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); - - if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { -@@ -351,7 +343,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (!is_as_req) { - code = ks_verify_pac(context, - flags, -- ks_client_princ, -+ client_princ, - client, - server, - krbtgt, -@@ -378,7 +370,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - goto done; - } - -- code = krb5_pac_sign(context, pac, authtime, ks_client_princ, -+ code = krb5_pac_sign(context, pac, authtime, client_princ, - server_key, krbtgt_key, &pac_data); - if (code != 0) { - DBG_ERR("krb5_pac_sign failed: %d\n", code); --- -2.24.1 - diff --git a/samba-4.12.0-winexe.patch b/samba-4.12.0-winexe.patch deleted file mode 100644 index b5ae3bb..0000000 --- a/samba-4.12.0-winexe.patch +++ /dev/null @@ -1,438 +0,0 @@ -From a1fdd83ab776f981e992c3f2fc8c341d6b37a0d4 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Thu, 5 Mar 2020 22:45:48 +0100 -Subject: [PATCH 1/3] s4-torture: add rpc test for ChangeServiceConfigW - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit 0825324bc75d2ab10164a1f137be782d84c822b8) ---- - selftest/knownfail | 3 ++ - source4/torture/rpc/svcctl.c | 78 +++++++++++++++++++++++++++++++++++- - 2 files changed, 80 insertions(+), 1 deletion(-) - -diff --git a/selftest/knownfail b/selftest/knownfail -index c9ef0851172..20441c078b4 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -234,6 +234,9 @@ - ^samba3.rpc.eventlog.eventlog.GetNumRecords\(ad_dc\) - ^samba3.rpc.eventlog.eventlog.OpenEventLog\(ad_dc\) - ^samba3.rap.basic.netsessiongetinfo\(ad_dc\) -+# not implemented -+^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\) -+^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\) - # - # This makes less sense when not running against an AD DC - # -diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c -index ebb2bc6ad0e..bd16ed4627d 100644 ---- a/source4/torture/rpc/svcctl.c -+++ b/source4/torture/rpc/svcctl.c -@@ -3,7 +3,7 @@ - test suite for svcctl rpc operations - - Copyright (C) Jelmer Vernooij 2004 -- Copyright (C) Guenther Deschner 2008,2009 -+ Copyright (C) Guenther Deschner 2008,2009,2020 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by -@@ -623,6 +623,80 @@ static bool test_SCManager(struct torture_context *tctx, - return true; - } - -+static bool test_ChangeServiceConfigW(struct torture_context *tctx, -+ struct dcerpc_pipe *p) -+{ -+ struct svcctl_ChangeServiceConfigW r; -+ struct svcctl_QueryServiceConfigW q; -+ struct policy_handle h, s; -+ NTSTATUS status; -+ struct dcerpc_binding_handle *b = p->binding_handle; -+ struct QUERY_SERVICE_CONFIG query; -+ bool ok; -+ -+ uint32_t offered = 0; -+ uint32_t needed = 0; -+ -+ ok = test_OpenSCManager(b, tctx, &h); -+ if (!ok) { -+ return false; -+ } -+ -+ ok = test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s); -+ if (!ok) { -+ return false; -+ } -+ -+ q.in.handle = &s; -+ q.in.offered = offered; -+ q.out.query = &query; -+ q.out.needed = &needed; -+ -+ status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &q); -+ torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!"); -+ -+ if (W_ERROR_EQUAL(q.out.result, WERR_INSUFFICIENT_BUFFER)) { -+ q.in.offered = needed; -+ status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &q); -+ torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!"); -+ } -+ torture_assert_werr_ok(tctx, q.out.result, "QueryServiceConfigW failed!"); -+ -+ r.in.handle = &s; -+ r.in.type = query.service_type; -+ r.in.start_type = query.start_type; -+ r.in.error_control = query.error_control; -+ -+ /* -+ * according to MS-SCMR 3.1.4.11 NULL params are supposed to leave the -+ * existing values intact. -+ */ -+ -+ r.in.binary_path = NULL; -+ r.in.load_order_group = NULL; -+ r.in.dependencies = NULL; -+ r.in.service_start_name = NULL; -+ r.in.password = NULL; -+ r.in.display_name = NULL; -+ r.out.tag_id = NULL; -+ -+ status = dcerpc_svcctl_ChangeServiceConfigW_r(b, tctx, &r); -+ torture_assert_ntstatus_ok(tctx, status, "ChangeServiceConfigW failed!"); -+ torture_assert_werr_ok(tctx, r.out.result, "ChangeServiceConfigW failed!"); -+ -+ ok = test_CloseServiceHandle(b, tctx, &s); -+ if (!ok) { -+ return false; -+ } -+ -+ ok = test_CloseServiceHandle(b, tctx, &h); -+ if (!ok) { -+ return false; -+ } -+ -+ return true; -+} -+ - struct torture_suite *torture_rpc_svcctl(TALLOC_CTX *mem_ctx) - { - struct torture_suite *suite = torture_suite_create(mem_ctx, "svcctl"); -@@ -652,6 +726,8 @@ struct torture_suite *torture_rpc_svcctl(TALLOC_CTX *mem_ctx) - test_StartServiceW); - torture_rpc_tcase_add_test(tcase, "ControlService", - test_ControlService); -+ torture_rpc_tcase_add_test(tcase, "ChangeServiceConfigW", -+ test_ChangeServiceConfigW); - - return suite; - } --- -2.24.1 - - -From 1168f1c392b3e315b5a4af9be793b93234420786 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Thu, 5 Mar 2020 20:42:21 +0100 -Subject: [PATCH 2/3] s4-torture: add ndr svcctl testsuite - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit c3fa0b2df9fc53dddcc3160b6a3dc751bbb389a4) ---- - librpc/idl/svcctl.idl | 2 +- - selftest/knownfail | 5 +++ - source4/torture/ndr/ndr.c | 1 + - source4/torture/ndr/svcctl.c | 85 +++++++++++++++++++++++++++++++++++ - source4/torture/wscript_build | 1 + - 5 files changed, 93 insertions(+), 1 deletion(-) - create mode 100644 source4/torture/ndr/svcctl.c - -diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl -index 671a1dc47be..e909bf2dbed 100644 ---- a/librpc/idl/svcctl.idl -+++ b/librpc/idl/svcctl.idl -@@ -188,7 +188,7 @@ import "misc.idl", "security.idl"; - SVCCTL_DISABLED = 0x00000004 - } svcctl_StartType; - -- WERROR svcctl_ChangeServiceConfigW( -+ [public] WERROR svcctl_ChangeServiceConfigW( - [in,ref] policy_handle *handle, - [in] uint32 type, - [in] svcctl_StartType start_type, -diff --git a/selftest/knownfail b/selftest/knownfail -index 20441c078b4..c5d4cdd9419 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -237,6 +237,11 @@ - # not implemented - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\) - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\) -+# broken IDL -+^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_IN -+^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_OUT -+^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_IN -+^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_OUT - # - # This makes less sense when not running against an AD DC - # -diff --git a/source4/torture/ndr/ndr.c b/source4/torture/ndr/ndr.c -index 32efe90757d..690301f31b1 100644 ---- a/source4/torture/ndr/ndr.c -+++ b/source4/torture/ndr/ndr.c -@@ -708,6 +708,7 @@ struct torture_suite *torture_local_ndr(TALLOC_CTX *mem_ctx) - torture_suite_add_suite(suite, ndr_krb5pac_suite(suite)); - torture_suite_add_suite(suite, ndr_cabinet_suite(suite)); - torture_suite_add_suite(suite, ndr_charset_suite(suite)); -+ torture_suite_add_suite(suite, ndr_svcctl_suite(suite)); - - torture_suite_add_simple_test(suite, "string terminator", - test_check_string_terminator); -diff --git a/source4/torture/ndr/svcctl.c b/source4/torture/ndr/svcctl.c -new file mode 100644 -index 00000000000..1c9404597cd ---- /dev/null -+++ b/source4/torture/ndr/svcctl.c -@@ -0,0 +1,85 @@ -+/* -+ Unix SMB/CIFS implementation. -+ test suite for svcctl ndr operations -+ -+ Copyright (C) Guenther Deschner 2020 -+ -+ This program is free software; you can redistribute it and/or modify -+ it under the terms of the GNU General Public License as published by -+ the Free Software Foundation; either version 3 of the License, or -+ (at your option) any later version. -+ -+ This program is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ GNU General Public License for more details. -+ -+ You should have received a copy of the GNU General Public License -+ along with this program. If not, see . -+*/ -+ -+#include "includes.h" -+#include "torture/ndr/ndr.h" -+#include "librpc/gen_ndr/ndr_svcctl.h" -+#include "torture/ndr/proto.h" -+#include "param/param.h" -+ -+static const uint8_t svcctl_ChangeServiceConfigW_req_data[] = { -+ 0x00, 0x00, 0x00, 0x00, 0xcd, 0x94, 0x05, 0x40, 0x30, 0x28, 0x00, 0x49, -+ 0x8d, 0xe4, 0x8e, 0x85, 0xb7, 0x19, 0x5c, 0x83, 0x10, 0x01, 0x00, 0x00, -+ 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 -+}; -+ -+static bool svcctl_ChangeServiceConfigW_req_check(struct torture_context *tctx, -+ struct svcctl_ChangeServiceConfigW *r) -+{ -+ struct policy_handle handle = { 0 }; -+ GUID_from_string("400594cd-2830-4900-8de4-8e85b7195c83", &handle.uuid); -+ -+ torture_assert_guid_equal(tctx, r->in.handle->uuid, handle.uuid, "handle"); -+ torture_assert_u32_equal(tctx, r->in.type, 0x00000110, "type"); -+ torture_assert_u32_equal(tctx, r->in.start_type, SVCCTL_AUTO_START, "start_type"); -+ torture_assert_u32_equal(tctx, r->in.error_control, SVCCTL_SVC_ERROR_NORMAL, "error_control"); -+ torture_assert_str_equal(tctx, r->in.binary_path, NULL, "binary_path"); -+ torture_assert_str_equal(tctx, r->in.load_order_group, NULL, "load_order_group"); -+ torture_assert_str_equal(tctx, r->in.dependencies, NULL, "dependencies"); -+ torture_assert_str_equal(tctx, r->in.service_start_name, NULL, "service_start_name"); -+ torture_assert_str_equal(tctx, r->in.password, NULL, "password"); -+ torture_assert_str_equal(tctx, r->in.display_name, NULL, "display_name"); -+ -+ return true; -+} -+ -+static const uint8_t svcctl_ChangeServiceConfigW_rep_data[] = { -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 -+}; -+ -+static bool svcctl_ChangeServiceConfigW_rep_check(struct torture_context *tctx, -+ struct svcctl_ChangeServiceConfigW *r) -+{ -+ torture_assert(tctx, r->out.tag_id == NULL, "tag_id"); -+ torture_assert_werr_ok(tctx, r->out.result, "result"); -+ -+ return true; -+} -+ -+struct torture_suite *ndr_svcctl_suite(TALLOC_CTX *ctx) -+{ -+ struct torture_suite *suite = torture_suite_create(ctx, "svcctl"); -+ -+ torture_suite_add_ndr_pull_fn_test(suite, -+ svcctl_ChangeServiceConfigW, -+ svcctl_ChangeServiceConfigW_req_data, -+ NDR_IN, -+ svcctl_ChangeServiceConfigW_req_check); -+ -+ torture_suite_add_ndr_pull_fn_test(suite, -+ svcctl_ChangeServiceConfigW, -+ svcctl_ChangeServiceConfigW_rep_data, -+ NDR_OUT, -+ svcctl_ChangeServiceConfigW_rep_check); -+ return suite; -+} -diff --git a/source4/torture/wscript_build b/source4/torture/wscript_build -index 65af160b322..05a6fbcbf14 100644 ---- a/source4/torture/wscript_build -+++ b/source4/torture/wscript_build -@@ -71,6 +71,7 @@ bld.SAMBA_SUBSYSTEM('TORTURE_NDR', - ndr/winspool.c - ndr/cabinet.c - ndr/charset.c -+ ndr/svcctl.c - ''', - autoproto='ndr/proto.h', - deps='torture krb5samba', --- -2.24.1 - - -From 28d86d48adfee6c1d03ea192b69be87a0b9ce400 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Wed, 4 Mar 2020 15:23:43 +0100 -Subject: [PATCH 3/3] librpc: fix IDL for svcctl_ChangeServiceConfigW - -Found while trying to run winexe against Windows Server 2019. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit ebda529b59105e9b70cc74377fe4d54cc16b4f37) ---- - examples/winexe/winexe.c | 2 ++ - librpc/idl/svcctl.idl | 23 ++++++++++++++++++----- - selftest/knownfail | 5 ----- - source4/torture/ndr/svcctl.c | 3 +++ - source4/torture/rpc/svcctl.c | 3 +++ - 5 files changed, 26 insertions(+), 10 deletions(-) - -diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c -index 22f748b1d45..fc6b15f8e52 100644 ---- a/examples/winexe/winexe.c -+++ b/examples/winexe/winexe.c -@@ -625,8 +625,10 @@ static NTSTATUS winexe_svc_install( - NULL, /* load_order_group */ - NULL, /* tag_id */ - NULL, /* dependencies */ -+ 0, /* dwDependSize */ - NULL, /* service_start_name */ - NULL, /* password */ -+ 0, /* dwPwSize */ - NULL, /* display_name */ - &werr); - -diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl -index e909bf2dbed..a9dd3dec990 100644 ---- a/librpc/idl/svcctl.idl -+++ b/librpc/idl/svcctl.idl -@@ -13,6 +13,17 @@ import "misc.idl", "security.idl"; - helpstring("Service Control") - ] interface svcctl - { -+ const int MAX_SERVICE_NAME_LENGTH = 256; -+ const short SC_MAX_DEPEND_SIZE = 4 * 1024; -+ const short SC_MAX_NAME_LENGTH = MAX_SERVICE_NAME_LENGTH + 1; -+ const short SC_MAX_PATH_LENGTH = 32 * 1024; -+ const short SC_MAX_PWD_SIZE = 514; -+ const short SC_MAX_COMPUTER_NAME_LENGTH = 1024; -+ const short SC_MAX_ACCOUNT_NAME_LENGTH = 2 * 1024; -+ const short SC_MAX_COMMENT_LENGTH = 128; -+ const short SC_MAX_ARGUMENT_LENGTH = 1024; -+ const short SC_MAX_ARGUMENTS = 1024; -+ - typedef struct { - uint32 is_locked; - [string,charset(UTF16)] uint16 *lock_owner; -@@ -195,11 +206,13 @@ import "misc.idl", "security.idl"; - [in] svcctl_ErrorControl error_control, - [in,unique] [string,charset(UTF16)] uint16 *binary_path, - [in,unique] [string,charset(UTF16)] uint16 *load_order_group, -- [out,ref] uint32 *tag_id, -- [in,unique] [string,charset(UTF16)] uint16 *dependencies, -- [in,unique] [string,charset(UTF16)] uint16 *service_start_name, -- [in,unique] [string,charset(UTF16)] uint16 *password, -- [in,unique] [string,charset(UTF16)] uint16 *display_name -+ [in,out,unique] uint32 *tag_id, -+ [in,unique,size_is(dwDependSize)] [string,charset(UTF16)] uint16 *dependencies, -+ [in,range(0, SC_MAX_DEPEND_SIZE)] uint32 dwDependSize, -+ [in,unique,range(0, SC_MAX_ACCOUNT_NAME_LENGTH)] [string,charset(UTF16)] uint16 *service_start_name, -+ [in,unique,size_is(dwPwSize)] [string,charset(UTF16)] uint16 *password, -+ [in,range(0, SC_MAX_PWD_SIZE)] uint32 dwPwSize, -+ [in,unique,range(0, SC_MAX_NAME_LENGTH)] [string,charset(UTF16)] uint16 *display_name - ); - - /*****************/ -diff --git a/selftest/knownfail b/selftest/knownfail -index c5d4cdd9419..20441c078b4 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -237,11 +237,6 @@ - # not implemented - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\) - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\) --# broken IDL --^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_IN --^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_OUT --^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_IN --^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_OUT - # - # This makes less sense when not running against an AD DC - # -diff --git a/source4/torture/ndr/svcctl.c b/source4/torture/ndr/svcctl.c -index 1c9404597cd..6592beda02e 100644 ---- a/source4/torture/ndr/svcctl.c -+++ b/source4/torture/ndr/svcctl.c -@@ -45,9 +45,12 @@ static bool svcctl_ChangeServiceConfigW_req_check(struct torture_context *tctx, - torture_assert_u32_equal(tctx, r->in.error_control, SVCCTL_SVC_ERROR_NORMAL, "error_control"); - torture_assert_str_equal(tctx, r->in.binary_path, NULL, "binary_path"); - torture_assert_str_equal(tctx, r->in.load_order_group, NULL, "load_order_group"); -+ torture_assert(tctx, r->in.tag_id == NULL, "tag_id"); - torture_assert_str_equal(tctx, r->in.dependencies, NULL, "dependencies"); -+ torture_assert_u32_equal(tctx, r->in.dwDependSize, 0, "dwDependSize"); - torture_assert_str_equal(tctx, r->in.service_start_name, NULL, "service_start_name"); - torture_assert_str_equal(tctx, r->in.password, NULL, "password"); -+ torture_assert_u32_equal(tctx, r->in.dwPwSize, 0, "dwPwSize"); - torture_assert_str_equal(tctx, r->in.display_name, NULL, "display_name"); - - return true; -diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c -index bd16ed4627d..746b399360e 100644 ---- a/source4/torture/rpc/svcctl.c -+++ b/source4/torture/rpc/svcctl.c -@@ -675,9 +675,12 @@ static bool test_ChangeServiceConfigW(struct torture_context *tctx, - r.in.binary_path = NULL; - r.in.load_order_group = NULL; - r.in.dependencies = NULL; -+ r.in.dwDependSize = 0; - r.in.service_start_name = NULL; - r.in.password = NULL; -+ r.in.dwPwSize = 0; - r.in.display_name = NULL; -+ r.in.tag_id = NULL; - r.out.tag_id = NULL; - - status = dcerpc_svcctl_ChangeServiceConfigW_r(b, tctx, &r); --- -2.24.1 - diff --git a/samba-pubkey_AA99442FB680B620.gpg b/samba-pubkey_AA99442FB680B620.gpg new file mode 100644 index 0000000..c901409 Binary files /dev/null and b/samba-pubkey_AA99442FB680B620.gpg differ diff --git a/samba-s4u.patch b/samba-s4u.patch new file mode 100644 index 0000000..83ed873 --- /dev/null +++ b/samba-s4u.patch @@ -0,0 +1,726 @@ +From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Fri, 27 Sep 2019 18:25:03 +0300 +Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support + +Signed-off-by: Isaac Boukris +Pair-Programmed-With: Andreas Schneider +--- + source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++--------- + source4/kdc/mit_samba.c | 47 ++---- + source4/kdc/mit_samba.h | 6 +- + wscript_configure_system_mitkrb5 | 3 + + 6 files changed, 91 insertions(+), 115 deletions(-) + +diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c +index 9197551ed61..944324d9a2f 100644 +--- a/source4/kdc/mit-kdb/kdb_samba_policies.c ++++ b/source4/kdc/mit-kdb/kdb_samba_policies.c +@@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, + krb5_keyblock *krbtgt_key, + krb5_timestamp authtime, + krb5_authdata **tgt_auth_data, +- krb5_pac *pac) ++ krb5_pac *out_pac) + { + struct mit_samba_context *mit_ctx; + krb5_authdata **authdata = NULL; +- krb5_pac ipac = NULL; +- DATA_BLOB logon_data = { NULL, 0 }; ++ krb5_keyblock *header_server_key = NULL; ++ krb5_key_data *impersonator_kd = NULL; ++ krb5_keyblock impersonator_key = {0}; + krb5_error_code code; ++ krb5_pac pac; ++ ++ *out_pac = NULL; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { +@@ -230,41 +234,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, + code = krb5_pac_parse(context, + authdata[0]->contents, + authdata[0]->length, +- &ipac); ++ &pac); + if (code != 0) { + goto done; + } + +- /* TODO: verify this is correct +- * +- * In the constrained delegation case, the PAC is from a service +- * ticket rather than a TGT; we must verify the server and KDC +- * signatures to assert that the server did not forge the PAC. ++ /* ++ * For constrained delegation in MIT version < 1.18 we aren't provided ++ * with the 2nd ticket server key to verify the PAC. ++ * We can workaround that by fetching the key from the client db entry, ++ * which is the impersonator account in that version. ++ * TODO: use the provided entry in the new 1.18 version. + */ + if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { +- code = krb5_pac_verify(context, +- ipac, +- authtime, +- client_princ, +- server_key, +- krbtgt_key); ++ /* The impersonator must be local. */ ++ if (client == NULL) { ++ code = KRB5KDC_ERR_BADOPTION; ++ goto done; ++ } ++ /* Fetch and decrypt 2nd ticket server's current key. */ ++ code = krb5_dbe_find_enctype(context, client, -1, -1, 0, ++ &impersonator_kd); ++ if (code != 0) { ++ goto done; ++ } ++ code = krb5_dbe_decrypt_key_data(context, NULL, ++ impersonator_kd, ++ &impersonator_key, NULL); ++ if (code != 0) { ++ goto done; ++ } ++ header_server_key = &impersonator_key; + } else { +- code = krb5_pac_verify(context, +- ipac, +- authtime, +- client_princ, +- krbtgt_key, +- NULL); +- } +- if (code != 0) { +- goto done; ++ header_server_key = krbtgt_key; + } + +- /* check and update PAC */ +- code = krb5_pac_parse(context, +- authdata[0]->contents, +- authdata[0]->length, +- pac); ++ code = krb5_pac_verify(context, pac, authtime, client_princ, ++ header_server_key, NULL); + if (code != 0) { + goto done; + } +@@ -272,17 +278,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, + code = mit_samba_reget_pac(mit_ctx, + context, + flags, +- client_princ, + client, + server, + krbtgt, + krbtgt_key, +- pac); ++ &pac); ++ if (code != 0) { ++ goto done; ++ } ++ ++ *out_pac = pac; ++ pac = NULL; + + done: ++ krb5_free_keyblock_contents(context, &impersonator_key); + krb5_free_authdata(context, authdata); +- krb5_pac_free(context, ipac); +- free(logon_data.data); ++ krb5_pac_free(context, pac); + + return code; + } +@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + { + #endif + krb5_authdata **authdata = NULL; +- krb5_boolean is_as_req; ++ krb5_const_principal pac_client; + krb5_error_code code; + krb5_pac pac = NULL; + krb5_data pac_data; +@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; + #endif + +- /* FIXME: We don't support S4U yet */ +- if (flags & KRB5_KDB_FLAGS_S4U) { +- return KRB5_KDB_DBTYPE_NOSUP; +- } +- +- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); +- +- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { +- code = ks_get_pac(context, client, client_key, &pac); +- if (code != 0) { +- goto done; +- } ++ /* In protocol transition, we are currently not provided with the tgt ++ * client name to verify the PAC, we could probably skip the name ++ * verification and just verify the signatures, but since we don't ++ * support cross-realm nor aliases, we can just use server->princ */ ++ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { ++ pac_client = server->princ; ++ } else { ++ pac_client = client_princ; + } + +- if (!is_as_req) { ++ /* TGS request */ ++ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) { + code = ks_verify_pac(context, + flags, +- client_princ, ++ pac_client, + client, + server, + krbtgt, +@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + if (code != 0) { + goto done; + } ++ ++ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */ ++ if (pac == NULL) { ++ code = KRB5_KDB_DBTYPE_NOSUP; ++ goto done; ++ } + } + +- if (pac == NULL && client != NULL) { ++ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { ++ krb5_pac_free(context, pac); ++ pac = NULL; ++ } + ++ /* AS request or local realm protocol transition */ ++ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) || ++ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) { + code = ks_get_pac(context, client, client_key, &pac); + if (code != 0) { + goto done; + } ++ /* We require a pac! */ ++ SMB_ASSERT(pac != NULL); + } + + if (pac == NULL) { +@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + } + + code = krb5_pac_sign(context, pac, authtime, client_princ, +- server_key, krbtgt_key, &pac_data); ++ server_key, krbtgt_key, &pac_data); + if (code != 0) { + DBG_ERR("krb5_pac_sign failed: %d\n", code); + goto done; +@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + KRB5_AUTHDATA_IF_RELEVANT, + authdata, + signed_auth_data); +- if (code != 0) { +- goto done; +- } +- +- code = 0; + + done: + krb5_pac_free(context, pac); +@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + * server; -> delegating service + * proxy; -> target principal + */ +- krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server); +- +- char *target_name = NULL; +- bool is_enterprise; +- krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + +- code = krb5_unparse_name(context, proxy, &target_name); +- if (code) { +- goto done; +- } +- +- is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL); +- +- code = mit_samba_check_s4u2proxy(mit_ctx, +- delegating_service, +- target_name, +- is_enterprise); +- +-done: +- free(target_name); +- return code; ++ return mit_samba_check_s4u2proxy(mit_ctx, server, proxy); + } + + +diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c +index 54dcd545ea1..f23327c9613 100644 +--- a/source4/kdc/mit_samba.c ++++ b/source4/kdc/mit_samba.c +@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, + krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + krb5_context context, + int flags, +- krb5_const_principal client_principal, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, +@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + context, + *pac, + server->princ, +- discard_const(client_principal), ++ client->princ, + deleg_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("Update delegation info failed: %s\n", +@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, + } + + int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, +- krb5_db_entry *kentry, +- const char *target_name, +- bool is_nt_enterprise_name) ++ const krb5_db_entry *server, ++ krb5_const_principal target_principal) + { +-#if 1 +- /* +- * This is disabled because mit_samba_update_pac_data() does not handle +- * S4U_DELEGATION_INFO +- */ +- +- return KRB5KDC_ERR_BADOPTION; +-#else +- krb5_principal target_principal; +- int flags = 0; +- int ret; +- +- if (is_nt_enterprise_name) { +- flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE; +- } +- +- ret = krb5_parse_name_flags(ctx->context, target_name, +- flags, &target_principal); +- if (ret) { +- return ret; +- } +- +- ret = samba_kdc_check_s4u2proxy(ctx->context, +- ctx->db_ctx, +- skdc_entry, +- target_principal); +- +- krb5_free_principal(ctx->context, target_principal); +- +- return ret; +-#endif ++ struct samba_kdc_entry *server_skdc_entry = ++ talloc_get_type_abort(server->e_data, ++ struct samba_kdc_entry); ++ ++ return samba_kdc_check_s4u2proxy(ctx->context, ++ ctx->db_ctx, ++ server_skdc_entry, ++ target_principal); + } + + static krb5_error_code mit_samba_change_pwd_error(krb5_context context, +diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h +index ba824557bd5..5aadf206443 100644 +--- a/source4/kdc/mit_samba.h ++++ b/source4/kdc/mit_samba.h +@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, + krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + krb5_context context, + int flags, +- krb5_const_principal client_principal, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, +@@ -73,9 +72,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, + DATA_BLOB *e_data); + + int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, +- krb5_db_entry *kentry, +- const char *target_name, +- bool is_nt_enterprise_name); ++ const krb5_db_entry *server, ++ krb5_const_principal target_principal); + + int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, + char *pwd, +-- +2.25.4 + +From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Fri, 27 Sep 2019 18:35:30 +0300 +Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build + +Signed-off-by: Isaac Boukris +Pair-Programmed-With: Andreas Schneider +--- + lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ + lib/krb5_wrap/krb5_samba.h | 2 - + source4/auth/kerberos/kerberos_util.c | 11 -- + 4 files changed, 185 insertions(+), 14 deletions(-) + +diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c +index 20ce86c708d..e72ab3c30f7 100644 +--- a/lib/krb5_wrap/krb5_samba.c ++++ b/lib/krb5_wrap/krb5_samba.c +@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + + return 0; + } ++ ++#else /* MIT */ ++ ++static bool princ_compare_no_dollar(krb5_context ctx, ++ krb5_principal a, ++ krb5_principal b) ++{ ++ bool cmp; ++ krb5_principal mod = NULL; ++ ++ if (a->length == 1 && b->length == 1 && ++ a->data[0].length != 0 && b->data[0].length != 0 && ++ a->data[0].data[a->data[0].length -1] != ++ b->data[0].data[b->data[0].length -1]) { ++ if (a->data[0].data[a->data[0].length -1] == '$') { ++ mod = a; ++ mod->data[0].length--; ++ } else if (b->data[0].data[b->data[0].length -1] == '$') { ++ mod = b; ++ mod->data[0].length--; ++ } ++ } ++ ++ cmp = krb5_principal_compare_flags(ctx, a, b, ++ KRB5_PRINCIPAL_COMPARE_CASEFOLD); ++ ++ if (mod != NULL) { ++ mod->data[0].length++; ++ } ++ ++ return cmp; ++} ++ ++krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, ++ krb5_ccache store_cc, ++ krb5_principal init_principal, ++ const char *init_password, ++ krb5_principal impersonate_principal, ++ const char *self_service, ++ const char *target_service, ++ krb5_get_init_creds_opt *krb_options, ++ time_t *expire_time, ++ time_t *kdc_time) ++{ ++ krb5_error_code code; ++ krb5_principal self_princ = NULL; ++ krb5_principal target_princ = NULL; ++ krb5_creds *store_creds; ++ krb5_creds *s4u2self_creds = NULL; ++ krb5_creds *s4u2proxy_creds = NULL; ++ krb5_creds init_creds = {0}; ++ krb5_creds mcreds = {0}; ++ krb5_flags options = KRB5_GC_NO_STORE; ++ krb5_ccache tmp_cc; ++ bool s4u2proxy; ++ ++ code = krb5_cc_new_unique(ctx, "MEMORY", NULL, &tmp_cc); ++ if (code != 0) { ++ return code; ++ } ++ ++ code = krb5_get_init_creds_password(ctx, &init_creds, ++ init_principal, ++ init_password, ++ NULL, NULL, ++ 0, ++ NULL, ++ krb_options); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_initialize(ctx, tmp_cc, init_creds.client); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_store_cred(ctx, tmp_cc, &init_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* ++ * Check if we also need S4U2Proxy or if S4U2Self is ++ * enough in order to get a ticket for the target. ++ */ ++ if (target_service == NULL) { ++ s4u2proxy = false; ++ } else if (strcmp(target_service, self_service) == 0) { ++ s4u2proxy = false; ++ } else { ++ s4u2proxy = true; ++ } ++ ++ code = krb5_parse_name(ctx, self_service, &self_princ); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* MIT lacks aliases support in S4U, for S4U2Self we require the tgt ++ * client and the request server to be the same principal name. */ ++ if (!princ_compare_no_dollar(ctx, init_creds.client, self_princ)) { ++ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; ++ goto done; ++ } ++ ++ mcreds.client = impersonate_principal; ++ mcreds.server = init_creds.client; ++ ++ code = krb5_get_credentials_for_user(ctx, options, tmp_cc, &mcreds, ++ NULL, &s4u2self_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ if (s4u2proxy) { ++ code = krb5_parse_name(ctx, target_service, &target_princ); ++ if (code != 0) { ++ goto done; ++ } ++ ++ mcreds.client = init_creds.client; ++ mcreds.server = target_princ; ++ mcreds.second_ticket = s4u2self_creds->ticket; ++ ++ code = krb5_get_credentials(ctx, options | ++ KRB5_GC_CONSTRAINED_DELEGATION, ++ tmp_cc, &mcreds, &s4u2proxy_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* Check KDC support of S4U2Proxy extension */ ++ if (!krb5_principal_compare(ctx, s4u2self_creds->client, ++ s4u2proxy_creds->client)) { ++ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; ++ goto done; ++ } ++ ++ store_creds = s4u2proxy_creds; ++ } else { ++ store_creds = s4u2self_creds;; ++ ++ /* We need to save the ticket with the requested server name ++ * or the caller won't be able to find it in cache. */ ++ if (!krb5_principal_compare(ctx, self_princ, ++ store_creds->server)) { ++ krb5_free_principal(ctx, store_creds->server); ++ store_creds->server = NULL; ++ code = krb5_copy_principal(ctx, self_princ, ++ &store_creds->server); ++ if (code != 0) { ++ goto done; ++ } ++ } ++ } ++ ++ code = krb5_cc_initialize(ctx, store_cc, store_creds->client); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_store_cred(ctx, store_cc, store_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ if (expire_time) { ++ *expire_time = (time_t) store_creds->times.endtime; ++ } ++ ++ if (kdc_time) { ++ *kdc_time = (time_t) store_creds->times.starttime; ++ } ++ ++done: ++ krb5_cc_destroy(ctx, tmp_cc); ++ krb5_free_cred_contents(ctx, &init_creds); ++ krb5_free_creds(ctx, s4u2self_creds); ++ krb5_free_creds(ctx, s4u2proxy_creds); ++ krb5_free_principal(ctx, self_princ); ++ krb5_free_principal(ctx, target_princ); ++ ++ return code; ++} + #endif + + #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) +diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h +index ca9a893e4f7..3264ce5eb3b 100644 +--- a/lib/krb5_wrap/krb5_samba.h ++++ b/lib/krb5_wrap/krb5_samba.h +@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, + krb5_get_init_creds_opt *krb_options, + time_t *expire_time, + time_t *kdc_time); +-#ifdef SAMBA4_USES_HEIMDAL + krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + krb5_ccache store_cc, + krb5_principal init_principal, +@@ -263,7 +262,6 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + krb5_get_init_creds_opt *krb_options, + time_t *expire_time, + time_t *kdc_time); +-#endif + + #if defined(HAVE_KRB5_MAKE_PRINCIPAL) + #define smb_krb5_make_principal krb5_make_principal +diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c +index 544d9d853cc..c14d8c72d8c 100644 +--- a/source4/auth/kerberos/kerberos_util.c ++++ b/source4/auth/kerberos/kerberos_util.c +@@ -234,9 +234,7 @@ done: + { + krb5_error_code ret; + const char *password; +-#ifdef SAMBA4_USES_HEIMDAL + const char *self_service; +-#endif + const char *target_service; + time_t kdc_time = 0; + krb5_principal princ; +@@ -268,9 +266,7 @@ done: + return ret; + } + +-#ifdef SAMBA4_USES_HEIMDAL + self_service = cli_credentials_get_self_service(credentials); +-#endif + target_service = cli_credentials_get_target_service(credentials); + + password = cli_credentials_get_password(credentials); +@@ -331,7 +327,6 @@ done: + #endif + if (password) { + if (impersonate_principal) { +-#ifdef SAMBA4_USES_HEIMDAL + ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context, + ccache, + princ, +@@ -342,12 +337,6 @@ done: + krb_options, + NULL, + &kdc_time); +-#else +- talloc_free(mem_ctx); +- (*error_string) = "INTERNAL error: s4u2 ops " +- "are not supported with MIT build yet"; +- return EINVAL; +-#endif + } else { + ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, + ccache, +-- +2.25.4 + + + +From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Sat, 19 Sep 2020 14:16:20 +0200 +Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code + +--- + source4/heimdal/lib/hdb/hdb.h | 1 + + source4/kdc/db-glue.c | 8 ++++++-- + source4/kdc/mit_samba.c | 3 +++ + source4/kdc/sdb.h | 1 + + 4 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h +index 6a09ecb6fe1..bc5211fef35 100644 +--- a/source4/heimdal/lib/hdb/hdb.h ++++ b/source4/heimdal/lib/hdb/hdb.h +@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; + #define HDB_F_ALL_KVNOS 2048 /* we want all the keys, live or not */ + #define HDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ + #define HDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ ++#define HDB_F_FORCE_CANON 16384 /* force canonicalition */ + + /* hdb_capability_flags */ + #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 +diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c +index a560a1cd84b..c27b6a8ef4c 100644 +--- a/source4/kdc/db-glue.c ++++ b/source4/kdc/db-glue.c +@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, + } + } + +- } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { ++ } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { // was this supposed to be || ? + ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); + if (ret) { + krb5_clear_error_message(context); + goto out; + } +- } else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) { ++ } else if (((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) || (flags & SDB_F_FORCE_CANON)){ + /* + * SDB_F_CANON maps from the canonicalize flag in the + * packet, and has a different meaning between AS-REQ + * and TGS-REQ. We only change the principal in the AS-REQ case ++ * ++ * The SDB_F_FORCE_CANON if for the new MIT kdc code that wants ++ * the canonical name in all lookups, and takes care to canonicalize ++ * only when appropriate. + */ + ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); + if (ret) { +diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c +index f23327c9613..4084e893cc2 100644 +--- a/source4/kdc/mit_samba.c ++++ b/source4/kdc/mit_samba.c +@@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, + if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { + sflags |= SDB_F_CANON; + } ++#if KRB5_KDB_API_VERSION >= 10 ++ sflags |= SDB_F_FORCE_CANON; ++#endif + if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY | + KRB5_KDB_FLAG_INCLUDE_PAC)) { + /* +diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h +index c929acccce6..a9115ec23d7 100644 +--- a/source4/kdc/sdb.h ++++ b/source4/kdc/sdb.h +@@ -116,6 +116,7 @@ struct sdb_entry_ex { + #define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */ + #define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ + #define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ ++#define SDB_F_FORCE_CANON 16384 /* force canonicalition */ + + void sdb_free_entry(struct sdb_entry_ex *e); + void free_sdb_entry(struct sdb_entry *s); +-- +2.25.4 + diff --git a/samba.spec b/samba.spec index 6ea36db..7ea2912 100644 --- a/samba.spec +++ b/samba.spec @@ -6,15 +6,15 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") +%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 5 +%define main_release 0 -%define samba_version 4.12.0 +%define samba_version 4.12.15 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.1.1 +%define ldb_version 2.1.5 # This should be rc1 or nil %define pre_release %nil @@ -88,11 +88,16 @@ %global with_winexe 0 %endif +%global with_vfs_io_uring 0 +%ifarch aarch64 ppc64le s390x x86_64 i686 +%global with_vfs_io_uring 1 +%endif + %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" Name: samba Version: %{samba_version} -Release: %{samba_release}.1 +Release: %{samba_release} %if 0%{?rhel} Epoch: 0 @@ -113,7 +118,7 @@ URL: https://www.samba.org # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz Source0: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.gz#/samba-%{version}%{pre_release}.tar.xz Source1: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.asc -Source2: gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg +Source2: samba-pubkey_AA99442FB680B620.gpg # Red Hat specific replacement-files Source10: samba.logrotate @@ -124,8 +129,7 @@ Source14: samba.pamd Source201: README.downgrade -Patch100: new_mit_118.patch -Patch101: samba-4.12.0-winexe.patch +Patch1: samba-s4u.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -224,6 +228,10 @@ BuildRequires: glusterfs-devel >= 3.4.0.16 BuildRequires: libcephfs-devel %endif +%if %{with_vfs_io_uring} +BuildRequires: liburing-devel +%endif + %if %{with_dc} # Add python3-iso8601 to avoid that the # version in Samba is being packaged @@ -380,7 +388,6 @@ Requires: ldb-tools # See bug 1507420 %samba_requires_eq libldb -Requires: python3-crypto Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} @@ -1299,6 +1306,9 @@ fi %{_libdir}/samba/vfs/full_audit.so %{_libdir}/samba/vfs/gpfs.so %{_libdir}/samba/vfs/glusterfs_fuse.so +%if %{with_vfs_io_uring} +%{_libdir}/samba/vfs/io_uring.so +%endif %{_libdir}/samba/vfs/linux_xfs_sgid.so %{_libdir}/samba/vfs/media_harmony.so %{_libdir}/samba/vfs/offline.so @@ -1319,6 +1329,10 @@ fi %{_libdir}/samba/vfs/worm.so %{_libdir}/samba/vfs/xattr_tdb.so +%dir %{_datadir}/samba +%dir %{_datadir}/samba/mdssvc +%{_datadir}/samba/mdssvc/elasticsearch_mappings.json + %{_unitdir}/nmb.service %{_unitdir}/smb.service %attr(1777,root,root) %dir /var/spool/samba @@ -1348,6 +1362,9 @@ fi %{_mandir}/man8/vfs_full_audit.8* %{_mandir}/man8/vfs_gpfs.8* %{_mandir}/man8/vfs_glusterfs_fuse.8* +%if %{with_vfs_io_uring} +%{_mandir}/man8/vfs_io_uring.8* +%endif %{_mandir}/man8/vfs_linux_xfs_sgid.8* %{_mandir}/man8/vfs_media_harmony.8* %{_mandir}/man8/vfs_offline.8* @@ -1432,9 +1449,6 @@ fi %{_mandir}/man8/cifsdd.8.* %{_mandir}/man8/samba-regedit.8* %{_mandir}/man8/smbspool.8* -%dir %{_datadir}/samba -%dir %{_datadir}/samba/mdssvc -%{_datadir}/samba/mdssvc/elasticsearch_mappings.json ### CLIENT-LIBS %files client-libs @@ -1522,7 +1536,6 @@ fi %{_libdir}/samba/libsmb-transport-samba4.so %{_libdir}/samba/libsmbclient-raw-samba4.so %{_libdir}/samba/libsmbd-base-samba4.so -%{_libdir}/samba/libsmbd-conn-samba4.so %{_libdir}/samba/libsmbd-shim-samba4.so %{_libdir}/samba/libsmbldaphelper-samba4.so %{_libdir}/samba/libsys-rw-samba4.so @@ -1699,7 +1712,6 @@ fi %{_libdir}/samba/service/winbindd.so %{_libdir}/samba/service/wrepl.so %{_libdir}/libdcerpc-server.so.* -%{_libdir}/libdcerpc-server-core.so.* %{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libdsdb-module-samba4.so %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so @@ -1714,6 +1726,8 @@ fi %{_libdir}/samba/bind9/dlz_bind9_10.so %{_libdir}/samba/bind9/dlz_bind9_11.so %{_libdir}/samba/bind9/dlz_bind9_12.so +%{_libdir}/samba/bind9/dlz_bind9_14.so +%{_libdir}/samba/bind9/dlz_bind9_16.so #endif with_dc %endif @@ -1804,6 +1818,7 @@ fi %{_includedir}/samba-4.0/util_ldb.h %{_libdir}/libdcerpc-binding.so %{_libdir}/libdcerpc-samr.so +%{_libdir}/libdcerpc-server-core.so %{_libdir}/libdcerpc.so %{_libdir}/libndr-krb5pac.so %{_libdir}/libndr-nbt.so @@ -1834,7 +1849,6 @@ fi %if %with_dc %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so -%{_libdir}/libdcerpc-server-core.so %{_libdir}/pkgconfig/dcerpc_server.pc %endif @@ -1872,6 +1886,7 @@ fi ### LIBS %files libs %{_libdir}/libdcerpc-samr.so.* +%{_libdir}/libdcerpc-server-core.so.* %{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so %{_libdir}/samba/libauth4-samba4.so @@ -2280,6 +2295,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_forwarder.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_invalid.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dns_packet.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc @@ -2299,6 +2315,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc @@ -2445,6 +2462,7 @@ fi %{python3_sitearch}/samba/tests/dns_forwarder_helpers/__pycache__/server.*.pyc %{python3_sitearch}/samba/tests/dns_forwarder_helpers/server.py %{python3_sitearch}/samba/tests/dns_invalid.py +%{python3_sitearch}/samba/tests/dns_packet.py %{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py @@ -2484,6 +2502,7 @@ fi %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %{python3_sitearch}/samba/tests/krb5_credentials.py +%{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py @@ -2558,6 +2577,9 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_check_password_script.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_base.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_gpg.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_userPassword.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_wdigest.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize_drs.*.pyc @@ -2589,6 +2611,9 @@ fi %{python3_sitearch}/samba/tests/samba_tool/user.py %{python3_sitearch}/samba/tests/samba_tool/user_check_password_script.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_base.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_userPassword.py %{python3_sitearch}/samba/tests/samba_tool/user_wdigest.py %{python3_sitearch}/samba/tests/samba_tool/visualize.py %{python3_sitearch}/samba/tests/samba_tool/visualize_drs.py @@ -2663,6 +2688,7 @@ fi ### WINBIND-KRB5-LOCATOR %files winbind-krb5-locator %ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so +%dir %{_libdir}/samba/krb5 %{_libdir}/samba/krb5/winbind_krb5_locator.so %{_mandir}/man8/winbind_krb5_locator.8* @@ -3287,6 +3313,7 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ps @@ -3557,9 +3584,94 @@ fi ### WINEXE %files winexe %{_bindir}/winexe +%{_mandir}/man1/winexe.1* %endif %changelog +* Thu Apr 29 2021 Guenther Deschner - 4.12.15-0 +- Update to Samba 4.12.15 +- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 + +* Thu Mar 25 2021 Guenther Deschner - 4.12.14-0 +- Update to Samba 4.12.14 +- related: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- related: #1941402, #1942497 - Security fixes for CVE-2021-20277 + +* Wed Mar 24 2021 Guenther Deschner - 4.12.13-0 +- Update to Samba 4.12.13 +- resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 + +* Thu Mar 11 2021 Guenther Deschner - 4.12.12-0 +- Update to Samba 4.12.12 + +* Thu Jan 14 2021 Guenther Deschner - 4.12.11-0 +- Update to Samba 4.12.11 + +* Thu Nov 05 2020 Guenther Deschner - 4.12.10-0 +- Update to Samba 4.12.10 + +* Thu Oct 29 2020 Guenther Deschner - 4.12.9-0 +- Update to Samba 4.12.9 +- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 +- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 +- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 + +* Thu Oct 22 2020 Alexander Bokovoy - 4.12.8-1 +- Add preliminary support for S4U operations in Samba AD DC + resolves: #1836630 - Samba DC: Remote Desktop cannot access files +- Fix lookup_unix_user_name to allow lookup of realm-qualified users and groups + required for upcoming FreeIPA Global Catalog support + +* Wed Oct 07 2020 Guenther Deschner - 4.12.8-0 +- Update to Samba 4.12.8 + +* Fri Sep 18 2020 Guenther Deschner - 4.12.7-0 +- Update to Samba 4.12.7 +- resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 + +* Thu Aug 13 2020 Guenther Deschner - 4.12.6-0 +- Update to Samba 4.12.6 + +* Wed Aug 12 2020 Andreas Schneider - 4.12.15-2 +- resolves: #1865831 - Add missing /usr/lib64/samba/krb5 directory +- resolves: #1866989 - Remove obsolete python3-crypto dependency + +* Tue Jul 14 2020 Andreas Schneider - 4.12.15-1 +- Move mdssvc data files to correct package + +* Thu Jul 02 2020 Guenther Deschner - 4.12.5-0 +- Update to Samba 4.12.5 + +* Thu Jul 02 2020 Guenther Deschner - 4.12.4-0 +- Update to Samba 4.12.4 +- resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 +- resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 +- resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 +- resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 + +* Tue May 19 2020 Guenther Deschner - 4.12.3-0 +- Update to Samba 4.12.3 + +* Wed May 13 2020 Guenther Deschner - 4.12.2-1 +- Add support for building the new experimental io_uring VFS module + +* Tue Apr 28 2020 Guenther Deschner - 4.12.2-0 +- Update to Samba 4.12.2 +- resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 +- resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 + +* Sun Apr 12 2020 Alexander Bokovoy - 4.12.1-1 +- Revert POSIX stat tuning in libsmbclient +- Resolves rhbz#1801442 + +* Tue Apr 07 2020 Guenther Deschner - 4.12.1-0 +- Update to Samba 4.12.1 + +* Sat Mar 21 2020 Alexander Bokovoy - 4.12.0-6 +- Fix samba_requires_eq macro definition +- Resolves rhbz#1815739 + * Tue Mar 10 2020 Guenther Deschner - 4.12.0-5 - Add build requirement for perl-FindBin - resolves: #1661213 - Add winexe subpackage for remote windows command execution diff --git a/sources b/sources index 85d472a..098d343 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.0.tar.xz) = d9d99136702d339803c96004d68c978405759059e6f71fa303b52d21f4bf5093c43bcec44b22aeee3610a1cdf033edf758ccb4c551de20b7d66632e9a23866b1 -SHA512 (samba-4.12.0.tar.asc) = b833e0917b3b244ce727d80c0b600a88aa986455b7dfa24df1306fd848e2d192a46e2dfd5a5e878cd0ca3f76e0827ee42f704f93ac86b063e57027b786d262f0 +SHA512 (samba-4.12.15.tar.xz) = fbacacd429f368238127196b120d1492da55a14102715f065e70ec5f729d30734452f05095780146baa4afed82efebf425f1118e823ed603af9f4c6f04c07978 +SHA512 (samba-4.12.15.tar.asc) = b5e96bebf12d594f63e81293b254211146bdd3799e3e3c3586c8ace5dc126a433d75f2cce3a10c3081bba893e245175df06a2d194f1937bbbaa28a6917e65aa2